Commit a4945a93 by devttys0

Improved Linux kernel version identification

parent 55414ae8
......@@ -11,9 +11,9 @@
# Finds and prints Linux kernel strings in raw Linux kernels (output like uname -a).
# Commonly found in decompressed embedded kernel binaries.
0 string Linux\x20version\x20 Linux kernel version
>14 byte 0 {invalid}
>14 byte !0
>>14 string x %.6s
>14 byte >0x33 {invalid}
>14 byte <0x32 {invalid}
>14 string x %.6s
# Linux ARM compressed kernel image
# Starts with 8 NOPs, with 0x016F2818 at offset 0x24
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment