Detection Logic
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint32(uint32(0x3C)) == 0x00004550 and
//TAGG+4E==packerid
//(uint32be(@a0+0x4E) == 0x0B51D132) and
//(uint32be(@a0+0x12) == 0x006092a86) and
//(uint32be(@a0+0x12)) == uint32be(@c0) and
//uint32be(@a0+0x04) < (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) and
$a0 Field Validations
Loading…
Comments (0)
Loading comments...