Exetools  

Go Back   Exetools > General > Source Code

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 02-11-2016, 06:03
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 783
Rept. Given: 490
Rept. Rcvd 1,123 Times in 305 Posts
Thanks Given: 89
Thanks Rcvd at 716 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
@atom0s: sure, I mainly use it for a more fine-grained matching on instructions with wildcard registers, for example FF D0 (call eax), for call reg you need to match FF D?, so without nibbles you would match on FF and this also matches a lot of other shit (invalid instructions, inc [reg], call [] etc). I agree that in signature matching it isn't quite useful, but if you need to find the next 'call reg' in a reliable way you need nibble matching. Same applies to 'push reg'.

Obviously if you feel it's a bloat you shouldn't use it I just commented so other people don't have to implement it themselves.

Greetings
Reply With Quote
The Following User Says Thank You to mr.exodia For This Useful Post:
tonyweb (02-15-2016)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On


Similar Threads
Thread Thread Starter Forum Replies Last Post
Reversing Key using pattern Maltese General Discussion 11 11-16-2007 19:49
pattern matching algorithm OHPen General Discussion 9 10-10-2003 05:11


All times are GMT +8. The time now is 09:38.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )