Skip to content

Instantly share code, notes, and snippets.

@confile

confile/get_eip.yara

Forked from williballenthin/get_eip.yara
Created October 30, 2018 08:47
Show Gist options
  • Save confile/121f2583bb637e520ca1c4cee627eaa0 to your computer and use it in GitHub Desktop.
Save confile/121f2583bb637e520ca1c4cee627eaa0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @williballenthin williballenthin created this gist Jul 23, 2018.
    22 changes: 22 additions & 0 deletions get_eip.yara
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,22 @@
    rule get_eip
    {
    meta:
    author = "William Ballenthin"
    email = "[email protected]"
    license = "Apache 2.0"
    copyright = "FireEye, Inc"
    description = "Match x86 that appears to fetch $PC."

    strings:
    // 0: e8 00 00 00 00 call 5 <_main+0x5>
    // 5: 58 pop eax
    // 6: 5b pop ebx
    // 7: 59 pop ecx
    // 8: 5a pop edx
    // 9: 5e pop esi
    // a: 5f pop edi
    $x86 = { e8 00 00 00 00 (58 | 5b | 59 | 5a | 5e | 5f) }
    condition:
    $x86
    }