diff options
Diffstat (limited to 'src/usr/local/share/protocols/exe.pat')
-rw-r--r-- | src/usr/local/share/protocols/exe.pat | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/src/usr/local/share/protocols/exe.pat b/src/usr/local/share/protocols/exe.pat new file mode 100644 index 0000000..0a16e2a --- /dev/null +++ b/src/usr/local/share/protocols/exe.pat @@ -0,0 +1,20 @@ +# Executable - Microsoft PE file format. +# Pattern attributes: good notsofast notsofast subset +# Protocol groups: file + +# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE +# Thanks to Brandon Enright [bmenrighATucsd.edu] + +# This pattern doesn't techincally match the PE file format but rather the +# MZ stub program Microsoft uses for backwards compatibility with DOS. +# That means this will correctly match DOS executables too. + +exe +# There are two different stubs used depending on the compiler/packer. +# Numerous NULL bytes have been stripped from this pattern. + +# This pattern may be more efficient: +# \x4d\x5a\x90\x03\x04|\x4d\x5a\x50\x02\x04 + +# This is easier to understand: +\x4d\x5a(\x90\x03|\x50\x02)\x04 |