mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2026-10-21 00:56:07 +08:00
emteere
91 lines
4.7 KiB
XML
91 lines
4.7 KiB
XML
<patternlist>
|
|
<patternpairs totalbits="32" postbits="16">
|
|
<prepatterns>
|
|
<data>0x4e800020 </data> <!-- BLR -->
|
|
<data>010010.. 0x.. 0x.. ......00 </data> <!-- B xxxxx -->
|
|
</prepatterns>
|
|
<postpatterns>
|
|
<data>10010100 00100001 11...... .....000 </data> <!-- STWU r1,xx(r1) -->
|
|
<data>011111.. ...01000 00000010 10100110 </data> <!-- MFSPR rx,lr -->
|
|
<data>0x7c2c0b78 0x38 0x21 ........ ........ 0x91810000 </data> <!-- or r12,r1,r1; stw r12,0x0(r1) -->
|
|
<codeboundary /> <!-- it is at least code -->
|
|
<possiblefuncstart/>
|
|
</postpatterns>
|
|
</patternpairs>
|
|
<patternpairs totalbits="32" postbits="16">
|
|
<prepatterns>
|
|
<data>010010.. 0x.. 0x.. ......00 </data> <!-- B xxxxx -->
|
|
</prepatterns>
|
|
<postpatterns>
|
|
<data>10010100 00100001 11...... .....000 011111.. ...01000 00000010 10100110 </data> <!-- STWU r1,xx(r1); MFSPR rx,lr -->
|
|
<data>011111.. ...01000 00000010 10100110 10010100 00100001 11...... .....000 </data> <!-- MFSPR rx,lr; STWU r1,xx(r1); -->
|
|
<data>10010100 00100001 11...... .....000 0x........ 011111.. ...01000 00000010 10100110 </data> <!-- STWU r1,xx(r1); xxx_instr; MFSPR rx,lr -->
|
|
<data>011111.. ...01000 00000010 10100110 0x........ 10010100 00100001 11...... .....000 </data> <!-- MFSPR rx,lr; xxx_instr; STWU r1,xx(r1) -->
|
|
<data>10010100 00100001 11...... .....000 0x........ 0x........ 011111.. ...01000 00000010 10100110 </data> <!-- STWU r1,xx(r1); xxx_instr; xxx_instr; MFSPR rx,lr -->
|
|
<data>011111.. ...01000 00000010 10100110 0x........ 0x........ 10010100 00100001 11...... .....000 </data> <!-- MFSPR rx,lr; xxx_instr; xxx_instr; STWU r1,xx(r1) -->
|
|
<data>0x7c2c0b78 0x38 0x21 ........ ........ 0x91810000 </data> <!-- or r12,r1,r1; stw r12,0x0(r1) -->
|
|
<codeboundary /> <!-- it is at least code -->
|
|
<possiblefuncstart/>
|
|
</postpatterns>
|
|
</patternpairs>
|
|
|
|
<pattern>
|
|
<data>10010100 00100001 11...... .....000 011111.. ...01000 00000010 10100110 </data> <!-- STWU r1,xx(r1); MFSPR rx,lr -->
|
|
<codeboundary />
|
|
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
|
|
</pattern>
|
|
|
|
<pattern>
|
|
<data>011111.. ...01000 00000010 10100110 10010100 00100001 11...... .....000 </data> <!-- MFSPR rx,lr; STWU r1,xx(r1) -->
|
|
<codeboundary />
|
|
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
|
|
</pattern>
|
|
|
|
<pattern>
|
|
<data> 0x4e 0x80 0x00 0x21</data> <!-- blrl -->
|
|
<possiblefuncstart validcode="function" label="__get_pc_thunk_lr" /> <!-- must be a function here -->
|
|
</pattern>
|
|
|
|
<pattern> <!-- .plt entry thunk -->
|
|
<data>
|
|
0xf8410028 <!-- std r2,0x28(r1) -->
|
|
001111.. ...00010 0xff 0xff <!-- subis rX,r2,0x1 -->
|
|
0xe9 ........ ........ ........ <!-- ld rX,#(x) -->
|
|
0x7d 0x.9 0x03 0xa6 <!-- mtctr rX -->
|
|
0xe8 010..... ........ ........ <!-- ld r2,#(x) -->
|
|
0x28220000 <!-- cmpldi r2,0 -->
|
|
0x4c 1..00010 0x04 0x20 <!-- bnectr+ -->
|
|
010010.. ........ ........ ......00 <!-- b X@plt -->
|
|
</data>
|
|
<funcstart after="defined" thunk="true"/> <!-- must be something define before this -->
|
|
</pattern>
|
|
|
|
<pattern> <!-- .plt entry thunk -->
|
|
<data>
|
|
0xf8410028 <!-- std r2,0x28(r1) -->
|
|
0xe9 ........ ........ ........ <!-- ld rX,#(x) -->
|
|
0x7d 0x.9 0x03 0xa6 <!-- mtctr rX -->
|
|
0xe8 010..... ........ ........ <!-- ld r2,#(x) -->
|
|
0x28220000 <!-- cmpldi r2,0 -->
|
|
0x4c 1..00010 0x04 0x20 <!-- bnectr+ -->
|
|
010010.. ........ ........ ......00 <!-- b X@plt -->
|
|
</data>
|
|
<funcstart after="defined" thunk="true"/> <!-- must be something define before this -->
|
|
</pattern>
|
|
|
|
<pattern> <!-- .plt entry thunk -->
|
|
<data>
|
|
011111.. ...01000 0x02 0xa6 <!-- mfspr rxx, LR -->
|
|
0x42 1....... 0x00 0x05 <!-- bl +0x4 -->
|
|
011111.. ...01000 0x02 0xa6 <!-- mfspr rxx,LR -->
|
|
001111.. ........ 0x.. 0x.. <!-- addis rxx, rxx, 0xxx -->
|
|
001110.. ........ 0x.. 0x.. <!-- addi rxx, rxx, 0xxx -->
|
|
011111.. ...01000 0x03 0xa6 <!-- mtspr LR, rxx -->
|
|
011111.. ...01001 0x03 0xa6 <!-- mtspr CTR, rxx -->
|
|
0x4e 10000... 0x04 0x20 <!--bctr -->
|
|
</data>
|
|
<funcstart thunk="true"/>
|
|
</pattern>
|
|
|
|
</patternlist>
|