|
|
|
@ -390,11 +390,9 @@ MalwareName:TargetType:Offset:HexSignature[:MinFL:[MaxFL]] |
|
|
|
|
\item \verb#EP-n# = entry point minus n bytes |
|
|
|
|
\item \verb#Sx+n# = start of section \verb+x+'s (counted from 0) |
|
|
|
|
data plus \verb+n+ bytes |
|
|
|
|
\item \verb#Sx-n# = start of section \verb+x+'s data minus \verb+n+ bytes |
|
|
|
|
\item \verb#SEx# = entire section \verb+x+ (offset must lie within section |
|
|
|
|
boundaries) |
|
|
|
|
\item \verb#SL+n# = start of last section plus \verb+n+ bytes |
|
|
|
|
\item \verb#SL-n# = start of last section minus \verb+n+ bytes |
|
|
|
|
\end{itemize} |
|
|
|
|
All the above offsets except \verb+*+ can be turned into |
|
|
|
|
\textbf{floating offsets} and represented as \verb+Offset,MaxShift+ where |
|
|
|
|