Difference between revisions of "Ephex"
(New page: {{AdvFileParam|ephex}} Bytes with offset from entry point, ?? as wildcard allowed. ==Usage== ephex=<offset(int)>|<hh>[hh[hh[hh[hh]...]]] ===Examples=== ephex=0|558BEC83C4F0 Would dete...) |
(added group) |
||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
| − | {{ | + | {{AdvParamInfo |
| − | Bytes with offset from entry point, ?? as wildcard allowed. | + | |SYNTAX = ephex |
| + | |TITLESYNTAX = ephex | ||
| + | |PREVIOUS = | ||
| + | |VARIANTS = | ||
| + | |PEVERSION = ??? < 1.5.4.5 | ||
| + | |GROUP = Binary Anywhere Matching | ||
| + | }}Bytes with offset from entry point, ?? as wildcard allowed. | ||
==Usage== | ==Usage== | ||
Latest revision as of 08:53, 22 February 2008
| ephex | |
| Variants | ephex |
| Previously | |
| Group | Binary Anywhere Matching |
| Version | advcheck.dll ??? < 1.5.4.5 |
Bytes with offset from entry point, ?? as wildcard allowed.
Contents
Usage
ephex=<offset(int)>|<hh>[hh[hh[hh[hh]...]]]
Examples
ephex=0|558BEC83C4F0
Would detect the following code at the entry point of the file:
PUSH EBP MOV EBP, ESP ADD ESP, F0
Description
Use offset to specify an offset to the file entry point (has to be a Portable Executable file).
See also
Similar parameters
- begin(searcharea)
- end(searcharea)
- findbinary(searcharea)
- findtext(searcharea)
- greptext(searcharea)
- section(searcharea)
