ephex

Bytes with offset from entry point, ?? as wildcard allowed.

Usage

ephex=<offset(int)>|<hh>[hh[hh[hh[hh]...]]]

Examples

ephex=0|558BEC83C4F0

Would detect the following code at the entry point of the file:

PUSH EBP
MOV EBP, ESP
ADD ESP, F0

Description

Use offset to specify an offset to the file entry point (has to be a Portable Executable file).

See also

Similar parameters

• begin(searcharea)
• end(searcharea)
• findbinary(searcharea)
• findtext(searcharea)
• greptext(searcharea)
• section(searcharea)