Difference between revisions of "Ephex"

From SpybotWiki
Jump to: navigation, search
(New page: {{AdvFileParam|ephex}} Bytes with offset from entry point, ?? as wildcard allowed. ==Usage== ephex=<offset(int)>|<hh>[hh[hh[hh[hh]...]]] ===Examples=== ephex=0|558BEC83C4F0 Would dete...)
 
(added group)
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
{{AdvFileParam|ephex}}
+
{{AdvParamInfo
Bytes with offset from entry point, ?? as wildcard allowed.
+
|SYNTAX = ephex
 +
|TITLESYNTAX = ephex
 +
|PREVIOUS =
 +
|VARIANTS =
 +
|PEVERSION = ??? < 1.5.4.5
 +
|GROUP = Binary Anywhere Matching
 +
}}Bytes with offset from entry point, ?? as wildcard allowed.
  
 
==Usage==
 
==Usage==

Latest revision as of 08:53, 22 February 2008

ephex
Variants ephex
Previously
Group Binary Anywhere Matching
Version advcheck.dll ??? < 1.5.4.5

Bytes with offset from entry point, ?? as wildcard allowed.

Usage

ephex=<offset(int)>|<hh>[hh[hh[hh[hh]...]]]

Examples

ephex=0|558BEC83C4F0

Would detect the following code at the entry point of the file:

PUSH EBP
MOV EBP, ESP
ADD ESP, F0

Description

Use offset to specify an offset to the file entry point (has to be a Portable Executable file).

See also

Similar parameters

Similar commands