Fix magic header wrong jump

dmknght · Jan 18, 2024 · 6c51b03 · 6c51b03
1 parent b135b2e
commit 6c51b03
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/rules/magics.yar b/rules/magics.yar
@@ -5,31 +5,31 @@
 
 private rule elf_magic {
   strings:
-    $magic = {7f 45 4c 46 [12] (00 | 01 | 02 | 03 | 04 )}
+    $magic = {7f 45 4c 46 [6] (00 | 01 | 02 | 03 | 04 )}
   condition:
     // $magic and not defined uint8(@magic[0] - 1)
     $magic at 0
 }
 
 private rule elf_rel {
   strings:
-    $magic = {7f 45 4c 46 [12] 01}
+    $magic = {7f 45 4c 46 [6] 01}
   condition:
     // $magic and not defined uint8(@magic[0] - 1)
     $magic at 0
 }
 
 private rule elf_exec {
   strings:
-    $magic = {7f 45 4c 46 [12] 02}
+    $magic = {7f 45 4c 46 [6] 02}
   condition:
     // $magic and not defined uint8(@magic[0] - 1)
     $magic at 0
 }
 
 private rule elf_dyn {
   strings:
-    $magic = {7f 45 4c 46 [12] 03}
+    $magic = {7f 45 4c 46 [6] 03}
   condition:
     // $magic and not defined uint8(@magic[0] - 1)
     $magic at 0