1# Executable - Microsoft PE file format. 2# Pattern attributes: good notsofast notsofast subset 3# Protocol groups: file 4 5# Thanks to Brandon Enright [bmenrighATucsd.edu] 6 7# This pattern doesn't techincally match the PE file format but rather the 8# MZ stub program Microsoft uses for backwards compatibility with DOS. 9# That means this will correctly match DOS executables too. 10 11exe 12# There are two different stubs used depending on the compiler/packer. 13# Numerous NULL bytes have been stripped from this pattern. 14 15# This pattern may be more efficient: 16# \x4d\x5a\x90\x03\x04|\x4d\x5a\x50\x02\x04 17 18# This is easier to understand: 19\x4d\x5a(\x90\x03|\x50\x02)\x04 20