mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
36 lines
No EOL
1.3 KiB
JavaScript
36 lines
No EOL
1.3 KiB
JavaScript
// Detect It Easy: detection rule file
|
|
// Author: hypn0 <hypn0@mail.ru>
|
|
|
|
// https://en.wikipedia.org/wiki/Rust_(programming_language)
|
|
meta("compiler", "Rust");
|
|
|
|
function detect() {
|
|
|
|
//x86-64
|
|
if (MACH.compareEP("554889e5415741564154534883ec..31ffbe........31c0e8........83f8")) {
|
|
bDetected = true;
|
|
} else if (MACH.compareEP("554889e54883ec..4889f14863d7488d05........488945..488d35........488d7df84531c0")) {
|
|
bDetected = true;
|
|
} else if (MACH.compareEP("554889e5415741564154534881ec........31ffbe........31c0e8........83f8")) {
|
|
bDetected = true;
|
|
} else if (MACH.compareEP("554889e541574156534881ec........31ffbe........31c0e8........83f8")) {
|
|
bDetected = true;
|
|
} else if (MACH.compareEP("554889e541574156534883ec..31ffbe........31c0e8........83f8")) {
|
|
bDetected = true;
|
|
}
|
|
|
|
//ARM64
|
|
if (MACH.compareEP("ff8300d1fd7b01a9fd430091e30301aa027c4093")) {
|
|
bDetected = true;
|
|
} else if (MACH.compareEP("ff....d1fc6f..a9fa67..a9f85f..a9f657..a9f44f..a9")) {
|
|
bDetected = true;
|
|
} else if (MACH.compareEP("ffc303d1fa670aa9f85f0ba9f6570ca9f44f0da9fd7b0ea9")) {
|
|
bDetected = true;
|
|
} else if (MACH.compareEP("ff8302d1f85f06a9f65707a9f44f08a9fd7b09a9fd430291")) {
|
|
bDetected = true;
|
|
}
|
|
|
|
sLang = "Rust";
|
|
|
|
return result();
|
|
} |