Detect-It-Easy/db/ELF/IBM_AIX_kernel_loader.sg
2024-11-12 20:11:38 +03:00

18 lines
No EOL
569 B
JavaScript

// Detect It Easy: detection rule file
init("boot", "IBM AIX kernel loader");
function detect() {
if (ELF.getNumberOfPrograms() >= 4) {
if (ELF.getProgramFileSize(1) <= 0x100) {
if (ELF.findString(ELF.getProgramFileOffset(1), Math.min(0x100, ELF.getProgramFileSize(1)), "IBM,RPA-Client-Config") != -1) {
bDetected = true;
}
}
}
if (ELF.findString(ELF.getProgramFileOffset(0), Math.min(0x100, ELF.getProgramFileSize(0)), "PowerPC") != -1) {
sVersion = "PowerPC";
}
return result();
}