Skip to content

Commit

Permalink
Add code block language to README
Browse files Browse the repository at this point in the history
  • Loading branch information
joakim-intezer committed Jan 20, 2022
1 parent b3b1642 commit 0df8428
Showing 1 changed file with 7 additions and 5 deletions.
12 changes: 7 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ Execute the plugin via `#!pipe` and save yourself time while reversing. The plug
After we have submitted the file to Intezer Analyze, we open the file
with radare2:

```
```bash
$ r2 7c82689142a415b0a34553478e445988980f48705735939d6d33c17e4e8dac94
-- *(ut64*)buffer ought to be illegal
[0x004028e3]> aaa
Expand All @@ -35,11 +35,12 @@ When we run `r2analyze`, it will query Analyze for code reuse. Functions
that share code already malware will be marked with a gene `flag`. All
the flags are added to a new flag space called "gene" for easier
filtering.
```

```bash
[0x004028e3]> #!pipe r2analyze
Analyzing 7c82689142a415b0a34553478e445988980f48705735939d6d33c17e4e8dac94
Functions found 194.
[0x004028e3]> fs gene
[0x004028e3]> fs gene
[0x004028e3]> f
0x00401000 1 gene_malware_ScarCruft_4198400
0x004013e0 1 gene_malware_ScarCruft_4199392
Expand All @@ -48,7 +49,8 @@ Functions found 194.
```

Function identified as sharing code with ScarCruft:
```

```bash
[0x004028e3]> pdfs @ 4202272
;-- gene_malware_ScarCruft_4202272:
0x00401f4a call dword [sym.imp.KERNEL32.dll_CreateFileA]
Expand All @@ -69,4 +71,4 @@ Function identified as sharing code with ScarCruft:
0x00402010 int32_t arg_ch
0x00402014 int32_t arg_8h
0x00402018 call fcn.00402090 fcn.00402090
```
```

0 comments on commit 0df8428

Please sign in to comment.