$ signsrch -s /usr/local/etc/signsrch.sig firmware_eBook-Reader_3-0_v-eBR30_CP_1.0.4_20111216.exe
Signsrch 0.2.2
by Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
optimized search function by Andrew http://www.team5150.com/~andrew/
disassembler engine by Oleh Yuschuk
- open file "firmware_eBook-Reader_3-0_v-eBR30_CP_1.0.4_20111216.exe"
- 100906660 bytes allocated
- load signatures
- open file /usr/local/etc/signsrch.sig
- 3069 signatures in the database
- WARNING:
the file loaded in memory is very big so the scanning may take many time
- start 4 threads
- start signatures scanning:
offset num description [bits.endian.size]
--------------------------------------------
0001aa64 876 SHA256 Initial hash value H (0x6a09e667UL) [32.le.32&]
000202f8 1835 Rar29 InitBinEsc [16.le.16]
00020308 874 SHA256 Hash constant words K (0x428a2f98) [32.le.256]
00025af0 894 AES Rijndael S / ARIA S1 [..256]
00025bd0 2233 RIJNDAEL1_DS [..33]
03176f03 3049 DMC compression [32.be.16&]
- 6 signatures found in the file in 23 seconds
- done
Signsrch 0.2.2
by Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
optimized search function by Andrew http://www.team5150.com/~andrew/
disassembler engine by Oleh Yuschuk
- open file "firmware_eBook-Reader_3-0_v-eBR30_CP_1.0.4_20111216.exe"
- 100906660 bytes allocated
- load signatures
- open file /usr/local/etc/signsrch.sig
- 3069 signatures in the database
- WARNING:
the file loaded in memory is very big so the scanning may take many time
- start 4 threads
- start signatures scanning:
offset num description [bits.endian.size]
--------------------------------------------
0001aa64 876 SHA256 Initial hash value H (0x6a09e667UL) [32.le.32&]
000202f8 1835 Rar29 InitBinEsc [16.le.16]
00020308 874 SHA256 Hash constant words K (0x428a2f98) [32.le.256]
00025af0 894 AES Rijndael S / ARIA S1 [..256]
00025bd0 2233 RIJNDAEL1_DS [..33]
03176f03 3049 DMC compression [32.be.16&]
- 6 signatures found in the file in 23 seconds
- done