Regex engine documentation about detect-it-easy

[horsicq]

It is for relative jumps or calls

For example: PE.compareEP("e8$$$$$$$$8b")

1. DiE reads 1 BYTE on EntryPoint
2. DiE compares this byte with "e8"
3. DiE reads 1 DWORD on EntryPoint+1
4. DiE goes to (EntryPoint+1+4)+this DWORD
5. DiE read 1 Byte on the new address
6. DiE compares this byte with "8b"
   ...

There are also:
$$$$$$$$$$$$$$$$ QWORD
$$$$$ WORD
$$ BYTE

For not relative jumps or calls DiE uses '#'

jmp DWORD PTR[Address]
call DWORD PTR[Address]

'################' QWORD
'########' DWORD
'####' WORD
'##' BYTE

C++ implementation:
DiE: https://github.com/horsicq/DIE-engine/blob/master/binary.cpp#L1348
NFD: https://github.com/horsicq/Formats/blob/master/xbinary.cpp#L2555

[Solumnant]

Thank you, I was trying to determine whether your signatures could be ported into YARA, but it appears that isn't the case.