← ClaudeAtlas

byte-pattern-matchinglisted

Search for raw byte patterns (hex sequences, opcodes) in binary code. Use when looking for specific instruction sequences, machine code patterns, UEFI SMI handlers, or known vulnerability signatures by their byte representation.
vulhunt-re/skills · ★ 15 · AI & Automation · score 63
Install: claude install-skill vulhunt-re/skills
# Byte Pattern Matching Search for raw byte patterns (hex sequences) in binary code. ## When to use - Find specific instruction sequences by their machine code bytes - Locate code patterns when the raw opcode bytes are known - Search for known vulnerability signatures by byte pattern - Find UEFI-specific patterns like SMI handlers or protocol usage ## Instructions Using the VulHunt MCP tools, open the project (`open_project`) and run the following Lua query (`query_project`), adapting it as needed: ```lua local result = project:search_code("<byte_pattern>") if result then local entry = { function_address = tostring(result.function_address), start_address = tostring(result.start_address), end_address = tostring(result.end_address), instructions = {}, } for _, insn in ipairs(result.insns) do table.insert(entry.instructions, { mnemonic = insn.mnemonic, address = tostring(insn.address), }) end return entry end ``` The byte pattern is a hex string (e.g., `"554889e5................"`, where `..` matches any byte). Returns a JSON object containing: - `function_address` - the address of the function containing the match - `start_address` - the start address of the matched pattern - `end_address` - the end address of the matched pattern - `instructions` - list of matched instructions with their mnemonics and addresses ### UEFI Platform For UEFI targets, additional functions and options are available: ```lua -- Search code withi