OOVPA Signature Guideline

NOTICE: This currently a draft, may subject to change at any time.

OVP, Offset Value Pairs, Guideline

• OV_MATCH:
  • may can have up to 4 instructions combine depending on how short they are.
    • i.e. three repeat pushes may only have one or two bytes each which is up to 3 or 6 bytes. Which is permitted to have in single OV_MATCH.
  • may can have 1 to 8 values plus offset.
  • whole instruction is not a requirement.
  • if one or more next instructions are used in a separate macro need to be on next newline. Otherwise is require to be after blank line.
• XREF_ENTRY:
  • require at beginning of OOVPA signatures and must be group together if there are more than 1 xrefs used.
  • requires a blank line for each reference and after the end of xref entry's group.
  • may not extend more than four references.

OOVPA Guideline

• OOVPA_SIG_HEADER_NO_XREF:
  • may not be less than 8 offset value pairs.
  • may not extend more than 30 offset value pairs.
    • i.e. OV_MATCH with 4 values is equivalent to 4 offset value pairs.
  • do require at least one or two unique instructions or matching pair of instructions to secure.
• OOVPA_SIG_HEADER_XREF:
  • if using XRefZero, follow OOVPA_SIG_HEADER_NO_XREF's expectation.
  • do at least try keep below 18 offset value pairs whenever is possible.
• OOVPA_SIG_HEADER_xxxx_DETECT:
  • same guideline as OOVPA_SIG_HEADER_XREF or OOVPA_SIG_HEADER_NO_XREF.
  • must be fully aware and acknowledge signature you make is designated to select specific duplicate functions.
    • it will suppress warning message and convert into a debug message.