Update nursery/populate-syswhispers2-syscall-list.yml

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
mandiant · Mar 24, 2024 · fd95127 · fd95127
1 parent 02780c7
commit fd95127
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/nursery/populate-syswhispers2-syscall-list.yml b/nursery/populate-syswhispers2-syscall-list.yml
@@ -34,7 +34,7 @@ rule:
         - instruction:
           - description: check 'Zw'
           - mnemonic: cmp
-          - operand[1].number: 0x775a
+          - operand[1].number: 0x775a = "wZ"
       - and: # this is optional but this should reduce false positives if any at all
         - description: syscall list sorting
         - instruction: