RTF / Equation Editor heuristics

1 detection rules

← All detection heuristics

Nibble-shifted Equation Editor object critical RTF_NIBBLE_SHIFTED_EQUATION_OBJECT
RTF objdata contains a half-byte-shifted CFB that realigns to a valid Microsoft Equation 3.0 object.