Add more tokens as desired. They can all be named "bytes" and thus all execute the same match statement even though they have different values if you want them all to register the same alert text (like in the above). If you want different alert text (say one for "possible buffer overflow" and another for "possible nop sled") you'll have to use different token names and match statements.
Add more bytes per token as desired. But note that if 20 0x90 are in the payload, a token consisting of 10 0x90 will still match (multiple times actually).
You can use the same basic outline / logic for any signature-type parser (see pattern -> register alert).