PDA

View Full Version : Signature Files


peterg70
June 7th, 2011, 08:44
I was thinking that alot of people keep asking for signature files (yes I know people like me).
What if we generated our own signature files.
Simple hex pattern for each function that we need.

I went looking for a signature maker and found a crude version called "Signature Maker 0.4" which you can highlight in ollydbg the hex pattern and it will generate a pattern.
The source is available so perhaps this could be better implemented so once people identified a routine (i.e. flexlm lc_checkout) they can generate a signature for that and post some database/blog/pastebin and these can be added to the plugin to scan and apply signatures back.

This would share the knowledge for each version of flexlm. Elimate all the requests for signatures.
Group effort would contribute.

Thoughts?

dELTA
June 20th, 2011, 19:25
Check here before implementing any tool of your own:

http://www.woodmann.com/collaborative/tools/index.php/Category:IDA_Signature_Creation_Tools

Gunther
July 2nd, 2011, 10:18
@peterg70: Sorry but will this article by arkon help?
http://www.ragestorm.net/blogs/?p=333

Or you are looking at something else?

BR,
[ Gunther ]