Results 1 to 4 of 4

Thread: IDA/FLAIR signature file issue

  1. #1
    rheax
    Guest

    IDA/FLAIR signature file issue

    Summary:
    Trying to import custom .sig file into IDA and I get the warning "signature format error (file pos=1caf)", and it does not seem to apply any signature.
    There was a similar post at:
    http://www.woodmann.com/forum/archive/index.php/t-1026.html
    But like the other author, I really have no clue what the response means.

    I tried making a signature for a simple library I compiled (VC6 debug) and IDA loaded it fine.

    Details:
    IDA: 5.2.0.908 (32 bit)
    FLAIR: flair38 (sigmake: 1.35, pcf: 1.10)

    I need signatures for boost for an app I'm reversing. I used the boost installer to have it download pre-compiled boost libraries, included in them filesystem-vc80-mt-s-1_40.lib, which is my best guess to what they are probably using. I run the following:
    $ cd /cygdrive/c/Program Files/boost/boost_1_40/lib
    $ pcf libboost_filesystem-vc80-mt-s-1_40.lib libboost_filesystem-vc80-mt-s-1_40
    .pat
    libboost_filesystem-vc80-mt-s-1_40.lib: skipped 44, total 895
    $ sigmake libboost_filesystem-vc80-mt-s-1_40.pat libboost_filesystem-vc80-mt-s-
    1_40.sig
    libboost_filesystem-vc80-mt-s-1_40.sig: modules/leaves: 643/359, COLLISIONS: 48
    And delete the header from the top f the exc file so as to ignore all collisions. Rerunning:
    $ sigmake libboost_filesystem-vc80-mt-s-1_40.pat libboost_filesystem-vc80-mt-s-
    1_40.sig

    Now in IDA:
    File -> Load File -> FLIRT signature file
    Select libboost_filesystem-vc80-mt-s-1_40 (Unnamed sample library)
    Get message saying it "has been put into queue and will be applied later"
    In the background it says:
    Loading signature XXX Just a moment...
    But has the error box:
    Warning: signature format error (file pos=1caf)
    If it helps, relevant file area:
    00001c90 74 65 6d 40 62 6f 6f 73 74 40 40 40 66 69 6c 65 |tem@boost@@@file|
    00001ca0 73 79 73 74 65 6d 40 62 6f 6f 73 74 40 40 40 65 |system@boost@@@e|
    00001cb0 78 63 65 70 74 69 6f 6e 5f 64 65 74 61 69 6c 40 |xception_detail@|

    Let me know if posting any files would help.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Could it be because you are using an old version of FLAIR? Try using FLAIR v5.2 to see if this solves your problem.

  3. #3
    rheax
    Guest
    Thanks for the reply. I switched to 5.2. Now things seem to be running happily. I didn't realize that version was so out of date
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    So.... any of the guys at iND want to give us the FLAIR and 5.5 SDK?

    :P

    Have Phun
    Blame Microsoft, get l337 !!

Similar Threads

  1. Unable to create signature file in IDA Pro
    By akovid in forum Advanced Reversing and Programming
    Replies: 0
    Last Post: January 28th, 2014, 01:31
  2. How to use "lmgr.map" to generate IDA signature file?
    By joyung in forum Advanced Reversing and Programming
    Replies: 3
    Last Post: June 10th, 2011, 16:39
  3. IDA signature issue
    By previn in forum Advanced Reversing and Programming
    Replies: 0
    Last Post: June 8th, 2011, 23:06
  4. IDA signature file format
    By diablo2oo2 in forum Tools of Our Trade (TOT) Messageboard
    Replies: 2
    Last Post: August 9th, 2010, 15:03
  5. IDA FLAIR
    By omega_red in forum Tools of Our Trade (TOT) Messageboard
    Replies: 2
    Last Post: August 6th, 2004, 04:43

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •