📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Function signatures

Topic created on: July 10, 2008 11:34 CDT by Dephased .

Hello,

I am currently working on dissasembling an application which is constantly updated (a few times per month) so everytime there is an update, I have to create a new database, find again the functions and "transfer" my comments.

In order to find again the functions, I manually get some "signatures" which are "position-independant" (for example, I avoid to insert any "call" instruction), store them in a file as HEX bytes and simply do a "search sequence of bytes" in my new database.

Obviously, its very tiresome and as the number of functions which I handle increases... it gets simply unmanageable.

My question is, are there currently any plugin which can allow me to automatically extract "position-independant" signatures which I could use when my target .exe gets updated?

Thanks a lot!

  neoxfx     July 11, 2008 02:34.50 CDT
Search for Plugin called IDB_2_PAT, have fun!

  aLS     July 12, 2008 10:19.12 CDT
You can get a few plugins to signature functions at: http://old.idapalace.net/plugins.html

But,  actually, you can easily do an IDAPython script to do exactly what you want (adjusting it to your specific case).

I've done something similar some time ago to do a crappy automated analysis of Windows Drivers. You can take a look to it here: http://exploiting.wordpress.com/2007/03/22/driver-inspector/

I hope it helps.

  Dephased   July 15, 2008 05:58.07 CDT
Thanks for the tip, IDB2PAT is exactly what I was looking for! I suppose the last thing I would need would be to transfer my comments from one database to another, it cannot be hard to do providing I now have the function signatures.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit