IDA startup signatures are sets of signatures used in FLIRT to detect what library is used in a static linked executable .
I am about to use these signatures to detect which library is used in an executable file .
I must use pattern files in IDA FLIARFLAIR in startup folder .
but i don't know it's format and what does each field mean (:?)
here are a few sample pattern :
1)8BFF558BECE8........E8........5DC3.............................. 00 0000 0011 :0000 s=A/- ^0006 ___security_init_cookie ^000B ___tmainCRTStartup
2)6A0C68........E8........8BF98BF28B5D0833C0408945E485F6750C3915.. 00 0000 00F6 :0000 o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@; :00E4@ $LN18 :00E3@ $LN25 :00D3@ $LN29 :00D3@ $LN17 ^0003 __sehtable$___DllMainCRTStartup ^0008 __SEH_prolog4 ^001F ___proc_attached ^0037 __pRawDllMain ^0055 __CRT_INIT@12 ^0068 _DllMain@12 ^00DD ___CppXcptFilter ^00F1 __SEH_epilog4 ......0F84C50000008365FC003BF0740583FE02752EA1........85C07408575653FFD08945E4837DE4000F8496000000575653E8........8945E485C00F8483000000575653E8........8945E483FE01752485C07520575053E8........576A0053E8........A1........85C07406576A0053FFD085F6740583FE037526575653E8........85C075032145E4837DE4007411A1........85C07408575653FFD08945E4C745FCFEFFFFFF8B45E4EB1D8B45EC8B088B095051E8........5959C38B65E8C745FCFEFFFFFF33C0E8........C3
i could 't find any relevant content on the internet.
can any body help me about the format?
More about my need:
I want to find library functions in PE files (on my own program not by IDA) and ,as there are a huge amount of FLAIR pattern for all libraries , I cannot load them altogether because of memory and speed issues .
I have also read pat.txt in IDA FLAIR and i know the patterns format but startup signatures format is a bit different and has new parts so I want to know about these new parts like :
o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@;
