So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this:

Lua Copyright Version

Which I am understanding that somewhere in this program they have statically linked a Lua C or something of the sort, so I did a quick Google for Lua 5.2.1 Libraries, I found this which is a link to the Source Forge for Lua static libraries for 5.2.1, so I downloaded it, opened up the IDA SDK, and ran:

.\pcf.exe .\lua52.lib .\lua52.pat

which returns:

...\lua52.lib: skipped 0, total 793

Which I interpret to understand it found 793 signatures or something similar, so then I ran:

.\sigmake.exe .\lua52.pat .\lua52.pat

Which returns an error;

.\lua52.pat: modules/leaves: 767/793, COLLISIONS: 1
See the documentation to learn how to resolve collisions.

Which I assume meant I had to use the -r switch, so I reran it

.\sigmake.exe -r .\lua52.pat .\lua52.sig

It generated no errors and produced the sig file, so I dropped it in the sig directory in IDA which lets it show up, so when I go to apply Lua Signature Image In IDA it shows up which I expected, I add it to IDA, it tells me there areProof of references references, but nothing I am "sure" is Lua gets renamed? Is that expect or not? I know this line

sub_140856EE0(v1, (__int64)"field '%s' missing in date table", "year");

is Lua because when you google the middle field it tells it's a Lua using a Lua function. Finally I've ran a reanalyses to make sure it looks back through the file to give it a once over.

Have I missed something obvious here?

  • Rename it with 'N' key – Biswapriyo Aug 5 at 18:58
  • I do that to manually rename things, but I thought the point in applying a FLIRT signature is that it would fill in names for me? – Jalomba Aug 6 at 11:40
  • You realize that you can roll your own signatures? I don't remember seeing that FLIRT signature in my default list, so perhaps it was generated by a third-party and it wasn't well-done? Alternatively, how about it's Lua but not that exact version or that exact compiler? – 0xC0000022L Aug 10 at 20:37
  • I figured it out, It's because it wasn't the right arcitecthure and I made it myself if you read the full post you'd see that. – Jalomba Aug 12 at 6:19
up vote -1 down vote accepted

It might help if you use the same architecture as the target process... But that doesn't fully explain why the other non x64 FLIRT signature doesn't rename stuff even if the window says it found X refs

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.