0

I have 2 binaries, with the same CPU architecture.

I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it.

I put the produced file in the right CPU directory under IDA home. Then I opened the second binary and applied the signature file on it.

The result is that some of the functions (~20%) are marked in blue as library functions, and actually appear in the original binary as expected, but almost none of those functions were renamed to the names from the first binary.

Does anyone know what could be the reason? Is there another way to find the original function name from the binary that I apply the signature file on?

  • did you get many collisions when running sigmake first time? – Igor Skochinsky Aug 6 at 13:47
  • also, what is the CPU? – Igor Skochinsky Aug 6 at 13:47
  • I got a minor number of collision (23 out of 2500), almost all of them were small functions. The CPU I use is ppc. – macr0controller Aug 6 at 14:06
0

Alas RISC instruction sets like PowerPC are often not a good fit for FLIRT. I you read the white paper (or even the FLAIR doc), you'll see that it only has provision for variable bytes, while in Power ISA the opcode fields usually cross byte boundaries, so you can get patterns which are either too broad (it ignores whole bytes instead of narrower bit fields) or too narrow (it does not allow enough variation and so won't match functions with slight changes). Additionally, solutions like IDB2PAT are mainly tuned for x86 so they likely produce suboptimal output for PPC.

I would suggest you to try simple byte sequence search to find some similar functions and then check if they were present in the original pattern list or not, and if they were, would the pattern bytes actually match the function.

  • But why IDA marks the functions as a library, but doesn't give the name? For example, I found a function in both of the binaries, by searching bytes sequence. No collisions with other functions. Still no name on the found function. – macr0controller Aug 7 at 8:58
  • Not sure, maybe no name was present in the signature for the matching address. FLIRT works with byte sequences, not functions. – Igor Skochinsky Aug 7 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.