IDA and flirt signatures

Question

I have 2 binaries, with the same CPU architecture.

I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it.

I put the produced file in the right CPU directory under IDA home. Then I opened the second binary and applied the signature file on it.

The result is that some of the functions (~20%) are marked in blue as library functions, and actually appear in the original binary as expected, but almost none of those functions were renamed to the names from the first binary.

Does anyone know what could be the reason? Is there another way to find the original function name from the binary that I apply the signature file on?

Answer 1

Alas RISC instruction sets like PowerPC are often not a good fit for FLIRT. I you read the white paper (or even the FLAIR doc), you'll see that it only has provision for variable bytes, while in Power ISA the opcode fields usually cross byte boundaries, so you can get patterns which are either too broad (it ignores whole bytes instead of narrower bit fields) or too narrow (it does not allow enough variation and so won't match functions with slight changes). Additionally, solutions like IDB2PAT are mainly tuned for x86 so they likely produce suboptimal output for PPC.

I would suggest you to try simple byte sequence search to find some similar functions and then check if they were present in the original pattern list or not, and if they were, would the pattern bytes actually match the function.