I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using the bds signature. Thanks !
Add a comment
|
3 Answers
It is important to understand that PEiD could potentially be identifying the wrong version of Delphi. While Delphi 6/7 are very similar (and frankly, all the way up to Delphi 2007 are very similar), you may be looking at a binary created with Delphi 2009 or newer.
This is relevant because Delphi 2009 introduced native unicode string support and mapped the generic type string to UnicodeString, by default, which can affect string analysis. Delphi 2007 and earlier did not have native support for unicode strings.
To complicate things slightly more, Delphi XE2 added 64-bit compilation support. So when dealing with a newer Delphi compiled binary, this may be relevant. (Delphi releases have been called Delphi 1-7, 2005, 2006, 2007, 2009, 2010, XE, XE2, XE3, XE4, and the latest is XE5). BDS stands for "Borland Developer Studio", although Delphi was later known as CodeGear Delphi and is now officially known as Embarcadero Delphi.
There's also this great answer on StackOverflow that covers the differences between different Delphi versions.
And in fact, on the Delphi and C++ Builder roadmap is a plan to move the Delphi compiler to Clang/LLVM (their iOS and Android compilers are currently using LLVM, but not the Windows compilers...yet). So store that bit of trivia away for future decompilation...
I looked at "Detect it Easy" v0.78, RDG Packer Detector v0.7.1, PEid, and Exeinfo PE 0.0.3.4 Beta, and I found that only Exeinfo PE could detect my Delphi 2010 compiled executable correctly:
On to the analysis. Once you've determined the correct Delphi compiler, things are often easier. Delphi GUI programs use a GUI framework called the 'VCL' (Visual Component Library). Its easy to look for the appropriate FLIRT signature by simply filtering on VCL:
Additionally, I like to also filter the FLIRT signatures on BDS as well. When looking at Delphi binaries I usually will add in the "Extra atl/ie library" and the "win32 runtime".
And finally, because Delphi creates native Windows binaries, I always make sure the mssdk32 FLIRT signature is added as well.
Good luck!
UPDATE
Detect It Easy v0.79 and newer can correctly detect Delphi versions up through XE6
Signature you are referring to are Fast Library Identification and Recognition Technology, which is know as FLIRT. IDA ships wit most common Windows compilers, plus several non-Windows signatures.
When binary is opened, IDA will try to apply start up signature files. Evidently, the entry point of the code is indicative enough to be able to identify complier used for given binary. If IDA successfully determines compiler used for stated binary, then it will load the signature files for corresponding compiler libraries and apply it to the remainder of the code.
The signatures that IDA come with are for the most part associated with proprietary compilers such as Microsoft's Visual C++ and Borland Delphi. However, for the precise pattern matching you will need to generate signature files for each different version of the library.
To overcome this hurdle, Hex-Rays makes tools available that allow you to generate your own signatures from static libraries. Fast Library Acquisition for Identification and Recognition (FLAIR) tool set is distributed to authorized (licensed) customers. Version of FLAIR needs to correspond to the version of IDA. The signature creation process is straight forward:
- Get the copy of the static library.
- Utilize FLAIR parser to create a pattern file.
- Run sigmake.exe to convert the pattern file into signature file
- Install new signature file by copying to IDADIR/sig directory.
In order to apply signature files manually, you should go to File->Load File->FLIRT Signature File, which will pop up dialog box with all of the signature files installed into IDADIR/sig directory. Select a signature you would like to use and click OK.
Also a powerful tool when dealing with Delphi is IDR : IDR (Interactive Delphi Reconstructor).
You can export the result of this tool to use it with IDA pro.
Just don't forget to download the coresponding signature for your binary http://kpnc.org/idr32/en/download.htm
See also this post
