I have more than 40 different IDA signature files (besides the built-in ones) and sometimes I don't want to go through the hassle of examining what signatures may be relevant for a given target. Instead I just want to apply all signatures, one at a time, and have IDA tell me which ones had the most matches in the target. Doing this manually is very tedious because
- IDA only allows applying 1 signature in each apply operation
- The application order of signatures influences how many matches a given signature generates. For example, when sig A is applied it may mean sig B misses some matches that A has matched before it.
I imagine the plugin/script would do something like this: apply sig A to the target database, count matches, then remove the application of sig A and apply B, count matches, then remove the application and apply C and so on.
Has nobody else ever had this idea? I have been unable to find a plugin or script that does this, and I would rather not write my own if one already exists.