I have a mipsel executable (DvdPlayer from a RTD1283 firmware). I know that IDA is able to identify many functions. Then, I would like to generate a .sig file with signatures of these functions for use with other executable DVDPlayer (from other firmwares).

Would it be possible to convert the executable in a library ?


You can try the IDB_2_SIG plugin that generates signature files from the IDB itself.

One thing to note is that with gcc-built MIPS ELF files, many non-library symbols/function names (basically anything in a .o file) get entries in the dynamic symbol table and thus survive strip/sstrip as long as the binary is dynamically linked. So you probably won't need to generate signatures against this ELF in order to identify those same functions in similar ELF files from other DVDPlayer firmwares - they'll just be there and IDA will do its thing.

  • I'm using IDA 6.1 for windows on linux but I have no windows compiler. I searched for an IDB2Sig executable and found woodmann.com/collaborative/tools/index.php/… but no luck (bad .pat file). I have DVDPlayer executables in both formats, static and dynamically linked. The idea was to generate a .sig file with the dynamically linked version of DvdPlayer and use it to identify the same functions in the static DvdPlayer. – usr100001 Mar 6 '14 at 10:39

Yes, either use IDA's FLAIR tools or use one of the tools mentioned here: Tools to work cooperatively on the same binary

  • How? I can generate a .sig file from a library with: pelf library library.pat and sigmake library.pat library.sig, but if I try pelf with an executable then I get "non-relocatable elf module, skipped" message and .pat file is not created. – usr100001 Mar 5 '14 at 15:05
  • No, you can't generate a FLIRT signature out of a non relocatable ELF module as far as I remember. – joxeankoret Mar 5 '14 at 15:27
  • In that case, follow the link I posted above instead. – Jason Geffner Mar 5 '14 at 16:06
  • I think you misunderstood my problem. I work with SEVERAL executable FILES and I want to use the information I get from one in the other. Sorry for my bad english. – usr100001 Mar 6 '14 at 10:45
  • I understood your question. Most of the tools to which I linked (such as crowdre.crowdstrike.com) support that scenario. – Jason Geffner Mar 6 '14 at 14:17

IIRC, you cannot generate a FLIRT signature from a non relocatable ELF binary. You may have better luck using BinDiff to export the function names and comments. If this is all you need it should be enough, I use it a lot for this very same purpose.

  • Is it useful for files with many differences? I tried code.google.com/p/patchdiff2 but only got results with similar files (dynamically linked with function names included in the executable). – usr100001 Mar 6 '14 at 16:10
  • BinDiff works with partially similar files. This is why this tool was wrote, I think. – joxeankoret Mar 7 '14 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.