2

I'm currently exploring some binaries in IDA aided by source code for some of the functions. Some functions are easily found using strings, while others are less easily found.

I don't have access to the compiler due to various reasons. Meaning I can't use the obvious solution of compiling the source and creating signatures with something like IDB2PAT or rizzo.

How can I create function signatures from the sources without compiling?

Improve this question

1 Answer 1

Reset to default
2

Creating signature files for IDA is a 2-step process:

  1. Create a PAT file
  2. Compile the PAT file to a SIG file

The tools that come with IDA's FLAIR toolset allow you to automatically generate PAT files for OMF, COFF, ELF, PSX, and Trimedia libraries. The toolset also includes the PAT-to-SIG compiler.

Even though you don't have the library binaries (and thus can't automatically generate the PAT files), given the fact that the PAT file format is documented in the FLAIR toolset's pat.txt file, you can write your own tool to generate a PAT file or even create the PAT file manually (and then compile it to create your signatures file).

However, since the patterns are based on the compiled bytes, you'd still need a binary form of the library code, so you'd still might as well use IDB2PAT or IDB2SIG. In other words, if you can't compile the source code and can't (or don't want to) identify the library functions in your IDB, then you're not going to be able to create traditional IDA signature files for that library code.

Improve this answer
3
  • 3
    (Note that you need to be a licensed IDA user in order to have the credentials to download the FLAIR toolset linked above.)
    – Jason Geffner
    May 30, 2015 at 20:30
  • The PAT file relies on the first 32 bytes of the function and several other features. As you already said it requires knowledge of the compiled bytes (and specific compiler flags for optimization btw) so your solution is not really a solution to my problem. using IDB2PAT will require manually identifying hundreds of functions. I'm looking for an automated process.
    – Eli K
    Jun 1, 2015 at 21:50
  • I didn't promise a solution to your problem; I answered the question you asked. Q: "How can I create function signatures from the sources without compiling?" A: "if you can't compile the source code and can't (or don't want to) identify the library functions in your IDB, then you're not going to be able to create traditional IDA signature files for that library code."
    – Jason Geffner
    Jun 1, 2015 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.