7
plb.exe is designed for OMF libraries (primarily used for 16 bit Borland compilers). What you probably want is pcf.exe, which parses COFF libraries commonly used in 32 bit windows.
5
There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API.
There are options to support:
FLIRT itself - r2 supports this format (see 'zF' commands)
Zignatures - internal format of r2 (see 'z?' command for help)
Yara signatures - requires an installed yara ...
5
Yes, getting the compiler version right is pretty important, as well as the compilation options.
FLIRT relies on fixed byte patterns and does not tolerate even slight differences in the generated code. A different version of compiler may have drastically different register allocator or optimization algorithms, which may result in very different binary for ...
4
There is also Sibyl, an open-source tool based on Miasm2 that performs function divination.
4
Oh, the happyness of near functions vs. far functions, near pointers vs. far pointers, and mixed models (far functions, near pointers)
Back in the 16 bit world, programs could either
use a maximum of 64 KB code, and 64 KB data, have all pointers use 16 bit, and ignore segment registers. This was called the near model, because all offsets were within the ...
3
If you are talking about IDA FLIRT signatures, unfortunately sooner or later you will probably hit their limitations, and, or, get frustrated with the results if you want high accuracy.
First you can read about IDA's system in detail here:
https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml
As you can see it only matches the first 32 bytes of ...
2
AFAIK, you can only create the .pat files from statically linked libraries using the method you describe. It appears your file is dynamically linked (that would explain the 'invalid input file' message)
You can give a try to this IDAPython plugin. A good explanation from its author can be found here
Good luck!
2
Read this here:
https://www.hex-rays.com/products/ida/tech/flirt/index.shtml
I think they overhauled the FLIRT system in a recent version of IDA.
Overall it works pretty well, but there is a lot of room for improvement.
It's kind of like "finding a needle in a haystack".
It's annoying when the FLIRT names so many false positives.
It assumes a match on just ...
2
You may be able to make use of snapshots to make this happen from a plugin. I don't think the database snapshot functions are exposed in IDC or IDAPython.
General algorithm on a freshly opened database would be something along the lines of
libs_before = iterate over all functions to determine initial count of library functions
snapshot_t ss;
::qstrncpy(ss....
2
Using FLIRT for C code requires you to know the exact version of CRT and the exact flags of the compilation so that you could build it yourself and then, having all the binaries and debug symbols, create the signatures from .a or .obj or .lib.
But there are so many variations of CRT built with various versions of the compilers. And there's no way to ...
2
There is a project called Sibyl based on the symbolic execution framework miasm. They basically call each unknown function with test cases until it passes all test cases for a given hypothesis.
E.g. if the unknown function is "strlen", one test case could be: It should, when you call it with the single parameter "AAAAAAA", not crash and return 7.
Sibyl ...
2
You need to build Qt 5.5.1 using MinGw 4.9.2. and guess all the build options that the developer used originally. Then use FLAIR for you IDA version to generate pat files from .a libraries. Then compile pat files into sig files. Put sig files to \IDA\sig and try to apply them.
2
You need to place them into a cpu specific subdirectory, e.g. pc.
1
Alas RISC instruction sets like PowerPC are often not a good fit for FLIRT. I you read the white paper (or even the FLAIR doc), you'll see that it only has provision for variable bytes, while in Power ISA the opcode fields usually cross byte boundaries, so you can get patterns which are either too broad (it ignores whole bytes instead of narrower bit fields) ...
1
IDAPython - you can automate almost everything in IDA with IDAPython or IDC.
The hard part is that it's not very well explained. There are a few things that can help:
All menu actions can be linked to IDC funtion via the IDA configuration files found in the cfg directory inside the IDA installation path (3 files starting with ida)
Read inside the source ...
1
There is a plugin called BinDiff
If you have renamed Sub_Routines in one IDA DB, you are able to run BinDiff between your current one and a new DB that hasn't been refactored yet. The only down side is it's a little time consuming for binaries that are 30mb+ in size.
http://i.imgur.com/dTPEyHq.png
Only top voted, non community-wiki answers of a minimum length are eligible