-
-
[推荐]dcu2pat--for Delphi IDA signature generation
-
发表于: 2014-6-28 12:44
-
dcu2pat,make Delphi .dcu to .pat!!
124K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4u0W2k6s2m8D9j5h3W2@1i4K6u0W2j5X3I4G2k6%4y4H3L8%4c8Q4x3X3g2U0L8$3#2Q4x3V1j5J5x3o6p5K6i4K6u0r3x3o6g2Q4x3V1k6V1j5%4f1J5M7r3q4@1i4K6u0W2K9s2c8E0L8l9`.`.
I wrote today some simple hack tool for creating signatures from delphi .dcu files for IDA flair
The main idea is very simple - flair expects .pat file to produce .sig file with signatures. So I just add some logic to my .dcu files loader to generate .pat files in right format
Supported Delphi versions:
Delphi 2007 (v12)
Delphi 2009 (v14)
Delphi 2010 (v15)
Delphi XE (v16)
Delphi XE2 (v17)
Download mirror
Sample of using:
Lets make signatures for delphi 2007 release run-time:
dcu2pat.exe I:\delphi.trash\2007\lib\*.dcu
wc -l .pat
26959 .pat
\ida\flair\bin\sigmake.exe .pat d2007.sig
: modules/leaves: 11149849/26655, COLLISIONS: 19389
After resolving of collisions (see flair\sigmake.txt for detail description):
wc -l d2007.exc
786 d2007.exc
\ida\flair\bin\sigmake.exe .pat d2007.sig
ls -l d2007.sig
-rw-rw-rw- 1 1250330 May 04 15:30 d2007.sig
124K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4u0W2k6s2m8D9j5h3W2@1i4K6u0W2j5X3I4G2k6%4y4H3L8%4c8Q4x3X3g2U0L8$3#2Q4x3V1j5J5x3o6p5K6i4K6u0r3x3o6g2Q4x3V1k6V1j5%4f1J5M7r3q4@1i4K6u0W2K9s2c8E0L8l9`.`.
I wrote today some simple hack tool for creating signatures from delphi .dcu files for IDA flair
The main idea is very simple - flair expects .pat file to produce .sig file with signatures. So I just add some logic to my .dcu files loader to generate .pat files in right format
Supported Delphi versions:
Delphi 2007 (v12)
Delphi 2009 (v14)
Delphi 2010 (v15)
Delphi XE (v16)
Delphi XE2 (v17)
Download mirror
Sample of using:
Lets make signatures for delphi 2007 release run-time:
dcu2pat.exe I:\delphi.trash\2007\lib\*.dcu
wc -l .pat
26959 .pat
\ida\flair\bin\sigmake.exe .pat d2007.sig
: modules/leaves: 11149849/26655, COLLISIONS: 19389
After resolving of collisions (see flair\sigmake.txt for detail description):
wc -l d2007.exc
786 d2007.exc
\ida\flair\bin\sigmake.exe .pat d2007.sig
ls -l d2007.sig
-rw-rw-rw- 1 1250330 May 04 15:30 d2007.sig
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
