search

ajkhoury / SigMaker-x64

IDA Pro 7 compatible SigMaker plugin
537 stars 88 forks source link

Option for double '??' wildcards #25

Closed Caraxi closed 2 years ago

Caraxi commented 3 years ago

It was for a very specific purpose, it may not be useful to everyone but I figured I'd PR it anyway. The system I use the signatures with them only accepts double ??, saving 10 seconds for every signature manually changing it was worth the time adding the option.

Caraxi commented 2 years ago

Any updates?

ajkhoury commented 2 years ago

This is implemented poorly imo, but I definitely like the idea of adding support for double wildcards.

Caraxi commented 2 years ago

out of curiosity, what is poor about it? I've never written c++ before so I just copied the existing settings that you wrote

ajkhoury commented 2 years ago

Double '??' wildcards are for denoting nibble wildcards. A proper implementation should support single nibble wildcards as well e.g. 48 8? C6 ?8. The way you implemented this is just to accept double '??' wildcards as a single '?'. I can give you a reference implementation of what I mean if you want to integrate it into this project.

Caraxi commented 2 years ago

Fair enough I guess. my use case doesn't support nibble wildcards so it's not a big deal to me, I'll just keep my fork