VxSig doesn't seem to be producing correct Yara signatures when using static binaries

[paul-abb]

The Yara signatures look off, and don't correctly match the expected binaries when using static binaries, produced using Ida Free, BinExport, and processed via VxSig.

Processing the following files outputs the warnings: string "$" may slow down scanning warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect warning: rule "VxSig_Signature": too many matches for $, results for this rule may be incorrect

And only one of the two files used to produce the diff is matched by the signatures.

Files attached: vxsig_attempt.zip

[cblichmann]

Well, the warning messages are sort of expected. $ and unbounded matches using [-] are known not to be super efficient in the YARA regex engine. You may want to experiment with VxSig's --trim_length argument (see --helpfull), which by default produces signatures of unbounded length.

That all said, the original files should match. If they don't, then there might be something funky going on with functions being reordered by the disassembler.\ Note that .BinExport files themselve may not necessarily match the signature as they contain string in arbitrary order.

It'd be helpful to have the original binaries as well :)

[paul-abb]

bins.zip

Binaries are attached.

I tried using a shorter trim_length of 50000 and still only one binary matched. At 500, both binaries matched. I'm confused, why does the trim length impact the matching?