search

kweatherman / sigmakerex

Enhanced IDA Pro signature generator plugin.
MIT License
323 stars 45 forks source link

Add test signature #7

Closed marfixdev closed 1 year ago

marfixdev commented 1 year ago

Please can you add "test signature" feature to check my patterns on IDA ?

kweatherman commented 1 year ago

I do think the original version of SigMaker has this feature, but just use the "IDA" version out and "Binary Search" for it.

So say if your output looks like this:

SigMakerEx: Finding function signature.
Function SIG: 0x00549A50, 9 bytes 0, wildcards.
IDA: "57 68 04 01 00 00 6A 00 68"
"\x57\x68\x04\x01\x00\x00\x6A\x00\x68", "xxxxxxxxx"

You take the 57 68 04 01 00 00 6A 00 68 part and search like this: image

And you'll get all the matches (should normally be unique) like this: image