search

mandiant / flare-ida

IDA Pro utilities from FLARE team
Apache License 2.0
2.21k stars 466 forks source link

idb2pat fix bugs #97

Open HongThatCong opened 4 years ago

HongThatCong commented 4 years ago

Hi William, I am TQN, the old author of idb2sig plugin. I need to update my plugin, so I used your script to test the result and compared the resulting .pat files with IDA flair tool. After some work, I found some bugs in the old plugin code. So I have fix those bugs in your code. But it still have a small bug: find_ref_loc will return BADADDR for the following sequence:

48 8D 05 29 06 00 00         lea     rax, `vtable for'loader_failure_t+10h

with:

But in byte pattern is 0x0629 (29 06) because of +10h Hope you have a time and fix it. Thanks and best regards. My code: https://github.com/HongThatCong/idb2sig

williballenthin commented 4 years ago

hey @HongThatCong thanks for reporting this issue! I'll look into the bug and try to make a fix here. thanks for your hard work over the years that enabled me to learn how FLIRT works.

HongThatCong commented 4 years ago

Thanks Willi, My friend have fixed this bug, and I recently uploaded. But still have a bug. It will failed on ARM. On x86 and x64, it run OK. The result match with IDA flair tool. I will add the form for user choose the type of functions which created pat ???

HongThatCong commented 4 years ago

Hi Willam. I have fixed all known bugs. Can you take a moment to test it. I hope it will be updated to your code. Sorry for my bad Python code and my English. I am Vietnamese. Thanks and best regards...

williballenthin commented 4 years ago

I'm glad we can communicate! Thank you very much for reaching out here :-)

I will take a look at your fork and try to merge the changes in here. I'll update this issue when this is done. Thank you!