Currently the FindSignature only supports the old-fashion \x2A as a wildcard. However, if a signature is outdated after an update, finding it in an old binary will need to remove all \ and replace 2A with ? and that will be tedious if there are a lot of outdated signature IMO.
Since most signature-maker plugins like A200K/IDA-Pro-SigMaker and senator715/IDA-Fusion generate either IDA style (48 89 1D ? ? ? ?) or code stlye (\x48\x89\x1D\x00\x00\x00\x00) with bitmask provided, to make compatible with current signature style will require to generate code style signature and replace \x00 with \x2A or modify the plugin so it will generate signatures with \x2A as wildcard, and both are a no-go IMO.
Currently the FindSignature only supports the old-fashion
\x2A
as a wildcard. However, if a signature is outdated after an update, finding it in an old binary will need to remove all\
and replace2A
with?
and that will be tedious if there are a lot of outdated signature IMO.Since most signature-maker plugins like A200K/IDA-Pro-SigMaker and senator715/IDA-Fusion generate either IDA style (
48 89 1D ? ? ? ?
) or code stlye (\x48\x89\x1D\x00\x00\x00\x00
) with bitmask provided, to make compatible with current signature style will require to generate code style signature and replace\x00
with\x2A
or modify the plugin so it will generate signatures with\x2A
as wildcard, and both are a no-go IMO.I can make a pr if needed, please let me know :)