From a8422ba964f58cfc944977da55a15f4fefb29c82 Mon Sep 17 00:00:00 2001 From: gir489 Date: Thu, 14 Jun 2018 20:50:04 -0500 Subject: [PATCH 1/2] Refactored SearchForSigs to use omin_ea to maintain consistency with whatever IDA is showing in the address bars. (This removes the need for __EA64__ awareness.) Added a more helpful README.md to the project. Resolved project warnings. --- README.md | 21 ++++++++--- SigMaker/Converter.cpp | 4 +-- SigMaker/Includes.h | 4 +++ SigMaker/Search.cpp | 75 +++++++++++---------------------------- SigMaker/SigMaker.vcxproj | 2 +- 5 files changed, 44 insertions(+), 62 deletions(-) diff --git a/README.md b/README.md index 662b8c2..9d2864e 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,25 @@ # SigMaker-x64 -IDA SigMaker Plugin updated for the IDA Pro 7.0 SDK. - -PLEASE NOTE: IDA Freeware 7.0 is NOT supported. +IDA SigMaker Plugin updated for the IDA Pro 7.0 SDK by [dude719](https://github.com/dude719). +PLEASE NOTE: IDA Freeware 7.0 is **NOT** supported. Originally made by P4TR!CK -Credits also go to bobbysing and xero|hawk +Credits also go to bobbysing and [xero|hawk](https://github.com/XeroHawk) -Thanks to gir489 for the contributions +Thanks to [gir489](https://github.com/gir489) for the contributions RIP GameDeception + +# Installation + +Visual Studio will expect the environment variable IDADIR to resolve to your IDA 7.0 installation directory. + +Visual Studio will also expect the SDK to be located at %IDADIR%\idasdk. Make sure these folders resolve in Windows properly before attempting to build the project. + +# Running the build + +Because IDA no longer has a native 32-bit compiled version anymore, the Release/Debug is the build script for the 32-bit version of IDA and Release64/Debug64 is the build script for the 64-bit version. + +**Do not change the target platform from x64!** \ No newline at end of file diff --git a/SigMaker/Converter.cpp b/SigMaker/Converter.cpp index 6cecb56..56f1d11 100644 --- a/SigMaker/Converter.cpp +++ b/SigMaker/Converter.cpp @@ -165,7 +165,7 @@ void IDAToCRC( const qstring& strSig, ea_t& dwCRC32, ea_t& dwMask ) { if (i <= iCount && szMask[i] == 'x') { - dwMask |= (1 << i); + dwMask |= (1i64 << i); } else { @@ -186,7 +186,7 @@ void CodeToCRC( const qstring& strByteSig, const qstring& strMask, ea_t& dwCRC32 { if (i <= iCount && szMask[i] == 'x') { - dwMask |= 1 << i; + dwMask |= 1i64 << i; } else { diff --git a/SigMaker/Includes.h b/SigMaker/Includes.h index 1b8e2f4..6ee374e 100644 --- a/SigMaker/Includes.h +++ b/SigMaker/Includes.h @@ -5,6 +5,9 @@ #define __NT__ 1 #define __X64__ 1 +#pragma warning( push ) +#pragma warning( disable : 4267 ) +#pragma warning( disable : 4244 ) #include #include #include @@ -26,6 +29,7 @@ #include #include #include +#pragma warning( pop ) #pragma comment(lib, "ida.lib") #pragma comment(lib, "pro.lib") \ No newline at end of file diff --git a/SigMaker/Search.cpp b/SigMaker/Search.cpp index 26feea5..e58325f 100644 --- a/SigMaker/Search.cpp +++ b/SigMaker/Search.cpp @@ -14,72 +14,39 @@ int GetOccurenceCount( const qstring& strSig, bool bSkipOut = false ) int iCount = 0; ea_t dwAddress = find_binary( inf.min_ea, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN ); - if (IsValidEA( dwAddress )) - { - do - { - if (bSkipOut == true && iCount >= 2) - return iCount; - - iCount++; - dwAddress = find_binary( dwAddress + 1, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN ); - } while (IsValidEA( dwAddress )); - } - else - { - dwAddress = find_binary( inf.omin_ea, inf.omax_ea, strSig.c_str( ), 16, SEARCH_DOWN ); - if (IsValidEA( dwAddress )) - { - do - { - if (bSkipOut == true && iCount >= 2) - return iCount; - iCount++; - dwAddress = find_binary( dwAddress + 1, inf.omax_ea, strSig.c_str( ), 16, SEARCH_DOWN ); - } while (IsValidEA( dwAddress )); - } - } + dwAddress = find_binary(inf.omin_ea, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN); + if (IsValidEA(dwAddress)) + { + do + { + if (bSkipOut == true && iCount >= 2) + return iCount; + iCount++; + dwAddress = find_binary(dwAddress + 1, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN); + } while (IsValidEA(dwAddress)); + } return iCount; } void SearchForSigs( const qstring& strSig ) { - ea_t dwAddress = find_binary( inf.min_ea, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN ); + ea_t dwAddress = find_binary( inf.omin_ea, inf.omax_ea, strSig.c_str( ), 16, SEARCH_DOWN ); const char* pszMessage = "===========================\n"; msg( pszMessage ); - if (IsValidEA( dwAddress )) - { - do - { -#ifdef __EA64__ - msg("sig found at 1%X\n", dwAddress); -#else - msg("sig found at %X\n", dwAddress); -#endif - dwAddress = find_binary( dwAddress + 1, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN ); - } while (IsValidEA( dwAddress )); - } - else - { - dwAddress = find_binary( inf.omin_ea, inf.omax_ea, strSig.c_str( ), 16, SEARCH_DOWN ); + dwAddress = find_binary(inf.omin_ea, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN); - if (IsValidEA( dwAddress )) - { - do - { -#ifdef __EA64__ - msg( "sig found at 1%X\n", dwAddress ); -#else - msg("sig found at %X\n", dwAddress); -#endif - dwAddress = find_binary( dwAddress + 1, inf.omax_ea, strSig.c_str( ), 16, SEARCH_DOWN ); - } while (IsValidEA( dwAddress )); - } - } + if (IsValidEA(dwAddress)) + { + do + { + msg("sig found at %llX\n", dwAddress); + dwAddress = find_binary(dwAddress + 1, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN); + } while (IsValidEA(dwAddress)); + } msg( pszMessage ); } diff --git a/SigMaker/SigMaker.vcxproj b/SigMaker/SigMaker.vcxproj index b1a26e1..5297377 100644 --- a/SigMaker/SigMaker.vcxproj +++ b/SigMaker/SigMaker.vcxproj @@ -22,7 +22,7 @@ {60916877-60AB-4565-93BC-2D6097976D86} Win32Proj SigMaker - 10.0.16299.0 + 10.0.17134.0 From 80df891be94bb2ded64bc2c45b4ccc8eb65298a0 Mon Sep 17 00:00:00 2001 From: gir489 Date: Thu, 14 Jun 2018 21:33:51 -0500 Subject: [PATCH 2/2] Removed extraneous includes from Includes.h. --- SigMaker/Includes.h | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/SigMaker/Includes.h b/SigMaker/Includes.h index 6ee374e..470d094 100644 --- a/SigMaker/Includes.h +++ b/SigMaker/Includes.h @@ -8,26 +8,9 @@ #pragma warning( push ) #pragma warning( disable : 4267 ) #pragma warning( disable : 4244 ) -#include -#include -#include -#include #include -#include -#include -#include -#include #include -#include -#include -#include -#include -#include -#include -#include #include // find_binary -#include -#include #include #pragma warning( pop )