Merge pull request #10 from gir489/master

Refactored SearchForSigs to use omin_ea
This commit is contained in:
Aidan Khoury
2018-06-15 00:10:06 -03:00
committed by GitHub
5 changed files with 44 additions and 79 deletions

View File

@@ -1,14 +1,25 @@
# SigMaker-x64 # SigMaker-x64
IDA SigMaker Plugin updated for the IDA Pro 7.0 SDK. IDA SigMaker Plugin updated for the IDA Pro 7.0 SDK by [dude719](https://github.com/dude719).
PLEASE NOTE: IDA Freeware 7.0 is NOT supported.
PLEASE NOTE: IDA Freeware 7.0 is **NOT** supported.
Originally made by P4TR!CK Originally made by P4TR!CK
Credits also go to bobbysing and xero|hawk Credits also go to bobbysing and [xero|hawk](https://github.com/XeroHawk)
Thanks to gir489 for the contributions Thanks to [gir489](https://github.com/gir489) for the contributions
RIP GameDeception RIP GameDeception
# Installation
Visual Studio will expect the environment variable IDADIR to resolve to your IDA 7.0 installation directory.
Visual Studio will also expect the SDK to be located at %IDADIR%\idasdk. Make sure these folders resolve in Windows properly before attempting to build the project.
# Running the build
Because IDA no longer has a native 32-bit compiled version anymore, the Release/Debug is the build script for the 32-bit version of IDA and Release64/Debug64 is the build script for the 64-bit version.
**Do not change the target platform from x64!**

View File

@@ -165,7 +165,7 @@ void IDAToCRC( const qstring& strSig, ea_t& dwCRC32, ea_t& dwMask )
{ {
if (i <= iCount && szMask[i] == 'x') if (i <= iCount && szMask[i] == 'x')
{ {
dwMask |= (1 << i); dwMask |= (1i64 << i);
} }
else else
{ {
@@ -186,7 +186,7 @@ void CodeToCRC( const qstring& strByteSig, const qstring& strMask, ea_t& dwCRC32
{ {
if (i <= iCount && szMask[i] == 'x') if (i <= iCount && szMask[i] == 'x')
{ {
dwMask |= 1 << i; dwMask |= 1i64 << i;
} }
else else
{ {

View File

@@ -5,27 +5,14 @@
#define __NT__ 1 #define __NT__ 1
#define __X64__ 1 #define __X64__ 1
#include <ida.hpp> #pragma warning( push )
#include <idp.hpp> #pragma warning( disable : 4267 )
#include <enum.hpp> #pragma warning( disable : 4244 )
#include <frame.hpp>
#include <expr.hpp> #include <expr.hpp>
#include <name.hpp>
#include <segment.hpp>
#include <bytes.hpp>
#include <struct.hpp>
#include <loader.hpp> #include <loader.hpp>
#include <kernwin.hpp>
#include <auto.hpp>
#include <entry.hpp>
#include <bytes.hpp>
#include <typeinf.hpp>
#include <demangle.hpp>
#include <allins.hpp>
#include <search.hpp> // find_binary #include <search.hpp> // find_binary
#include <ua.hpp>
#include <fpro.h>
#include <diskio.hpp> #include <diskio.hpp>
#pragma warning( pop )
#pragma comment(lib, "ida.lib") #pragma comment(lib, "ida.lib")
#pragma comment(lib, "pro.lib") #pragma comment(lib, "pro.lib")

View File

@@ -14,19 +14,6 @@ int GetOccurenceCount( const qstring& strSig, bool bSkipOut = false )
int iCount = 0; int iCount = 0;
ea_t dwAddress = find_binary( inf.min_ea, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN ); ea_t dwAddress = find_binary( inf.min_ea, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN );
if (IsValidEA( dwAddress ))
{
do
{
if (bSkipOut == true && iCount >= 2)
return iCount;
iCount++;
dwAddress = find_binary( dwAddress + 1, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN );
} while (IsValidEA( dwAddress ));
}
else
{
dwAddress = find_binary(inf.omin_ea, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN); dwAddress = find_binary(inf.omin_ea, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN);
if (IsValidEA(dwAddress)) if (IsValidEA(dwAddress))
{ {
@@ -38,48 +25,28 @@ int GetOccurenceCount( const qstring& strSig, bool bSkipOut = false )
dwAddress = find_binary(dwAddress + 1, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN); dwAddress = find_binary(dwAddress + 1, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN);
} while (IsValidEA(dwAddress)); } while (IsValidEA(dwAddress));
} }
}
return iCount; return iCount;
} }
void SearchForSigs( const qstring& strSig ) void SearchForSigs( const qstring& strSig )
{ {
ea_t dwAddress = find_binary( inf.min_ea, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN ); ea_t dwAddress = find_binary( inf.omin_ea, inf.omax_ea, strSig.c_str( ), 16, SEARCH_DOWN );
const char* pszMessage = "===========================\n"; const char* pszMessage = "===========================\n";
msg( pszMessage ); msg( pszMessage );
if (IsValidEA( dwAddress ))
{
do
{
#ifdef __EA64__
msg("sig found at 1%X\n", dwAddress);
#else
msg("sig found at %X\n", dwAddress);
#endif
dwAddress = find_binary( dwAddress + 1, inf.max_ea, strSig.c_str( ), 16, SEARCH_DOWN );
} while (IsValidEA( dwAddress ));
}
else
{
dwAddress = find_binary(inf.omin_ea, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN); dwAddress = find_binary(inf.omin_ea, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN);
if (IsValidEA(dwAddress)) if (IsValidEA(dwAddress))
{ {
do do
{ {
#ifdef __EA64__ msg("sig found at %llX\n", dwAddress);
msg( "sig found at 1%X\n", dwAddress );
#else
msg("sig found at %X\n", dwAddress);
#endif
dwAddress = find_binary(dwAddress + 1, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN); dwAddress = find_binary(dwAddress + 1, inf.omax_ea, strSig.c_str(), 16, SEARCH_DOWN);
} while (IsValidEA(dwAddress)); } while (IsValidEA(dwAddress));
} }
}
msg( pszMessage ); msg( pszMessage );
} }

View File

@@ -22,7 +22,7 @@
<ProjectGuid>{60916877-60AB-4565-93BC-2D6097976D86}</ProjectGuid> <ProjectGuid>{60916877-60AB-4565-93BC-2D6097976D86}</ProjectGuid>
<Keyword>Win32Proj</Keyword> <Keyword>Win32Proj</Keyword>
<RootNamespace>SigMaker</RootNamespace> <RootNamespace>SigMaker</RootNamespace>
<WindowsTargetPlatformVersion>10.0.16299.0</WindowsTargetPlatformVersion> <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
</PropertyGroup> </PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">