Skip to content
This repository was archived by the owner on Sep 7, 2020. It is now read-only.

IDA .sig file format

Jump to bottom
mrexodia edited this page Mar 30, 2015 · 17 revisions

There is a published form of this format now available. A local copy can be found under util/rheax_dumpsig. Now that this format is available, pat2sig is now under implementation that will be followed by a working signature recognition engine.

Header

From uvudec/flirt/uvd_flirt_ignature_format.h:

 
struct UVD_IDA_sig_header_t
{
	char magic[6];
	uint8_t version;
	uint8_t processor;
	uint32_t file_types;
	uint16_t OS_types;
	uint16_t app_types;
	uint8_t feature_flags;
	uint8_t pad;
	uint16_t old_number_modules;
	uint16_t crc16;
	char ctype[0x22 - 0x16];
	uint8_t library_name_sz;
	uint16_t alt_ctype_crc;
	uint32_t n_modules;
}  __attribute__((__packed__));

magic: set to IDASGN
version: example was for 7. Indicates other versions may be supported with minor effort.
processor: enumeration. See code for values. 0 indicates x86
file_types: flags for .dll, exe, etc that we expect these to be in
app_types: what sort of applications use this (console, windowed, etc). Mostly a Windows thing I think
feature_flags: compressed, etc
pad: unknown field
old_number_modules:
crc16: probably crc16 of tree. For making sure file is intact
ctype: embedded string
library_name_sz: how long the library name string is
alt_ctype_crc: unknown meaning. Null terminated?
n_modules: how many functions there are in the coming tree.

Immediately after this is the library name string. It is not null terminated.

Tree

Next is the root node of the tree. Top level nodes are based around the leading pattern bytes. Next level nodes are based upon crc length and the crc. Finally, the last level nodes are based upon total function length.

General notes

  • Each .sig module may only reference one symbol, although the .pat file can have many
  • Compression is standard ZLIB. The deflated data starts immediately after the header.

Implementation specific notes

uvudec

  • Support is incomplete
  • TODO: figure out what the XXXX: YYYY style entries are
  • TODO: verify calculating crc correctly
  • TODO: let users resolve collisions instead of just inserting them anyway
  • TODO: implement and figure out how compression / decompression is done

IDA/FLAIR

Reference implementation of why this format exists in the first place. Implementation specific notes

  • A reference is included with the following conditions:
    • The module does not have any tailing bytes
    • There exists at least one reference
    • I’m guessing the first one is chosen, but I’ll need some evidence to support this
  • There does not seem to be any special treatment of local symbols
  • Collisions are reported into a .exc file. A .err file showing the tree structure may also be generated
    • Resolved by editing the .exc file

GoDup+ (OllyDbg plugin, closed source)

http://www.woodmann.com/forum/archive/index.php/t-8578.html
The first IDA independent program I’m aware of to be able to process (read) the .sig format. Free, closed source, buggy, and the author is nowhere to be found.

IDA_Sigs (OllyDbg plugin, open source unlicensed)

http://www.woodmann.com/forum/showthread.php?7517-IDA-signature-file-format
Uses dumpsig.exe to generate a form it can parse. On the bright side, it means it has full support for all IDA supported .sig formats. Link should include an attachment with binary + source code.

Clone this wiki locally