v1.11.0

sigmaker.py - IDA Python Standalone Python Release

Release Information

• Version: 1.11.0
• Source: https://github.com/mahmoudimus/ida-sigmaker
• Author: @mahmoudimus (Mahmoud Abdelkader)

What changed

Added

• Opt-in "Limit uniqueness and search to the containing segment". A new checkbox scopes both signature creation and the "Search for a signature" action to a single segment (the segment containing the anchor for creation, the segment under the cursor for search) instead of the whole database. This lets you sign functions that are duplicated across segments, for example a boot section and a main section, where no whole-database-unique signature exists, and then search for that signature within the same segment. Off by default, so existing behavior is unchanged. (#64, #67, #70)

Fixed

• Signature search reports the correct address across non-contiguous segments. The SIMD search mapped a match's buffer offset to min_ea + offset, which is wrong once segments are not contiguous: an extra binary loaded at a distant address such as 0x1F78000 was reported around 0x570000. Matches now map back to their real address through a recorded segment map. Making signatures was never affected (it uses the function address, not the scan buffer). (#68, #69)

Description

This is a standalone release of the IDA Pro signature maker plugin. The file sigmaker.py contains the complete plugin code that can be directly imported into IDA Pro.

Installation

1. Copy sigmaker.py to your IDA Pro plugins directory
2. Restart IDA Pro
3. Use Ctrl+Alt+S to access the Signature Maker menu

License

See the main repository for license information.