APISignature v0.2.0

I'm reconstructing rather than diffing.

APISignature 0.2.0

⚠️ Upgrading from 0.1.0 — replace both files

The index format changed (schema v3). A 0.1.0 plugin will refuse a 0.2.0 index
and log index schema v3, but this build expects v2, leaving the panel blank.
Copy both APISignature.dp64/.dp32 and apisignature.db.

New: capa API combinations

Every API now shows the known malicious combinations it takes part in, sourced
from capa-rules — the members you
already have highlighted against the ones you don't, with ATT&CK IDs.

New: Capabilities button

Answers the same question for the whole target. It scans the imports of every
loaded module and matches them against capa's rules. Press it again after a
sample unpacks and anything gained since is marked NEW — the module-wide
rescan is what makes a second press meaningful.

Results default to the API-only confidence tier, and the panel states how many
rules it could evaluate and how many it could not. A short list can mean "this
sample does little" or "most of what capa checks is invisible from an import
table", and those are opposite conclusions.

New: real search, and clickable results

• A search bar and Search button in the panel; Ctrl+Shift+A focuses it
• Results are clickable — previously search results could not be opened
• API names inside a combination are links, so you can walk a chain without
  touching the disassembly
• Typing an exact API name jumps straight to its entry

Changed: the panel is split into three labelled sections

Malicious use (malapi.io), then Documentation (Microsoft, CC BY 4.0),
then API combinations (capa-rules). Each names its source, because the three
make very different kinds of claim and merged prose loses track of which is which.

Also in the repo

mcp_server/ exposes the same index to an AI assistant over MCP — seven tools
covering lookup, search, capa combinations and import-set analysis. Not part of
this download; clone the repo to use it.

Quick Start

Copy APISignature.dp64 and apisignature.db into <x64dbg>\release\x64\plugins\
Copy APISignature.dp32 and apisignature.db into <x32dbg>\release\x32\plugins\

apisignature.db is the prebuilt index. install.ps1 places it beside the plugin, which is where the plugin looks for it.

APISignature-0.1.0

APISignature 0.1.0

Option 1:

Install:

1. Close x64dbg (in case it's open).
2. Right-click install.ps1 -> Run with PowerShell

or from a PowerShell prompt in this directory:

.\install.ps1

If x64dbg is not found automatically:

.\install.ps1 -X64dbgRoot "C:\path\to\x64dbg"

Option 2:

Manual install:

Copy APISignature.dp64 and apisignature.db into <x64dbg>\release\x64\plugins\
Copy APISignature.dp32 and apisignature.db into <x64dbg>\release\x32\plugins\

apisignature.db is the prebuilt index. install.ps1 places it beside the plugin, which is where the plugin looks for it.

Requires an x64dbg from 2025-06-30 or newer.