Long signatures

[lab313ru]

I have read readsig.txt, and have found that currently, signatures are 23 bytes long. Is it true?
If so, is it possible to create signatures that will be longer? And, why is 23? How much signatures are missed in DCC because of this (and because of collisions)?

[uxmal]

The DCCS file format hard-wires it to 23 bytes. Sprinkled in the DCC code you find:

#define  PATLEN 23

Goodness knows why the original authors chose that size; it's likely to avoid excessive file sizes on a project that may have been developed on an x86 MS-DOS environment.

You could try changing PATLEN to a larger number and then running makedsig on a *.LIB file, but the resulting signature file will be incompatible with older DCCS files.

[lab313ru]

What I want: Regenerate new libs, that will be with all functions, and almost without collisions. Then, I want apply them in IDA.

[uxmal]

You'll need access to the original LIB files from the various compilers to accomplish this, since only the first 23 bytes are available in the existing DCCS files.

[lab313ru]

I understand.

Another question: signature models:
dccb3c.sig
dccb3l.sig

"l" and "c" - what the difference?

[uxmal]

The naming convention used here is: dcc<v><n><m> where

• v is the vendor of the compiler library (b= Borland m= Microsoft)
• n is the version of the library
• m is the x86 memory/pointer model, where c is "compact", s is "small", m is "medium" and l is large. For more about the x86 memory models, see https://en.wikipedia.org/wiki/Intel_Memory_Model

[lab313ru]

Ok. There is some compiler lib-file. Which model will be selected and which criteria will be used when naming it? There is some lib-inner memory model?

[uxmal]

When generating the signatures using makedsig, the user herself has to know what vendor, version and model the LIB file was compiled with.

[lab313ru]

But makedsig only asks libname as parameter.

[uxmal]

If you look at makedsig.cpp, you'll find the usage:

"This program is to make 'signatures' of known c and tpl library calls for the dcc program.\n"
"It needs as the first arg the name of a library file, and as the second arg, the name "
"of the signature file to be generated.\n"
"Example: makedsig CL.LIB dccb3l.sig\n"
"      or makedsig turbo.tpl dcct4p.sig\n"

So it's the user's responsibility to provide a correct file name for the .sig file.

[lab313ru]

Ah, I see. dcc selects correct sig file. And I should provide correct file name.

[nemerle]

Exactly so.

AFAIK there is no identification information contained inside lib/tpl files.

[uxmal]

Reko will probably use a variant of this scheme, but the mapping of signature files may be happening in the configuration file to avoid dependencies on the naming of the signature files themselves.

[nemerle]

Yup, the format of signature files could be made a bit more robust:

{
    "Vendor": "Borland",
    "CompilerName" : "TurboC 3.0",
    "Language": "C",
    "Version": "3.0",
    "SignatureBlocks": [{
    "Model": "Large",
    "SigLength": 29,
    "Signatures": []
    }, {
    "Model": "Small",
    "SigLength": 23,
    "Signatures": []
    }]
}

and makedsig could be made to work with this to 'add'/'update' signatures inside this files

[lab313ru]

Makedsig asks me for "Seed:". What is it?

[lab313ru]

And second question: how to merge signatures from different lib fies?