#1
|
|||
|
|||
openssl signature for ida
Hello,
i've just compiled openssl and now when i try to make a signature pcf yells: pcf libeay32.lib libeay32.pat Fatal [libeay32.lib] (LIBEAY32.dll): not a coff module press enter to exit. does anyone know how could i generate those signature files for ida? i already have the .sigs here that someone else generated but i'd like to know how to do it by myself. thanks in advace skyper |
#2
|
|||
|
|||
You will need FLAIR (Fast Library Acquisition for Identification and Recognition), there are all utilties you need to work with signatures (read readme).
|
#3
|
|||
|
|||
skyper, you took wrong lib for parsing. There are 2 types of them, static and dynamic.
You need static lib for parsing. The lib you took is just an dynamical "envelope". All funcs there just linked into libeay.dll so pcf utility doesn't work. Kinsky, how do you think he used pcf utility without having flair? btw 3.8 is too old, better use 4.6 instead. Last edited by cr0aker; 05-03-2004 at 18:51. |
#4
|
||||
|
||||
IDA 4.6!!!
Humm, I found only the free demo version of IDA 4.6, which is limited to VisualC++ compiled programs and no more. The newest Pro version around is the 4.5.xx Did I miss something? A pointer to 4.6 Pro or Full or not demo is appreciated!
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪) There are only 10 types of people in the world: Those who understand binary, and those who don't http://www.accessroot.com |
#5
|
|||
|
|||
I was talking about flair v4.6, not IDA. Sorry but IDA 4.6 is not accessible for free distribution.
|
#6
|
|||
|
|||
Flair 4.6
is it possible for anyone to share flair 4.6 ??
|
#7
|
||||
|
||||
what a pity! A remedy?
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪) There are only 10 types of people in the world: Those who understand binary, and those who don't http://www.accessroot.com |
#8
|
|||
|
|||
Signatures for OpenSSL:
http://wasm.ru/tools/11/sigs.zip Flair 4.6 is attached. |
#9
|
|||
|
|||
thanx volodya
|
#10
|
|||
|
|||
Any chance of updated links? O.O
|
#11
|
|||
|
|||
OpenSSL is distributed as source code, which means any compiler and any optimization setting will produce a different library, making signatures nearly impossible if you don't know which compiler and settings where used.
If you're looking for FLAIR you will find many links here on the forum from the RDW release. |
The Following User Gave Reputation+1 to Kerlingen For This Useful Post: | ||
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Creating IDA sig files for openssl fips v1.1.2 | melatonin | General Discussion | 0 | 01-04-2008 21:11 |