1

I have a mipsel executable (DvdPlayer from a RTD1283 firmware). I know that IDA is able to identify many functions. Then, I would like to generate a .sig file with signatures of these functions for use with other executable DVDPlayer (from other firmwares).

Would it be possible to convert the executable in a library ?

perror
  • 19,083
  • 29
  • 87
  • 150
usr100001
  • 11
  • 1
  • 2

3 Answers3

2

You can try the IDB_2_SIG plugin that generates signature files from the IDB itself.

One thing to note is that with gcc-built MIPS ELF files, many non-library symbols/function names (basically anything in a .o file) get entries in the dynamic symbol table and thus survive strip/sstrip as long as the binary is dynamically linked. So you probably won't need to generate signatures against this ELF in order to identify those same functions in similar ELF files from other DVDPlayer firmwares - they'll just be there and IDA will do its thing.

devttys0
  • 2,714
  • 13
  • 10
  • I'm using IDA 6.1 for windows on linux but I have no windows compiler. I searched for an IDB2Sig executable and found http://woodmann.com/collaborative/tools/index.php/Fast_IDB2Sig_and_LoadMap_IDA_plugins but no luck (bad .pat file).

    I have DVDPlayer executables in both formats, static and dynamically linked. The idea was to generate a .sig file with the dynamically linked version of DvdPlayer and use it to identify the same functions in the static DvdPlayer.

     – usr100001 Mar 06 '14 at 10:39
1

Yes, either use IDA's FLAIR tools or use one of the tools mentioned here: Tools to work cooperatively on the same binary

Community
  • 1
Jason Geffner
  • 20,681
  • 1
  • 36
  • 75
  • How? I can generate a .sig file from a library with: pelf library library.pat and sigmake library.pat library.sig, but if I try pelf with an executable then I get "non-relocatable elf module, skipped" message and .pat file is not created. – usr100001 Mar 05 '14 at 15:05
  • No, you can't generate a FLIRT signature out of a non relocatable ELF module as far as I remember. – joxeankoret Mar 05 '14 at 15:27
  • In that case, follow the link I posted above instead. – Jason Geffner Mar 05 '14 at 16:06
  • I think you misunderstood my problem. I work with SEVERAL executable FILES and I want to use the information I get from one in the other. Sorry for my bad english. – usr100001 Mar 06 '14 at 10:45
  • I understood your question. Most of the tools to which I linked (such as https://crowdre.crowdstrike.com/) support that scenario. – Jason Geffner Mar 06 '14 at 14:17
1

IIRC, you cannot generate a FLIRT signature from a non relocatable ELF binary. You may have better luck using BinDiff to export the function names and comments. If this is all you need it should be enough, I use it a lot for this very same purpose.

joxeankoret
  • 4,488
  • 2
  • 21
  • 35
  • Is it useful for files with many differences? I tried https://code.google.com/p/patchdiff2/ but only got results with similar files (dynamically linked with function names included in the executable). – usr100001 Mar 06 '14 at 16:10
  • BinDiff works with partially similar files. This is why this tool was wrote, I think. – joxeankoret Mar 07 '14 at 17:09