Raised This Month: $51 Target: $400
 12% 

How to identify signatures from unique ones?


Post New Thread Reply   
 
Thread Tools Display Modes
Author Message
cravenge
Veteran Member
Join Date: Nov 2015
Location: Chocolate Factory
Old 12-04-2016 , 03:34   How to identify signatures from unique ones?
Reply With Quote #1

So far, I've been studying IDA and its functionalities and I'm learning bit by bit but I'm getting confused by one thing: How can I tell if a signature I'm looking for is unique or not?
cravenge is offline
backwards
AlliedModders Donor
Join Date: Feb 2014
Location: USA
Old 12-04-2016 , 07:31   Re: How to identify signatures from unique ones?
Reply With Quote #2

You can write a c++ program that scans for the signature in question via ReadProcessMemory or by injecting into the process. Just start the signature scan at the base address of the dll/binary you are looking for the signature in. Then you can use GetModuleHandle("binaryname.dll") - (0xAddressInIDA - 0x10000000 or the base address in IDA). Now you take that return value and add it to 0xIDABaseAddress and if it hits the same exact memory address you are looking for then you know. There are many public pattern scan source codes on the net.

Alternatively you can just download SigMaker by Patrick (or the updated version released on some cheat websites) and run that in IDA, it will automatically find the shortest unique signature for the function you have selected.
__________________
I highly recommend joining the SourceMod Discord Server for real time support.
backwards is offline
psychonic

BAFFLED
Join Date: May 2008
Old 12-04-2016 , 08:36   Re: How to identify signatures from unique ones?
Reply With Quote #3

IDA has a binary search function. You don't need a separate program to see if a signature is unique. Just run the search and confirm that there's exactly one result.
psychonic is offline
Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -4. The time now is 09:38.


Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Theme made by Freecode