Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Independent function signatures #2

Open
naim94a opened this issue Dec 18, 2020 · 2 comments
Open

Independent function signatures #2

naim94a opened this issue Dec 18, 2020 · 2 comments
Labels
enhancement New feature or request help wanted Extra attention is needed

Comments

@naim94a
Copy link
Owner

naim94a commented Dec 18, 2020

A bit more research is required to determine how IDA calculates function signatures. Calculating signatures independently would allow other tools (such as radare2, binary-ninja, Ghidra) to use the lumen server.

The signature is the md5 of the function's bytes and a bitmap of the same length.

Ideally, something like this:

fn calc_chksum(fn_bytes: &[u8]) -> [u8; 16] {
    let mut md5 = Md5::new();
    md5.update(fn_bytes);
    let bitmap = // work needed
    md5.update(&bitmap);
    md5.digest()
}
@naim94a naim94a added enhancement New feature or request help wanted Extra attention is needed labels Dec 18, 2020
@jesterret
Copy link

Hi, just letting You know, in case You're still working on it, it's actually hash of function bytes, but all function & variable adresses are nulled, so
call sub_... (E8 BA AD F0 0D) turns into call $+5 (E8 00 00 00 00)
mov eax, dword_... (B8 BA AD F0 0D) turns into mov eax, 0 (B8 00 00 00 00)
and the other part is nulled array, where any place that got cleared from original function bytes is replaced with 0xFF
Hope it's clear enough, and that it will be helpful ;)

@TheDuchy
Copy link

@naim94a please DM me on Twitter at DuchyRE and let's make radare2 compatible!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

3 participants