суббота, 4 мая 2013 г.


I wrote today some simple hack tool for creating signatures from delphi .dcu files for IDA flair
The main idea is very simple - flair expects .pat file to produce .sig file with signatures. So I just add some logic to my .dcu files loader to generate .pat files in right format
Supported Delphi versions:
  • Delphi 2007 (v12)
  • Delphi 2009 (v14)
  • Delphi 2010 (v15)
  • Delphi XE (v16)
  • Delphi XE2 (v17)
signatures for delphi 2007
.pat files
Sample of using:
Lets make signatures for delphi 2007 release run-time:

dcu2pat.exe I:\delphi.trash\2007\lib\*.dcu
wc -l .pat
  26959 .pat
\ida\flair\bin\sigmake.exe .pat d2007.sig
  : modules/leaves: 11149849/26655, COLLISIONS: 19389

After resolving of collisions (see flair\sigmake.txt for detail description):  
wc -l d2007.exc
  786 d2007.exc
\ida\flair\bin\sigmake.exe .pat d2007.sig
ls -l d2007.sig
  -rw-rw-rw-   1                    1250330 May 04 15:30 d2007.sig

9 комментариев:

  1. i am interested in the delphi .dcu file format.could you tell me where to get these resources(or doc things)?or if you could send me the src of dcu2pat,that would be great! :) email:yufeng.zjj@gmail.com

  2. Could you please update this nice tool for Delphi XE4/XE5/XE6/XE7/XE8 and Delphi 10 ? Or give me some tips to do it myself? Thank you very much. My email:vincehsu.de@gmail.com

  3. no
    bcs a lot of work needed to add support for newer versions of Delphi

  4. is a copy of dcu2pat still available? download links are down. if you could share any pat files it generated that would be awesome too

  5. if I right remember I gave up on xe4
    and even not sure that sources in some compilable form

  6. any old sig or pat files I could experiment with? would be interested in anything you could share.

  7. re-up old archive
    also add ready sigs for delphi 2007 and .pat files for 2007 and 2010

  8. random note that might be of interest. another dcu loader you might be able to join with your pat engine: https://github.com/crypto2011/KBBUILDER