суббота, 4 мая 2013 г.

dcu2pat

I wrote today some simple hack tool for creating signatures from delphi .dcu files for IDA flair
The main idea is very simple - flair expects .pat file to produce .sig file with signatures. So I just add some logic to my .dcu files loader to generate .pat files in right format
Supported Delphi versions:
  • Delphi 2007 (v12)
  • Delphi 2009 (v14)
  • Delphi 2010 (v15)
  • Delphi XE (v16)
  • Delphi XE2 (v17)
Download
signatures for delphi 2007
.pat files
Sample of using:
Lets make signatures for delphi 2007 release run-time:

dcu2pat.exe I:\delphi.trash\2007\lib\*.dcu
wc -l .pat
  26959 .pat
\ida\flair\bin\sigmake.exe .pat d2007.sig
  : modules/leaves: 11149849/26655, COLLISIONS: 19389

After resolving of collisions (see flair\sigmake.txt for detail description):  
wc -l d2007.exc
  786 d2007.exc
\ida\flair\bin\sigmake.exe .pat d2007.sig
ls -l d2007.sig
  -rw-rw-rw-   1                    1250330 May 04 15:30 d2007.sig

9 комментариев:

  1. i am interested in the delphi .dcu file format.could you tell me where to get these resources(or doc things)?or if you could send me the src of dcu2pat,that would be great! :) email:yufeng.zjj@gmail.com

    ОтветитьУдалить
  2. Could you please update this nice tool for Delphi XE4/XE5/XE6/XE7/XE8 and Delphi 10 ? Or give me some tips to do it myself? Thank you very much. My email:vincehsu.de@gmail.com

    ОтветитьУдалить
  3. no
    bcs a lot of work needed to add support for newer versions of Delphi

    ОтветитьУдалить
  4. is a copy of dcu2pat still available? download links are down. if you could share any pat files it generated that would be awesome too

    ОтветитьУдалить
  5. if I right remember I gave up on xe4
    and even not sure that sources in some compilable form

    ОтветитьУдалить
  6. any old sig or pat files I could experiment with? would be interested in anything you could share.

    ОтветитьУдалить
  7. re-up old archive
    also add ready sigs for delphi 2007 and .pat files for 2007 and 2010

    ОтветитьУдалить
  8. random note that might be of interest. another dcu loader you might be able to join with your pat engine: https://github.com/crypto2011/KBBUILDER

    ОтветитьУдалить