суббота, 4 мая 2013 г.


I wrote today some simple hack tool for creating signatures from delphi .dcu files for IDA flair
The main idea is very simple - flair expects .pat file to produce .sig file with signatures. So I just add some logic to my .dcu files loader to generate .pat files in right format
Supported Delphi versions:
  • Delphi 2007 (v12)
  • Delphi 2009 (v14)
  • Delphi 2010 (v15)
  • Delphi XE (v16)
  • Delphi XE2 (v17)
Download mirror
Sample of using:
Lets make signatures for delphi 2007 release run-time:

dcu2pat.exe I:\delphi.trash\2007\lib\*.dcu
wc -l .pat
  26959 .pat
\ida\flair\bin\sigmake.exe .pat d2007.sig
  : modules/leaves: 11149849/26655, COLLISIONS: 19389

After resolving of collisions (see flair\sigmake.txt for detail description):  
wc -l d2007.exc
  786 d2007.exc
\ida\flair\bin\sigmake.exe .pat d2007.sig
ls -l d2007.sig
  -rw-rw-rw-   1                    1250330 May 04 15:30 d2007.sig

3 комментария:

  1. i am interested in the delphi .dcu file format.could you tell me where to get these resources(or doc things)?or if you could send me the src of dcu2pat,that would be great! :) email:yufeng.zjj@gmail.com

  2. Could you please update this nice tool for Delphi XE4/XE5/XE6/XE7/XE8 and Delphi 10 ? Or give me some tips to do it myself? Thank you very much. My email:vincehsu.de@gmail.com

  3. no
    bcs a lot of work needed to add support for newer versions of Delphi