push0ebp/sig-database

IDA FLIRT Signature Database

sig-database

IDA FLIRT Signature Database

Script

GitHub - push0ebp/ALLirt - https://github.com/push0ebp/ALLirt

Sig List

• Ubuntu libc6 OpenSSL

  • 4.10 (warty)
  • 5.04 (hoary)
  • 5.10 (breezy)
  • 6.06 (dapper)
  • 6.10 (edgy)
  • 7.04 (feisty)
  • 7.10 (gutsy)
  • 8.04 (hardy)
  • 8.10 (intrepid)
  • 9.04 (jaunty)
  • 9.10 (karmic)
  • 10.10 (maverick)
  • 11.04 (natty)
  • 11.10 (oneiric)
  • 12.04 (precise)
  • 12.10 (quantal)
  • 13.04 (raring)
  • 13.10 (saucy)
  • 14.04 (trusty)
  • 14.10 (utopic)
  • 15.04 (vivid)
  • 15.10 (wily)
  • 16.04 (xenial)
  • 16.10 (yakkety)
  • 17.04 (zesty)
  • 17.10 (artful)
  • 18.04 (bionic)
  • 18.10 (cosmic)

• Windows

  • VC12 - libcmt
  • OpenSSL
    • 0.9.8
    • 1.0.2

I used launchpad.net please suggest me mirrors.

Thank you @HexRabbit

sig-database's Issues

have ever faced “Couldn't find 'pelf.rtb' file” when use ./pelf

Hi, I use flair 6.3 to generate sig
but I faced a question
Couldn't find 'pelf.rtb' file

press enter to exit.

and i really have pelf.rtb in this folder
dumpsig libsndfile_elf.pat pcf pelf pelf.rtb plb pmacho pomf166 ppsx ptmobj sigmake zipsig

could you please do me a favor to send me your's flair ，thank you very much

Change a directory structure

{version} ({code name}) to just {version}
ex) 20.04 (focal) to 20.04

Question: generation script

Hi, do you use a script in order to download all the libc version from repositories and generate signatures or do it by hand? If you use a script can you post it, please? :)

Help libc6 2.27 error when using pelf

when I use pelf to make a sig (libc 2.27 latest), it caused error,

Fatal [/private/tmp/usr/lib/x86_64-linux-gnu/libc.a] (init-first.o): Unknown relocation type 42 (offset in section=0x3).

-r option not worked you know solution?, please write issue. and commit this repository

Unknown relocation type fix

Hey - I saw you had issues with generating certain .pat files.
To fix this you can add the "-rXX:0:0" flag to your command, where XX is the unknown relocation type number.

So if you were running ./pelf libc.a libc.pat and got the following error:

Fatal [libc.a] (init-first.o): Unknown relocation type 42 (section#=3, offset in section=0x1b9d000000000).

Your new command would be ./pelf libc.a -r42:0:0 libc.pat. You may have to do this several times before it works, but you can just add the same flag multiple times if so.

Hope this helps.

Add .exc

For someone wants to generate other sigs like no compressed sigs or other named sigs.

I can't use sig files in Ida Pro

I use Ida Pro 7.2 in Windows 10, I can't find sig files in Ida Pro "File->Load file -> FLIRT signature file..." after I copy the dir ubuntu & windows of the project to ida_path/sig/. Ida Pro can't find the sigs, how to solve this problem?

Add various and latest sigs

like libstdc++.
Recommend other libraries!

ㅎㅇ

ㅎㅇㅎㅇ

Find Linux package mirrors

Is there anyone who knows Linux package mirrors for automated downloads? like pkgs.org
I'm finding mirrors that have all versions of the packages the tool can retrieve.

can these be stored in a non-binary format?

i don't use IDA, but the tooling i use can make use of FLAIR-style signature dbs.
it looks like the ALLirt tool requires IDA to be installed in order to access the dbs.

suggestions?

thanks,
@