openssl signature for ida
 

Hello,

i've just compiled openssl and now when i try to make a signature pcf yells:

pcf libeay32.lib libeay32.pat
Fatal [libeay32.lib] (LIBEAY32.dll): not a coff module
press enter to exit.

does anyone know how could i generate those signature files for ida? i already have the .sigs here that someone else generated but i'd like to know how to do it by myself.

thanks in advace
skyper

You will need FLAIR (Fast Library Acquisition for Identification and Recognition), there are all utilties you need to work with signatures (read readme).

skyper, you took wrong lib for parsing. There are 2 types of them, static and dynamic.

You need static lib for parsing. The lib you took is just an dynamical "envelope". All funcs there just linked into libeay.dll so pcf utility doesn't work.

Kinsky, how do you think he used pcf utility without having flair? ;) btw 3.8 is too old, better use 4.6 instead.

IDA 4.6!!!

Humm,

I found only the free demo version of IDA 4.6, which is limited to VisualC++ compiled programs and no more.

The newest Pro version around is the 4.5.xx

Did I miss something? :rolleyes:

A pointer to 4.6 Pro or Full or not demo is appreciated! :D :D

I was talking about flair v4.6, not IDA. :) Sorry but IDA 4.6 is not accessible for free distribution.

Flair 4.6
 

is it possible for anyone to share flair 4.6 ??

what a pity! A remedy? :rolleyes: :p

Signatures for OpenSSL:

http://wasm.ru/tools/11/sigs.zip

Flair 4.6 is attached.

thanx volodya

Any chance of updated links? O.O

OpenSSL is distributed as source code, which means any compiler and any optimization setting will produce a different library, making signatures nearly impossible if you don't know which compiler and settings where used.

If you're looking for FLAIR you will find many links here on the forum from the RDW release.