0 functions applied in IDA from .sig file #107
Comments
|
After digging into this more, I found out that the first line that causes this problem with 0 functions applied is the line #31605(in the If I make a sig with first 31605 lines, it applies 0 functions. If I make a sig with 31604 lines, it applies a few tenths of thousands functions. I disabled word wrap and compared lines 31604 and 31605 visually in Notepad++: I noticed that the name of 31604 line ends much sooner than the name on the line 31605: After I shortened line 31605 to this:
It applies the signatures as expected! Yay! Now I guess it's either the name length or some combinations of characters in the name causing sigmake to generate invalid .sig file. Or long/invalid name causing IDA to not to apply this .sig file onto executable for some reason. For right now I think I'll be able to search for long 6th members in the strings with regular expressions in Notepad++ and shorten their names when they're too long. I guess I could try to find where idb2pat generates these names and just trim them up to like 125 characters or something and hope it's name length and not combination of characters. I hope this will help you to fix this bug, wherever it is(in idb2pat, sigmake or IDA itself). |
thank you! yes, in the short term, i'll update idb2pat to ensure the symbol names are not too long. i'll also try to reproduce the sigmake issue and report a bug to hex-rays if appropriate. i'll update here with what i hear. thanks for taking the time to dig into the bug and suggest a fix, it really helps. |
|
Looks like somewhere there's a cap to 1000 characters for the function name, or close to that. After I do search and replace on the file using this It removes whole lines where 6th member is longer than 1010 characters. It does 41 replaces. It applies all the functions that are left. But if I do replace with It does look like a name length problem. From 170k lines there would be shorter lines like 800 characters long with problematic character sequences. |
|
i bet there's a hardcoded limitation in sigmake of the symbol being 0x200 (1024) characters long, or less. i ran into a similar issue that sigmake would not process more than 0x2000 leaves, but this could be bypassed by patching sigmake ;-) in this case, i think we should restrict the length of symbols generated by idb2pat. |
|
Yea! I'm having the same problem here, it works in home tests (like hello-world), but in large projects the same problem occurs. 0 applied functions. |
|
Hi @williballenthin |
|
Unfortunately, we cannot share the patched |
|
in 7.6 the too many leaves cmp is at 0x140009ECC |
|
also one of the things which can cause bad xdigit is lines like you can see the issue by comparing it to this line basicly 1A798 is 5 digits instead of 4 digits |
|
A way to find such lines is using the regex of it checks for sequences like |
Pretty sure it's not me doing something wrong(and creating all those issues I mean). Works on a simple VC++ Hello World project as expected and explained in the articles(One, Two):
On the other hand, in a big UE4 project 0 functions get applied in IDA from .sig file after generating the .sig file with sigmake from idb2pat:
I generate the .sig file using command
sigmake -lrsub_ "S05_TestingGrounds-Win64-Shipping - No Xdigit errors(deleted lines with errors).pat" "S05_TestingGrounds-Win64-Shipping - No Xdigit errors(deleted lines with errors).sig".-lrsub_parameter is to exclude functions that havesub_in them.After generating the .sig file and then trying to apply the .sig file, that's what I get: 0 functions applied.
Here's the link with the project, pat and sig file, so you can try to generate and apply this sig file onto executable yourself:
https://www.dropbox.com/h?preview=TestingGrounds_DebugSymbols.zip
This is a Unreal Engine 4.26 C++ project created from FPS template which I packaged in UE4 with debug symbols.
The executable, pat and .sig files are in
\WindowsNoEditor\S05_TestingGrounds\Binaries\Win64\folder. The original pat file with xdigit problem is calledS05_TestingGrounds-Win64-Shipping - Original.pat. The pat file with problematic lines deleted which cause xdigit problem is calledS05_TestingGrounds-Win64-Shipping - No Xdigit errors(deleted lines with errors).pat.Problem for 0 functions applied is somewhere between lines 30000 and 35000 in the .pat file because if I delete all lines after line 30000, it generates valid .sig file and then applies this sig file appropriately on the executable:
After I delete lines 30000 - 35000 in the pat file and then delete all the lines after 50000, it generates valid .sig files and applies the sig file appropriately on the executable:
As you can see on the screenshots, no meaningful logs is generated after applying new FLIRT signature in IDA, just
Plan FLIRT signature: Unnamed sample libraryin the case of success and failure to apply any function signatures.The text was updated successfully, but these errors were encountered: