3 ms·

No idea what signature scanning is, but found this resource for those curious: https://www.unknowncheats.me/forum/general-programming-and-reversing/171994-unde

• deleted 2y ago
  [deleted]
• c0balt 2y ago
  From my limited experience, it refers to the act of reverse engendering the function (signatures) contained the code of a binary. A binary, like the underlying code, has commonly used code split into functions that may get called in multiple places. These calls can be analyzed either through static analyzers or by a human, who may analyze context of the callsite to guess what each Arg is supposed to do/be. For modding, e. G. in a single player game, one might want to find out where the engine adjusts the health points of a player or updates progress.
• landr0id 2y ago
  Signature scanning is just scanning for unique bytes from a compiled function that will remain consistent across builds. You search memory for those bytes and when you find them, you find the function you're interested in. Here's an example from some shellcode loader I wrote: https://github.com/exploits-forsale/solstice/blob/c3fc9a55c6c6d84501bd2fdd2cc8704d7a4a9509/crates/solstice_loader/src/pelib.rs#L720-L722 https://github.com/exploits-forsale/solstice/blob/c3fc9a55c6...
  • Cyph0n 2y ago
    Thanks for explaining. How do you identify such byte patterns that are likely stable across builds? Is it experimental - i.e., look at a few versions of the binary and check if it has changed?
    • apple1417 2y ago
      You can actually usually get a pretty good starting point from just a single build, and only refine it once you find a build it breaks on. It's essentially just finding a unique substring. In my experience this almost always involves some wildcard sections, so the signature in the parent got lucky not to need them. I like to think about it as more of matching the shape of the original instructions than matching them verbatim. To manually construct a signature, you basically just take what the existing instructions encode to, and wildcard out the bits which are likely to change between builds. Then you'll see if it's still a unique match, and if not add a few more instructions on. This will be things like absolute addresses, larger pointer offsets, the length of relative jumps, and sometimes even what registers the instructions operate on. Here's an example of mine that needed all of those: "48 8B ?? ????????", // mov rcx, [rdi+000001D0] "48 85 C9", // test rcx, rcx "74 ??", // je Talos2-Win64-Shipping.exe+25EE729 "E8 ????????", // call Talos2-Win64-Shipping.exe+25E45F0 "48 63 ?? ????????", // movsxd rax, dword ptr [rbx+000005D0] "8D 70 FF" // lea esi, [rax-01] Now since making a signature is essentially just finding a unique substring, with a handful of extra rules for wildcards, you can also automate it. Here's a ghidra script (not my own) which I've found quite handy. https://github.com/nosoop/ghidra_scripts/blob/master/makesig.py https://github.com/nosoop/ghidra_scripts/blob/master/makesig...