Page 1 of 1
Psy-Q flirt signatures
Posted: November 7th, 2018, 2:13 pm
by Squaresoft74
Hi,
Beside the ones
from here, are there any other ones available somewhere for older/newer(?) versions ?
Thanks
Re: Psy-Q flirt signatures
Posted: November 30th, 2018, 12:30 pm
by lamb_of_senpai
I stumbled upon the REDasm disassembler project, which actually comes with PSY-Q 4.7 signatures (in its REDasm's own database format, however):
https://github.com/REDasmOrg/REDasm
Seems to be in early phase, but a really promising project.
Re: Psy-Q flirt signatures
Posted: December 1st, 2018, 6:16 pm
by Squaresoft74
Thank you very much, i'll keep an eye on this project !
Re: Psy-Q flirt signatures
Posted: December 2nd, 2018, 1:31 pm
by lamb_of_senpai
On this subject, I've actually been trying to get those signatures to work with radare2, but haven't had any luck. It looks like two of the .sig files are compressed in a way that r2 can't handle, and the others scan fine but won't convert to zignatures. Maybe this is because they're from a much older version of IDA?
Have you tried those with radare2? Or do you have a new version of IDA Pro that can save new versions of them?
Re: Psy-Q flirt signatures
Posted: December 6th, 2018, 3:13 pm
by lamb_of_senpai
I sorted this out, by the way. It's because they were compressed signatures, which r2 doesn't like. The IDA FLAIR utilities has a tool called "zipsig" to decompress .sig files, which makes them work.