Page 1 of 1

Psy-Q flirt signatures

Posted: November 7th, 2018, 2:13 pm
by Squaresoft74
Hi,

Beside the ones from here, are there any other ones available somewhere for older/newer(?) versions ?

Thanks :)

Re: Psy-Q flirt signatures

Posted: November 30th, 2018, 12:30 pm
by lamb_of_senpai
I stumbled upon the REDasm disassembler project, which actually comes with PSY-Q 4.7 signatures (in its REDasm's own database format, however): https://github.com/REDasmOrg/REDasm

Seems to be in early phase, but a really promising project.

Re: Psy-Q flirt signatures

Posted: December 1st, 2018, 6:16 pm
by Squaresoft74
Thank you very much, i'll keep an eye on this project ! :)

Re: Psy-Q flirt signatures

Posted: December 2nd, 2018, 1:31 pm
by lamb_of_senpai
On this subject, I've actually been trying to get those signatures to work with radare2, but haven't had any luck. It looks like two of the .sig files are compressed in a way that r2 can't handle, and the others scan fine but won't convert to zignatures. Maybe this is because they're from a much older version of IDA?

Have you tried those with radare2? Or do you have a new version of IDA Pro that can save new versions of them?

Re: Psy-Q flirt signatures

Posted: December 6th, 2018, 3:13 pm
by lamb_of_senpai
I sorted this out, by the way. It's because they were compressed signatures, which r2 doesn't like. The IDA FLAIR utilities has a tool called "zipsig" to decompress .sig files, which makes them work.