Psy-Q flirt signatures

Post by **Squaresoft74** » November 7th, 2018, 2:13 pm

Hi,

Beside the ones from here, are there any other ones available somewhere for older/newer(?) versions ?

Thanks

Post by **lamb_of_senpai** » November 30th, 2018, 12:30 pm

I stumbled upon the REDasm disassembler project, which actually comes with PSY-Q 4.7 signatures (in its REDasm's own database format, however): https://github.com/REDasmOrg/REDasm

Seems to be in early phase, but a really promising project.

Post by **Squaresoft74** » December 1st, 2018, 6:16 pm

Thank you very much, i'll keep an eye on this project !

Post by **lamb_of_senpai** » December 2nd, 2018, 1:31 pm

On this subject, I've actually been trying to get those signatures to work with radare2, but haven't had any luck. It looks like two of the .sig files are compressed in a way that r2 can't handle, and the others scan fine but won't convert to zignatures. Maybe this is because they're from a much older version of IDA?

Have you tried those with radare2? Or do you have a new version of IDA Pro that can save new versions of them?

Post by **lamb_of_senpai** » December 6th, 2018, 3:13 pm

I sorted this out, by the way. It's because they were compressed signatures, which r2 doesn't like. The IDA FLAIR utilities has a tool called "zipsig" to decompress .sig files, which makes them work.