'How to convert a signature from IDA style to code style in C?
Essentially I have a function which takes in a signature like "0F 2F 05 D8 20 ?? 03 72 41" and converts it to the signature like "\x0F\x2F\x05\xD8\x20\x90\x03\x72\x41" where wild card bytes ?? get converted to nop. Also it creates a mask where every non wild card byte gets represented as x. In this case it is xxxxx?xxx.
I tried to create such a function but I struggle to convert spaces to \x.
void idastyle_to_codestyle(const char* pattern, char* codestyle_pattern, char* mask) {
int patternLength = (int)strlen(pattern);
int j = 0, k = 0;
for (int i = 0; i < patternLength; i++) {
if (pattern[i] == ' ') {
codestyle_pattern[j] = '\x';
mask[k] = 'x';
j++; k++;
}
else if (pattern[i] == '?') {
codestyle_pattern[j] = '9';
codestyle_pattern[j + 1] = '0';
mask[k] = '?';
j += 2; k++;
}
else {
codestyle_pattern[j] = pattern[i];
j++;
}
}
}
int main() {
char* codestyle_pattern, char* mask;
idastyle_to_codestyle("0F 2F 05 D8 20 ?? 03 72 41", codestyle_pattern, mask);
return 0;
}
The algorithm is completely wrong but it doesnt matter as the compiler gives an error at codestyle_pattern[j] = '\x';. This function has char* codestyle_pattern and char* mask as outputs.
Solution 1:[1]
I found a solution. It doesn't validate signatures because it is a waste of time.
int hex2int(char ch)
{
if (ch >= '0' && ch <= '9')
return ch - '0';
if (ch >= 'A' && ch <= 'F')
return ch - 'A' + 10;
if (ch >= 'a' && ch <= 'f')
return ch - 'a' + 10;
return -1;
}
void idastyle_to_codestyle(const char* pattern, char* codestylePattern, char* mask)
{
int patternLength = (int)strlen(pattern);
int i = 0; int j = 0;
while (i < patternLength) {
if (pattern[i] == '?') {
if (pattern[i + 1] == '?') {
codestylePattern[j] = '\x90';
mask[j] = '?';
i += 3; j++;
}
}
else {
int firstDigit = hex2int(pattern[i]);
int secondDigit = hex2int(pattern[i + 1]);
codestylePattern[j] = (char)(firstDigit * 0x10 + secondDigit);
mask[j] = 'x';
i += 3; j++;
}
}
}
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Nicolay |
