dispsrch.txt 7.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221
  1. DISPSIG and SRCHSIG
  2. ===================
  3. 1 What are DispSig and SrchSig?
  4. 2 How do I use DispSig?
  5. 3 How do I use SrchSig?
  6. 4 What can I do with the binary pattern file from DispSig?
  7. 5 How can I create a binary pattern file for SrchSig?
  8. 1 What are DispSig and SrchSig?
  9. -------------------------------
  10. SrchSig is a program to display the name of a function, given a
  11. signature (pattern).
  12. DispSig is a program to display a signature, given a function name.
  13. Dispsig also writes the signature to a binary file, so you can
  14. disassemble it, or use it in Srchsig to see if some other signature
  15. file has the same pattern.
  16. 2 How do I use DispSig?
  17. -----------------------
  18. Just type
  19. DispSig <SignatureFileName> <FunctionName> <BinaryFileName>
  20. For example:
  21. dispsig dccb2s.sig strcmp strcmp.bin
  22. Function index 58
  23. 55 8B EC 56 57 8C D8 8E C0 FC 33 C0 8B D8 8B 7E 06 8B F7 32 C0 B9 F4
  24. This tells us that the function was the 59th function in the
  25. signature file (and that the signature above will hash to 58
  26. (decimal)). We can see that it is a standard C function, since it
  27. starts with "55 8B EC", which is the standard C function prologue.
  28. The rest of it is a bit hard to follow, but fortunately we have also
  29. written the pattern to a binary file, strcmp.bin. See section 4 on
  30. how to disassemble this pattern.
  31. If I type
  32. dispsig dcct4p.sig writeln wl.bin
  33. I get
  34. Function writeln not found!
  35. In fact, there is no one function that performs the writeln function;
  36. there are functions like WriteString, WriteInt, CrLf (Carriage
  37. return, linefeed), and so on. Dispsig is case insensitive, so:
  38. dispsig dcct4p.sig writestring wl.bin
  39. produces
  40. Function WriteString index 53
  41. 55 8B EC C4 7E 0C E8 F4 F4 75 25 C5 76 08 8B 4E 06 FC AC F4 F4 2B C8
  42. 3 How do I use SrchSig?
  43. -----------------------
  44. Just type
  45. srchsig <SignatureFileName> <BinaryFileName>
  46. dispsig dcct4p.sig writeln wl.bin
  47. where BinaryFileName contains a pattern. See section 5 for how to
  48. create one of these. For now, we can use the pattern file from the
  49. first example:
  50. srchsig dccb2s.sig strcmp.bin
  51. Pattern:
  52. 55 8B EC 56 57 8C D8 8E C0 FC 33 C0 8B D8 8B 7E 06 8B F7 32 C0 B9 F4
  53. Pattern hashed to 58 (0x3A), symbol strcmp
  54. Pattern matched
  55. Note that the pattern reported above need not be exactly the same as
  56. the one we provided in <BinaryFileName>. The pattern displayed is the
  57. wildcarded and chopped version of the pattern provided; it will have
  58. F4s (wildcards) and possibly zeroes at the end; see the file
  59. makedstp.txt for a simple explanation of wildcarding and chopping.
  60. If we type
  61. srchsig dccb2s.sig ws.bin
  62. we get
  63. Pattern:
  64. 55 8B EC C4 7E 0C E8 F4 F4 75 25 C5 76 08 8B 4E 06 FC AC F4 F4 2B C8
  65. Pattern hashed to 0 (0x0), symbol _IOERROR
  66. Pattern mismatch: found following pattern
  67. 55 8B EC 56 8B 76 04 0B F6 7C 14 83 FE 58 76 03 BE F4 F4 89 36 F4 F4
  68. 300
  69. The pattern often hashes to zero when the pattern is unknown, due to
  70. the sparse nature of the tables used in the hash function. The first
  71. pattern in dccb2s.sig happens to be _IOERROR, and its pattern is
  72. completely different, apart from the first three bytes. The "300" at
  73. the end is actually a running count of signatures searched linearly,
  74. in case there is a problem with the hash function.
  75. 4 What can I do with the binary pattern file from DispSig?
  76. ----------------------------------------------------------
  77. You can feed it into SrchSig; this might make sense if you wanted to
  78. know if, e.g. the signature for printf was the same for version 2 as
  79. it is for version 3. In this case, you would use DispSig on the
  80. version 2 signature file, and SrchSig on the version 3 file.
  81. You can also disassemble it, using debug (it comes with MS-DOS). For
  82. example
  83. debug strcmp.bin
  84. -u100 l 17
  85. 1754:0100 55 PUSH BP
  86. 1754:0101 8BEC MOV BP,SP
  87. 1754:0103 56 PUSH SI
  88. 1754:0104 57 PUSH DI
  89. 1754:0105 8CD8 MOV AX,DS
  90. 1754:0107 8EC0 MOV ES,AX
  91. 1754:0109 FC CLD
  92. 1754:010A 33C0 XOR AX,AX
  93. 1754:010C 8BD8 MOV BX,AX
  94. 1754:010E 8B7E06 MOV DI,[BP+06]
  95. 1754:0111 8BF7 MOV SI,DI
  96. 1754:0113 32C0 XOR AL,AL
  97. 1754:0115 B9F42B MOV CX,2BF4
  98. -q
  99. Note that the "2B" at the end is actually past the end of the
  100. signature. (Signatures are 23 bytes (17 in hex) long, so only
  101. addresses 100-116 are valid). Remember that most 16 bit operands will
  102. be "wildcarded", so don't believe the resultant addresses.
  103. 5 How can I create a binary pattern file for SrchSig?
  104. -----------------------------------------------------
  105. Again, you can use debug. Suppose you have found an interesing piece
  106. of code at address 05BE (this example comes from a hello world
  107. program):
  108. -u 5be
  109. 15FF:05BE 55 PUSH BP
  110. 15FF:05BF 8BEC MOV BP,SP
  111. 15FF:05C1 83EC08 SUB SP,+08
  112. 15FF:05C4 57 PUSH DI
  113. 15FF:05C5 56 PUSH SI
  114. 15FF:05C6 BE1E01 MOV SI,011E
  115. 15FF:05C9 8D4606 LEA AX,[BP+06]
  116. 15FF:05CC 8946FC MOV [BP-04],AX
  117. 15FF:05CF 56 PUSH SI
  118. 15FF:05D0 E8E901 CALL 07BC
  119. 15FF:05D3 83C402 ADD SP,+02
  120. 15FF:05D6 8BF8 MOV DI,AX
  121. 15FF:05D8 8D4606 LEA AX,[BP+06]
  122. 15FF:05DB 50 PUSH AX
  123. 15FF:05DC FF7604 PUSH [BP+04]
  124. -mcs:5be l 17 cs:100
  125. -u100 l 17
  126. 15FF:0100 55 PUSH BP
  127. 15FF:0101 8BEC MOV BP,SP
  128. 15FF:0103 83EC08 SUB SP,+08
  129. 15FF:0106 57 PUSH DI
  130. 15FF:0107 56 PUSH SI
  131. 15FF:0108 BE1E01 MOV SI,011E
  132. 15FF:010B 8D4606 LEA AX,[BP+06]
  133. 15FF:010E 8946FC MOV [BP-04],AX
  134. 15FF:0111 56 PUSH SI
  135. 15FF:0112 E8E901 CALL 02FE
  136. 15FF:0115 83C41F ADD SP,+1F
  137. -nfoo.bin
  138. -rcx
  139. CS 268A
  140. :17
  141. -w
  142. Writing 0017 bytes
  143. -q
  144. c>dir foo.bin
  145. foo.bin 23 3-25-94 12:04
  146. c>
  147. The binary file has to be exactly 23 bytes long; that's why we
  148. changed cx to the value 17 (hex 17 = decimal 23). If you are studying
  149. a large file (> 64K) remember to set bx to 0 as well. The m (block
  150. move) command moves the code of interest to cs:100, which is where
  151. debug will write the file from. The "rcx" changes the length of the
  152. save, and the "nfoo.bin" sets the name of the file to be saved. Now
  153. we can feed this into srchsig:
  154. srchsig dccb2s.sig foo.bin
  155. Pattern:
  156. 55 8B EC 83 EC 08 57 56 BE F4 F4 8D 46 06 89 46 FC 56 E8 F4 F4 83 C4
  157. Pattern hashed to 278 (0x116), symbol sleep
  158. Pattern mismatch: found following pattern
  159. 55 8B EC 83 EC 04 56 57 8D 46 FC 50 E8 F4 F4 59 80 7E FE 5A 76 05 BF
  160. 300
  161. Hmmm. Not a Borland C version 2 small model signature. Perhaps its a
  162. Microsoft Version 5 signature:
  163. Pattern:
  164. 55 8B EC 83 EC 08 57 56 BE F4 F4 8D 46 06 89 46 FC 56 E8 F4 F4 83 C4
  165. Pattern hashed to 31 (0x1F), symbol printf
  166. Pattern matched
  167. Yes, it was good old printf. Of course, no need for you to guess, DCC
  168. will figure out the vendor, version number, and model for you.