makedsig.txt 6.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188
  1. MAKEDSIG
  2. 1 What is MakeDsig?
  3. 2 How does it work?
  4. 3 How do I use MakeDsig?
  5. 4 What's in a signature file?
  6. 5 What other tools are useful for signature work?
  7. 1 What is MakeDsig?
  8. -------------------
  9. MakeDsig is a program that reads a library (.lib) file from a
  10. compiler, and generates a signature file for use by DCC. Without
  11. signature files, dcc cannot recognise library functions, and so will
  12. attempt to decompile them, and cannot name them. This makes the
  13. resultant decompiled code bulkier and difficult to understand.
  14. 2 How does it work?
  15. -------------------
  16. Library files contain complete functions, relocation information,
  17. function names, and more. MakeDsig reads a library file, and for each
  18. function found, it saves the name, and creates a signature. These
  19. are stored in an array. When all functions are done, tables for the
  20. perfect hashing function are generated. During this process,
  21. duplicate keys (functions that produce identical signatures) may be
  22. detected; if so, one of the keys will be zeroed.
  23. The signature file contains information needed by dcc to hash the
  24. signatures, as well as the symbols and signatures. Dcc reads the various
  25. sections of the signature file to be able to hash signatures. The
  26. signatures, not the symbols, are hashed, since dcc gets a signature
  27. from the executable file, and needs to know quickly if there is a
  28. symbolic name for it.
  29. 3 How do I use MakeDsig?
  30. ------------------------
  31. You can always find out by just executing it with no arguments, or
  32. MakeDsig -h for more details.
  33. Basically, you just give it the names of the files that it needs:
  34. MakeDsig <libname> <signame>
  35. It will ask you for a seed; enter any number, e.g. 1.
  36. You need the library file for the appropriate compiler. For example,
  37. to analyse executable programs created from Turbo C 2.1 small model,
  38. you need the cs.lib file that comes with that compiler.
  39. You also need to know the correct name for the signature file, i.e.
  40. <signame>. Dcc will detect certain compiler vendors and version
  41. numbers, and will look for a signature file named like this:
  42. d c c <vendor> <version> <model> . s i g
  43. Here are the current vendors:
  44. Vendor Vendor letter
  45. Microsoft C/C++ m
  46. Borland C/C++ b
  47. Logitech (Modula) l
  48. Turbo Pascal t
  49. Here are the model codes:
  50. small/tiny s
  51. medium m
  52. compact c
  53. large l
  54. Turbo Pascal p
  55. The version codes are fairly self explanatory:
  56. Microsoft C 5.1 5
  57. Microsoft C 8 8
  58. Borland C 2.0 2
  59. Borland C 3.0 3
  60. Turbo Pascal 3.0 3 Note: currently no way to make dcct3p.sig
  61. Turbo Pascal 4.0 4 Use Makedstp, not makedsig
  62. Turbo Pascal 5.0 5 Use Makedstp, not makedsig
  63. Some examples: the signature file for Borland C version 2.0, small
  64. model, would be dccb2s.sig. To generate it, you would supply as the
  65. library file cs.lib that came with that compiler. Suppose it was in
  66. the \bc\lib directory. To generate the signature file required to
  67. work with files produced by this compiler, you would type
  68. makedsig \bc\lib\cs.lib dccb2s.sig
  69. This will create dccb2s.sig in the current directory. For dcc to use
  70. this file, place it in the same directory as dcc itself, or point the
  71. environment variable DCC to the directory containing it.
  72. Another example: to make the signature file for Microsoft Visual
  73. C/C++ (C 8.0), large model, and assuming the libraries are in
  74. the directory \msvc\lib, you would type
  75. makedsig \msvc\lib\llibce.lib dccm8l.sig
  76. Note that the signature files for Turbo Pascal from version 4 onwards
  77. are generated by makedstp, not makedsig. The latter program reads a
  78. special file called turbo.tpl, as there are no normal .lib files for
  79. turbo pascal. Dcc will recognise turbo pascal 3.0 files, and look
  80. for dcct3p.sig. Because all the library routines are contained in
  81. every Turbo Pascal executable, there are no library files or even a
  82. turbo.tpl file, so the signature file would have to be constructed by
  83. guesswork. You can still use dcc on these files; just ignore the
  84. warning about not finding the signature file.
  85. For executables that dcc does not recognise, it will look for the
  86. signature file dccxxx.sig. That way, if you have a new compiler, you
  87. can at least have dcc detect library calls, even if it attempts to
  88. decompile them all, and has not identified the main program.
  89. Logitech Modula V1.0 files are recognised, and the signature file
  90. dccl1x.sig is looked for. This was experimental in nature, and is not
  91. recommended for serious analysis at this stage.
  92. 4 What's in a signature file?
  93. -----------------------------
  94. The details of a signature file are best documented in the source for
  95. makedsig; see the function saveFile(). Briefly:
  96. 1) a 4 byte pattern identifying the file as a signature file: "dccs".
  97. 2) a two byte integer containing the number of keys (signatures)
  98. 3) a two byte integer containing the number of vertices on the graph
  99. used to generate the hash table. See the source code and/or the
  100. Czech, Havas and Majewski articles for details
  101. 4) a two byte integer containing the pattern length
  102. 5) a two byte integer containing the symbolic name length
  103. The next sections all have the following structure:
  104. 1) 2 char ID
  105. 2) a two byte integer containing the size of the body
  106. 3) the body.
  107. There are 4 sections: "T1", "T2", "gg", and "ht". T1 and T2 are the
  108. tables associated with the hash function. (The hash function is a
  109. random function, meaning that it involves tables. T1 and T2 are the
  110. tables used by the hash function). "gg" is another table associated
  111. with the graph needed by the perfect hashing function algorithm.
  112. "ht" contains the actual hash table. The body of this section is an
  113. array of records of this structure:
  114. typedef struct _hashEntry
  115. {
  116. char name[SYMLEN]; /* The symbol name */
  117. byte pat [PATLEN]; /* The pattern */
  118. word offset; /* Offset (needed temporarily) */
  119. } HASHENTRY;
  120. This part of the signature file can be browsed with a binary dump
  121. program; a PATLEN length signature will follow the (null padded)
  122. symbol name. There are tools for searching signature files, e.g.
  123. srchsig, dispsig, and readsig. See below.
  124. 5 What other tools are useful for signature work?
  125. -------------------------------------------------
  126. Makedstp - makes signature files from turbo.tpl. Needed to make
  127. signature files for Turbo Pascal version 4.0 and later.
  128. SrchSig - tells you whether a given pattern exists in a signature
  129. file, and gives its name. You need a binary file with the signature
  130. in it, exactly the right length. This can most easily be done with
  131. debug (comes with MS-DOS).
  132. DispSig - given the name of a function, displays its signature, and
  133. stores the signature into a binary file as well. (You can use this
  134. file with srchsig on another signature file, if you want).
  135. ReadSig - reads a signature file, checking for correct structure, and
  136. displaying duplicate signatures. With the -a switch, it will display
  137. all signatures, with their symbols.
  138. The file perfhlib.c is used by various of these tools to do the work
  139. of the perfect hashing functions. It could be used as part of other
  140. tools that use signature files, or just perfect hashing functions for
  141. that matter.