Add Signature PEiD Plugin v1.04
by BoB
03.10.2006


Description

This plugin is used to add a signature from the entrypoint of a file, and to edit your UserDB.TXT list easily. 
Signature data is entered in the same way as in the UserDB.TXT file, eg 11 22 33 44 55 66 77 ?? ?? ?? ?? 11 22 33 44 ?? 55 66

There are a number of crap sigs around, any sig that is not of a PE file is pointless, any sig that is all ?? bytes is very stupid..
If people are going to copy their sigs from ancient programs like FA, then they are going to have lots of dodgy sigs.

Sigs like : 90 90 90 90 ?1 EB 5? 90 90 90 - Are invalid! It is either ?? or not..

In this version, you can read any number of bytes from the entrypoint to the signature box on the window, and edit it if necessary, and save it to the UserDB.TXT file in the PEiD installation directory.

New in V1.04 -- Now when you grab bytes from EntryPoint, a disassembly will be shown in the log window.

Signatures will be marked as dodgy if the length < 5 bytes, there are any bytes with ? but not ??, or any chars are not valid (0-9, A-F and ?) ..
You can remove the dodgy entries by clicking 'Remove Dodgy' ..

Note: You can sort a coloumn by clicking it's header, the UserDB.TXT will be saved in the order of the list..
Note: Nothing is saved until 'Save to UserDB' is clicked..

If you don't understand a word of this, you probably downloaded the wrong file.


Changes

V1.02 - Fixed error where I left the directory path to PEiD fixed instead of read from the registry.    Thanks to Tori for pointing this out.

V1.03 - Added Editor for signatures, scan duplicate signatures, remove relocs from signature, sorted list..
- BugFix : If 'Scan with PEiD' not in reg, had error! Now uses Param path to find userdb.txt ..
- Added : 'Remove dodgy' and listing of dodgy sigs..

V1.04 - Added disassembly of Entrypoint to help with locating bytes that need masking..
- Added : 'Show DisAsm' button to view disasm of sig bytes in Signature Editor (Uses $401000 as base address)
- Uses CADt 1.1 by MS-REM for all DisAssembling..


Info

Greets to: MS-REM, snaker, Jibs & Qwerton, and all peeps on PEiD forum

Comments? email : BobSoft@GMail.com

Thanks again to whoever invented coffee, without which I would never get anything done.. ;)