Skip to content

Error in signatures detection #18

@hasherezade

Description

@hasherezade

Example (from unpacking by Athracene):

Both files have been packed with UPX.

comparison

Signature that should match:

UPX_old
48
60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 83 CD FF
EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB
75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00

If this is the only signature loaded, both are detected properly. But in case if there are other signatures, only one is detected.

The reason is, there is another signature that overshadows the matching one.

overshadowed

Once the character that is not a wildcard is matched (here at position 3: 60 BE 00 _A0_), the signature with the wildcard is completely dropped.
This is an invalid behavior, and the signature with the wildcards should be still kept for the comparisons.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions