Hi, here is an interesting (to me) dilemma I am faced with: I have a compiled third party DLL which I wish to reverse. I also have the SDK for this particular app which includes sample source code.

My feeling id the third party developer has used the sample DLL as a template and added there own methods to it.

Of course IDA cannot identify these method names as there isn't a .SIG file available. Is there any way I can use the supplied .cpp files to create a library and ultimately a signature file to help me make better sense of the disassembly listing?

PS I've searched the forum and found reference to how to do this for Delphi source but not C++. Or perhaps there is another approach I am not aware of? I hope someone can enlighten me.

Kind regards,
5aLive.

1. Compile the CPP files (remember, compile ONLY, do not link)
2. See the resulting .OBJ files?
3. Run the IDA FLIRT utilities on the .OBJ files
4. Voila! Instant .SIG files
5. Copy those .SIG files to the SIG folder of IDA
6. Disassemble the app in IDA
7. Open the "APPLY SIGNATURE" box
8. Select your signatures and apply
9. Have Phun!


Have Phun

Thankyou Aimless,

having done this, IDA will now identify the method calls in the DLL. I have one other question, can I somehow merge these object files before applying FLIRT so that I need only apply a single signature file?

I expect you would have described this technique if it were possible.

Thanks for you help Sir.

Simple.

Instead of merging .OBJ files, why don't you create a SINGLE .SIG file? Its the same thing in the end.

Check up the documentation that comes with FLIRT to see how to add multiple OBJ file signatures into a single .SIG file

Using the parameter "-a" without the quotes comes immedately to mind.

Have Phun
(Any Hey, you can always call me Aimless. I'm not THAT old yet)

Perfect. Thats exactly what I want I to achieve. I'll read up on FLIRT and get started on this.

Addressing you as "Sir" is a little regional humour of sorts, I'll call you Aimless from now on if you like. Isn't your user name a little self-depreciating? It's like me calling myself Pointless, I wouldn't much care for people calling me that.

EDIT:Just a thought, will the IDA .SIG file still create identifiable methods regardless of the compiler and its optimizations used?

Thankyou once again.