Author Topic: PEiD Signature Organizer  (Read 5549 times)

0 Members and 1 Guest are viewing this topic.

March 14, 2008, 12:37:11 pm
Read 5549 times

sowhat-x

  • Guest
...just one of the semi-automated signature making tools,
that I was referring to in the following thread...
http://www.malwaredomainlist.com/forums/index.php?topic=1639.0
Note that it's packed with Upack (by the author),
ie.depending on your AV's policy and unpacking abilities,it might trigger an alert...

Few notes (regarding possible buggy behavior)...
At first,don't try to input either illegal and/or huge values,
eg.entering a value of more than 2000 bytes,it is almost certain it will crash it.
Secondly,wildcarding of bytes isn't sophisticated at all...as an example,
you might end up with something as "EB 01 ?4 E9",
instead of the valid for signature "EB 01 ?? E9"...
this has to corrected manually afterwards...