I am curious about how peid loads signature database. Does Peid store the signature as an array and load it to memory?

If I compare the used memory between peid and exeinfope

Exeinfope

Priv. Working Set : 316,676 K

Commit Size : 318.068 K

Peid

Priv. Working Set : 2232 K

Commit Size : 6792 K

I know they are different program but they are quite similar with big difference about memory consumption.

Actually, I have signature database, I put it as an array in a DLL. My EXE retrieve the array from DLL and assign the array to EXE's variable. The problem is my EXE will consume huge memory. What is the effective way?

question is are they both packed with same packers? if you dont use a packer then it wont be as big in memory as a packer has to load the whole lot in memory before executing, I think custom signatures are stored in .txt file and loaded into to an array at scan time, They probably have small pre-defined database compiled into the exe, to be honest I wouldn't know...

I am not just talking about Peid, but what is the effective way to load huge data/array as database and read it fastly.

Hmm..I think scan time is not a good idea because I/O activity is more consume time. I might be wrong.

I am not just talking about Peid, but what is the effective way to load huge data/array as database and read it fastly.

Hmm..I think scan time is not a good idea because I/O activity is more consume time. I might be wrong.

linked list http://en.wikipedia.org/wiki/Linked_list , with a smart search algorithm