Posted April 25, 20214 yr I Am Reversing A Malware Called Raccoon Stealer Its Written In C++ My Problem Is They Use Some Libraries That IDA Marks As unknown_libname This is Because It Doesn't Have Signatures For Them I Downloaded Class Informer and It Pointed Me That They Uses A Library Called nlohmann Its A Json Parsing Library For C++ But I can't figure out how can I add signatures for these libraries though I saw this repo (FLIRTDB) contains some signatures but the library is not included is there is sort of generator for these signatures I can use ? or how can I approach this situation. Thanks In Advance .
April 25, 20214 yr Author okay looks like I found the solution in these blogs Creating library signatures for IDA idenLib https://www.hex-rays.com/products/ida/tech/flirt/in_depth/ FLARE IDA Pro Script Series: Generating FLAIR function patterns using IDAPython Edited April 25, 20214 yr by astr0
Create an account or sign in to comment