AddSig v2.00 -- Signature Editor plugin for PEiD ..
Description:
Complete rewrite of one of my oldest plugins!
AddSig is a plugin that enables you to easily manage your external signatures.
It has a full signature editor, with ratings system.
You can type a signature without spaces, or binary copy from Olly, it will be
corrected anyway.
If you download some UserDB.TXT you can drag-drop it onto the editor window to
import the signatures from the file.
A search-box is provided to easily find sigs, even if you can't remember full name.
If you type 'UPX' then if UPX is at beginning of sig, the list scrolls to there..
If upx is not at the beginning of line, then the whole name is searched and the first
match (if any) is selected..
EG: Typing 'Vaska' would find sig 'RCryptor v1.6d --> Vaska'; and typing 'RCryptor' would
find it too. There is Find-next button to go to next match..
Rating System:
The rating works like this..
+1 for EP only
+1 for less than 9 masked bytes, and more than 20 total bytes
+1 for less than 1/3 of total bytes are masked, and more than 30 bytes total
+1 for more than 50 bytes in signature
+1 for more than 100 bytes in signature
So a signature can be rated 1 (Not very reliable) to 5 (The perfect sig) ..
If a sig gets a rating of 0 an exclaimation (!) is shown..
Also, a signature can be rated Dodgy. This means it is invalid in some way, the reasons are:
Empty Signature
All masked bytes - EG : ?? ?? ?? ?? ?? ?? ?? ?? ??
Signature length less than 8 bytes
Odd number of masked signature bytes - EG : 00 03 45 0? ?? 00 (3 ?, not 4)
Odd number of signature bytes - EG : 00 03 45 0 ?? 00
Bad chars in Sig - Not 0 .. 9, A .. F or ?
Wrongly masked bytes - EG : 00 03 ?5 ?? ?6 00 (4 ?, but in wrong place)
If a sig is dodgy, an unhappy face is shown and Dodgy! Is written next to it ..
Features:
o Totally rewritten without using Delphi VCL stuff.. (Size is < 10% of orig!)
o Just 1 button press to remove duplicate sigs or dodgy signatures ..
o Safe to use - nothing is saved until Save UserDB button is pressed!
o Easily tell good, weak or dodgy signatures with rating system ..
o Sort by name, signature, EP Only or rating ..
o Can import another userdb.txt by dropping file into the editor window ..
o Can import PETools Signs.TXT by dropping it onto Gui ..
o Automatically removes duplicates when UserDB.TXT / Signs.txt imported ..
o Automatically removes masked bytes from end of sig ..
o Automatically fixes spaces in sig, so Add / Update a sig and it will be formatted ..
o Includes a search box to find text from a sig name in list ..
o Compare Entrypoint code of multiple files to create sig ..
o Checks database before add, and warns user how many sigs match ..
o Say when changed / ask when not saved on exit ..
o Search box with Find-Next button
o Sig bytes are always shown using static width .. (Bit slower drawing, but looks good in any font)
o Added option to change font for Sig table .. (Jupiter)
o Added button in options window to download UserDB.TXT from my site ..
o Added button in options window to make plugin (and PEiD) use XP themes ..
o Set maximum length of EP Scan to 1000 bytes ..
o Added Remove All / Yes / No / Keep All - query box for removing duplicates ..
o Added support for UserDB.TXT that has ep_only=1 (SigTool by BlackPanther does this)
o Added option to make window Stay on top ..
o Added button to copy selected sig, name, ep_only as text to paste into forum / userdb.txt ..
o Changed default Scan EP sig length to 120 (so it gets 5 smileys rating)