Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

idb2pat sigmake FATAL: Bad xdigit: error #106

Open
KulaGGin opened this issue Apr 14, 2021 · 3 comments
Open

idb2pat sigmake FATAL: Bad xdigit: error #106

KulaGGin opened this issue Apr 14, 2021 · 3 comments
Assignees

Comments

@KulaGGin
Copy link
Contributor

KulaGGin commented Apr 14, 2021

I get the FATAL: Bad xdigit: error error when trying to use sigmake on a file with long lines, such as this one:
https://slexy.org/view/s2UyxIhZQR

Here's the .pat file with quite a few problem lines like that if you want to try it yourself: https://www.dropbox.com/s/ym8mfm0k037gbd4/S05_TestingGrounds-Win64-Shipping.pat?dl=0

It's a pat file generated from a compiled executable with Unreal Engine 4 for Win64 with .pdb supplied. And UE4 uses MSBuild, iirc, if that helps in any way.

I use updated idb2pat from #105 but I get the exact same issue on non-updated idb2pat on IDA 7.2 with all the default settings.

I think the problem is here: 48894C2408B808160100E8D11A2A02482BE0C78424D086000002000000488B84 FF ABF9 60247. Fourth member with numbers - 60247. Usually there are 4 digits in most lines but on the lines with that exact error it's always more than 4 digits for the fourth member. I don't know how to fix that, I think I'll go try a version from #98 with fixes, they might have fixed exactly this?

Removing all the lines with more than 4 digits on the fourth member does let sigmake tool finish generating .sig file.

@williballenthin
Copy link
Contributor

interesting.

coincidentally, i had also discovered that the fields that look like 16bit numbers do in fact accept numbers larger than 16bits. so, this probably does lead to an issue in idb2pat.

thanks for providing a test file - i'll use that to help diagnose the bug and develop a fix.

@KulaGGin
Copy link
Contributor Author

KulaGGin commented Apr 14, 2021

@williballenthin Awesome, big thanks.

I created another issue which I have with the same project: #107

So when you'll work on it, you might want to look into that one as well.

They might be related, but doesn't really look like it, they look like different issues.

@williballenthin williballenthin self-assigned this Apr 14, 2021
@ZehMatt
Copy link

ZehMatt commented Aug 30, 2023

If anyone stumbles into this, you can resolve the issue by 8 digits, sigmake seems to only accept 0000 or 00000000,
so if you have 11960 turn that into 00011960

N0fix added a commit to N0fix/flare-ida that referenced this issue Jul 9, 2024
@N0fix N0fix mentioned this issue Jul 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants