SEARCH
0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Prev | Current Page 558 | Next

Shon Harris, Allen Harper, Chris Eagle, and Jonathan Ness

"Gray Hat Hacking, Second Edition"

In this example we seem to have a problem;
sigmake is reporting some collisions. In a nutshell, collisions occur when two functions
reduce to the same signature. If any collisions are found, sigmake will refuse to
generate a sig file and instead generates an exclusions (.exc) file. The first few lines of this
particular exclusions file are shown here:
;--------- (delete these lines to allow sigmake to read this file)
; add '+' at the start of a line to select a module
; add '-' if you are not sure about the selection
; do nothing if you want to exclude all modules
___ntohs 00 0000 FB744240486C4C3................................................
___htons 00 0000 FB744240486C4C3................................................
In this example, we see that the functions ntohs and htons have the same signature,
which is not surprising considering that they do the same thing on an x86 architecture,
namely swap the bytes in a two-byte short value. The exclusions file must be edited to
instruct sigmake how to resolve each collision. As shown earlier, basic instructions for
this can be found in the generated .exc file. At a minimum, the comment lines (those
beginning with a semicolon) must be removed. You must then choose which, if any, of
the colliding functions you wish to keep.


Pages:
546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570