Skip to content

Commit 3a627a7

Browse files
author
Lasha Khasaia
committed
add jaccard index
1 parent f95cf94 commit 3a627a7

File tree

2 files changed

+9
-1
lines changed

2 files changed

+9
-1
lines changed

README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,14 @@ If you want to generate a signature for `main` function compiled using `MSVC 14`
6363

6464
- `idenLib` uses the `DIA APIs` to browse debug information stored in a PDB file. To run `idenLib` with `-getmain` parameter you will need to ensure that the msdia140.dll (found in `Microsoft Visual Studio\2017\Community\DIA SDK\bin`) is registered as a COM component, by invoking regsvr32.exe on the dll.
6565

66+
67+
## Applying Signatures
68+
69+
There are two ways to apply signatures, exact match and using [`Jaccard index`](https://en.wikipedia.org/wiki/Jaccard_index)
70+
71+
![x32dbg_jaccard](https://user-images.githubusercontent.com/16405698/53361361-80489f80-392f-11e9-9339-36b719394cbe.png)
72+
73+
6674
## Useful links:
6775
- Detailed information about [`C Run-Time Libraries (CRT)`](https://docs.microsoft.com/en-us/cpp/c-runtime-library/crt-library-features)
6876

idenLib/pdb.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ bool ProcessMainSignature(const fs::path& pePath)
5050
subFolder = L"x86";
5151
zydisMode = ZYDIS_MACHINE_MODE_LEGACY_32;
5252
zydisWidth = ZYDIS_ADDRESS_WIDTH_32;
53-
auto ntHeaderCurrent = static_cast<PIMAGE_NT_HEADERS32>(ntHeader);
53+
auto ntHeaderCurrent = reinterpret_cast<PIMAGE_NT_HEADERS32>(ntHeader);
5454
mainInfo.EntryAddress = static_cast<DWORD_PTR>(ntHeaderCurrent->OptionalHeader.AddressOfEntryPoint);
5555
}
5656

0 commit comments

Comments
 (0)