Skip to content

Disable SigKit and enable WARP by default #6231

Open
@emesare

Description

@emesare

Right now on 4.2 dev we have SigKit as the function matching toolkit and and experimental WARP function matching toolkit. The intention is to disable SigKit and run just the WARP integration. Before this can be done we need to iron out the matching issues.

  • Function adjacency on identical function GUID's creates a cascading set of false positives.
  • Types with only GUID's are stored in the binary view.
  • Certain functions in msvcrt are not being matched due to mismatching basic blocks at the time of GUID creation.
  • Users should be able to blacklist WARP signatures

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions