From bac9ed154452203ef13de3af7cc569a46622ad00 Mon Sep 17 00:00:00 2001 From: wesinator <5124946+wesinator@users.noreply.github.com> Date: Wed, 24 Oct 2018 10:24:44 -0400 Subject: [PATCH 1/2] Remove bad PEiD Armadillo v1.71 packer signature Armadillo v1.71 signature has false positives on binaries compiled with MSVC --- peid/UserDB.TXT | 4 ---- 1 file changed, 4 deletions(-) diff --git a/peid/UserDB.TXT b/peid/UserDB.TXT index eaa86da..2a53351 100755 --- a/peid/UserDB.TXT +++ b/peid/UserDB.TXT @@ -11133,10 +11133,6 @@ ep_only = true signature = 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 ep_only = true -[Armadillo v1.71] -signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 -ep_only = true - [Armadillo v1.72 - v1.73] signature = 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 ep_only = true From 07bcae67b5f52e81241bc9c146ad94a712837da4 Mon Sep 17 00:00:00 2001 From: wesinator <5124946+wesinator@users.noreply.github.com> Date: Tue, 21 May 2019 12:08:33 -0400 Subject: [PATCH 2/2] Disable PEiD Armadillo packer false positive "Armadillo v1.xx - v2.xx" is a false positive https://www.zscaler.com/blogs/research/your-windows-8-packed --- peid/UserDB.TXT | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/peid/UserDB.TXT b/peid/UserDB.TXT index 2a53351..41c7e62 100755 --- a/peid/UserDB.TXT +++ b/peid/UserDB.TXT @@ -11141,9 +11141,10 @@ ep_only = true signature = 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 ep_only = true -[Armadillo v1.xx - v2.xx] -signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 -ep_only = true +; False positive - https://www.zscaler.com/blogs/research/your-windows-8-packed +;[Armadillo v1.xx - v2.xx] +;signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 +;ep_only = true [Armadillo v2.51] signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20