PE signature extractor powered by Zydis. Generates IDA, YARA, raw, mask, and C-array signatures from PE executables with instruction-aware byte masking and quality scoring.
- Instruction-aware masking — wildcards displacements, relative branches, large immediates, and relocation bytes automatically
- Quality scoring — ranks signatures by fixed ratio, operand density, instruction category rarity, register diversity, and ISA set uniqueness
- Multi-format output — IDA pattern, YARA rule, raw hex, hex+mask, C struct array
- Modes — per-instruction, fixed-size chunks, sliding window
- Deduplication & scanning — dedup identical sigs, count occurrences in the binary via rarest-byte-indexed search, filter by match count
- Find shortest unique sig —
--find-sig <addr>grows instruction window until the sig matches only once - Relocation-aware — consumes PE base relocations to wildcard fixup bytes automatically
sigextract <pe_file> [options]
| Flag | Description |
|---|---|
--mode <inst|chunk|window> |
Extraction mode (default: inst) |
--format <ida|yara|raw|msk|carray> |
Output format |
--unique |
Deduplicate + scan matches |
--best <N> |
Top N sigs by quality (implies --unique) |
--find-sig <addr> |
Shortest unique sig at address |
--filter-inst |
Skip NOP/INT/RET/SYSCALL |
--skip-padding |
Skip CC/00/FF/90 padding sections |
--no-noncode |
Skip non-executable sections |
--section <name> |
Only process one section |
--min-fixed <N> |
Minimum fixed bytes to keep |
--max-matches <N> |
Max binary matches to keep |
--output <file> |
Write to file |
--quiet |
Suppress progress |
cmake -B build
cmake --build buildRequires: C++17, CMake 3.16+, Zydis v4.x (fetched automatically via FetchContent).
Top 10 unique signatures from an executable:
sigextract target.exe --unique --best 10
Generate YARA rules with padding skipped:
sigextract target.dll --unique --best 5 --format yara --skip-padding -o sigs.yara
Find the shortest unique signature covering an address:
sigextract target.exe --find-sig 0x140001234