IDA-Fusion is an ULTRA fast signature scanner and creator for IDA Pro versions 7 and 8+, powered by GCC.
IDA-Fusion was developed to address the lack of stable and reliable signature scanners and creators available for IDA. Most existing solutions are riddled with bugs, generate non-unique signatures, and struggle with binaries that employ anti-reverse engineering techniques, such as duplicated binary parts.
IDA-Fusion stands apart because it is:
- GCC-Powered: Built with GCC for reliability and compatibility.
- Optimized and Fast: Efficient algorithms for signature creation and scanning, quickly handling large binaries.
- Compact and Unique: Keeps signatures small without sacrificing uniqueness.
- Versatile: Supports IDA-style, code-style, CRC-32, and FNV1-A signature generation.
- User-Friendly: Auto-jumps to matches, copies signatures to clipboard, and keeps things streamlined.
IDA-Fusion operates by wildcarding any operand that contains an immediate value (IMM). For example, the instruction lea rax, [rbx+10h] is converted into the signature lea rax, [rbx+?]. This approach differs significantly from traditional signature creators, as it ensures that only the opcodes are captured, making IDA-Fusion especially effective for programs designed to resist signature creation.
In the image above, the highlighted portion shows what is omitted when creating a signature. By focusing solely on opcodes, IDA-Fusion produces more reliable signatures, especially for binaries that employ anti-signature measures.
We're committed to enhancing and optimizing IDA-Fusion with new features and performance improvements. We're also open to contributions from the community. Some planned future features include:
- Reverse Searching: Create even smaller signatures by analyzing from the end (optional feature).
- Reference-Based Signatures: Generate signatures based on references (optional feature).
- More Features: We're continuously brainstorming additional features to enhance IDA-Fusion.
- IDA Pro Version 7.5 or Above
- Download the Latest Release: Get the latest Release here, or compile it yourself.
- Copy Plugin Files: Drag
fusion.dllandfusion64.dllinto your IDA installation'spluginsfolder. - Access the Fusion Menu: Use
Edit > Plugins > Fusionor pressCTRL + ALT + Sto open the action menu.
- Download GCC: Install GCC, preferably using MSYS2.
- Extract SDK: Extract the contents of IDA's
idasdk7.x.zipinto thesdkfolder within IDA-Fusion. - Modify Copy Directories: To avoid confusion, update the copy directories in
compile.bat. - Run the Compilation Script: Run
compile.batto compile IDA-Fusion for both x86 and x64 versions of IDA.
We warmly welcome contributions! Whether it's a new feature, bug fix, or advice, your help is greatly appreciated. Join us in making IDA-Fusion even better.
Feel free to get in touch if you have any questions or suggestions for improvement. Happy reversing!
