Signature Maker Plugin for IDA Pro 9.0+

Magnifying glass with the word 'sigmaker' and a cross-hair over the 'A' in sigmaker

An IDA Pro 9.0+ zero-dependency cross-platform signature maker plugin with optional SIMD (e.g. AVX2/NEON/SSE2) speedups that works on macOS, Linux, and Windows. SigMaker includes processor-aware operand wildcarding for x86, x64, ARM, and MIPS binaries. The primary goal of this plugin is to work with future versions of IDA without needing to compile against the IDA SDK, while allowing easier community contributions.

Background reading on mahmoudimus.com:

IDA Pro and Cython: super-charging the work-horse of reverse engineering: how the optional SIMD speedups were built.
Growing a unique function signature without rescanning the binary: the search algorithm, with interactive visualizations.
How do you know your Cython hot loop is fast enough?: how I confirmed those kernels are already optimal (memory-bound, not compute-bound).

Installation
SIMD Speedups
Requirements
- Processor support
What is a "sigmaker"?
Usage
Performance
- Benchmarks
- How it works
Using SigMaker as a library
Acknowledgements
Development & Releases
- Coverage
- Contributing
Contact

Installation

sigmaker's main value proposition is its cross-platform (Windows, macOS, Linux) Python 3 support. It uses zero third party dependencies, making the code both portable and easy to install.

Quick Install

Copy src/sigmaker/__init__.py into the /plugins/ folder to the plugin directory!
Rename it to sigmaker.py
OPTIONALLY, if you would like SIMD speedups, just pip install sigmaker
Restart IDA Pro.

From Releases

Download the latest conveniently renamed sigmaker.py release from the Releases page
Copy it to your IDA Pro plugins directory
OPTIONALLY, if you would like SIMD speedups, just pip install sigmaker
Restart IDA Pro

That's it!

Install with hcli

hcli is Hex-Rays' command-line tool, and it can install sigmaker from the IDA Plugin Repository. Install hcli once:

curl -LsSf https://hcli.docs.hex-rays.com/install | sh        # macOS/Linux
iwr -useb https://hcli.docs.hex-rays.com/install.ps1 | iex    # Windows (PowerShell)

Then authenticate (see the hcli docs) and install the plugin:

hcli plugin search sigmaker
hcli plugin install SigMaker

hcli installs the plugin under $IDAUSR/plugins/SigMaker and installs the matching sigmaker wheel into IDA's Python environment. That wheel includes the SIMD speedups for supported Python and platform combinations, so an HCLI install does not require a separate pip install. IDA loads the plugin on its next launch. Requires IDA 9.0+.

Need to find your plugin directory?

From IDA's Python console run the following command to find its plugin directory:

import idaapi, os; print(os.path.join(idaapi.get_user_idadir(), "plugins"))

Where and what is my default user directory?

The user directory is a location where IDA stores some of the global settings and which can be used for some additional customization. Default location:

On Windows: %APPDATA%\Hex-Rays\IDA Pro
On macOS: ~/.idapro
On Linux: ~/.idapro

SIMD Speedups

An HCLI install pulls in the matching sigmaker wheel automatically. For a manual or standalone sigmaker.py install, run pip install sigmaker in IDA's Python environment. On supported Windows, Linux, and macOS systems, pip selects the wheel for the active CPython version and architecture. SigMaker uses the extension automatically when it is available and shows its status in the top-right menu bar:

Compatibility and updates

The speedup wheel is optional. SigMaker validates the required native entry points on the exact extension module it loaded before enabling SIMD. Newer wheels also declare an API range; older wheels without that declaration remain eligible when they provide the complete native contract. A stale, partial, or incompatible wheel is disabled before it can affect a search; the pure-Python implementation continues with the same results.

In interactive IDA, SigMaker shows one update prompt per process with the loaded extension path and the applicable command:

HCLI install: hcli plugin upgrade SigMaker
Manual or standalone install: "<IDA Python from sys.exec_prefix>" -m pip install --upgrade "sigmaker==<plugin version>"

Restart IDA after updating. The manual command intentionally derives its interpreter from sys.exec_prefix; embedded IDA hosts can report ida.exe as sys.executable, which cannot run pip. If updating does not resolve the problem, open an issue and include the path from the prompt.

Library and headless users need no special setup. SigMaker never opens an IDA dialog outside the graphical plugin. An absent extension is bypassed silently; a discovered stale or incompatible extension is logged, then bypassed automatically.

SIMD Enabled

No SIMD Speedups

Requirements

IDA Pro 9.0+
IDA Python
Python 3.10+

Processor support

SigMaker creates and searches byte signatures using IDA's decoded instructions. Its operand wildcarding has architecture-specific rules for:

x86 and x64
ARMv6-M Thumb (Cortex-M0)
ARMv7 A32
AArch64
MIPS and MIPSEL

Other IDA processor modules use the generic operand wildcarding behavior. Architecture-specific rules keep stable opcode and register bytes exact while wildcarding address-bearing bytes according to IDA's operand metadata. The ARM variants above are exercised through checked-in ELF objects and real IDALIB decoding rather than processor mocks alone.

What is a "sigmaker"?

Sigmaker stands for "signature maker." It enables users to create unique binary pattern signatures that can identify specific addresses or routines within a binary, even after the binary has been updated.

In malware analysis or binary reverse engineering, a common challenge is pinpointing an important address, such as a function or global variable. However, when the binary is updated, all the effort spent identifying these locations can be lost if their addresses change.

To preserve this work, reverse engineers take advantage of the fact that most programs do not change drastically between updates. While some functions or data may be modified, much of the binary remains the same. Most often, previously identified addresses are simply relocated. This is where sigmaker comes in.

Sigmaker lets you create unique patterns to track important parts of a program, making your analysis more resilient to updates. By generating signatures for specific functions, data references, or other critical locations, you can quickly relocate these points in a new version of the binary, saving time and effort in future reverse engineering tasks.

Usage

In disassembly view, select a line you want to generate a signature for, and press CTRL+ALT+S:

OR Right-Click and select SigMaker:

The generated signature will be printed to the output console, as well as copied to the clipboard:

Signature type	Example preview
IDA Signature	`E8 ? ? ? ? 45 33 F6 66 44 89 34 33`
x64Dbg Signature	`E8 ?? ?? ?? ?? 45 33 F6 66 44 89 34 33`
C Byte Array Signature + String mask	`\xE8\x00\x00\x00\x00\x45\x33\xF6\x66\x44\x89\x34\x33 x????xxxxxxxx`
C Raw Bytes Signature + Bitmask	`0xE8, 0x00, 0x00, 0x00, 0x00, 0x45, 0x33, 0xF6, 0x66, 0x44, 0x89, 0x34, 0x33 0b1111111100001`

Finding XREFs

Generating code Signatures by data or code xrefs and finding the shortest ones is also supported:

Signature searching

Searching for Signatures works for supported formats:

It also supports nibble wildcard searches such as 48 4? ?F 90:

Nibble wildcard search works with or without the optional SIMD speedups. Without the speedup wheel, SigMaker finds the longest exact-byte run with the standard library's C-speed byte search and verifies the remaining nibble masks in Python. The pattern must therefore contain at least one exact byte, and patterns whose best exact run is very common can be substantially slower without SIMD.

Just enter any string containing your Signature, it will automatically try to figure out what kind of Signature format is being used:

Currently, all output formats you can generate are supported.

Match(es) of your signature will be printed to console alongside the containing function name:

If the matched address is not a function name or has no function name, it falls back to just printing the address:

Signature Configuration

sigmaker also supports configurable wildcardable operands for unique signature creation:

There are also various options that be configured via the Other options button:

Performance

SigMaker's "find the shortest unique signature for the current function" search has been heavily optimized. On a real 16 MB module, a single worst-case function search once took 462 seconds (7.7 minutes). A stack of four optimizations brought the heaviest searches down to the tens-of-seconds range and typical ones to near-instant. One user reported the progress wait-box now "barely show[s] up for a 26 byte signature."

The full derivation, including the match-set math, the counting-sort index, the selectivity proof, and what is novel about the approach, is written up in ALGORITHM.md.

Benchmarks

Measured on the largest function (8486 bytes) of a 16 MB module via native idalib on Apple Silicon. The effects are cumulative across the four phases:

Optimization	Effect	PR
Phase 1: seed-then-refine candidate refinement	~13x faster function search	#33
Phase 2: 2-byte bucket position index	additional ~2.48x on large databases, widening as the database grows	#35
Phase 3: dynamic seed selection (1- or 2-byte)	per-anchor seed scans cut from 206 to 2	#36
Phase 4: Cython in-place refinement	per-byte refinement ~14 s to ~0.28 s (~50x); function total ~24 s to ~15.6 s	#36

Signature output is byte-identical before and after every optimization. The test suite cross-checks each fast path against a brute-force oracle and diffs the generated signatures across the entire test binary.

How it works

A short tour (see ALGORITHM.md for the math):

Seed, then refine. The set of database matches can only shrink as a signature grows, so instead of rescanning the whole database for every candidate length, SigMaker scans once to seed a candidate set and then filters that set in place as each byte is appended.
Index the database once. A counting-sort index over every adjacent byte pair lets the seed be drawn from the rarest exact run in the pattern, in time proportional to that run's frequency rather than to the database size. The same index serves both 1-byte and 2-byte runs for free, so the most selective anchor is always chosen.
Push the hot loops into C. With the optional pip install sigmaker SIMD wheel, the index build and the per-byte refinement run as nogil C over typed buffers with zero per-call allocation, and the raw byte scan uses AVX2/NEON/SSE2. Without the wheel, pure-Python fallbacks produce identical results.

Using SigMaker as a library

Beyond the IDA plugin, sigmaker is imported directly as a Python library by other tools (for example, batch signature-generation pipelines). The core types are usable from any IDAPython or idalib context:

import sigmaker

cfg = sigmaker.SigMakerConfig(
    output_format=sigmaker.SignatureType.IDA,
    wildcard_operands=True,
    continue_outside_of_function=False,
    wildcard_optimized=True,
    ask_longer_signature=False,
)
result = sigmaker.SignatureMaker().make_signature(ea, cfg)
print(f"{result.signature:ida}")   # IDA-style string
print(len(result.signature))       # byte length

# Cross-references:
xrefs = sigmaker.XrefFinder().find_xrefs(ea, cfg)
for gen in xrefs.signatures:
    print(str(gen.address), f"{gen.signature:ida}")

Batch search API

Why batch search?

Signatures are usually maintained as a collection. After a binary update, you need to know which patterns still match, which became ambiguous, and which no longer match. Searching each pattern separately repeats scan setup and leaves you to compare the results by hand. Batch search accepts the collection once and returns one result per pattern in input order.

The batch layer adds little overhead:

A current profile of BatchSignatureSearcher.from_text() parsed a 5,003-line mixed paste into 5,000 entries in 16.0 ms median, or roughly 312,000 entries per second.
The requested segment buffer is loaded once and reused for every unique normalized pattern. This design follows real-binary profiling of signature generation where loading segments before every uniqueness check consumed 84% of total generation time.
Duplicate normalized patterns share their match results, and file offsets are resolved only when a caller or formatter requests them. A performance regression test constructs a 100,000-hit batch result while asserting that search performs no file-offset lookups.

These are focused measurements of parsing, scan setup, and result construction. End-to-end search time still depends on the binary, search scope, patterns, and whether SIMD speedups are available.

Search a batch

Batch search is available to IDAPython and idalib scripts:

import sigmaker

text = """
print = "48 8B ?? ??"
update := E8 ? ? ? ? 48 89 C7
tick = 90;90;CC
draw = "48 89 C7"
48 8B ?? ?? 89
"""

results = sigmaker.BatchSignatureSearcher.from_text(text).search()
print(results)            # text
print(f"{results:text}")  # registered text formatter
print(f"{results:csv}")   # registered CSV formatter
print(f"{results:json}")  # registered JSON formatter

for result in results:
    print(result.display_name, result.status, result.match_count)
    print(result.raw_pattern, result.search_pattern, result.normalized_signature)
    for hit in result.matches:
        file_offset = result.file_offset_for_match(hit)
        file_offset_text = (
            "unavailable" if file_offset is None else f"0x{file_offset:X}"
        )
        print(f"{hit:ea}", f"{hit:rva}", file_offset_text)

Input format

Each non-empty line is one signature:

Unnamed pattern: Write the pattern by itself. The result is labeled with its source line.
Named pattern: Use name := pattern or name = pattern.
Quoted pattern: Quotes are accepted only around the right-hand side of a named pattern, as in update = "E8 ? ? ? ? 48".
Comments: # and // comments are ignored outside quoted strings. Markdown fence lines are also skipped, which makes snippets from issues and notes safe to paste.
Entry boundary: Only a newline starts a new entry. A semicolon remains a byte separator, so tick := 90;90;CC is one signature.
Source text: SigMaker does not parse declarations, infer signatures from prose, or join a signature across multiple lines.

SignatureSearcher.from_many(text) returns the parsed per-pattern searchers if you need to inspect names and source lines before searching. BatchSignatureSearcher.from_text(text) uses it internally.

Each line uses the same strict parser as regular signature search. Supported forms include:

48 8B ? ?? 4? ?F
488B??9090
488B4??F90
48,8B;?;90
\x48\x8B\x00\x48\x89 xx?xx
0x48, 0x8B, 0x00, 0x48, 0x89 0b11011
(48 8B ? 90)

Compact input may omit separators only when the complete pattern consists of two-character cells: HH, ??, H?, or ?H. For example, 488B??9090 parses as 48 8B ? 90 90.

The strict parser rejects ambiguous input instead of guessing:

Single nibbles, such as E 8 4.
Odd-length compact input, such as 488B?9090.
Input that mixes glued and separated cells, such as 488B ?? 90.
Long integer notation, such as 0x488B9090.
Colon, pipe, or hyphen separators.
Declaration text and random prose.

An invalid pattern becomes an error on that entry; it does not abort the rest of the batch. Every searchable pattern must contain at least one exact byte. An all-wildcard pattern such as ?? ?? ?? is rejected because it matches almost everywhere and is not a useful search key.

Results

BatchSearchResults is iterable and preserves input order. list(results) returns the per-pattern SearchResults objects. Each entry contains:

Identity and input
- name and source_line identify the entry.
- raw_pattern contains the extracted user input.
Parsed patterns
- search_pattern is the parsed SigMaker pattern used for display.
- normalized_signature is the canonical matcher and cache pattern.
- signature_str remains a compatibility alias for search_pattern.
Outcome
- status is matched, no_matches, or error.
- matches is the list of matching addresses.
- error contains the per-entry failure, when present.

Nibble masks such as 4? and ?F are preserved in both parsed and normalized patterns. A full-byte wildcard displays as ? in search_pattern and as ?? in normalized_signature.

Match addresses and offsets

Each Match still behaves like an int, so existing address-based code keeps working. It also carries optional RVA and file-offset metadata and supports:

f"{hit:ea}" for the absolute effective address.
f"{hit:rva}" for the module-relative virtual address.
f"{hit:fileoffset}" for the input-file offset.

Search populates the RVA directly. File offsets are lazy because IDA resolves them one address at a time. Call result.file_offset_for_match(hit), or let a formatter resolve the hits it emits. Each result caches both successful and unavailable lookups.

Batch search itself performs no file-offset lookups. The text formatter resolves only previewed hits; CSV and JSON resolve every exported hit. :rva and :fileoffset do not fall back to :ea, since that would label an absolute address as a derived offset. When the requested metadata is absent from the Match, formatting returns repr(hit), which still includes the effective address.

Scope, buffer reuse, and cancellation

With SIMD speedups, a batch lazily copies the requested segment or all segments once, then reuses that buffer for every unique normalized pattern.
Without SIMD speedups, nibble wildcard patterns use the same shared-buffer path. Ordinary IDA-compatible patterns continue through IDA's native search.
batch.search(scope_ea=ea) limits the scan to the containing segment, using the same fallback policy as ordinary signature search.
A caller may pass a preloaded buf. Supplying both buf and scope_ea is rejected because SigMaker cannot prove that the buffer represents that segment.
Canceling a batch raises UserCanceledError. Partial hits are not cached or exported as a completed entry.

GUI and headless embedding

SignatureSearcher and BatchSignatureSearcher select their default services once from the host:

Host	Search progress and cancellation
Graphical IDA (`idaapi.is_idaq() is True`)	IDA wait box and Cancel button
idalib	Headless no-op services
Missing or failed `is_idaq()` probe	Headless no-op services

The interactive plugin also installs IDA-backed services explicitly while it runs an action. Direct calls from IDAPython therefore retain their existing UI, while idalib and stripped embedders do not call idaapi.user_cancelled().

Under idalib, no search-specific configuration is required. Initialize IDA before importing SigMaker, then use the same search API:

import idapro
import sigmaker

results = sigmaker.BatchSignatureSearcher.from_text(text).search()

To force headless search even inside graphical IDA, scope an empty service set to the operation:

with sigmaker.UIServices.use(sigmaker.UIServices()):
    results = sigmaker.BatchSignatureSearcher.from_text(text).search()

An embedder may instead provide its own progress context or cancellation predicate. The predicate is resolved once before each scan loop and polled at the existing cancellation stride, so injection does not add a context lookup to every match:

services = sigmaker.UIServices(
    cancel_requested=cancel_event.is_set,
)

with sigmaker.UIServices.use(services):
    results = sigmaker.BatchSignatureSearcher.from_text(text).search()

progress is any callable that accepts the progress message and returns a context manager. Within an explicitly constructed UIServices, omitted fields use their headless no-op defaults.

UIServices isolates search-side UI behavior. It does not remove the plugin's Form, action, or menu classes from the full module; producing a distributable engine-only source file remains a separate packaging concern.

Display and export

str(results) and f"{results:text}" use the human-readable text formatter. BatchSearchResults.display() writes that format to idaapi.msg by default, or writes any selected formatter to a text file-like object or callable sink:

import io

buf = io.StringIO()
results.display(output=buf, formatter="json")
payload = buf.getvalue()

The built-in formats are:

text and .txt for a human-readable summary with a bounded match preview.
csv and .csv for spreadsheets and line-oriented tooling.
json and .json for structured interchange.

The built-ins intentionally stop at common interchange formats. Project-specific layouts belong in registered formatters, so a team can decide how to name symbols, handle ambiguous matches, and emit EAs, RVAs, or file offsets without changing SigMaker core. Loadable examples live in examples/.

Custom batch search formatters

Output conventions vary between reverse-engineering projects. One project may need debugger labels, another C declarations, and another a module-relative map for a loader. The formatter registry lets those conventions remain local while still supporting results.format(...), f-strings, display(), and suffix-based file export.

import sigmaker


@sigmaker.BatchSearchFormatter.register("labels", suffixes=(".labels",))
class LabelFormatter:
    def format(self, results: sigmaker.BatchSearchResults) -> str:
        lines = []
        for result in results:
            if len(result.matches) != 1:
                continue
            name = result.name or result.display_name
            hit = result.matches[0]
            address = f"{hit:rva}" if hit.rva is not None else f"{hit:ea}"
            lines.append(f"{name}: {address}")
        return "\n".join(lines) + "\n"

After registration, results.format("labels") and f"{results:labels}" use the formatter by name. Exporting to something.labels selects it by suffix. Formatter classes are instantiated once at registration time; formatter objects can be registered the same way.

Registration safety

Formatter registration guards existing behavior, including the built-in text, csv, and json formats:

Formatter names and export suffixes must be unique.
A conflicting registration raises ValueError before either registry is changed. The error points to override=True when replacement is intentional.
override=True is required to replace an existing name or rebind an existing suffix:

@sigmaker.BatchSearchFormatter.register(
    "labels",
    suffixes=(".labels",),
    override=True,
)
class ReplacementLabelFormatter:
    ...

One override=True covers both the formatter name and its listed suffixes. Existing suffixes that already point to a replaced name remain valid. This makes replacement explicit without silently disconnecting other suffixes.

Loading personal formatters

To install a formatter permanently, paste its registration code into $IDAUSR/idapythonrc.py. IDA sources that file during startup, so personal and project-specific formats are available in each new IDA session.

If sigmaker is not already importable from your IDA Python environment, add the SigMaker plugin directory to sys.path before the formatter code.

See examples/batch_search_c_formatter.py for a complete C-style formatter template that emits absolute EAs, RVAs, and file offsets while keeping C output out of the built-in format list.

Stability contract

If you embed sigmaker, you can rely on the following. These guarantees are checked before any change to the public surface:

Append-only configuration
- SigMakerConfig fields are never reordered or removed.
- New behavior arrives as new fields with safe defaults, so existing constructions keep working.
Stable public names
- Signature generation
  - SignatureMaker
  - SigMakerConfig
  - SignatureType
    - Stable members: IDA, x64Dbg, Mask, and BitMask.
  - Signature
    - Stable behavior: __len__ and __format__.
  - GeneratedSignature
    - Stable attributes: signature, address, status, and match_count.
  - GenerationPolicy
  - GenerationStatus
- Cross-reference generation
  - XrefFinder
  - XrefGeneratedSignature
    - Stable attribute: signatures.
- Signature search
  - SignatureSearcher
    - Stable attributes: input_signature, name, and source_line.
  - SearchResults
    - Stable attributes: matches, signature_str, raw_pattern, search_pattern, and normalized_signature.
    - Stable method: file_offset_for_match.
  - Match
    - Stable attributes: address, rva, and file_offset.
    - __str__ returns the hexadecimal address.
    - __format__ supports ea, rva, and fileoffset.
  - UIServices
    - Stable attributes: progress and cancel_requested.
    - current() returns the services active in the current context.
    - use(services) scopes services to one context and restores the previous value on exit.
- Optional SIMD compatibility
  - SIMD_SPEEDUP_AVAILABLE reports whether a validated native backend was loaded during import.
  - from sigmaker._speedups import simd_scan remains available when the matching optional speedups wheel is installed.
- Batch search
  - BatchSignatureSearcher
    - Stable attributes: input_text and searchers.
  - BatchSearchResults
    - Stable behavior: __str__ and __format__.
  - BatchSearchFormatter
Stable method signatures
- Signature generation
  - SignatureMaker.make_signature(ea, cfg, end=None, *, progress_reporter=None, policy=GenerationPolicy.strict(), buf=None)
- Cross-reference generation
  - XrefFinder.find_xrefs(ea, cfg)
  - XrefFinder.count_code_xrefs_to(ea)
  - XrefFinder.iter_code_xrefs_to(ea)
- Signature search
  - SignatureSearcher.from_signature(input_signature, *, name=None, source_line=0)
  - SignatureSearcher.from_many(text)
  - UIServices.current()
  - UIServices.use(services)
- Batch search
  - BatchSignatureSearcher.search(*, buf=None, scope_ea=None)
Stable format specifications
- Signature formats keep producing their current output exactly:
  - f"{sig:ida}"
  - f"{sig:x64dbg}"
  - f"{sig:mask}"
  - f"{sig:bitmask}"
- Batch search keeps the registered built-in formatter names:
  - text
  - csv
  - json
Byte-identical defaults
- Production defaults are unchanged across optimizations.
- A script that does not opt into a new flag gets byte-identical signatures to previous versions.

Used by

Projects that build on or embed the sigmaker library:

mrexodia/ida-pro-mcp, an AI reverse-engineering MCP server (8.9k+ stars), vendors a stripped, engine-only copy of sigmaker and exposes signature tools through SigMakerConfig, SignatureType, SignatureMaker().make_signature, and XrefFinder().find_xrefs.
koyzdev/sigdrift is a batch signature-generation script that imports the library and calls SignatureMaker().make_signature(ea, SigMakerConfig(...)) and XrefFinder(), formatting results via f"{sig:ida}" and f"{sig:mask}".

Building something on top of sigmaker? Open a PR or an issue and I will add it here.

Acknowledgements

Thank you to @A200K's IDA-Pro-SigMaker plugin, which served as inspiration and the basis for the initial port of this plugin. I would also like to acknowledge @kweatherman's sigmakerex as independent prior work within the SigMaker ecosystem. While the initial port did not draw from sigmakerex, members of the community later requested compatibility and feature parity with parts of its functionality (for example, see issue #17). As documented in sigmakerex's README credits, there is a long history of SigMaker authors and contributors, and I would like to thank and acknowledge them as well:

thanks to the previous creators of the original SigMaker tool back from the gamedeception.net days up to the current C/C++ and Python iteration authors: P4TR!CK, bobbysing, xero|hawk, ajkhoury, and zoomgod et al.

Thanks to Wojciech Mula for his SIMD programming resources.

Development & Releases

Coverage

The coverage badge reports the latest combined pure-Python unit and IDA integration report from the primary IDA 9.3 test job. Both IDA 9.3 and IDA 9.2 jobs enforce a 90% line-and-branch coverage floor with coverage.py; the badge is a convenient summary, while the CI gate is authoritative. The workflow authenticates its Codecov upload with GitHub OIDC, so maintainers do not need to copy a Codecov token into repository secrets. Forked pull requests use Codecov's public tokenless path when available; coverage upload is non-blocking, while the local 90% CI gate remains authoritative.

Contributing

Fork the repository
Create a feature branch
Make your changes
Test thoroughly
Submit a pull request

The version lives in one place, __version__ in src/sigmaker/__init__.py. To keep ida-plugin.json in step with it automatically, enable the repo's git hook once per clone:

git config core.hooksPath .githooks

The pre-commit hook (.githooks/pre-commit) runs tools/sync_plugin_version.py, which copies __version__ into both the HCLI manifest version and its exact sigmaker==VERSION dependency, then stages the manifest. CI checks the same contract as a backstop for commits that skip the hook.

Contact

ping me on x @mahmoudimus or you may contact me from any one of the addresses on mahmoudimus.com.

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

sigmaker-1.14.2.tar.gz (317.8 kB view details)

Uploaded Jul 21, 2026 Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

sigmaker-1.14.2-cp314-cp314-win_amd64.whl (400.2 kB view details)

Uploaded Jul 21, 2026 CPython 3.14Windows x86-64

sigmaker-1.14.2-cp314-cp314-win32.whl (381.6 kB view details)

Uploaded Jul 21, 2026 CPython 3.14Windows x86

sigmaker-1.14.2-cp314-cp314-musllinux_1_2_x86_64.whl (977.8 kB view details)

Uploaded Jul 21, 2026 CPython 3.14musllinux: musl 1.2+ x86-64

sigmaker-1.14.2-cp314-cp314-musllinux_1_2_aarch64.whl (953.7 kB view details)

Uploaded Jul 21, 2026 CPython 3.14musllinux: musl 1.2+ ARM64

sigmaker-1.14.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl (989.0 kB view details)

Uploaded Jul 21, 2026 CPython 3.14manylinux: glibc 2.17+ x86-64manylinux: glibc 2.28+ x86-64

sigmaker-1.14.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl (976.1 kB view details)

Uploaded Jul 21, 2026 CPython 3.14manylinux: glibc 2.17+ ARM64manylinux: glibc 2.28+ ARM64

sigmaker-1.14.2-cp314-cp314-macosx_11_0_arm64.whl (411.3 kB view details)

Uploaded Jul 21, 2026 CPython 3.14macOS 11.0+ ARM64

sigmaker-1.14.2-cp314-cp314-macosx_10_15_x86_64.whl (412.3 kB view details)

Uploaded Jul 21, 2026 CPython 3.14macOS 10.15+ x86-64

sigmaker-1.14.2-cp313-cp313-win_amd64.whl (392.4 kB view details)

Uploaded Jul 21, 2026 CPython 3.13Windows x86-64

sigmaker-1.14.2-cp313-cp313-win32.whl (374.1 kB view details)

Uploaded Jul 21, 2026 CPython 3.13Windows x86

sigmaker-1.14.2-cp313-cp313-musllinux_1_2_x86_64.whl (977.9 kB view details)

Uploaded Jul 21, 2026 CPython 3.13musllinux: musl 1.2+ x86-64

sigmaker-1.14.2-cp313-cp313-musllinux_1_2_aarch64.whl (948.9 kB view details)

Uploaded Jul 21, 2026 CPython 3.13musllinux: musl 1.2+ ARM64

sigmaker-1.14.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl (990.0 kB view details)

Uploaded Jul 21, 2026 CPython 3.13manylinux: glibc 2.17+ x86-64manylinux: glibc 2.28+ x86-64

sigmaker-1.14.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl (971.3 kB view details)

Uploaded Jul 21, 2026 CPython 3.13manylinux: glibc 2.17+ ARM64manylinux: glibc 2.28+ ARM64

sigmaker-1.14.2-cp313-cp313-macosx_11_0_arm64.whl (404.4 kB view details)

Uploaded Jul 21, 2026 CPython 3.13macOS 11.0+ ARM64

sigmaker-1.14.2-cp313-cp313-macosx_10_13_x86_64.whl (406.0 kB view details)

Uploaded Jul 21, 2026 CPython 3.13macOS 10.13+ x86-64

sigmaker-1.14.2-cp312-cp312-win_amd64.whl (392.7 kB view details)

Uploaded Jul 21, 2026 CPython 3.12Windows x86-64

sigmaker-1.14.2-cp312-cp312-win32.whl (374.2 kB view details)

Uploaded Jul 21, 2026 CPython 3.12Windows x86

sigmaker-1.14.2-cp312-cp312-musllinux_1_2_x86_64.whl (983.6 kB view details)

Uploaded Jul 21, 2026 CPython 3.12musllinux: musl 1.2+ x86-64

sigmaker-1.14.2-cp312-cp312-musllinux_1_2_aarch64.whl (955.1 kB view details)

Uploaded Jul 21, 2026 CPython 3.12musllinux: musl 1.2+ ARM64

sigmaker-1.14.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl (992.1 kB view details)

Uploaded Jul 21, 2026 CPython 3.12manylinux: glibc 2.17+ x86-64manylinux: glibc 2.28+ x86-64

sigmaker-1.14.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl (975.2 kB view details)

Uploaded Jul 21, 2026 CPython 3.12manylinux: glibc 2.17+ ARM64manylinux: glibc 2.28+ ARM64

sigmaker-1.14.2-cp312-cp312-macosx_11_0_arm64.whl (405.2 kB view details)

Uploaded Jul 21, 2026 CPython 3.12macOS 11.0+ ARM64

sigmaker-1.14.2-cp312-cp312-macosx_10_13_x86_64.whl (406.6 kB view details)

Uploaded Jul 21, 2026 CPython 3.12macOS 10.13+ x86-64

sigmaker-1.14.2-cp311-cp311-win_amd64.whl (390.4 kB view details)

Uploaded Jul 21, 2026 CPython 3.11Windows x86-64

sigmaker-1.14.2-cp311-cp311-win32.whl (373.3 kB view details)

Uploaded Jul 21, 2026 CPython 3.11Windows x86

sigmaker-1.14.2-cp311-cp311-musllinux_1_2_x86_64.whl (983.7 kB view details)

Uploaded Jul 21, 2026 CPython 3.11musllinux: musl 1.2+ x86-64

sigmaker-1.14.2-cp311-cp311-musllinux_1_2_aarch64.whl (963.2 kB view details)

Uploaded Jul 21, 2026 CPython 3.11musllinux: musl 1.2+ ARM64

sigmaker-1.14.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl (985.8 kB view details)

Uploaded Jul 21, 2026 CPython 3.11manylinux: glibc 2.17+ x86-64manylinux: glibc 2.28+ x86-64

sigmaker-1.14.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl (977.4 kB view details)

Uploaded Jul 21, 2026 CPython 3.11manylinux: glibc 2.17+ ARM64manylinux: glibc 2.28+ ARM64

sigmaker-1.14.2-cp311-cp311-macosx_11_0_arm64.whl (403.3 kB view details)

Uploaded Jul 21, 2026 CPython 3.11macOS 11.0+ ARM64

sigmaker-1.14.2-cp311-cp311-macosx_10_9_x86_64.whl (404.2 kB view details)

Uploaded Jul 21, 2026 CPython 3.11macOS 10.9+ x86-64

sigmaker-1.14.2-cp310-cp310-win_amd64.whl (390.4 kB view details)

Uploaded Jul 21, 2026 CPython 3.10Windows x86-64

sigmaker-1.14.2-cp310-cp310-win32.whl (373.7 kB view details)

Uploaded Jul 21, 2026 CPython 3.10Windows x86

sigmaker-1.14.2-cp310-cp310-musllinux_1_2_x86_64.whl (947.7 kB view details)

Uploaded Jul 21, 2026 CPython 3.10musllinux: musl 1.2+ x86-64

sigmaker-1.14.2-cp310-cp310-musllinux_1_2_aarch64.whl (929.1 kB view details)

Uploaded Jul 21, 2026 CPython 3.10musllinux: musl 1.2+ ARM64

sigmaker-1.14.2-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl (951.7 kB view details)

Uploaded Jul 21, 2026 CPython 3.10manylinux: glibc 2.17+ x86-64manylinux: glibc 2.28+ x86-64

sigmaker-1.14.2-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl (944.5 kB view details)

Uploaded Jul 21, 2026 CPython 3.10manylinux: glibc 2.17+ ARM64manylinux: glibc 2.28+ ARM64

sigmaker-1.14.2-cp310-cp310-macosx_11_0_arm64.whl (403.8 kB view details)

Uploaded Jul 21, 2026 CPython 3.10macOS 11.0+ ARM64

sigmaker-1.14.2-cp310-cp310-macosx_10_9_x86_64.whl (404.6 kB view details)

Uploaded Jul 21, 2026 CPython 3.10macOS 10.9+ x86-64

File details

Details for the file sigmaker-1.14.2.tar.gz.

File metadata

Download URL: sigmaker-1.14.2.tar.gz
Upload date: Jul 21, 2026
Size: 317.8 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for sigmaker-1.14.2.tar.gz
Algorithm	Hash digest
SHA256	`0aa7132fd22b0c7d3d5ac3056e02b3e906b226e0edcb21c86863446d74ae9b92`
MD5	`749d3829f61ffa50cee4da6dac9bd50e`
BLAKE2b-256	`4165fcf69d87b42627a45ee4a220f1c7576d91bef75883ef55fa18423507a282`

Algorithm	Hash digest
SHA256	`5a43435e2ad8eb1878bcfe76f8d5819947deac5ed84d9ff5bcc1c57a527f98db`
MD5	`6acd98cf8b3c07351cba6cc911c6a358`
BLAKE2b-256	`73010bc7396d156d8a05a498adfd607fa7d90e46826f9a31b58ead46b774f029`

Algorithm	Hash digest
SHA256	`f168796afa8ccbf48761943cccb19791ddc2d3228e66ef8149a31e035e5cedb5`
MD5	`1449d52b8962d22979bf9e158cf30161`
BLAKE2b-256	`7d73854e3c9b2e8365f3cb6eb101cdd69cefad70ef6fefb38eb67a431bae08b9`

Algorithm	Hash digest
SHA256	`9454f2d5807d1c359110610192a6c43c9ec3661c645072b49cc68f485f3d8571`
MD5	`5312a42cee66dc5493f66b282ee95a11`
BLAKE2b-256	`1afaaa5fffb1848fe2c544b06add7a448bdd7fe95ba10f469840bdab4631f34f`

Algorithm	Hash digest
SHA256	`df8fe78df97211f7352b9cfbff9acb3a26715411233a21ae901f2342f8e890e6`
MD5	`7727685cfe0b148da5f908491b66039f`
BLAKE2b-256	`cf2ccf4e1a09832235f411e6a54be9c67933ade10455a774ac42e5741ed96d27`

Algorithm	Hash digest
SHA256	`f06a1f41c199b20025d4531c27efff551091b0bc13221d677515967981a4fe64`
MD5	`344e8b49b591ad14129c9b79a9693b15`
BLAKE2b-256	`dd4e3b4faabf72fb874efe35b8f1472b6083c61fde8bde29bbfd349e8c725d62`

Algorithm	Hash digest
SHA256	`f236d9f28a957cbae0955d0c8f070accd60239adc550d493e5d4563266d50b5c`
MD5	`192fe7b0874c742c8eb7352e7f725b89`
BLAKE2b-256	`8f8c3b93ee9fec5c4191f13deca42d9e2e57d65fe740c0c63d8d1b8f0600e91d`

Algorithm	Hash digest
SHA256	`bcb2fd70789cc196bcd2ea491192d3f475df33fa9e9b8dde6a641abc51de834f`
MD5	`ff36a1ba48e3624ffc3c15361d39c330`
BLAKE2b-256	`4cbe8ac867fec69cc583ae351691383e460e59760eedec9a382f4572ba98d184`

Algorithm	Hash digest
SHA256	`f8065466679962c35b444772f5c78d250622d2722757e3cc86ddd052f18d8172`
MD5	`61166ba5b40483cf30a866ed8bc06e65`
BLAKE2b-256	`6a114dbc5d0d62f194e731cd91cea845084a6178c30415459f8469e109fffeeb`

Algorithm	Hash digest
SHA256	`e1a6389cd83535136f11da4fbd60ae2b5d225b4c55ae7e41f3e7fe9be11dd114`
MD5	`afe993be0188885ed0aa346b3be14b00`
BLAKE2b-256	`e34e0e92e7b5b03b887fb8b1df192902a88aee2e2805793cdc5c51f0658b094d`

Algorithm	Hash digest
SHA256	`41d4e7224d85556c4df444efd78af883a2551e5b7d34ef2fae848782c04db06a`
MD5	`899c1e38570be0fbb0c4dcb0399e25a6`
BLAKE2b-256	`cc9ca06269bfc3269702a7d84d4f4aa97c86cbafee2f06e05a688f9744edfbd9`

Algorithm	Hash digest
SHA256	`f67146e3a85fa9801f1fd30d7c24494c134756166db9c12b2a644a7433643f7b`
MD5	`bf0fa83ba8cc18d14d419ce72fd99d92`
BLAKE2b-256	`81ea6a081d556d72f9f39afa63d0deb35fbb59dbe37a752368bddedada297709`

Algorithm	Hash digest
SHA256	`0141caf6cff113b0629e6ec39dec1d18060adb826ff2264efbd433478e1cf126`
MD5	`d1e3411b035b8b5d8f1eee5a648a9925`
BLAKE2b-256	`57a6baac2c85183e4f6517a72f017175a230b20f63ddba2f9dedad94bdf5c47e`

Algorithm	Hash digest
SHA256	`99766ec1ba768f9b4d8b3c1f758662a17dce9ede93c2be1de3a67180f5682154`
MD5	`2a100f67766bfde282a7a466b6a8b1d5`
BLAKE2b-256	`ba49f14a36cc3a368693c5871edba4dfb44c2b8160de975ac2b80dae4802808c`

Algorithm	Hash digest
SHA256	`de9ce91733d45bf7dfecce08aec31d94828818c0b9d7eaee48d8a05e5a5c9f44`
MD5	`cd282ca036636a6cf15c9648a4ba632b`
BLAKE2b-256	`de0d7465cac7a1e6eefe254fc4b25c641d65b44ec11e3dd633d4e428bb39b855`

Algorithm	Hash digest
SHA256	`aaf17d80f262fd334b4371dc1fbc702e1ee0fedc458db317b06c3935041a593c`
MD5	`6de0118e418b96ad2b331754b6751211`
BLAKE2b-256	`1eec744bace143ae6dcc663c9ba2f7ad11183573ee2d99e0d3b144c84d961545`

Algorithm	Hash digest
SHA256	`d9f688e534fb7c07880720379a2858e66aab2de0c6dc7fc55cef355c72e5f252`
MD5	`d1ccb53bfae5f1ea46159dc02cd03951`
BLAKE2b-256	`3940e199fa2ca56e2f38e76b18d24f724146409d3fa27bc7d697710e900b41e0`

Algorithm	Hash digest
SHA256	`bd0335034a7ec968e18ed6087ac85c07356cb5abe0ceb3deaf8636b38a375b93`
MD5	`1eac6c446a2398383a0190b35f2966bc`
BLAKE2b-256	`a262336e3866fcfadb69412059ca214bb8de19c7306e675e87fa419c9d1a3302`

Algorithm	Hash digest
SHA256	`54dc4401cb3c4bb9e5b275540b608893f1b6badf0079ae6d4b2ff86a744a40fd`
MD5	`e66b2a2d5cb15b2bc487a774aeb8f12b`
BLAKE2b-256	`742ce7a1f6b07dd11e4d68dc493f76cce1df0065cbdc8485e347fdd4648585a9`

Algorithm	Hash digest
SHA256	`3e1ff38245cd9a7690570449e6af092adaa7b7cab9aefac81ff3039ec1bd1829`
MD5	`2c5cbeeeb16590ab1e5cb0a4bc20f495`
BLAKE2b-256	`5c6dc8e6880340f6d21f6113d93b499db980acaef4d760424d845b597e0b24e8`

Algorithm	Hash digest
SHA256	`b5e8f1ef41eee365a68b7d7d276cc6b56828d066b43c916af14dea1293ddd6cc`
MD5	`75f549c8615280b39121ebf3889dfab8`
BLAKE2b-256	`b25e986976438502705bbf232ddd0d8da7ce43e5976ad52010502ae09faeb8c7`

sigmaker 1.14.2

Signature Maker Plugin for IDA Pro 9.0+

Table of contents

Installation

Quick Install

From Releases

Install with hcli

Need to find your plugin directory?

Where and what is my default user directory?

SIMD Speedups

Compatibility and updates

SIMD Enabled

No SIMD Speedups

Requirements

Processor support

What is a "sigmaker"?

Usage

Finding XREFs

Signature searching

Signature Configuration

Performance

Benchmarks

How it works

Using SigMaker as a library

Batch search API

Why batch search?

Search a batch

Input format

Results

Match addresses and offsets

Scope, buffer reuse, and cancellation

GUI and headless embedding

Display and export

Custom batch search formatters

Registration safety

Loading personal formatters

Stability contract

Used by

Acknowledgements

Development & Releases

Coverage

Contributing

Contact

Project links

Key dates

1 maintainer

Credits

GitHub Statistics

License expression

Requires

Provides Extra

Tags

Classifiers

Download files

Source Distribution

Built Distributions

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

Algorithm	Hash digest
SHA256	`9f94ad33d9ab0edc8c08e6ba9a17e790cdb73a72c0cec79b168373ccb0889152`
MD5	`5736eab2a922f9507088eeaf97208c8a`
BLAKE2b-256	`2254e05e53c86307384c768aa1fbdc7f35253a7f15a9a1949f190863bf9e26ab`

Algorithm	Hash digest
SHA256	`50f03f1185a3178b351119618f9e8ec3945f20008d453c687ba2701a415109b2`
MD5	`918b30a2c995561b5ce32e70a32e4d9b`
BLAKE2b-256	`86d1b09b9213a9ba3efac08f513288571af6969864d0a6988a3ba4ed1139a4db`

Algorithm	Hash digest
SHA256	`075a5a2e6a1bb401d187267fb24f2d602cb4a19f1af381ed2358f2ee92f504c4`
MD5	`c65ec8e789fc9fd680875e6ddadbf08b`
BLAKE2b-256	`63b552ce60497bc5096c3cec5e305cce037d7dca2eee228344a7f0231a4bffea`

Algorithm	Hash digest
SHA256	`28312109952cced1c4f37f18f3be14a38925d446e98d048afadfd5b5db9c853f`
MD5	`82c74e57c4843d85d9f2d653ce18d260`
BLAKE2b-256	`8980011899c5cafe7efa96be0a1390e3aef01933c016b00ed9c387c2eab971c8`

Algorithm	Hash digest
SHA256	`45e500d158ce2938621cf6dd81cbe961f36321653a30e31b975520e32b52a325`
MD5	`9409fa630bde241907f12cecd769b6b7`
BLAKE2b-256	`01650409f594b466fa5f4d1f63f5e88ea9d56e80c0e2393265a475d3d3a821a5`

Algorithm	Hash digest
SHA256	`bc49549a93c18c9c08aba6d6c359ac3ab4cf323d22be167037c55cd4fd9399a0`
MD5	`86b930141c186dfcdf1e31ba23d8bf3e`
BLAKE2b-256	`d932d0565d29989a0fab54a6a5d71e5daecf5eecfd5ca1325950dc25b2e68e7c`

Algorithm	Hash digest
SHA256	`8a7fc96a1098a9839dbef7b33e7974394c336cf1c31df857ae53c7e3350a69e8`
MD5	`71a66bd137d96f5760743aa7bf026285`
BLAKE2b-256	`0a3726c5e3e978a35efcccee1a4ad500e4d9b70cb4e49dfbf4b7450c6b702d74`

Algorithm	Hash digest
SHA256	`fa622a7485964f9d9b1a76a296b68fd402fbdc62707706e52793a58507290159`
MD5	`4033c2956742b0a3fe523e4bfc005ac1`
BLAKE2b-256	`cc3d874f00fc92c94791929275153715609fa21b588274bc811eb1a04b8e5fc2`

Algorithm	Hash digest
SHA256	`a53421c15072a5f0ed867dfd13d3df54e33983cf11d10204f4cfdf3ef0f9a2e5`
MD5	`511b1222cfad4dfe950587d60bad2a69`
BLAKE2b-256	`1b8f4f40e0cfbf684faceaa68f0574b013d4fde1dbd9545f4e1a4b2f1fdfad5d`

Algorithm	Hash digest
SHA256	`bda06ba742ff41f50cd8812bb172133ea857389e94a85927076d69c86e633062`
MD5	`1ee02e1738089dfe1ce478ad99a395ba`
BLAKE2b-256	`7cc886dcffbb715a34205097b37a674530c18487d78a58447f2d441cb17e0906`