mirror of
https://github.com/mandiant/speakeasy.git
synced 2026-10-12 11:19:52 +00:00
The signature database answers only permissive lookups: a name can match through DLL aliases, name prefixes or another DLL's declaration. That is useful to format handler arguments, but it cannot tell which functions a module really declares or whether the generic executor can run a declaration. SignatureSource now has iter_functions, which lists the declarations of one DLL for the architecture in name order, with no aliases, name prefixes or declarations of other DLLs. SignatureDatabase.get_functions maps these declarations to their signatures with source precedence and keeps the map until a source is added. Win32MetadataSource keeps a per-DLL index so that a listing does not scan the whole table. FuncSig.supports_emulation tells whether the integer-slot executor can run a declaration. An explicit empty arch list now means no architecture in lookup as well. The unified API commit uses these methods to build synthetic export tables and to gate generic dispatch. The win32metadata archive is now win32json_signatures.json.gz, so that its name states its source next to phnt_signatures.json.gz. A source checkout must run `just gen-signatures` or reinstall to create it.