8

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.

Right now, the only way I can do that is to use IDA's FLIRT (Fast Library Identification and Recognition Technology) engine to mark the RVA of these functions and use this database as reference in my program.

My question is whether there are any open-source/free equivalents engines that can be embedded inside my C program in order to recognize known-functions using heuristics?

5

There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API.

There are options to support:

  1. FLIRT itself - r2 supports this format (see 'zF' commands)
  2. Zignatures - internal format of r2 (see 'z?' command for help)
  3. Yara signatures - requires an installed yara plugin via r2pm (provides a 'yara' command)
| improve this answer | |
3

There is also Sibyl, an open-source tool based on Miasm2 that performs function divination.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.