Open-source equivalent for FLIRT

Question

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.

Right now, the only way I can do that is to use IDA's FLIRT (Fast Library Identification and Recognition Technology) engine to mark the RVA of these functions and use this database as reference in my program.

My question is whether there are any open-source/free equivalents engines that can be embedded inside my C program in order to recognize known-functions using heuristics?

Answer 1

There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API.

There are options to support:

1. FLIRT itself - r2 supports this format (see 'zF' commands)
2. Zignatures - internal format of r2 (see 'z?' command for help)
3. Yara signatures - requires an installed yara plugin via r2pm (provides a 'yara' command)

Answer 2

There is also Sibyl, an open-source tool based on Miasm2 that performs function divination.