Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

The tag has no usage guidance.

1
vote
1answer
72 views

FLIRT Signature Applied, IDA shows references but no auto rename?

So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this: Which I am understanding that somewhere in this program they have statically linked a Lua C or ...
6
votes
2answers
181 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
2
votes
1answer
378 views

How to generate IDA FLIRT signatures for Qt 5.5.1

I am trying to reverse engineer an executable which uses Qt 5.5.1 graphic library and is compiled with MinGw 4.9.2. When i open it with IDA pro 6.8 all of the code appears as user code, without any ...
3
votes
1answer
385 views

Creating FLIRT Signature Files for new CPU

I have writen a new processor module for M-CORE CPU, now i want to generate FLIRT Signature Files for this cpu. the problème is that FLIRT tools like pelf.exe dose not recognize the CPU type. What ...
8
votes
2answers
540 views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
2
votes
1answer
1k views

IDA Pro and recognized library functions

I start by saying that I'm completely new to the topic of reversing although I have many years of experience with programming in general. I've some problems with automatic recognition of library ...
5
votes
1answer
3k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
3
votes
1answer
5k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
3
votes
1answer
845 views

Unable to create FLIRT signature for IDA

I'm trying to create a .sig file for sqlite3. I downloaded the source code from the website, compiled it into a .lib (smoothly), and this is what I get when I try to turn it into a .pat file: plb.exe ...
2
votes
0answers
67 views

IDA Signatures for OpenSSL [duplicate]

This may be an old topic, but I still haven't find a solution. Sometimes happens to reverse Windows executables that contain strings clearly related to encryption algorithms implemented through ...
11
votes
3answers
948 views

IDA plugin/script for generating signature statistics (for all sigs) for a target?

I have more than 40 different IDA signature files (besides the built-in ones) and sometimes I don't want to go through the hassle of examining what signatures may be relevant for a given target. ...
29
votes
3answers
13k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
9
votes
1answer
364 views

Equivalent of IDA FLIRT signatures for GDB?

Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers? Is it at all possible with GDB/objdump?