Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [flirt-signatures]

The tag has no usage guidance.

0
votes
0answers
24 views

IDA FLIRT signatures for externs?

I have a simple bit of code, that's invoking OpenSSL. Disassembly shows an expected call; int __cdecl BN_bin2bn(int a1, int a2, int a3) { return BN_bin2bn(a1, a2, a3); } Which points BN_bin2bn to ...
3
votes
1answer
42 views

Importance of Compiler Version in generating a signature

I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake. I then use the signature file (in the appropriate IDA Pro ...
1
vote
1answer
96 views

FLIRT Signature Applied, IDA shows references but no auto rename?

So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this: Which I am understanding that somewhere in this program they have statically linked a Lua C or ...
6
votes
2answers
234 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
2
votes
1answer
467 views

How to generate IDA FLIRT signatures for Qt 5.5.1

I am trying to reverse engineer an executable which uses Qt 5.5.1 graphic library and is compiled with MinGw 4.9.2. When i open it with IDA pro 6.8 all of the code appears as user code, without any ...
3
votes
1answer
439 views

Creating FLIRT Signature Files for new CPU

I have writen a new processor module for M-CORE CPU, now i want to generate FLIRT Signature Files for this cpu. the problème is that FLIRT tools like pelf.exe dose not recognize the CPU type. What ...
8
votes
2answers
623 views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
2
votes
1answer
1k views

IDA Pro and recognized library functions

I start by saying that I'm completely new to the topic of reversing although I have many years of experience with programming in general. I've some problems with automatic recognition of library ...
5
votes
1answer
3k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
3
votes
1answer
6k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
3
votes
1answer
912 views

Unable to create FLIRT signature for IDA

I'm trying to create a .sig file for sqlite3. I downloaded the source code from the website, compiled it into a .lib (smoothly), and this is what I get when I try to turn it into a .pat file: plb.exe ...
2
votes
0answers
115 views

IDA Signatures for OpenSSL [duplicate]

This may be an old topic, but I still haven't find a solution. Sometimes happens to reverse Windows executables that contain strings clearly related to encryption algorithms implemented through ...
11
votes
3answers
1k views

IDA plugin/script for generating signature statistics (for all sigs) for a target?

I have more than 40 different IDA signature files (besides the built-in ones) and sometimes I don't want to go through the hassle of examining what signatures may be relevant for a given target. ...
29
votes
3answers
13k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
9
votes
1answer
370 views

Equivalent of IDA FLIRT signatures for GDB?

Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers? Is it at all possible with GDB/objdump?