Questions tagged [flirt-signatures]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
76 views

Is there any way to apply FLIRT signatures through a script like idapython?

I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
1
vote
1answer
98 views

IDA FLAIR doesn't see sig files

I've added the following sig files which were generated using flair 7.0 to ida 7.0 I want ida to find known function names from the sig files, when I list the FLIRT signature files I don't see the ...
1
vote
1answer
651 views

IDA and flirt signatures

I have 2 binaries, with the same CPU architecture. I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it. I put the ...
3
votes
0answers
426 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
4
votes
1answer
273 views

Importance of Compiler Version in generating a signature

I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake. I then use the signature file (in the appropriate IDA Pro ...
1
vote
1answer
408 views

FLIRT Signature Applied, IDA shows references but no auto rename?

So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this: Which I am understanding that somewhere in this program they have statically linked a Lua C or ...
7
votes
2answers
729 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
4
votes
1answer
2k views

How to generate IDA FLIRT signatures for Qt 5.5.1

I am trying to reverse engineer an executable which uses Qt 5.5.1 graphic library and is compiled with MinGw 4.9.2. When i open it with IDA pro 6.8 all of the code appears as user code, without any ...
2
votes
1answer
690 views

Creating FLIRT Signature Files for new CPU

I have writen a new processor module for M-CORE CPU, now i want to generate FLIRT Signature Files for this cpu. the problème is that FLIRT tools like pelf.exe dose not recognize the CPU type. What ...
9
votes
2answers
1k views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
2
votes
1answer
2k views

IDA Pro and recognized library functions

I start by saying that I'm completely new to the topic of reversing although I have many years of experience with programming in general. I've some problems with automatic recognition of library ...
5
votes
1answer
4k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
3
votes
1answer
9k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
3
votes
1answer
1k views

Unable to create FLIRT signature for IDA

I'm trying to create a .sig file for sqlite3. I downloaded the source code from the website, compiled it into a .lib (smoothly), and this is what I get when I try to turn it into a .pat file: plb.exe ...
2
votes
0answers
484 views

IDA Signatures for OpenSSL [duplicate]

This may be an old topic, but I still haven't find a solution. Sometimes happens to reverse Windows executables that contain strings clearly related to encryption algorithms implemented through ...
11
votes
3answers
1k views

IDA plugin/script for generating signature statistics (for all sigs) for a target?

I have more than 40 different IDA signature files (besides the built-in ones) and sometimes I don't want to go through the hassle of examining what signatures may be relevant for a given target. ...
32
votes
3answers
20k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
9
votes
1answer
420 views

Equivalent of IDA FLIRT signatures for GDB?

Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers? Is it at all possible with GDB/objdump?