Questions tagged [flirt-signatures]
The flirt-signatures tag has no usage guidance.
19
questions
3
votes
0
answers
564
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 185
1
vote
1
answer
370
views
Is there any way to apply FLIRT signatures through a script like idapython?
I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
1
vote
1
answer
480
views
IDA FLAIR doesn't see sig files
I've added the following sig files which were generated using flair 7.0 to ida 7.0
I want ida to find known function names from the sig files,
when I list the FLIRT signature files I don't see the ...
- 11
1
vote
1
answer
1k
views
IDA and flirt signatures
I have 2 binaries, with the same CPU architecture.
I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it.
I put the ...
- 1,848
3
votes
0
answers
894
views
How does IDA apply its FLIRT signatures and how are they licenced?
I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
- 173
5
votes
1
answer
395
views
Importance of Compiler Version in generating a signature
I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake.
I then use the signature file (in the appropriate IDA Pro ...
- 173
1
vote
1
answer
683
views
FLIRT Signature Applied, IDA shows references but no auto rename?
So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this:
Which I am understanding that somewhere in this program they have statically linked a Lua C or ...
- 11
7
votes
2
answers
896
views
Best Way to Identify Statically Linked Functions in Firmware
I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
- 71
4
votes
1
answer
2k
views
How to generate IDA FLIRT signatures for Qt 5.5.1
I am trying to reverse engineer an executable which uses Qt 5.5.1 graphic library and is compiled with MinGw 4.9.2. When i open it with IDA pro 6.8 all of the code appears as user code, without any ...
- 178
2
votes
1
answer
860
views
Creating FLIRT Signature Files for new CPU
I have writen a new processor module for M-CORE CPU, now i want to generate FLIRT Signature Files for this cpu.
the problème is that FLIRT tools like pelf.exe dose not recognize the CPU type.
What ...
- 111
9
votes
2
answers
2k
views
Open-source equivalent for FLIRT
I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.
Right now, the only way I can do that is to use IDA's FLIRT (...
- 337
2
votes
1
answer
3k
views
IDA Pro and recognized library functions
I start by saying that I'm completely new to the topic of reversing although I have many years of experience with programming in general.
I've some problems with automatic recognition of library ...
- 195
5
votes
1
answer
5k
views
How to create a IDA FLIRT signature for a PPC library?
I'd like to create a IDA FLIRT signature for the following PPC uClibc library:
libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
- 227
3
votes
1
answer
11k
views
IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection
I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures.
A lot of standard C++ functions are not being recognized ...
- 346
3
votes
1
answer
2k
views
Unable to create FLIRT signature for IDA
I'm trying to create a .sig file for sqlite3. I downloaded the source code from the website, compiled it into a .lib (smoothly), and this is what I get when I try to turn it into a .pat file:
plb.exe ...
- 147
2
votes
0
answers
573
views
IDA Signatures for OpenSSL [duplicate]
This may be an old topic, but I still haven't find a solution. Sometimes happens to reverse Windows executables that contain strings clearly related to encryption algorithms implemented through ...
- 71
12
votes
3
answers
2k
views
IDA plugin/script for generating signature statistics (for all sigs) for a target?
I have more than 40 different IDA signature files (besides the built-in ones) and sometimes I don't want to go through the hassle of examining what signatures may be relevant for a given target. ...
- 221
37
votes
3
answers
24k
views
What is a FLIRT signature?
I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
- 4,056
9
votes
1
answer
455
views
Equivalent of IDA FLIRT signatures for GDB?
Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers?
Is it at all possible with GDB/objdump?
- 293