6 votes

Open-source equivalent for FLIRT

There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API. There are options to support: FLIRT ...
Anton Kochkov's user avatar
5 votes

Importance of Compiler Version in generating a signature

Yes, getting the compiler version right is pretty important, as well as the compilation options. FLIRT relies on fixed byte patterns and does not tolerate even slight differences in the generated ...
Igor Skochinsky's user avatar
  • 36.6k
4 votes

Open-source equivalent for FLIRT

There is also Sibyl, an open-source tool based on Miasm2 that performs function divination.
W. Bruneau's user avatar
3 votes

How to generate IDA FLIRT signatures for Qt 5.5.1

You need to build Qt 5.5.1 using MinGw 4.9.2. and guess all the build options that the developer used originally. Then use FLAIR for you IDA version to generate pat files from .a libraries. Then ...
Anton Kukoba's user avatar
  • 1,840
2 votes

Best Way to Identify Statically Linked Functions in Firmware

Using FLIRT for C code requires you to know the exact version of CRT and the exact flags of the compilation so that you could build it yourself and then, having all the binaries and debug symbols, ...
Anton Kukoba's user avatar
  • 1,840
2 votes

Best Way to Identify Statically Linked Functions in Firmware

There is a project called Sibyl based on the symbolic execution framework miasm. They basically call each unknown function with test cases until it passes all test cases for a given hypothesis. E.g. ...
manduca's user avatar
  • 351
2 votes

IDA FLAIR doesn't see sig files

You need to place them into a cpu specific subdirectory, e.g. pc.
Igor Skochinsky's user avatar
  • 36.6k
1 vote
Accepted

IDA and flirt signatures

Alas RISC instruction sets like PowerPC are often not a good fit for FLIRT. I you read the white paper (or even the FLAIR doc), you'll see that it only has provision for variable bytes, while in Power ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Creating FLIRT Signature Files for new CPU

IDAPython - you can automate almost everything in IDA with IDAPython or IDC. The hard part is that it's not very well explained. There are a few things that can help: All menu actions can be linked ...
Eli K's user avatar
  • 151

Only top scored, non community-wiki answers of a minimum length are eligible