7
votes
Accepted
Unable to create FLIRT signature for IDA
plb.exe is designed for OMF libraries (primarily used for 16 bit Borland compilers). What you probably want is pcf.exe, which parses COFF libraries commonly used in 32 bit windows.
- 1,561
5
votes
Importance of Compiler Version in generating a signature
Yes, getting the compiler version right is pretty important, as well as the compilation options.
FLIRT relies on fixed byte patterns and does not tolerate even slight differences in the generated ...
- 34.7k
5
votes
Open-source equivalent for FLIRT
There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API.
There are options to support:
FLIRT ...
- 644
4
votes
IDA Pro and recognized library functions
Oh, the happyness of near functions vs. far functions, near pointers vs. far pointers, and mixed models (far functions, near pointers)
Back in the 16 bit world, programs could either
use a maximum ...
- 12.7k
4
votes
Open-source equivalent for FLIRT
There is also Sibyl, an open-source tool based on Miasm2 that performs function divination.
- 53
3
votes
How to generate IDA FLIRT signatures for Qt 5.5.1
You need to build Qt 5.5.1 using MinGw 4.9.2. and guess all the build options that the developer used originally. Then use FLAIR for you IDA version to generate pat files from .a libraries. Then ...
- 1,750
2
votes
Accepted
How to create a IDA FLIRT signature for a PPC library?
AFAIK, you can only create the .pat files from statically linked libraries using the method you describe. It appears your file is dynamically linked (that would explain the 'invalid input file' ...
- 991
2
votes
IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection
Read this here:
https://www.hex-rays.com/products/ida/tech/flirt/index.shtml
I think they overhauled the FLIRT system in a recent version of IDA.
Overall it works pretty well, but there is a lot of ...
- 241
2
votes
Best Way to Identify Statically Linked Functions in Firmware
Using FLIRT for C code requires you to know the exact version of CRT and the exact flags of the compilation so that you could build it yourself and then, having all the binaries and debug symbols, ...
- 1,750
2
votes
Best Way to Identify Statically Linked Functions in Firmware
There is a project called Sibyl based on the symbolic execution framework miasm. They basically call each unknown function with test cases until it passes all test cases for a given hypothesis.
E.g. ...
- 341
2
votes
IDA FLAIR doesn't see sig files
You need to place them into a cpu specific subdirectory, e.g. pc.
- 34.7k
1
vote
Accepted
IDA and flirt signatures
Alas RISC instruction sets like PowerPC are often not a good fit for FLIRT. I you read the white paper (or even the FLAIR doc), you'll see that it only has provision for variable bytes, while in Power ...
- 34.7k
1
vote
Creating FLIRT Signature Files for new CPU
IDAPython - you can automate almost everything in IDA with IDAPython or IDC.
The hard part is that it's not very well explained. There are a few things that can help:
All menu actions can be linked ...
- 151
Only top scored, non community-wiki answers of a minimum length are eligible