7 votes
Accepted

Unable to create FLIRT signature for IDA

plb.exe is designed for OMF libraries (primarily used for 16 bit Borland compilers). What you probably want is pcf.exe, which parses COFF libraries commonly used in 32 bit windows.
user avatar
  • 1,561
5 votes

Importance of Compiler Version in generating a signature

Yes, getting the compiler version right is pretty important, as well as the compilation options. FLIRT relies on fixed byte patterns and does not tolerate even slight differences in the generated ...
user avatar
  • 34.7k
5 votes

Open-source equivalent for FLIRT

There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API. There are options to support: FLIRT ...
user avatar
4 votes

IDA Pro and recognized library functions

Oh, the happyness of near functions vs. far functions, near pointers vs. far pointers, and mixed models (far functions, near pointers) Back in the 16 bit world, programs could either use a maximum ...
user avatar
4 votes

Open-source equivalent for FLIRT

There is also Sibyl, an open-source tool based on Miasm2 that performs function divination.
user avatar
3 votes

How to generate IDA FLIRT signatures for Qt 5.5.1

You need to build Qt 5.5.1 using MinGw 4.9.2. and guess all the build options that the developer used originally. Then use FLAIR for you IDA version to generate pat files from .a libraries. Then ...
user avatar
  • 1,750
2 votes
Accepted

How to create a IDA FLIRT signature for a PPC library?

AFAIK, you can only create the .pat files from statically linked libraries using the method you describe. It appears your file is dynamically linked (that would explain the 'invalid input file' ...
user avatar
2 votes

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

Read this here: https://www.hex-rays.com/products/ida/tech/flirt/index.shtml I think they overhauled the FLIRT system in a recent version of IDA. Overall it works pretty well, but there is a lot of ...
user avatar
  • 241
2 votes

Best Way to Identify Statically Linked Functions in Firmware

Using FLIRT for C code requires you to know the exact version of CRT and the exact flags of the compilation so that you could build it yourself and then, having all the binaries and debug symbols, ...
user avatar
  • 1,750
2 votes

Best Way to Identify Statically Linked Functions in Firmware

There is a project called Sibyl based on the symbolic execution framework miasm. They basically call each unknown function with test cases until it passes all test cases for a given hypothesis. E.g. ...
user avatar
  • 341
2 votes

IDA FLAIR doesn't see sig files

You need to place them into a cpu specific subdirectory, e.g. pc.
user avatar
  • 34.7k
1 vote
Accepted

IDA and flirt signatures

Alas RISC instruction sets like PowerPC are often not a good fit for FLIRT. I you read the white paper (or even the FLAIR doc), you'll see that it only has provision for variable bytes, while in Power ...
user avatar
  • 34.7k
1 vote

Creating FLIRT Signature Files for new CPU

IDAPython - you can automate almost everything in IDA with IDAPython or IDC. The hard part is that it's not very well explained. There are a few things that can help: All menu actions can be linked ...
user avatar
  • 151

Only top scored, non community-wiki answers of a minimum length are eligible