# IDA Feeds

## IDA Feeds

Starting with IDA 9.0, we introduced IDA Feeds (aka FLIRT Signature Manager), the tool designed to ease the application of new signatures through updatable libraries, (known as **IDA FLIRT Signature Bundles**), shipped alongside other IDA plugins just out-of-the-box.

## What is IDA Feeds?

Ida Feeds helps you identify which signatures to apply when analyzing binary files, especially when you don't know which static libraries were linked to them. Rather than manually applying signatures, IDA Feeds automatically scans and applies many signatures in seconds. Just open the signature folder, allow IDA to scan and find the possible matches, and then bulk apply the suggested signatures.

IDA Feeds uses the [**FLIRT Signature Bundles**](https://docs.hex-rays.com/9.0/user-guide/plugins/plugins-shipped-with-ida/ida-feeds/flirt-signature-bundle), which are going to be regularly updated and released to keep you up to date with the newest recognizable signatures.

## IDA Feeds configuration and setup

The proper configuration of the plugin is required to start using IDA Feeds and make it visible in the plugins list under **Edit -> Plugins** submenu.

### Prerequisites

* idalib configured properly (check [idalib installation](https://docs.hex-rays.com/9.0/idalib#installation-for-python) and [activation steps](https://docs.hex-rays.com/9.0/idalib#setting-up-the-ida-library-python-module))
* Downloaded the latest IDA FLIRT Signature Bundle. You can get it from our [Download Center in My Hex-Rays portal](https://my.hex-rays.com/dashboard/download-center/downloads) under **SDK and utilities**.

### Install and activate your virtual environment

We recommend using IDA Feeds from within your Python virtual environment (venv). To do so, ensure you have created and activated your virtual environment before proceeding.

#### Linux & macOS

1. Create a Python virtual environment at your preferred location

   ```
   `python -m venv ~/.idapro/venv`
   ```

   Replace `~/.idapro/venv` with your path.
2. Activate your virtual environment

   ```
   source ~/.idapro/venv/bin/activate
   ```

#### Windows

1. Create a Python virtual environment at your preferred location

   ```
   python -m venv %YOURPROFILE%\.idapro\venv

   ```

   Replace `.idapro\venv` with your path.
2. Activate your virtual environment

   ```
   %YOURPROFILE%\.idapro\venv\Scripts\activate

   ```

### Installing requirements/dependencies

Install requirements for Python modules from within your virtual environment.

1. Navigate to the `plugin/ida_feeds` folder within the IDA Pro installation directory and install the requirements.

```
python3 -m pip install -r requirements.txt
```

2. Create symbolic link (optional)

**Linux & OSX**

```
ln -s $(pwd) $HOME/.idapro/plugins/ida_feeds
```

**Windows**

```
mklink /D "%APPDATA%\Hex-Rays\IDA Pro\plugins\ida_feeds" "%cd%"
```

After successfully performing these steps, IDA Feeds plugin should be visible in the **Edit -> Plugins** submenu and ready to try.

## How to use IDA Feeds?

To use IDA Feeds, you need to [configure the plugin](#ida-feeds-configuration-and-setup) first.

1. Go to the **Edit -> Plugins -> IDA Feeds**. IDA Feeds will open in a new **Signature Tools** subview.
2. In the **Signature Tools** window, click **Open signatures folder** and select the folder with the downloaded FLIRT signature bundle (1), or leave the preloaded signatures already provided with your IDA instance.

![](https://3101246880-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7BOcMAWP0fQxJv6opQQC%2Fuploads%2Fgit-blob-a1da81ff166e01e39fe9d7875fb84594254ba35f%2Fida-feeds.png?alt=media)

3. Select all or chosen signature files, and then click **Run multi-core analysis** (2).
4. Check the results and click **Apply signatures** to bulk apply (3) correct matches.

![](https://3101246880-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7BOcMAWP0fQxJv6opQQC%2Fuploads%2Fgit-blob-ad00bd2f00e41618803f322327537f31d60dbad8%2Fapply-signatures.png?alt=media)