For the complete documentation index, see llms.txt. This page is also available as Markdown.

Generate FLIRT signatures from libraries

 Action    name: makesig:create_signature
 

This command generates a FLIRT signature file. It is available via File → Produce File → Create SIG file.... A function is eligible when the name doesn't start with sub_.

 File: Pathname for the signature file
 Library name: identifier, shown in the description of Signature

 Collect functions
  - All: Generate signature for all functions in the idb that are eligible
  - Selected: Generate a signature only for the selection in Functions

 Collisions
  - Ignore: don't add collision FLIRT signature
            will delete the Exclusion file if it exists
  - Deal with manually: if there is collisions, a window will open to manage
                        the collisions

Two or three files are generated:

File
Description

Signature file

The output file

Pattern file

Filename is Signature filename with extension replaced with "pat"

Exclusion File

Filename with extension replaced by "exc". Only present if you want to deal with collision and there is any.

The last two files can be deleted once the signature file is generated.

Last updated

Was this helpful?