# Generate FILRT signatures from analyzed binaries (Makesig)

The built-in Makesig plugin is a tool for generating FLIRT signatures from a current database. This tutorial will walk you through creating signatures from an analyzed binary.

{% hint style="info" %}
The content here was a part of the [blog article](https://hex-rays.com/blog/an-overview-of-the-makesig-plugin/)
{% endhint %}

## How to make signatures from working database?

1. Export the patterns from the database into a `.sig` file;
2. Re-import the `.sig` into the target database.

## Example

Let’s see how that would work in a real scenario. Imagine working on a long-term reversing project with frequent new versions. With the makesig plugin, we can migrate the carefully curated list of functions that we already reverse-engineered and exported as a signature file, into the current binary (given that compiler flags didn’t change too much between releases). Let’s say we identified an interesting function In the older release (source) binary and wanted to port that information to the newer binary:

![](https://920252027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXnMt6HMopakRTMzxxSKh%2Fuploads%2Fgit-blob-39e92731fafac1f53344024584125da0f584a0b9%2Fmakesig.png?alt=media)

We can export a signature file for this function via menu item **File -> Produce File -> Create SIG file...**

![Create .sig file dialog](https://920252027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXnMt6HMopakRTMzxxSKh%2Fuploads%2Fgit-blob-af6ce2ee9eb2c120f3775a651acc17e1f5b5d180%2Fcreate-sig-file.png?alt=media)

Then, in the new binary file, we can import this signature file in the Signatures window:

![Import signature](https://920252027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXnMt6HMopakRTMzxxSKh%2Fuploads%2Fgit-blob-525e7b63a3da3a182ef0252822fb8316b83befcf%2Fimport-signature.png?alt=media)

As we can see, IDA applies the signature and reports that it found a match in the new database! And indeed, we can find the function, labeled as a library function, because its function name came from the signature file:

![Applied signature](https://920252027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXnMt6HMopakRTMzxxSKh%2Fuploads%2Fgit-blob-bac1db65c7024d6d06a681715509e50f199ee4a7%2Fapplied-signature.png?alt=media)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.hex-rays.com/core/flirt/how-tos/makesig.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.