Overview

What is FLIRT?

FLIRT stands for Fast Library Identification and Recognition Technology. This technology allows IDA to recognize standard library functions generated by supported compilers and greatly improves the usability and readability of generated disassemblies. Of course, FLIRT can be combined with IDA’s usual interactivity to further improve the analysis.

Producing FLIRT Signature Files

FLIRT signatures can be created from compiled libraries or binaries. These signature files allow IDA to match known library functions in new programs. Signatures can come from official compiler libraries, custom-built libraries, or IDA official signature bundles.

Related FLIRT Tooling

IDA provides tools to manage and apply FLIRT signatures, including:

• FLAIR for creating FLIRT signature files from compiled libraries or binaries

• IDA Feeds to ease the signature application

IDA Feeds

Version Availability

This feature is available only in IDA Pro, as it depends on idalib for full functionality.

IDA Feeds (aka FLIRT Signature Manager) is a tool designed to simplify applying new signatures via updatable libraries (IDA FLIRT Signature Bundles), which ship alongside other IDA plugins out of the box. You can run IDA Feeds directly through the IDA Pro UI by navigating to Edit → Plugins → IDA Feeds. All related IDA Feeds files are located in the plugins/ida_feeds directory within your IDA installation folder.

Why do you need IDA Feeds?

IDA Feeds helps you identify which signatures to apply when analyzing binary files, especially when you don't know which static libraries were linked to them. Rather than manually applying signatures, IDA Feeds automatically scans and applies many signatures in seconds. Just open the signature folder, allow IDA to scan and find the possible matches, and then bulk apply the suggested signatures.

IDA Feeds uses the FLIRT Signature Bundles, which are going to be regularly updated and released to keep you up to date with the newest recognizable signatures.

Besides managing FLIRT signatures, IDA Feeds can generate Rust signatures on demand.

FLIRT Signature Bundle

With FLIRT Signature Bundle, designed to be used with IDA Feeds (aka FLIRT Signature Manager), you can analyze thousands of signatures and bulk apply them to your binary.

The bundle contains signatures for modern languages like Golang, Rust, and C(++), as well as updates for classic compilers, for all major OS and architectures. The latest version of the FLIRT Signature Bundle can be downloaded from My Hex-Rays portal under SDK and utilities.

FLIRT Signature Bundle is regularly updated and released independently whenever there is a new compiler, language, or library release, or with a new IDA version.

Signatures update automatically when the upstream program changes, keeping them current without manual intervention.