Generate FLIRT signatures from libraries
Action name: makesig:create_signature
This command generates a FLIRT signature file. It is available via File → Produce file → Create SIG file.... A function is eligible when the name doesn't start with sub_.
File: Pathname for the signature file
Library name: identifier, shown in the description of Signature
Collect functions
- All: Generate signature for all functions in the idb that are eligible
- Selected: Generate a signature only for the selection in Functions
Collisions
- Ignore: don't add collision FLIRT signature
will delete the Exclusion file if it exists
- Deal with manually: if there is collisions, a window will open to manage
the collisionsTwo or three files are generated:
File
Description
Signature file
The output file
Pattern file
Filename is Signature filename with extension replaced with "pat"
Exclusion File
Filename with extension replaced by "exc". Only present if you want to deal with collision and there is any.
The last two files can be deleted once the signature file is generated.
Last updated
Was this helpful?
