Package: python-flirt
python-flirtA Python library for parsing, compiling, and matchingFast Library Identification and Recognition Technology (FLIRT)signatures. These signatures are typically used by the Hex-Rays IDA Pro tool; this library is the result of reverse engineering the matching engine and reimplementing parsers and matchers. You can use this library to match FLIRT signatures against byte sequences to recognize statically-linked code without IDA Pro.These are thePython bindingstolancelot-flirtgenerated viaPyO3for Python 3.x that are available on PyPI aspython-flirt.UsageAddpython-flirtto your Python project dependencies (such as viasetup.py); for example, like this:setuptools.setup(...install_requires=["python-flirt~=0.6.3",]...)Here's a sample example that parses a FLIRT signature from a string and matches against a byte sequence:importflirtBUF=bytes([# utcutil.dll#  MD5 abc9ea116498feb8f1de45f60d595af6#  SHA-1 2f1ba350237b74c454caf816b7410490f5994c59#  SHA-256 7607897638e9dae406f0840dbae68e879c3bb2f08da350c6734e4e2ef8d61ac2# __EH_prolog3_catch_align0x51,0x8b,0x4c,0x24,0x0c,0x89,0x5c,0x24,0x0c,0x8d,0x5c,0x24,0x0c,0x50,0x8d,0x44,0x24,0x08,0xf7,0xd9,0x23,0xc1,0x8d,0x60,0xf8,0x8b,0x43,0xf0,0x89,0x04,0x24,0x8b,0x43,0xf8,0x50,0x8b,0x43,0xfc,0x8b,0x4b,0xf4,0x89,0x6c,0x24,0x0c,0x8d,0x6c,0x24,0x0c,0xc7,0x44,0x24,0x08,0xff,0xff,0xff,0xff,0x51,0x53,0x2b,0xe0,0x56,0x57,0xa1,0x70,0x14,0x01,0x10,0x33,0xc5,0x50,0x89,0x65,0xf0,0x8b,0x43,0x04,0x89,0x45,0x04,0xff,0x75,0xf4,0x64,0xa1,0x00,0x00,0x00,0x00,0x89,0x45,0xf4,0x8d,0x45,0xf4,0x64,0xa3,0x00,0x00,0x00,0x00,0xf2,0xc3])PAT="""\518B4C240C895C240C8D5C240C508D442408F7D923C18D60F88B43F08904248B 21 B4FE 006E :0000 __EH_prolog3_GS_align ^0041 ___security_cookie ........33C5508941FC8B4DF0895DF08B4304894504FF75F464A1000000008945F48D45F464A300000000F2C3518B4C240C895C240C8D5C240C508D442408F7D923C18D60F88B43F08904248B 1F E4CF 0063 :0000 __EH_prolog3_align ^003F ___security_cookie ........33C5508B4304894504FF75F464A1000000008945F48D45F464A300000000F2C3518B4C240C895C240C8D5C240C508D442408F7D923C18D60F88B43F08904248B 22 E4CE 006F :0000 __EH_prolog3_catch_GS_align ^0042 ___security_cookie ........33C5508941FC8B4DF08965F08B4304894504FF75F464A1000000008945F48D45F464A300000000F2C3518B4C240C895C240C8D5C240C508D442408F7D923C18D60F88B43F08904248B 20 6562 0067 :0000 __EH_prolog3_catch_align ^0040 ___security_cookie ........33C5508965F08B4304894504FF75F464A1000000008945F48D45F464A300000000F2C3---"""# parse signature file content into a list of signatures.sigs=flirt.parse_pat(PAT)# compile signatures into a matching engine instance.# separate from above so that you can load multiple files.matcher=flirt.compile(sigs)# match the signatures against the given buffer, starting at offset 0.# results in a list of rule instances with a field `name` tuple like:##     ("__EH_prolog3_catch_align", "public", 0)forminmatcher.match(BUF):print(f"match:{m.names[0][0]}")expected output:match: __EH_prolog3_catch_alignNote, the above logic does not handle "references" that are describe below;
however, it does give a sense for the required setup to parse and compile rules.Usage: signature file formatsThis library supports loading signatures from both the .sig and .pat file formats:.sig files are the compiled signatures usually fed into IDA Pro for matching. They are structurally compressed (and uncommonly compressed with a zlib-like algorithm, not supported here) and have a raw binary representation..pat files are the ASCII-encoded text files generated bysigmake.exe. These are typically compiled into .sig files for use in IDA Pro; however, sincelancelot-flirtcompiles the rules into its own intermediate representation, you can use them directly. Notably, this library supports a slight extension to enable a file header with lines prefixed with#, which enables you to embed a acknowledgement/copyright/license.With knowledge of the above, you may consider also supporting.pat.gzsignature files in your client application, as this enables a great compression ratio while preserving the file license header and human-inspectability.Usage: matching referencesTo differentiate functions with a shared byte-wise representation, such as wrapper functions that dispatch other addresses, a FLIRT engine matches recursively using "references".
This feature is used heavily to match common routines provided by modern C/C++ runtime libraries.Unfortunately, client code must coordinate the recursive invocation of FLIRT matching.Therefore, when integrating this library into a client application, you should review the matching logic oflancelot::core::analysis::flirthere.
Essentially, you'll need to inspect the "references" found within a function and recursively FLIRT match those routines to resolve the best matching signature.
There's also a matching implementation in Python for vivisectherethat relies on more thorough code flow recovery.Usage: example toolThe toolcapausespython-flirtto recognize statically-linked functions within PE files.
You can use this code as an example for how to integrate this library with your client code.LicenseThis project is licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0).
You should not redistribute FLIRT signatures distributed by Hex-Rays; however, there are open source signatures available here:https://github.com/fireeye/siglib/https://github.com/Maktm/FLIRTDBhttps://github.com/rizinorg/sigdb