Signature Files

signature_files

Classes:

• FileInfo –

  Represents information about a FLIRT signature file application.

• MatchInfo –

  Represents information about a single function matched by a FLIRT signature.

• SignatureFiles –

  Provides access to FLIRT signature (.sig) files in the IDA database.

FileInfo dataclass

FileInfo(
    path: str = '',
    matches: int = 0,
    functions: List[MatchInfo] = list(),
)

Represents information about a FLIRT signature file application. Contains the signature file path, number of matches, and details of matched functions.

Attributes:

• functions (List[MatchInfo]) –
• matches (int) –
• path (str) –

functions class-attribute instance-attribute

functions: List[MatchInfo] = field(default_factory=list)

matches class-attribute instance-attribute

matches: int = 0

path class-attribute instance-attribute

path: str = ''

MatchInfo dataclass

MatchInfo(addr: ea_t, name: str = '', lib: str = '')

Represents information about a single function matched by a FLIRT signature.

Attributes:

• addr (ea_t) –
• lib (str) –
• name (str) –

addr instance-attribute

addr: ea_t

lib class-attribute instance-attribute

lib: str = ''

name class-attribute instance-attribute

name: str = ''

SignatureFiles

SignatureFiles(database: Database)

Bases: DatabaseEntity

Provides access to FLIRT signature (.sig) files in the IDA database.

Args: database: Reference to the active IDA database.

Methods:

• apply –

  Applies signature files to current database.

• create –

  Create signature files (.pat and .sig) from current database.

• get_files –

  Retrieves a list of available FLIRT signature (.sig) files.

• get_index –

  Get index of applied signature file.

Attributes:

• database (Database) –

  Get the database reference, guaranteed to be non-None when called from

• m_database –

database property

database: Database

Get the database reference, guaranteed to be non-None when called from methods decorated with @check_db_open.

Returns: The active database instance.

Note: This property should only be used in methods decorated with @check_db_open, which ensures m_database is not None.

m_database instance-attribute

m_database = database

apply

apply(
    path: Path, probe_only: bool = False
) -> List[FileInfo]

Applies signature files to current database.

Args: path: Path to the signature file or directory with sig files. probe_only: If true, signature files are only probed (apply operation is undone).

Returns: A list of FileInfo objects containing application details.

create

create(pat_only: bool = False) -> List[str] | None

Create signature files (.pat and .sig) from current database.

Args: pat_only: If true, generate only PAT file.

Returns: A list containing paths to the generated files. In case of failure, returns None.

get_files

get_files(
    directories: Optional[List[Path]] = None,
) -> List[Path]

Retrieves a list of available FLIRT signature (.sig) files.

Args: directories: Optional list of paths to directories containing FLIRT signature files. If the parameter is missing, IDA signature folders will be used.

Returns: A list of available signature file paths.

get_index

get_index(path: Path) -> int

Get index of applied signature file.

Args: path: Path to the signature file.

Returns: Index of applied signature file, -1 if not found.