Skip to content

Signature Files

signature_files

Classes:

  • FileInfo –

    Represents information about a FLIRT signature file application.

  • MatchInfo –

    Represents information about a single function matched by a FLIRT signature.

  • SignatureFiles –

    Provides access to FLIRT signature (.sig) files in the IDA database.

FileInfo dataclass 

FileInfo(
    path: str = '',
    matches: int = 0,
    functions: List[MatchInfo] = list(),
)

Represents information about a FLIRT signature file application. Contains the signature file path, number of matches, and details of matched functions.

Attributes:

functions class-attribute instance-attribute 

functions: List[MatchInfo] = field(default_factory=list)

matches class-attribute instance-attribute 

matches: int = 0

path class-attribute instance-attribute 

path: str = ''

MatchInfo dataclass 

MatchInfo(addr: ea_t, name: str = '', lib: str = '')

Represents information about a single function matched by a FLIRT signature.

Attributes:

addr instance-attribute 

addr: ea_t

lib class-attribute instance-attribute 

lib: str = ''

name class-attribute instance-attribute 

name: str = ''

SignatureFiles 

SignatureFiles(database: 'Database')

Provides access to FLIRT signature (.sig) files in the IDA database.

Constructs a signature file handler for the given database.

Args: database: Reference to the active IDA database.

Methods:

  • apply –

    Applies signature files to current database.

  • create –

    Create signature files (.pat and .sig) from current database.

  • get_files –

    Retrieves a list of available FLIRT signature (.sig) files.

  • get_index –

    Get index of applied signature file.

Attributes:

m_database instance-attribute 

m_database = database

apply 

apply(path: Path, probe_only: bool = False)

Applies signature files to current database.

Args: path: Path to the signature file or directory with sig files. probe_only: If true, signature files are only probed (apply operation is undone).

Returns: A list of FileInfo objects containing application details.

create 

create(pat_only: bool = False) -> List[str] | None

Create signature files (.pat and .sig) from current database.

Args: pat_only: If true, generate only PAT file.

Returns: A list containing paths to the generated files. In case of failure, returns None.

get_files 

get_files(directories: List[Path] = None) -> List[Path]

Retrieves a list of available FLIRT signature (.sig) files.

Args: directories: Optional list of paths to directories containing FLIRT signature files. If the parameter is missing, IDA signature folders will be used.

Returns: A list of available signature file paths.

get_index 

get_index(path: Path) -> int

Get index of applied signature file.

Args: path: Path to the signature file.

Returns: Index of applied signature file, -1 if not found.