Add doc/flirt
This commit is contained in:
parent
e8140ab8bf
commit
f766d23fd8
2 changed files with 50 additions and 0 deletions
49
doc/flirt
Normal file
49
doc/flirt
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
FLIRT
|
||||
=====
|
||||
At the moment of writing r2 supports loading and finding FLIRT
|
||||
patterns, those files can be generated with the FLIRT tools from IDA.
|
||||
R2 doesn't yet supports creating those files. But it supports its
|
||||
own signature format which can be used to generate signatures and
|
||||
find them.
|
||||
|
||||
This document will focus on FLIRT, not the native r2 'Zignatures'.
|
||||
|
||||
You need the flair tools/ida utilities. Those tools are closed source
|
||||
and privative, so you should not distribute them. It is probable that
|
||||
it is not possible to redistribute the .pat or the .sig files. It
|
||||
doesnt seems to have watermarks. however it's a bit unclear what
|
||||
licence the file generated should have. Mentionning the files should
|
||||
be free of copyrighted material (the original libs bytes). That said,
|
||||
there's a paragraph in the flirt paper:
|
||||
|
||||
https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml
|
||||
|
||||
|
||||
Create the .pat file
|
||||
--------------------
|
||||
|
||||
cd flair/bin/linux
|
||||
./pelf -p64 /usr/lib/x86_64-linux-gnu/libc.a libc.pat
|
||||
|
||||
Create the .sig file (possible collisions):
|
||||
--------------------
|
||||
|
||||
./sigmake -n <libname> libc.pat libc.sig
|
||||
|
||||
There's little chance libc.sig will be compatible across systems and
|
||||
libc versions. If libc.exc exists, you need to resolve some functions
|
||||
conflicts. Prepend a '+' on the lines you're sure you want to keep
|
||||
(see end of flair/sigmake.txt). Then redo the sigmake command. The
|
||||
.sig is now ready to be used with r2.
|
||||
|
||||
Using it with r2:
|
||||
-----------------
|
||||
|
||||
$ r2 -c 'zF libc.sig' staticbin
|
||||
|
||||
PROFIT.
|
||||
|
||||
refs:
|
||||
flair/sigmake.txt
|
||||
flair/pat.txt
|
||||
|
||||
|
|
@ -228,3 +228,4 @@ R2 loves everyone, even Java coders, but less than others
|
|||
It's not a bug, it's a work in progress
|
||||
Stop swearing!
|
||||
I didn't said that it was working, I said that it's implemented
|
||||
Wrong argument
|
||||
|
|
|
|||
Loading…
Reference in a new issue