radareorg/radare2

Using multiple FLIRT signature files

Open

#11,784 opened on Oct 10, 2018

View on GitHub
 (2 comments) (0 reactions) (0 assignees)C (23,826 stars) (3,229 forks)batch import
FLIRTHacktoberfestenhancementgood first issuezignatures

Description

I need to find statically linked libraries inside a binary. Is it possible to load multiple flirt file together with zfs command?

Contributor guide

Tech stack
c
Domain
clisecurity
Issue type
research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
basic knowledge of radare2understanding FLIRT signatures
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate the `zfs` command in radare2 to see if it supports multiple FLIRT files. Check the radare2 documentation and source code for FLIRT signature loading, specifically the `libr/core/cmd zignature.c` file. Look for any existing PRs or issues that discuss loading multiple signatures. If not supported, consider implementing a feature to allow passing multiple file arguments or using a configuration file.