Expose FLIRT in rasign2

radareorg / radare2

UNIX-like reverse engineering framework and command-line toolset

https://www.radare.org/

GNU Lesser General Public License v3.0

20.52k stars 2.99k forks source link

Expose FLIRT in rasign2 #16930

Open XVilka opened 4 years ago

XVilka commented 4 years ago

cc @swoops

A follow up of https://github.com/radareorg/radare2/issues/9336 and https://github.com/radareorg/radare2/pull/16836

XVilka commented 4 years ago

@swoops did the status of this issue changed?

swoops commented 4 years ago

So far rasig2 exposes the zfd command to dump FLIRT signatures. Nothing else though.

trufae commented 3 years ago

@swoops it is really worth keep supporting FLIRT in r2? the file format has changed and its not working again, and at the end we can keep exporting r2 signatures from IDA in case interop is needed

swoops commented 3 years ago

I would have no objection to doping the code. I don't know anything about the FLIRT code really. I have never used IDA. I would rather spend my time improving r2 signatures then reversing FLIRT file type changes.

There is an abundance of FLIRT signatures databases out there. A lot more then r2 signatures. So I think that would be the primary reason for keeping it. Maybe it would be better supported as a plugin?