Hacker News Reader

Comment by rjzzleep | Hacker News Reader

For me I got the Company I was contracting for to buy me an IDA license and as I was trying to take over from there Hexrays never responded to any requests.

I'm guessing that I'm on the same pirate blacklist that a lot of people landed. I guess I should have expensed it instead of having the Company buy it. I was the only person doing RE work, it was a single user person license and I was also the only linux user out of that 300 people org.

I think there are a lot of people that would like to pay for IDA but can't get it.

On the other hand I really don't like the Ghidra user experience.

Is there something similar to FLIRT in r2 or ghidra?

View on HN

> I think there are a lot of people that would like to pay for IDA but can't get it.

Many years ago we wanted to buy IDA Pro license and were quickly declined because we had whois privacy protection enabled on our domain.

Rizin (and Cutter) does fully support FLIRT. You can create and load them, we also provide sigdb which is a collection of FLIRT files created by us (and yes, they are 100% compatible with IDA if you ever want to use them). - https://github.com/rizinorg/cutter/releases/tag/v2.1.0 - https://github.com/rizinorg/rizin/releases/tag/v0.4.0 - https://github.com/rizinorg/sigdb

beware that these are not the latest versions.

Fantastic. So Rizin is a more active fork of r2 + iaito?

can't speak for r2, but we are definetely active. The project github page has better details :) But as far as i know rizin is the only tool capable to fully support flirt, and i would love to extend the support even more (and obviously add more features) in both tools (rizin & cutter).

It’s not r2 or ghidra, but binary ninja has signature libraries: “The matching algorithm is inspired by FLIRT, which was designed with similar requirements in mind.”

https://binary.ninja/2020/03/11/signature-libraries.html

I don't think Ghidra has a proper FLIRT equivalent yet. That's one of those bells and whistles that may (or may not) be worth the license fee, along with in my opinion a more polished UI.

Just to clarify, if I wasn't concerned with budget and had to pick a product today, I'd still go with IDA, but the mindshare among new hires and interns is swinging pretty rapidly towards Ghidra. If they are able to continue adding features (with US government funding, and open source development), IDA is right to be worried about whether they will still be the best choice in 5 years.

Ghidra has function id databases, but only ships with signatures for relatively modern visual studio.

You can create your own signature databases, although i have been unsuccessful in my brief attempts.

The algorithm is different from flirt though.

Its roughly, mask a bunch of stuff (relocations, etc), and hash whats left. There is some parent/child analysis for ambiguous calls i believe.

My recollection is flirt also masks its version of a bunch of stuff, but builds a trie of the first xx bytes with some provision for needed values past that, and some parent child analysis. They have a paper on the algorithm you can google.

Ida ships with more signatures out of the box, In my experience. Although i havent seen them listed anywhere.

Reply on news.ycombinator.com