Creating FLIRT Signatures in IDA Pro for CTF's, Malware, etc...
MOST VIDEOS ARE UNDER THE LIVE SECTION!
Often times during Capture the Flag (CTF) challenges, you are given a binary that is not only stripped of symbols, but also includes statically compiled library code. This can make reverse engineering more challenging, especially depending on what other techniques were used to increase the difficulty of the challenge. One tool to help is FLAIR and FLIRT, which comes with IDA Pro. Using FLAIR, we can create FLIRT signatures. These signatures are generated from static libraries, such as those on Linux with the ".a" extension. Common libraries used include libssl, libcrypto, and others. These libraries contain hundreds of functions. When the signatures are applied to an IDA input file where there is a match, the library code is then color-coded as such. This is not the only method or tool to rule out library code.. There are various other tools, such as Karta for IDA Pro, and Rizzo for Ghidra.