{"id":27310,"library":"python-flirt","title":"Python FLIRT","description":"A Python library for parsing, compiling, and matching Fast Library Identification and Recognition Technology (FLIRT) signatures. It enables identification of known library functions in binary code using signature files. Current version 0.9.10, requires Python >=3.10, released on an ad-hoc cadence.","status":"active","version":"0.9.10","language":"python","source_language":"en","source_url":"https://github.com/williballenthin/lancelot/tree/master/pyflirt","tags":["binary-analysis","signature-matching","flirt","reverse-engineering"],"install":[{"cmd":"pip install python-flirt","lang":"bash","label":"PyPI install"}],"dependencies":[{"reason":"Rust-based core engine for signature matching","package":"python-flirt-core","optional":false},{"reason":"Binary analysis and disassembly framework","package":"lancelot","optional":false}],"imports":[{"note":"The top-level package is 'flirt', not 'pyflirt'.","wrong":"from pyflirt import Signature","symbol":"Signature","correct":"from flirt import Signature"},{"note":"Compiles a .pat file into a .sig file.","symbol":"compile_sig","correct":"from flirt import compile_sig"},{"note":"Matches a signature against a binary.","symbol":"match_sig","correct":"from flirt import match_sig"}],"quickstart":{"code":"from flirt import Signature, match_sig\nimport urllib.request\n\n# Load a signature file (example URL, replace with actual)\nurl = 'https://raw.githubusercontent.com/williballenthin/lancelot/master/pyflirt/tests/data/test.sig'\nresponse = urllib.request.urlopen(url)\nsig_data = response.read()\nsig = Signature.from_bytes(sig_data)\n\n# Load a binary to scan (example placeholder)\nbinary_data = b'\\x55\\x48\\x89\\xe5\\x48\\x83\\xec\\x20'\nmatches = match_sig(sig, binary_data)\nprint(matches)","lang":"python","description":"Load a FLIRT signature from a URL and match against a binary byte sequence."},"warnings":[{"fix":"Upgrade to Python 3.10 or later, or pin to python-flirt==0.9.6.","message":"Python >=3.10 required; versions <=0.9.6 support Python 3.9, but removed in 0.9.8.","severity":"breaking","affected_versions":">=0.9.8"},{"fix":"Use 'from flirt import Signature' instead of 'from pyflirt import Signature'.","message":"Import uses 'flirt' not 'pyflirt'. The PyPI package is 'python-flirt' but the module is 'flirt'. Many users incorrectly try 'import pyflirt'.","severity":"gotcha","affected_versions":"all"},{"fix":"Use '.match(binary)' method on Signature object for consistent behavior.","message":"The old API 'match_sig(sig, binary)' returns a list of tuples; newer versions may return a different format. Check documentation for your version.","severity":"deprecated","affected_versions":">=0.9.0"}],"env_vars":null,"last_verified":"2026-04-27T00:00:00.000Z","next_check":"2026-07-26T00:00:00.000Z","problems":[{"fix":"Run: pip install python-flirt, then use 'from flirt import ...'","cause":"The package installs as 'python-flirt' but the module is named 'flirt', not 'pyflirt'. Users often import the wrong name.","error":"ModuleNotFoundError: No module named 'pyflirt'"},{"fix":"Use 'from flirt import Signature' for v0.9.x, or check your version with 'print(flirt.__version__)'.","cause":"The class may be named differently (e.g., 'FlirtSignature') depending on version. Old docs used 'FlirtSignature'.","error":"ImportError: cannot import name 'Signature' from 'flirt'"},{"fix":"Use 'Signature.from_bytes(data, name=\"my_sig\")'.","cause":"The method signature changed in v0.9.x; now requires a 'name' parameter for the signature.","error":"flirt.Signature.from_bytes() missing 1 required positional argument: 'name'"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}