Python FLIRT

0.9.10 verified Mon Apr 27 auth: no python

A Python library for parsing, compiling, and matching Fast Library Identification and Recognition Technology (FLIRT) signatures. It enables identification of known library functions in binary code using signature files. Current version 0.9.10, requires Python >=3.10, released on an ad-hoc cadence.

pip install python-flirt

Common errors

error ModuleNotFoundError: No module named 'pyflirt' ↓

cause The package installs as 'python-flirt' but the module is named 'flirt', not 'pyflirt'. Users often import the wrong name.

fix

Run: pip install python-flirt, then use 'from flirt import ...'

error ImportError: cannot import name 'Signature' from 'flirt' ↓

cause The class may be named differently (e.g., 'FlirtSignature') depending on version. Old docs used 'FlirtSignature'.

fix

Use 'from flirt import Signature' for v0.9.x, or check your version with 'print(flirt.__version__)'.

error flirt.Signature.from_bytes() missing 1 required positional argument: 'name' ↓

cause The method signature changed in v0.9.x; now requires a 'name' parameter for the signature.

fix

Use 'Signature.from_bytes(data, name="my_sig")'.

Warnings

breaking Python >=3.10 required; versions <=0.9.6 support Python 3.9, but removed in 0.9.8. ↓

fix Upgrade to Python 3.10 or later, or pin to python-flirt==0.9.6.

gotcha Import uses 'flirt' not 'pyflirt'. The PyPI package is 'python-flirt' but the module is 'flirt'. Many users incorrectly try 'import pyflirt'. ↓

fix Use 'from flirt import Signature' instead of 'from pyflirt import Signature'.

deprecated The old API 'match_sig(sig, binary)' returns a list of tuples; newer versions may return a different format. Check documentation for your version. ↓

fix Use '.match(binary)' method on Signature object for consistent behavior.

Imports

Signature
wrong
```
from pyflirt import Signature
```
correct
```
from flirt import Signature
```
The top-level package is 'flirt', not 'pyflirt'.
compile_sig
```
from flirt import compile_sig
```
Compiles a .pat file into a .sig file.
match_sig
```
from flirt import match_sig
```
Matches a signature against a binary.

Quickstart

Load a FLIRT signature from a URL and match against a binary byte sequence.

from flirt import Signature, match_sig
import urllib.request

# Load a signature file (example URL, replace with actual)
url = 'https://raw.githubusercontent.com/williballenthin/lancelot/master/pyflirt/tests/data/test.sig'
response = urllib.request.urlopen(url)
sig_data = response.read()
sig = Signature.from_bytes(sig_data)

# Load a binary to scan (example placeholder)
binary_data = b'\x55\x48\x89\xe5\x48\x83\xec\x20'
matches = match_sig(sig, binary_data)
print(matches)