Fast Library Identification and Recognition Technology, better known as FLIRT,^[76] encompasses the set of techniques employed by IDA to identify sequences of code as library code. At the heart of FLIRT are pattern-matching algorithms that enable IDA to quickly determine whether a disassembled function matches one of the many signatures known to IDA. The <IDADIR>/sig directory contains the signature files that ship with IDA. For the most part, these are libraries that ship with common Windows compilers, though a few non-Windows signatures are also included.

Signature files utilize a custom format in which the bulk of the signature data is compressed and wrapped in an IDA-specific header. In most cases, signature filenames do not clearly indicate which library the associated signatures were generated from. Depending on how they were created, signature files may contain a library name comment that describes their contents. If we view the first few lines of extracted ASCII content from a signature file, this comment is often revealed. The following Unix-style command^[77] generally reveals the comment in the second or third line of output:

# strings sigfile | head -n 3

Within IDA, there are two ways to view comments associated with signature files. First, you can access the list of signatures that have been applied to a binary via View ▸ Open Subviews ▸ Signatures. Second, the list of all signature files is displayed as part of the manual signature application process, which is initiated via File ▸ Load File ▸ FLIRT Signature File.