{"id":27310,"library":"python-flirt","title":"Python FLIRT","description":"A Python library for parsing, compiling, and matching Fast Library Identification and Recognition Technology (FLIRT) signatures. It enables identification of known library functions in binary code using signature files. Current version 0.9.10, requires Python >=3.10, released on an ad-hoc cadence.","status":"active","version":"0.9.10","language":"python","source_language":"en","source_url":"https://github.com/williballenthin/lancelot/tree/master/pyflirt","tags":["binary-analysis","signature-matching","flirt","reverse-engineering"],"install":[{"cmd":"pip install python-flirt","lang":"bash","label":"PyPI install"}],"dependencies":[{"reason":"Rust-based core engine for signature matching","package":"python-flirt-core","optional":false},{"reason":"Binary analysis and disassembly framework","package":"lancelot","optional":false}],"imports":[{"wrong":"from flirt import Signature","symbol":"FlirtMatcher","correct":"from flirt import FlirtMatcher"},{"symbol":"FlirtSignature","correct":"from flirt import FlirtSignature"},{"symbol":"compile","correct":"from flirt import compile"}],"quickstart":{"code":"from flirt import Signature, match_sig\nimport urllib.request\n\n# Load a signature file (example URL, replace with actual)\nurl = 'https://raw.githubusercontent.com/williballenthin/lancelot/master/pyflirt/tests/data/test.sig'\nresponse = urllib.request.urlopen(url)\nsig_data = response.read()\nsig = Signature.from_bytes(sig_data)\n\n# Load a binary to scan (example placeholder)\nbinary_data = b'\\x55\\x48\\x89\\xe5\\x48\\x83\\xec\\x20'\nmatches = match_sig(sig, binary_data)\nprint(matches)","lang":"python","description":"Load a FLIRT signature from a URL and match against a binary byte sequence."},"warnings":[{"fix":"Upgrade to Python 3.10 or later, or pin to python-flirt==0.9.6.","message":"Python >=3.10 required; versions <=0.9.6 support Python 3.9, but removed in 0.9.8.","severity":"breaking","affected_versions":">=0.9.8"},{"fix":"Use 'from flirt import Signature' instead of 'from pyflirt import Signature'.","message":"Import uses 'flirt' not 'pyflirt'. The PyPI package is 'python-flirt' but the module is 'flirt'. Many users incorrectly try 'import pyflirt'.","severity":"gotcha","affected_versions":"all"},{"fix":"Use '.match(binary)' method on Signature object for consistent behavior.","message":"The old API 'match_sig(sig, binary)' returns a list of tuples; newer versions may return a different format. Check documentation for your version.","severity":"deprecated","affected_versions":">=0.9.0"}],"env_vars":null,"search_vec":"'0.9.10':34 '3.10':37 'ad':42 'ad-hoc':41 'analysi':47 'binari':27,46 'binary-analysi':45 'cadenc':44 'code':28 'compil':8 'current':32 'enabl':20 'engin':54 'fast':11 'file':31 'flirt':2,17,51 'function':25 'hoc':43 'identif':13,21 'known':23 'librari':5,12,24 'match':10,50 'pars':7 'python':1,4,36 'recognit':15 'releas':38 'requir':35 'revers':53 'reverse-engin':52 'signatur':18,30,49 'signature-match':48 'technolog':16 'use':29 'version':33","created_at":"2026-05-01T17:45:36.628806+00:00","updated_at":"2026-05-01T17:45:36.628806+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"flirt","cli_version":"sh: 1: flirt: not found","type":"library","homepage":null,"github":"https://github.com/williballenthin/lancelot","docs":null,"changelog":null,"pypi":"https://pypi.org/project/python-flirt/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["serialization"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-30","last_verified":"2026-06-30","next_check":"2026-07-30","install_tag":null}}