python-flirt

library0.9.10pypypi✓ verified 85d ago

A Python library for parsing, compiling, and matching Fast Library Identification and Recognition Technology (FLIRT) signatures. It enables identification of known library functions in binary code using signature files. Current version 0.9.10, requires Python >=3.10, released on an ad-hoc cadence.

serialization

pip install python-flirt

github ↗package ↗

INSTALL

IMPORT

SIG · PYTHON-FLIRT

python-flirt

serializationpythonv0.9.10

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

FlirtMatcher

✓ from flirt import FlirtMatcher

✗ from flirt import Signature

FlirtSignature

✓ from flirt import FlirtSignature

compile

✓ from flirt import compile

Load a FLIRT signature from a URL and match against a binary byte sequence.

from flirt import Signature, match_sig import urllib.request # Load a signature file (example URL, replace with actual) url = 'https://raw.githubusercontent.com/williballenthin/lancelot/master/pyflirt/tests/data/test.sig' response = urllib.request.urlopen(url) sig_data = response.read() sig = Signature.from_bytes(sig_data) # Load a binary to scan (example placeholder) binary_data = b'\x55\x48\x89\xe5\x48\x83\xec\x20' matches = match_sig(sig, binary_data) print(matches)

flirt --version

Debug

Known issues

breakingPython >=3.10 required; versions <=0.9.6 support Python 3.9, but removed in 0.9.8.

fix

Upgrade to Python 3.10 or later, or pin to python-flirt==0.9.6.

affects: >=0.9.8

gotchaImport uses 'flirt' not 'pyflirt'. The PyPI package is 'python-flirt' but the module is 'flirt'. Many users incorrectly try 'import pyflirt'.

fix

Use 'from flirt import Signature' instead of 'from pyflirt import Signature'.

affects: all

deprecatedThe old API 'match_sig(sig, binary)' returns a list of tuples; newer versions may return a different format. Check documentation for your version.

fix

Use '.match(binary)' method on Signature object for consistent behavior.

affects: >=0.9.0

Upgrade

Version history

0.9.10latest on PyPI · released Jan 8, 2026

Audit

Dependencies

python-flirt-corerequiredRust-based core engine for signature matching

lancelotrequiredBinary analysis and disassembly framework

Agent activity

2 hits · last 30 days

node

Resources

githubhttps://github.com/williballenthin/lancelot ↗

packagehttps://pypi.org/project/python-flirt/ ↗