
 FLAIR -- Fast Library Acquisition for Identification and Recognition
 ====================================================================

The FLAIR utilities allow you to create new signature files for IDA 
Pro v3.64. 

The FLAIR utilities are actually a collection of tools :

plb		parselib  processes OMF  libraries and creates PAT file
pcf		parsecoff processes COFF libraries and creates PAT file
sigmake		sigmake takes PAT files as input and creates SIG file
zipsig		zipsig compresses and uncompresses SIG files (with wildcards)
dumpsig		dumpsig dumps the content of SIG file in a text form.


The package contains utilities that run natively on three OS : 
 
        - MS-DOS 
        - OS/2 32 bit
	- Win32

Limited support is also included for DOS 16-bit.


The typical scenario of a signature creation process is:

	- run plb or pcf to create pattern files.
	- run sigmake to get an EXC file with collisions.
	- edit the EXC file to resolve collisions.
	- run sigmake again to get a SIG file.
	- repeat the above 2 steps until there is no collision left.
	- run zipsig to get a compressed SIG file

The procedure to create the startup signature files is slightly different.
You must have all pattern files for all compilers in order to create startup 
signature files. All these files are located in the STARTUP directory.

If you want IDA Pro 3.64 to apply your signature file automatically,
you must 

        - create startup patterns for the libraries you are using
        - copy them to STARTUP directory
        - run startup.bat

Please note the naming convention of startup patterns: EXE file patterns
have EXE*.PAT names etc.

Some examples (command files and EXC files) can be found in the EXAMPLE 
directory.

For mre specific information about our utilities please read the files

	PLB.DOC
	PCF.DOC
	SIGMAKE.DOC

All questions and your feedback are highly appreciated at
 

                           flair@datarescue.com
