Ghidra has function id databases, but only ships with signatures for relatively modern visual studio. You can create your own signature databases, although i h

Ghidra has function id databases, but only ships with signatures for relatively modern visual studio. You can create your own signature databases, although i have been unsuccessful in my brief attempts. The algorithm is different from flirt though. Its roughly, mask a bunch of stuff (relocations, etc), and hash whats left. There is some parent/child analysis for ambiguous calls i believe. My recollection is flirt also masks its version of a bunch of stuff, but builds a trie of the first xx bytes with some provision for needed values past that, and some parent child analysis. They have a paper on the algorithm you can google. Ida ships with more signatures out of the box, In my experience. Although i havent seen them listed anywhere.