end users can select which function they want to generate a signature for (one, all or user selection).

feature is embedded in IDA GUI : external tools to generate signatures are no longer needed.

In a nutshell Lumina is the evolution of the good old FLIRT (Fast Library Identification and Recognition Technology) mechanism with some improvements: It is possible to configure IDA to automatically request metadata at the end of analysis.” This is a great way to improve the disassembly listing. If metadata is found, it will be downloaded and applied to the current database. Instead, it sends some hash values and this is enough for Lumina to find the corresponding metadata. When using Lumina, IDA does not send byte patterns to the server. Any user can send or receive metadata from Lumina. “The Lumina server is currently very simple: it holds metadata (function names, prototypes, comments, operand types, and other info) about well-known functions.

are replaced by the new type automatically.Introduced in IDA 7.2 Lumina is an online function recognition feature described in those terms: This is indicated by the arrow sign pointing to the new type’s definition.Īll uses of the old type in the function prototypes, local variable types etc. To map a type to another, open the Local Types window ( Shift– F1), and choose “Map to another type…” from the context menu on the type you want to map.Īfter choosing the type to replace it, the original type is deleted and all references to it are redirected to the new one. Of course, you can go and replace all references to the “wrong” one manually, which is doable if you discover this early, but if you already have hundreds of functions or other types referring to it, the process can become tedious.

Or, after analyzing two different functions, you only find out later that two structures are, in fact, one and the same. For example, you find out that the “custom” structure you’ve been building up is actually a well-known type and you found the correct definition in debug info or header files. However, it may happen that eventually you discover duplicates. importing them from type libraries or debug information.creating structures manually, from data, or using decompiler.When working on a binary, you often recover types used in it from many sources:

Ida hexrays