The IDA Pro Book, 2nd Edition

Applying FLIRT Signatures

When a binary is first opened, IDA attempts to apply special signature files, designated as startup signatures, to the entry point of the binary. It turns out that the entry point code generated by various compilers is sufficiently unique that matching entry point signatures is a useful technique for identifying the compiler that may have been used to generate a given binary.

MAIN VS. _START

Recall that a program’s entry point is the address of the first instruction that will be executed. Many longtime C programmers incorrectly believe that this is the address of the function named main, when in fact it is not. The file type of the program, not the language used to create the program, dictates the manner in which command-line ...