TLS handshakeĭuring a TLS handshake, the server certificate is checked against two hardcoded CA certificates: ecdsa-with-SHA256: The client initiates an RPC handshake followed by a client request, a server response, then the session termination. This protocol is simple: on each client request, a TLS/TCP session to :443 is established. Hex-Rays developers have implemented a custom TCP based RPC protocol to communicate between IDA instances and the servers.

additional metadata is stored, instead of only function name and comment in the past.

unlike FLIRT, all signatures and metadata are stored in a single database to avoid individual loading of each signature file.

end users can select which function they want to generate a signature for (one, all or user selection).

feature is embedded in IDA GUI : external tools to generate signatures are no longer needed.

In a nutshell Lumina is the evolution of the good old FLIRT (Fast Library Identification and Recognition Technology) mechanism with some improvements: It is possible to configure IDA to automatically request metadata at the end of analysis.”

This is a great way to improve the disassembly listing. If metadata is found, it will be downloaded and applied to the current database.

Instead, it sends some hash values and this is enough for Lumina to find the corresponding metadata. When using Lumina, IDA does not send byte patterns to the server. Any user can send or receive metadata from Lumina. “The Lumina server is currently very simple: it holds metadata (function names, prototypes, comments, operand types, and other info) about well-known functions. Introduced in IDA 7.2 Lumina is an online function recognition feature described in those terms:

Ida pro python api