summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJordan Wiens <jordan@psifertex.com>2024-02-19 15:04:00 -0500
committerJordan Wiens <jordan@psifertex.com>2024-02-23 11:14:06 -0500
commit448f40be71dffa86a6581c3696627ccc1bdf74f2 (patch)
treecd79923c85986c0135b41eb7432e54218f1a56e5
parent748c2295e31c03afa1d4b1b776a59f9fa9a48d34 (diff)
4.0 documentation
- Refactored Type Documentation - Added Projects - Added Type Archives - Added New Sidebar Documentation - Added String Concepts - Added Light/Dark Mode - Added New Tab Documentation - Added BNIL Guide: HLIL docs - Added new cookbook examples - Added migration guide - Added script for building docsets - Added documentation for themes - Updated all images to Ninja Edit - API Docs : Documents BasicBlockEdge and BasicBlock - API Docs : Documents CoreVariable, Variable, and VariableNameAndType - API Docs : Corrects note on `BinaryView.update_analysis` and `BinaryView.update_analysis_and_wait` to represent that analysis is run by default for you now. - Many, many other changes
-rw-r--r--.github/ISSUE_TEMPLATE/bug_report.md2
-rw-r--r--.gitignore7
-rw-r--r--CMakeLists.txt2
-rw-r--r--api-docs/cppdocs/Doxyfile-Docset2535
-rw-r--r--api-docs/cppdocs/Doxyfile-HTML (renamed from api-docs/cppdocs/USEBUILDMINDOCS)0
-rw-r--r--api-docs/cppdocs/Makefile23
-rw-r--r--api-docs/cppdocs/build_min_docs.py34
-rw-r--r--api-docs/source/conf.py9
-rw-r--r--docs/about/open-source.md4
-rw-r--r--docs/dev/annotation.md297
-rw-r--r--docs/dev/bnil-hlil.md158
-rw-r--r--docs/dev/bnil-llil.md10
-rw-r--r--docs/dev/bnil-mlil.md16
-rw-r--r--docs/dev/bnil-overview.md8
-rw-r--r--docs/dev/concepts.md64
-rw-r--r--docs/dev/cookbook.md163
-rw-r--r--docs/dev/flags.md6
-rw-r--r--docs/dev/index.md4
-rw-r--r--docs/dev/plugins.md2
-rw-r--r--docs/dev/themes.md138
-rw-r--r--docs/dev/typelibraries.md288
-rw-r--r--docs/dev/uidf.md39
-rw-r--r--docs/dev/workflows.md1
-rw-r--r--docs/docs.css141
-rw-r--r--docs/getting-started.md44
-rw-r--r--docs/guide/index.md590
-rw-r--r--docs/guide/migration/index.md21
-rw-r--r--docs/guide/migration/migrationguideghidra.md119
-rw-r--r--docs/guide/migration/migrationguideida.md66
-rw-r--r--docs/guide/objectivec.md4
-rw-r--r--docs/guide/plugins.md2
-rw-r--r--docs/guide/projects.md122
-rw-r--r--docs/guide/settings.md98
-rw-r--r--docs/guide/troubleshooting.md2
-rw-r--r--docs/guide/type.md363
-rw-r--r--docs/guide/types/basictypes.md173
-rw-r--r--docs/guide/types/cpp.md (renamed from docs/guide/cpp.md)18
-rw-r--r--docs/guide/types/debuginfo.md (renamed from docs/guide/debuginfo.md)2
-rw-r--r--docs/guide/types/index.md18
-rw-r--r--docs/guide/types/platformtypes.md42
-rw-r--r--docs/guide/types/type.md88
-rw-r--r--docs/guide/types/typearchives.md47
-rw-r--r--docs/guide/types/typeimportexport.md184
-rw-r--r--docs/guide/types/typelibraries.md37
-rw-r--r--docs/img/BNIL-hlil.pngbin40400 -> 36969 bytes
-rw-r--r--docs/img/BNIL-llil.pngbin40254 -> 36803 bytes
-rw-r--r--docs/img/BNIL-mlil.pngbin40390 -> 36907 bytes
-rw-r--r--docs/img/BNIL-overview.pngbin79401 -> 46721 bytes
-rw-r--r--docs/img/BNIL.pngbin39769 -> 26955 bytes
-rw-r--r--docs/img/address-indicator.pngbin58102 -> 50375 bytes
-rw-r--r--[-rwxr-xr-x]docs/img/after-template-simplification.pngbin87740 -> 137998 bytes
-rw-r--r--docs/img/apply_enum.pngbin91006 -> 0 bytes
-rw-r--r--docs/img/auto-create-members.pngbin28429 -> 57427 bytes
-rw-r--r--docs/img/auto-create-one-member.pngbin22854 -> 0 bytes
-rw-r--r--[-rwxr-xr-x]docs/img/before-template-simplification.pngbin106157 -> 150555 bytes
-rw-r--r--docs/img/change-type.pngbin46488 -> 77785 bytes
-rw-r--r--docs/img/clear-var-value.pngbin152231 -> 64450 bytes
-rw-r--r--docs/img/command-palette.pngbin96334 -> 87296 bytes
-rw-r--r--docs/img/console-split.pngbin108715 -> 92967 bytes
-rw-r--r--docs/img/console.pngbin59637 -> 92327 bytes
-rw-r--r--docs/img/controls.pngbin2241 -> 0 bytes
-rw-r--r--docs/img/correct-switch-after-uidf.pngbin40405 -> 0 bytes
-rw-r--r--docs/img/create-array.pngbin0 -> 81453 bytes
-rw-r--r--docs/img/create-derived-struct-1.pngbin0 -> 50174 bytes
-rw-r--r--docs/img/create-derived-struct-2.pngbin0 -> 50742 bytes
-rw-r--r--docs/img/create-multi-derived-struct.pngbin0 -> 48873 bytes
-rw-r--r--docs/img/create-struct-menu.pngbin0 -> 85030 bytes
-rw-r--r--docs/img/create_array.pngbin47957 -> 0 bytes
-rw-r--r--docs/img/create_derived_struct_1.pngbin66815 -> 0 bytes
-rw-r--r--docs/img/create_derived_struct_2.pngbin67254 -> 0 bytes
-rw-r--r--docs/img/create_multi_derived_struct.pngbin75288 -> 0 bytes
-rw-r--r--docs/img/create_struct_menu.pngbin56056 -> 0 bytes
-rw-r--r--docs/img/cross-reference-filter.pngbin24431 -> 47078 bytes
-rw-r--r--docs/img/cross-reference-panel-pin.pngbin25763 -> 21072 bytes
-rw-r--r--docs/img/cross-reference-table.pngbin43800 -> 34487 bytes
-rw-r--r--docs/img/cross-reference-tree.pngbin88717 -> 62627 bytes
-rw-r--r--docs/img/dead-store-after.pngbin27977 -> 24818 bytes
-rw-r--r--docs/img/dead-store-example.pngbin35415 -> 24055 bytes
-rw-r--r--docs/img/dead-store-menu.pngbin166633 -> 199137 bytes
-rw-r--r--docs/img/efp-dialog-diagram.pngbin0 -> 187848 bytes
-rw-r--r--docs/img/efp_dialog_diagram.pngbin115580 -> 0 bytes
-rw-r--r--docs/img/external-links-edit-external-library.pngbin0 -> 232678 bytes
-rw-r--r--docs/img/external-links-edit-external-location.pngbin0 -> 93060 bytes
-rw-r--r--docs/img/external-links-right-click-library.pngbin0 -> 46086 bytes
-rw-r--r--docs/img/external-links.pngbin0 -> 42146 bytes
-rw-r--r--docs/img/featuremap.pngbin6684 -> 4029 bytes
-rw-r--r--docs/img/find.pngbin0 -> 227006 bytes
-rw-r--r--docs/img/functionlist.pngbin66676 -> 0 bytes
-rw-r--r--docs/img/graphview.pngbin190457 -> 52381 bytes
-rw-r--r--docs/img/hanyu-no-codepage.pngbin0 -> 17977 bytes
-rw-r--r--docs/img/hanyu-with-codepage.pngbin0 -> 17444 bytes
-rw-r--r--docs/img/hex.pngbin319944 -> 214354 bytes
-rw-r--r--docs/img/hlil-after-uidf.pngbin91085 -> 0 bytes
-rw-r--r--docs/img/hlil-before-uidf.pngbin74449 -> 0 bytes
-rw-r--r--docs/img/hlil-braces.pngbin303084 -> 297481 bytes
-rw-r--r--docs/img/hlil-hierarchy-call.pngbin39238 -> 25428 bytes
-rw-r--r--docs/img/hlil-scope.pngbin25489 -> 30777 bytes
-rw-r--r--docs/img/hover-uidf.pngbin43901 -> 0 bytes
-rw-r--r--docs/img/ilmapping.pngbin116999 -> 175295 bytes
-rw-r--r--docs/img/import-bndb.pngbin296661 -> 133730 bytes
-rw-r--r--docs/img/import-header.pngbin509733 -> 248135 bytes
-rw-r--r--docs/img/jump-table-uidf.pngbin77602 -> 0 bytes
-rw-r--r--docs/img/keybindings.pngbin80351 -> 60116 bytes
-rw-r--r--docs/img/license-popup.pngbin69296 -> 115823 bytes
-rw-r--r--docs/img/linear.pngbin309443 -> 342383 bytes
-rw-r--r--docs/img/llil-hierarchy.pngbin241251 -> 129772 bytes
-rw-r--r--docs/img/llil-option.pngbin0 -> 50569 bytes
-rw-r--r--docs/img/llil_option.pngbin29139 -> 0 bytes
-rw-r--r--docs/img/logo.pngbin15720 -> 9652 bytes
-rw-r--r--docs/img/logs.pngbin0 -> 264406 bytes
-rw-r--r--docs/img/main.pngbin285874 -> 478007 bytes
-rw-r--r--docs/img/memory-map-icon.pngbin0 -> 2859 bytes
-rw-r--r--docs/img/memory-map.pngbin73128 -> 317898 bytes
-rw-r--r--docs/img/merge-variables.pngbin150397 -> 101221 bytes
-rw-r--r--docs/img/merge-vars-dialog.pngbin58976 -> 0 bytes
-rw-r--r--docs/img/merge-vars.pngbin63066 -> 0 bytes
-rw-r--r--docs/img/mini-graph.pngbin0 -> 18100 bytes
-rw-r--r--docs/img/mystring.pngbin17069 -> 0 bytes
-rw-r--r--docs/img/navigation.pngbin50125 -> 64492 bytes
-rw-r--r--docs/img/newtab-compact.pngbin0 -> 164348 bytes
-rw-r--r--docs/img/newtab-personal.pngbin0 -> 1033053 bytes
-rw-r--r--docs/img/newtab-projects.pngbin0 -> 529169 bytes
-rw-r--r--docs/img/objc-analyze-action.pngbin0 -> 127684 bytes
-rw-r--r--docs/img/objc-workflow-selected.pngbin0 -> 71140 bytes
-rw-r--r--docs/img/objc_analyze_action.pngbin107944 -> 0 bytes
-rw-r--r--docs/img/objc_workflow_selected.pngbin37469 -> 0 bytes
-rw-r--r--docs/img/open-with-options.pngbin121934 -> 424007 bytes
-rw-r--r--docs/img/options-setting-uidf.pngbin46958 -> 0 bytes
-rw-r--r--docs/img/options.pngbin79025 -> 63295 bytes
-rw-r--r--docs/img/overview.pngbin381544 -> 504705 bytes
-rw-r--r--docs/img/plugin-manager.pngbin151411 -> 529518 bytes
-rw-r--r--docs/img/preferences.pngbin72367 -> 0 bytes
-rw-r--r--docs/img/projects.pngbin0 -> 424810 bytes
-rw-r--r--docs/img/pseudo-c.pngbin134160 -> 102908 bytes
-rw-r--r--docs/img/rename.pngbin17634 -> 71322 bytes
-rw-r--r--docs/img/right-click-uidf.pngbin175393 -> 0 bytes
-rw-r--r--docs/img/save-choices.pngbin24272 -> 28511 bytes
-rw-r--r--docs/img/save-with-options.pngbin41830 -> 82454 bytes
-rw-r--r--docs/img/select-enum-member.pngbin0 -> 164197 bytes
-rw-r--r--docs/img/select_enum_member.pngbin101703 -> 0 bytes
-rw-r--r--docs/img/settings.pngbin332687 -> 238566 bytes
-rw-r--r--docs/img/sidebar.pngbin345978 -> 0 bytes
-rw-r--r--docs/img/sidebaricons.pngbin0 -> 17417 bytes
-rw-r--r--docs/img/sidebars.pngbin0 -> 552152 bytes
-rw-r--r--docs/img/split-var.pngbin54707 -> 92559 bytes
-rw-r--r--docs/img/stack.pngbin0 -> 85071 bytes
-rw-r--r--docs/img/status-bar.pngbin16608 -> 12324 bytes
-rw-r--r--docs/img/stringapplied.pngbin16193 -> 0 bytes
-rw-r--r--docs/img/strings.pngbin0 -> 160654 bytes
-rw-r--r--docs/img/symbols-header-menu.pngbin0 -> 75558 bytes
-rw-r--r--docs/img/symbols-right-click.pngbin0 -> 80996 bytes
-rw-r--r--docs/img/symbols_dragtocreate.pngbin117537 -> 0 bytes
-rw-r--r--docs/img/symbols_header_drag.pngbin178695 -> 0 bytes
-rw-r--r--docs/img/symbols_header_menu.pngbin117775 -> 0 bytes
-rw-r--r--docs/img/symbols_overview1.pngbin392638 -> 0 bytes
-rw-r--r--docs/img/symbols_right_click_NFwS.pngbin154256 -> 0 bytes
-rw-r--r--docs/img/symbols_truncation.pngbin23655 -> 0 bytes
-rw-r--r--docs/img/tags.pngbin0 -> 85901 bytes
-rw-r--r--docs/img/taped/1.pngbin27905 -> 23879 bytes
-rw-r--r--docs/img/taped/2.pngbin33085 -> 32969 bytes
-rw-r--r--docs/img/taped/3.pngbin29260 -> 31573 bytes
-rw-r--r--docs/img/taped/4.pngbin28660 -> 28580 bytes
-rw-r--r--docs/img/taped/5.pngbin65863 -> 40997 bytes
-rw-r--r--docs/img/taped/6.pngbin276452 -> 196049 bytes
-rw-r--r--docs/img/themedocs-console.pngbin34610 -> 0 bytes
-rw-r--r--docs/img/themedocs-graphview.pngbin34406 -> 0 bytes
-rw-r--r--docs/img/themedocs-hexview.pngbin28782 -> 0 bytes
-rw-r--r--docs/img/themedocs-highlighting.pngbin59619 -> 0 bytes
-rw-r--r--docs/img/themedocs-linearview.pngbin62882 -> 0 bytes
-rw-r--r--docs/img/themedocs-tokens.pngbin135432 -> 0 bytes
-rw-r--r--docs/img/themes-console.pngbin0 -> 80034 bytes
-rw-r--r--docs/img/themes-graph.pngbin0 -> 95413 bytes
-rw-r--r--docs/img/themes-hex.pngbin0 -> 26790 bytes
-rw-r--r--docs/img/themes-hexview.pngbin0 -> 26222 bytes
-rw-r--r--docs/img/themes-highlighting.pngbin0 -> 76592 bytes
-rw-r--r--docs/img/themes-linear.pngbin0 -> 110410 bytes
-rw-r--r--docs/img/themes-minigraph.pngbin0 -> 9962 bytes
-rw-r--r--docs/img/themes-panes.pngbin0 -> 31145 bytes
-rw-r--r--docs/img/themes-statusbar.pngbin0 -> 13490 bytes
-rw-r--r--docs/img/themes-tokens.pngbin0 -> 235554 bytes
-rw-r--r--docs/img/tiling-panes.pngbin282560 -> 591934 bytes
-rw-r--r--docs/img/type-archives-status.pngbin0 -> 81319 bytes
-rw-r--r--docs/img/type-archives.pngbin0 -> 61102 bytes
-rw-r--r--docs/img/type-view-accesses.pngbin17547 -> 0 bytes
-rw-r--r--docs/img/types-containers.pngbin0 -> 32689 bytes
-rw-r--r--docs/img/types-list.pngbin0 -> 31999 bytes
-rw-r--r--docs/img/types-right-click-menu-bottom.pngbin0 -> 86147 bytes
-rw-r--r--docs/img/types-right-click-menu-top.pngbin0 -> 66646 bytes
-rw-r--r--docs/img/types-right-click-menu.pngbin21040 -> 0 bytes
-rw-r--r--docs/img/types-view.pngbin248754 -> 357042 bytes
-rw-r--r--docs/img/uidf-correct-switch-after.pngbin0 -> 31723 bytes
-rw-r--r--docs/img/uidf-hlil-after.pngbin0 -> 35351 bytes
-rw-r--r--docs/img/uidf-hlil-before.pngbin0 -> 83679 bytes
-rw-r--r--docs/img/uidf-hover.pngbin0 -> 24938 bytes
-rw-r--r--docs/img/uidf-jump-table.pngbin0 -> 59090 bytes
-rw-r--r--docs/img/uidf-options-setting.pngbin0 -> 126457 bytes
-rw-r--r--docs/img/uidf-right-click.pngbin0 -> 111094 bytes
-rw-r--r--docs/img/uidf-sidebar.pngbin0 -> 146005 bytes
-rw-r--r--docs/img/unicode-settings.pngbin0 -> 48085 bytes
-rw-r--r--docs/img/variables.pngbin0 -> 137636 bytes
-rw-r--r--docs/img/view-choices.pngbin45913 -> 29523 bytes
-rw-r--r--docs/img/vtable-cross-refs-context.pngbin0 -> 54577 bytes
-rw-r--r--docs/img/vtable-cross-refs.pngbin0 -> 38743 bytes
-rw-r--r--docs/img/vtable_cross_refs.pngbin48986 -> 0 bytes
-rw-r--r--docs/img/vtable_cross_refs_context.pngbin68328 -> 0 bytes
-rw-r--r--docs/index.md15
-rw-r--r--mkdocs-verify.yml87
-rw-r--r--mkdocs.yml79
-rw-r--r--python/__init__.py28
-rw-r--r--python/basicblock.py25
-rw-r--r--python/binaryview.py19
-rw-r--r--python/bncompleter.py8
-rw-r--r--python/demangle.py2
-rw-r--r--python/filemetadata.py2
-rw-r--r--python/highlevelil.py2
-rw-r--r--python/mediumlevelil.py2
-rw-r--r--python/plugin.py107
-rw-r--r--python/project.py2
-rw-r--r--python/variable.py31
219 files changed, 5052 insertions, 1348 deletions
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index c9b959f6..76644a33 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -8,7 +8,7 @@ assignees: ''
---
**Version and Platform (required):**
-- Binary Ninja Version: [e.g. 3.2.4000-dev] (if version is stable, please also test the latest development build via the "Update Channel" option)
+- Binary Ninja Version: [e.g. 4.0.4000-dev] (if version is stable, please also test the latest development build via the "Update Channel" option)
- OS: [e.g. Ubuntu Linux]
- OS Version: [e.g. 22.04]
- CPU Architecture: [e.g. x64 or M1]
diff --git a/.gitignore b/.gitignore
index 1fc21ced..e6e73fc9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,6 +52,8 @@ api-docs/source/uiapi
api-docs/cppdocs/api
api-docs/cppdocs/xml
api-docs/cppdocs/html
+api-docs/cppdocs/docset
+!api-docs/cppdocs/Makefile
!api-docs/Makefile
# CMake
@@ -86,7 +88,4 @@ rust/examples/dwarf/*/target/
# Debugger docs
docs/img/debugger
-docs/guide/debugger.md
-docs/guide/remote-debugging.md
-docs/guide/dbgeng-ttd.md
-docs/guide/windows-kd.md
+docs/guide/debugger
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 183e24c4..2c543f85 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -113,7 +113,7 @@ if (DEBUGGER)
add_custom_command(TARGET binaryninjaapi PRE_BUILD
COMMAND ${CMAKE_COMMAND} -E echo "Copying Debugger Docs"
COMMAND ${CMAKE_COMMAND} -E copy_directory ${CMAKE_CURRENT_SOURCE_DIR}/../public/debugger/docs/guide
- ${CMAKE_CURRENT_SOURCE_DIR}/docs/guide
+ ${CMAKE_CURRENT_SOURCE_DIR}/docs/guide/debugger
COMMAND ${CMAKE_COMMAND} -E copy_directory ${CMAKE_CURRENT_SOURCE_DIR}/../public/debugger/docs/img
${CMAKE_CURRENT_SOURCE_DIR}/docs/img
)
diff --git a/api-docs/cppdocs/Doxyfile-Docset b/api-docs/cppdocs/Doxyfile-Docset
new file mode 100644
index 00000000..7303bc67
--- /dev/null
+++ b/api-docs/cppdocs/Doxyfile-Docset
@@ -0,0 +1,2535 @@
+# Doxyfile 1.8.20
+
+# This file describes the settings to be used by the documentation system
+# doxygen (www.doxygen.org) for a project.
+#
+# All text after a double hash (##) is considered a comment and is placed in
+# front of the TAG it is preceding.
+#
+# All text after a single hash (#) is considered a comment and will be ignored.
+# The format is:
+# TAG = value [value, ...]
+# For lists, items can also be appended using:
+# TAG += value [value, ...]
+# Values that contain spaces should be placed between quotes (\" \").
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+
+# This tag specifies the encoding used for all characters in the configuration
+# file that follow. The default is UTF-8 which is also the encoding used for all
+# text before the first occurrence of this tag. Doxygen uses libiconv (or the
+# iconv built into libc) for the transcoding. See
+# https://www.gnu.org/software/libiconv/ for the list of possible encodings.
+# The default value is: UTF-8.
+
+DOXYFILE_ENCODING = UTF-8
+
+# The PROJECT_NAME tag is a single word (or a sequence of words surrounded by
+# double-quotes, unless you are using Doxywizard) that should identify the
+# project for which the documentation is generated. This name is used in the
+# title of most generated pages and in a few other places.
+# The default value is: My Project.
+
+PROJECT_NAME = "Binary Ninja API C++"
+
+# The PROJECT_NUMBER tag can be used to enter a project or revision number. This
+# could be handy for archiving the generated documentation or if some version
+# control system is used.
+
+PROJECT_NUMBER =
+
+# Using the PROJECT_BRIEF tag one can provide an optional one line description
+# for a project that appears at the top of each page and should give viewer a
+# quick idea about the purpose of the project. Keep the description short.
+
+PROJECT_BRIEF = "API Documentation for the Binary Ninja Reverse Engineering Platform"
+
+# With the PROJECT_LOGO tag one can specify a logo or an icon that is included
+# in the documentation. The maximum height of the logo should not exceed 55
+# pixels and the maximum width should not exceed 200 pixels. Doxygen will copy
+# the logo to the output directory.
+
+PROJECT_LOGO = ../../docs/img/logo.png
+
+# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) path
+# into which the generated documentation will be written. If a relative path is
+# entered, it will be relative to the location where doxygen was started. If
+# left blank the current directory will be used.
+
+OUTPUT_DIRECTORY =
+
+# If the CREATE_SUBDIRS tag is set to YES then doxygen will create 4096 sub-
+# directories (in 2 levels) under the output directory of each output format and
+# will distribute the generated files over these directories. Enabling this
+# option can be useful when feeding doxygen a huge amount of source files, where
+# putting all generated files in the same directory would otherwise causes
+# performance problems for the file system.
+# The default value is: NO.
+
+CREATE_SUBDIRS = NO
+
+# If the ALLOW_UNICODE_NAMES tag is set to YES, doxygen will allow non-ASCII
+# characters to appear in the names of generated files. If set to NO, non-ASCII
+# characters will be escaped, for example _xE3_x81_x84 will be used for Unicode
+# U+3044.
+# The default value is: NO.
+
+ALLOW_UNICODE_NAMES = NO
+
+# The OUTPUT_LANGUAGE tag is used to specify the language in which all
+# documentation generated by doxygen is written. Doxygen will use this
+# information to generate all constant output in the proper language.
+# Possible values are: Afrikaans, Arabic, Armenian, Brazilian, Catalan, Chinese,
+# Chinese-Traditional, Croatian, Czech, Danish, Dutch, English (United States),
+# Esperanto, Farsi (Persian), Finnish, French, German, Greek, Hungarian,
+# Indonesian, Italian, Japanese, Japanese-en (Japanese with English messages),
+# Korean, Korean-en (Korean with English messages), Latvian, Lithuanian,
+# Macedonian, Norwegian, Persian (Farsi), Polish, Portuguese, Romanian, Russian,
+# Serbian, Serbian-Cyrillic, Slovak, Slovene, Spanish, Swedish, Turkish,
+# Ukrainian and Vietnamese.
+# The default value is: English.
+
+OUTPUT_LANGUAGE = English
+
+# The OUTPUT_TEXT_DIRECTION tag is used to specify the direction in which all
+# documentation generated by doxygen is written. Doxygen will use this
+# information to generate all generated output in the proper direction.
+# Possible values are: None, LTR, RTL and Context.
+# The default value is: None.
+
+OUTPUT_TEXT_DIRECTION = None
+
+# If the BRIEF_MEMBER_DESC tag is set to YES, doxygen will include brief member
+# descriptions after the members that are listed in the file and class
+# documentation (similar to Javadoc). Set to NO to disable this.
+# The default value is: YES.
+
+BRIEF_MEMBER_DESC = YES
+
+# If the REPEAT_BRIEF tag is set to YES, doxygen will prepend the brief
+# description of a member or function before the detailed description
+#
+# Note: If both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the
+# brief descriptions will be completely suppressed.
+# The default value is: YES.
+
+REPEAT_BRIEF = YES
+
+# This tag implements a quasi-intelligent brief description abbreviator that is
+# used to form the text in various listings. Each string in this list, if found
+# as the leading text of the brief description, will be stripped from the text
+# and the result, after processing the whole list, is used as the annotated
+# text. Otherwise, the brief description is used as-is. If left blank, the
+# following values are used ($name is automatically replaced with the name of
+# the entity):The $name class, The $name widget, The $name file, is, provides,
+# specifies, contains, represents, a, an and the.
+
+ABBREVIATE_BRIEF =
+
+# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then
+# doxygen will generate a detailed section even if there is only a brief
+# description.
+# The default value is: NO.
+
+ALWAYS_DETAILED_SEC = NO
+
+# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all
+# inherited members of a class in the documentation of that class as if those
+# members were ordinary class members. Constructors, destructors and assignment
+# operators of the base classes will not be shown.
+# The default value is: NO.
+
+INLINE_INHERITED_MEMB = NO
+
+# If the FULL_PATH_NAMES tag is set to YES, doxygen will prepend the full path
+# before files name in the file list and in the header files. If set to NO the
+# shortest path that makes the file name unique will be used
+# The default value is: YES.
+
+FULL_PATH_NAMES = NO
+
+# The STRIP_FROM_PATH tag can be used to strip a user-defined part of the path.
+# Stripping is only done if one of the specified strings matches the left-hand
+# part of the path. The tag can be used to show relative paths in the file list.
+# If left blank the directory from which doxygen is run is used as the path to
+# strip.
+#
+# Note that you can specify absolute paths here, but also relative paths, which
+# will be relative from the directory where doxygen is started.
+# This tag requires that the tag FULL_PATH_NAMES is set to YES.
+
+STRIP_FROM_PATH =
+
+# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of the
+# path mentioned in the documentation of a class, which tells the reader which
+# header file to include in order to use a class. If left blank only the name of
+# the header file containing the class definition is used. Otherwise one should
+# specify the list of include paths that are normally passed to the compiler
+# using the -I flag.
+
+STRIP_FROM_INC_PATH =
+
+# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter (but
+# less readable) file names. This can be useful is your file systems doesn't
+# support long names like on DOS, Mac, or CD-ROM.
+# The default value is: NO.
+
+SHORT_NAMES = NO
+
+# If the JAVADOC_AUTOBRIEF tag is set to YES then doxygen will interpret the
+# first line (until the first dot) of a Javadoc-style comment as the brief
+# description. If set to NO, the Javadoc-style will behave just like regular Qt-
+# style comments (thus requiring an explicit @brief command for a brief
+# description.)
+# The default value is: NO.
+
+JAVADOC_AUTOBRIEF = NO
+
+# If the JAVADOC_BANNER tag is set to YES then doxygen will interpret a line
+# such as
+# /***************
+# as being the beginning of a Javadoc-style comment "banner". If set to NO, the
+# Javadoc-style will behave just like regular comments and it will not be
+# interpreted by doxygen.
+# The default value is: NO.
+
+JAVADOC_BANNER = NO
+
+# If the QT_AUTOBRIEF tag is set to YES then doxygen will interpret the first
+# line (until the first dot) of a Qt-style comment as the brief description. If
+# set to NO, the Qt-style will behave just like regular Qt-style comments (thus
+# requiring an explicit \brief command for a brief description.)
+# The default value is: NO.
+
+QT_AUTOBRIEF = YES
+
+# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make doxygen treat a
+# multi-line C++ special comment block (i.e. a block of //! or /// comments) as
+# a brief description. This used to be the default behavior. The new default is
+# to treat a multi-line C++ comment block as a detailed description. Set this
+# tag to YES if you prefer the old behavior instead.
+#
+# Note that setting this tag to YES also means that rational rose comments are
+# not recognized any more.
+# The default value is: NO.
+
+MULTILINE_CPP_IS_BRIEF = NO
+
+# By default Python docstrings are displayed as preformatted text and doxygen's
+# special commands cannot be used. By setting PYTHON_DOCSTRING to NO the
+# doxygen's special commands can be used and the contents of the docstring
+# documentation blocks is shown as doxygen documentation.
+# The default value is: YES.
+
+PYTHON_DOCSTRING = YES
+
+# If the INHERIT_DOCS tag is set to YES then an undocumented member inherits the
+# documentation from any documented member that it re-implements.
+# The default value is: YES.
+
+INHERIT_DOCS = YES
+
+# If the SEPARATE_MEMBER_PAGES tag is set to YES then doxygen will produce a new
+# page for each member. If set to NO, the documentation of a member will be part
+# of the file/class/namespace that contains it.
+# The default value is: NO.
+
+SEPARATE_MEMBER_PAGES = NO
+
+# The TAB_SIZE tag can be used to set the number of spaces in a tab. Doxygen
+# uses this value to replace tabs by spaces in code fragments.
+# Minimum value: 1, maximum value: 16, default value: 4.
+
+TAB_SIZE = 4
+
+# This tag can be used to specify a number of aliases that act as commands in
+# the documentation. An alias has the form:
+# name=value
+# For example adding
+# "sideeffect=@par Side Effects:\n"
+# will allow you to put the command \sideeffect (or @sideeffect) in the
+# documentation, which will result in a user-defined paragraph with heading
+# "Side Effects:". You can put \n's in the value part of an alias to insert
+# newlines (in the resulting output). You can put ^^ in the value part of an
+# alias to insert a newline as if a physical newline was in the original file.
+# When you need a literal { or } or , in the value part of an alias you have to
+# escape them by means of a backslash (\), this can lead to conflicts with the
+# commands \{ and \} for these it is advised to use the version @{ and @} or use
+# a double escape (\\{ and \\})
+
+ALIASES = threadsafety{1}="<dl class=\"threadsafe \1\"><dt><img class=\"thread\" src=\"thread.png\"> Thread Safe: <dd>\1</dd></dt></dl>" threadsafetywith{2}="<dl class=\"threadsafe \1\"><dt title=\"\2\"><img class=\"thread\" src=\"thread.png\"> Thread Safe: <dd>\1</dd></dt></dl>" threadsafe="\threadsafety{Yes}" threadunsafe="\threadsafety{No}" threadunsafewith{1}="\threadsafetywith{No,\1}" threadmainonly="\threadsafety{Main Thread Only}"
+
+# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C sources
+# only. Doxygen will then generate output that is more tailored for C. For
+# instance, some of the names that are used will be different. The list of all
+# members will be omitted, etc.
+# The default value is: NO.
+
+OPTIMIZE_OUTPUT_FOR_C = NO
+
+# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java or
+# Python sources only. Doxygen will then generate output that is more tailored
+# for that language. For instance, namespaces will be presented as packages,
+# qualified scopes will look different, etc.
+# The default value is: NO.
+
+OPTIMIZE_OUTPUT_JAVA = NO
+
+# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran
+# sources. Doxygen will then generate output that is tailored for Fortran.
+# The default value is: NO.
+
+OPTIMIZE_FOR_FORTRAN = NO
+
+# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL
+# sources. Doxygen will then generate output that is tailored for VHDL.
+# The default value is: NO.
+
+OPTIMIZE_OUTPUT_VHDL = NO
+
+# Set the OPTIMIZE_OUTPUT_SLICE tag to YES if your project consists of Slice
+# sources only. Doxygen will then generate output that is more tailored for that
+# language. For instance, namespaces will be presented as modules, types will be
+# separated into more groups, etc.
+# The default value is: NO.
+
+OPTIMIZE_OUTPUT_SLICE = NO
+
+# Doxygen selects the parser to use depending on the extension of the files it
+# parses. With this tag you can assign which parser to use for a given
+# extension. Doxygen has a built-in mapping, but you can override or extend it
+# using this tag. The format is ext=language, where ext is a file extension, and
+# language is one of the parsers supported by doxygen: IDL, Java, JavaScript,
+# Csharp (C#), C, C++, D, PHP, md (Markdown), Objective-C, Python, Slice, VHDL,
+# Fortran (fixed format Fortran: FortranFixed, free formatted Fortran:
+# FortranFree, unknown formatted Fortran: Fortran. In the later case the parser
+# tries to guess whether the code is fixed or free formatted code, this is the
+# default for Fortran type files). For instance to make doxygen treat .inc files
+# as Fortran files (default is PHP), and .f files as C (default is Fortran),
+# use: inc=Fortran f=C.
+#
+# Note: For files without extension you can use no_extension as a placeholder.
+#
+# Note that for custom extensions you also need to set FILE_PATTERNS otherwise
+# the files are not read by doxygen.
+
+EXTENSION_MAPPING =
+
+# If the MARKDOWN_SUPPORT tag is enabled then doxygen pre-processes all comments
+# according to the Markdown format, which allows for more readable
+# documentation. See https://daringfireball.net/projects/markdown/ for details.
+# The output of markdown processing is further processed by doxygen, so you can
+# mix doxygen, HTML, and XML commands with Markdown formatting. Disable only in
+# case of backward compatibilities issues.
+# The default value is: YES.
+
+MARKDOWN_SUPPORT = NO
+
+# When the TOC_INCLUDE_HEADINGS tag is set to a non-zero value, all headings up
+# to that level are automatically included in the table of contents, even if
+# they do not have an id attribute.
+# Note: This feature currently applies only to Markdown headings.
+# Minimum value: 0, maximum value: 99, default value: 5.
+# This tag requires that the tag MARKDOWN_SUPPORT is set to YES.
+
+TOC_INCLUDE_HEADINGS = 5
+
+# When enabled doxygen tries to link words that correspond to documented
+# classes, or namespaces to their corresponding documentation. Such a link can
+# be prevented in individual cases by putting a % sign in front of the word or
+# globally by setting AUTOLINK_SUPPORT to NO.
+# The default value is: YES.
+
+AUTOLINK_SUPPORT = YES
+
+# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want
+# to include (a tag file for) the STL sources as input, then you should set this
+# tag to YES in order to let doxygen match functions declarations and
+# definitions whose arguments contain STL classes (e.g. func(std::string);
+# versus func(std::string) {}). This also make the inheritance and collaboration
+# diagrams that involve STL classes more complete and accurate.
+# The default value is: NO.
+
+BUILTIN_STL_SUPPORT = NO
+
+# If you use Microsoft's C++/CLI language, you should set this option to YES to
+# enable parsing support.
+# The default value is: NO.
+
+CPP_CLI_SUPPORT = NO
+
+# Set the SIP_SUPPORT tag to YES if your project consists of sip (see:
+# https://www.riverbankcomputing.com/software/sip/intro) sources only. Doxygen
+# will parse them like normal C++ but will assume all classes use public instead
+# of private inheritance when no explicit protection keyword is present.
+# The default value is: NO.
+
+SIP_SUPPORT = NO
+
+# For Microsoft's IDL there are propget and propput attributes to indicate
+# getter and setter methods for a property. Setting this option to YES will make
+# doxygen to replace the get and set methods by a property in the documentation.
+# This will only work if the methods are indeed getting or setting a simple
+# type. If this is not the case, or you want to show the methods anyway, you
+# should set this option to NO.
+# The default value is: YES.
+
+IDL_PROPERTY_SUPPORT = YES
+
+# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC
+# tag is set to YES then doxygen will reuse the documentation of the first
+# member in the group (if any) for the other members of the group. By default
+# all members of a group must be documented explicitly.
+# The default value is: NO.
+
+DISTRIBUTE_GROUP_DOC = NO
+
+# If one adds a struct or class to a group and this option is enabled, then also
+# any nested class or struct is added to the same group. By default this option
+# is disabled and one has to add nested compounds explicitly via \ingroup.
+# The default value is: NO.
+
+GROUP_NESTED_COMPOUNDS = YES
+
+# Set the SUBGROUPING tag to YES to allow class member groups of the same type
+# (for instance a group of public functions) to be put as a subgroup of that
+# type (e.g. under the Public Functions section). Set it to NO to prevent
+# subgrouping. Alternatively, this can be done per class using the
+# \nosubgrouping command.
+# The default value is: YES.
+
+SUBGROUPING = YES
+
+# When the INLINE_GROUPED_CLASSES tag is set to YES, classes, structs and unions
+# are shown inside the group in which they are included (e.g. using \ingroup)
+# instead of on a separate page (for HTML and Man pages) or section (for LaTeX
+# and RTF).
+#
+# Note that this feature does not work in combination with
+# SEPARATE_MEMBER_PAGES.
+# The default value is: NO.
+
+INLINE_GROUPED_CLASSES = YES
+
+# When the INLINE_SIMPLE_STRUCTS tag is set to YES, structs, classes, and unions
+# with only public data fields or simple typedef fields will be shown inline in
+# the documentation of the scope in which they are defined (i.e. file,
+# namespace, or group documentation), provided this scope is documented. If set
+# to NO, structs, classes, and unions are shown on a separate page (for HTML and
+# Man pages) or section (for LaTeX and RTF).
+# The default value is: NO.
+
+INLINE_SIMPLE_STRUCTS = YES
+
+# When TYPEDEF_HIDES_STRUCT tag is enabled, a typedef of a struct, union, or
+# enum is documented as struct, union, or enum with the name of the typedef. So
+# typedef struct TypeS {} TypeT, will appear in the documentation as a struct
+# with name TypeT. When disabled the typedef will appear as a member of a file,
+# namespace, or class. And the struct will be named TypeS. This can typically be
+# useful for C code in case the coding convention dictates that all compound
+# types are typedef'ed and only the typedef is referenced, never the tag name.
+# The default value is: NO.
+
+TYPEDEF_HIDES_STRUCT = NO
+
+# The size of the symbol lookup cache can be set using LOOKUP_CACHE_SIZE. This
+# cache is used to resolve symbols given their name and scope. Since this can be
+# an expensive process and often the same symbol appears multiple times in the
+# code, doxygen keeps a cache of pre-resolved symbols. If the cache is too small
+# doxygen will become slower. If the cache is too large, memory is wasted. The
+# cache size is given by this formula: 2^(16+LOOKUP_CACHE_SIZE). The valid range
+# is 0..9, the default is 0, corresponding to a cache size of 2^16=65536
+# symbols. At the end of a run doxygen will report the cache usage and suggest
+# the optimal cache size from a speed point of view.
+# Minimum value: 0, maximum value: 9, default value: 0.
+
+LOOKUP_CACHE_SIZE = 0
+
+# The NUM_PROC_THREADS specifies the number threads doxygen is allowed to use
+# during processing. When set to 0 doxygen will based this on the number of
+# cores available in the system. You can set it explicitly to a value larger
+# than 0 to get more control over the balance between CPU load and processing
+# speed. At this moment only the input processing can be done using multiple
+# threads. Since this is still an experimental feature the default is set to 1,
+# which efficively disables parallel processing. Please report any issues you
+# encounter. Generating dot graphs in parallel is controlled by the
+# DOT_NUM_THREADS setting.
+# Minimum value: 0, maximum value: 32, default value: 1.
+
+NUM_PROC_THREADS = 0
+
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+
+# If the EXTRACT_ALL tag is set to YES, doxygen will assume all entities in
+# documentation are documented, even if no documentation was available. Private
+# class members and static file members will be hidden unless the
+# EXTRACT_PRIVATE respectively EXTRACT_STATIC tags are set to YES.
+# Note: This will also disable the warnings about undocumented members that are
+# normally produced when WARNINGS is set to YES.
+# The default value is: NO.
+
+EXTRACT_ALL = YES
+
+# If the EXTRACT_PRIVATE tag is set to YES, all private members of a class will
+# be included in the documentation.
+# The default value is: NO.
+
+EXTRACT_PRIVATE = NO
+
+# If the EXTRACT_PRIV_VIRTUAL tag is set to YES, documented private virtual
+# methods of a class will be included in the documentation.
+# The default value is: NO.
+
+EXTRACT_PRIV_VIRTUAL = NO
+
+# If the EXTRACT_PACKAGE tag is set to YES, all members with package or internal
+# scope will be included in the documentation.
+# The default value is: NO.
+
+EXTRACT_PACKAGE = NO
+
+# If the EXTRACT_STATIC tag is set to YES, all static members of a file will be
+# included in the documentation.
+# The default value is: NO.
+
+EXTRACT_STATIC = NO
+
+# If the EXTRACT_LOCAL_CLASSES tag is set to YES, classes (and structs) defined
+# locally in source files will be included in the documentation. If set to NO,
+# only classes defined in header files are included. Does not have any effect
+# for Java sources.
+# The default value is: YES.
+
+EXTRACT_LOCAL_CLASSES = YES
+
+# This flag is only useful for Objective-C code. If set to YES, local methods,
+# which are defined in the implementation section but not in the interface are
+# included in the documentation. If set to NO, only methods in the interface are
+# included.
+# The default value is: NO.
+
+EXTRACT_LOCAL_METHODS = NO
+
+# If this flag is set to YES, the members of anonymous namespaces will be
+# extracted and appear in the documentation as a namespace called
+# 'anonymous_namespace{file}', where file will be replaced with the base name of
+# the file that contains the anonymous namespace. By default anonymous namespace
+# are hidden.
+# The default value is: NO.
+
+EXTRACT_ANON_NSPACES = NO
+
+# If the HIDE_UNDOC_MEMBERS tag is set to YES, doxygen will hide all
+# undocumented members inside documented classes or files. If set to NO these
+# members will be included in the various overviews, but no documentation
+# section is generated. This option has no effect if EXTRACT_ALL is enabled.
+# The default value is: NO.
+
+HIDE_UNDOC_MEMBERS = NO
+
+# If the HIDE_UNDOC_CLASSES tag is set to YES, doxygen will hide all
+# undocumented classes that are normally visible in the class hierarchy. If set
+# to NO, these classes will be included in the various overviews. This option
+# has no effect if EXTRACT_ALL is enabled.
+# The default value is: NO.
+
+HIDE_UNDOC_CLASSES = NO
+
+# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, doxygen will hide all friend
+# declarations. If set to NO, these declarations will be included in the
+# documentation.
+# The default value is: NO.
+
+HIDE_FRIEND_COMPOUNDS = NO
+
+# If the HIDE_IN_BODY_DOCS tag is set to YES, doxygen will hide any
+# documentation blocks found inside the body of a function. If set to NO, these
+# blocks will be appended to the function's detailed documentation block.
+# The default value is: NO.
+
+HIDE_IN_BODY_DOCS = NO
+
+# The INTERNAL_DOCS tag determines if documentation that is typed after a
+# \internal command is included. If the tag is set to NO then the documentation
+# will be excluded. Set it to YES to include the internal documentation.
+# The default value is: NO.
+
+INTERNAL_DOCS = NO
+
+# If the CASE_SENSE_NAMES tag is set to NO then doxygen will only generate file
+# names in lower-case letters. If set to YES, upper-case letters are also
+# allowed. This is useful if you have classes or files whose names only differ
+# in case and if your file system supports case sensitive file names. Windows
+# (including Cygwin) and Mac users are advised to set this option to NO.
+# The default value is: system dependent.
+
+CASE_SENSE_NAMES = NO
+
+# If the HIDE_SCOPE_NAMES tag is set to NO then doxygen will show members with
+# their full class and namespace scopes in the documentation. If set to YES, the
+# scope will be hidden.
+# The default value is: NO.
+
+HIDE_SCOPE_NAMES = NO
+
+# If the HIDE_COMPOUND_REFERENCE tag is set to NO (default) then doxygen will
+# append additional text to a page's title, such as Class Reference. If set to
+# YES the compound reference will be hidden.
+# The default value is: NO.
+
+HIDE_COMPOUND_REFERENCE= NO
+
+# If the SHOW_INCLUDE_FILES tag is set to YES then doxygen will put a list of
+# the files that are included by a file in the documentation of that file.
+# The default value is: YES.
+
+SHOW_INCLUDE_FILES = NO
+
+# If the SHOW_GROUPED_MEMB_INC tag is set to YES then Doxygen will add for each
+# grouped member an include statement to the documentation, telling the reader
+# which file to include in order to use the member.
+# The default value is: NO.
+
+SHOW_GROUPED_MEMB_INC = NO
+
+# If the FORCE_LOCAL_INCLUDES tag is set to YES then doxygen will list include
+# files with double quotes in the documentation rather than with sharp brackets.
+# The default value is: NO.
+
+FORCE_LOCAL_INCLUDES = NO
+
+# If the INLINE_INFO tag is set to YES then a tag [inline] is inserted in the
+# documentation for inline members.
+# The default value is: YES.
+
+INLINE_INFO = YES
+
+# If the SORT_MEMBER_DOCS tag is set to YES then doxygen will sort the
+# (detailed) documentation of file and class members alphabetically by member
+# name. If set to NO, the members will appear in declaration order.
+# The default value is: YES.
+
+SORT_MEMBER_DOCS = NO
+
+# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the brief
+# descriptions of file, namespace and class members alphabetically by member
+# name. If set to NO, the members will appear in declaration order. Note that
+# this will also influence the order of the classes in the class list.
+# The default value is: NO.
+
+SORT_BRIEF_DOCS = NO
+
+# If the SORT_MEMBERS_CTORS_1ST tag is set to YES then doxygen will sort the
+# (brief and detailed) documentation of class members so that constructors and
+# destructors are listed first. If set to NO the constructors will appear in the
+# respective orders defined by SORT_BRIEF_DOCS and SORT_MEMBER_DOCS.
+# Note: If SORT_BRIEF_DOCS is set to NO this option is ignored for sorting brief
+# member documentation.
+# Note: If SORT_MEMBER_DOCS is set to NO this option is ignored for sorting
+# detailed member documentation.
+# The default value is: NO.
+
+SORT_MEMBERS_CTORS_1ST = NO
+
+# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the hierarchy
+# of group names into alphabetical order. If set to NO the group names will
+# appear in their defined order.
+# The default value is: NO.
+
+SORT_GROUP_NAMES = YES
+
+# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be sorted by
+# fully-qualified names, including namespaces. If set to NO, the class list will
+# be sorted only by class name, not including the namespace part.
+# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.
+# Note: This option applies only to the class list, not to the alphabetical
+# list.
+# The default value is: NO.
+
+SORT_BY_SCOPE_NAME = NO
+
+# If the STRICT_PROTO_MATCHING option is enabled and doxygen fails to do proper
+# type resolution of all parameters of a function it will reject a match between
+# the prototype and the implementation of a member function even if there is
+# only one candidate or it is obvious which candidate to choose by doing a
+# simple string match. By disabling STRICT_PROTO_MATCHING doxygen will still
+# accept a match between prototype and implementation in such cases.
+# The default value is: NO.
+
+STRICT_PROTO_MATCHING = NO
+
+# The GENERATE_TODOLIST tag can be used to enable (YES) or disable (NO) the todo
+# list. This list is created by putting \todo commands in the documentation.
+# The default value is: YES.
+
+GENERATE_TODOLIST = NO
+
+# The GENERATE_TESTLIST tag can be used to enable (YES) or disable (NO) the test
+# list. This list is created by putting \test commands in the documentation.
+# The default value is: YES.
+
+GENERATE_TESTLIST = NO
+
+# The GENERATE_BUGLIST tag can be used to enable (YES) or disable (NO) the bug
+# list. This list is created by putting \bug commands in the documentation.
+# The default value is: YES.
+
+GENERATE_BUGLIST = NO
+
+# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or disable (NO)
+# the deprecated list. This list is created by putting \deprecated commands in
+# the documentation.
+# The default value is: YES.
+
+GENERATE_DEPRECATEDLIST= YES
+
+# The ENABLED_SECTIONS tag can be used to enable conditional documentation
+# sections, marked by \if <section_label> ... \endif and \cond <section_label>
+# ... \endcond blocks.
+
+ENABLED_SECTIONS =
+
+# The MAX_INITIALIZER_LINES tag determines the maximum number of lines that the
+# initial value of a variable or macro / define can have for it to appear in the
+# documentation. If the initializer consists of more lines than specified here
+# it will be hidden. Use a value of 0 to hide initializers completely. The
+# appearance of the value of individual variables and macros / defines can be
+# controlled using \showinitializer or \hideinitializer command in the
+# documentation regardless of this setting.
+# Minimum value: 0, maximum value: 10000, default value: 30.
+
+MAX_INITIALIZER_LINES = 30
+
+# Set the SHOW_USED_FILES tag to NO to disable the list of files generated at
+# the bottom of the documentation of classes and structs. If set to YES, the
+# list will mention the files that were used to generate the documentation.
+# The default value is: YES.
+
+SHOW_USED_FILES = NO
+
+# Set the SHOW_FILES tag to NO to disable the generation of the Files page. This
+# will remove the Files entry from the Quick Index and from the Folder Tree View
+# (if specified).
+# The default value is: YES.
+
+SHOW_FILES = NO
+
+# Set the SHOW_NAMESPACES tag to NO to disable the generation of the Namespaces
+# page. This will remove the Namespaces entry from the Quick Index and from the
+# Folder Tree View (if specified).
+# The default value is: YES.
+
+SHOW_NAMESPACES = YES
+
+# The FILE_VERSION_FILTER tag can be used to specify a program or script that
+# doxygen should invoke to get the current version for each file (typically from
+# the version control system). Doxygen will invoke the program by executing (via
+# popen()) the command command input-file, where command is the value of the
+# FILE_VERSION_FILTER tag, and input-file is the name of an input file provided
+# by doxygen. Whatever the program writes to standard output is used as the file
+# version. For an example see the documentation.
+
+FILE_VERSION_FILTER =
+
+# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed
+# by doxygen. The layout file controls the global structure of the generated
+# output files in an output format independent way. To create the layout file
+# that represents doxygen's defaults, run doxygen with the -l option. You can
+# optionally specify a file name after the option, if omitted DoxygenLayout.xml
+# will be used as the name of the layout file.
+#
+# Note that if you run doxygen from a directory containing a file called
+# DoxygenLayout.xml, doxygen will parse it automatically even if the LAYOUT_FILE
+# tag is left empty.
+
+LAYOUT_FILE =
+
+# The CITE_BIB_FILES tag can be used to specify one or more bib files containing
+# the reference definitions. This must be a list of .bib files. The .bib
+# extension is automatically appended if omitted. This requires the bibtex tool
+# to be installed. See also https://en.wikipedia.org/wiki/BibTeX for more info.
+# For LaTeX the style of the bibliography can be controlled using
+# LATEX_BIB_STYLE. To use this feature you need bibtex and perl available in the
+# search path. See also \cite for info how to create references.
+
+CITE_BIB_FILES =
+
+#---------------------------------------------------------------------------
+# Configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+
+# The QUIET tag can be used to turn on/off the messages that are generated to
+# standard output by doxygen. If QUIET is set to YES this implies that the
+# messages are off.
+# The default value is: NO.
+
+QUIET = YES
+
+# The WARNINGS tag can be used to turn on/off the warning messages that are
+# generated to standard error (stderr) by doxygen. If WARNINGS is set to YES
+# this implies that the warnings are on.
+#
+# Tip: Turn warnings on while writing the documentation.
+# The default value is: YES.
+
+WARNINGS = YES
+
+# If the WARN_IF_UNDOCUMENTED tag is set to YES then doxygen will generate
+# warnings for undocumented members. If EXTRACT_ALL is set to YES then this flag
+# will automatically be disabled.
+# The default value is: YES.
+
+WARN_IF_UNDOCUMENTED = NO
+
+# If the WARN_IF_DOC_ERROR tag is set to YES, doxygen will generate warnings for
+# potential errors in the documentation, such as not documenting some parameters
+# in a documented function, or documenting parameters that don't exist or using
+# markup commands wrongly.
+# The default value is: YES.
+
+WARN_IF_DOC_ERROR = YES
+
+# This WARN_NO_PARAMDOC option can be enabled to get warnings for functions that
+# are documented, but have no documentation for their parameters or return
+# value. If set to NO, doxygen will only warn about wrong or incomplete
+# parameter documentation, but not about the absence of documentation. If
+# EXTRACT_ALL is set to YES then this flag will automatically be disabled.
+# The default value is: NO.
+
+WARN_NO_PARAMDOC = NO
+
+# If the WARN_AS_ERROR tag is set to YES then doxygen will immediately stop when
+# a warning is encountered.
+# The default value is: NO.
+
+WARN_AS_ERROR = NO
+
+# The WARN_FORMAT tag determines the format of the warning messages that doxygen
+# can produce. The string should contain the $file, $line, and $text tags, which
+# will be replaced by the file and line number from which the warning originated
+# and the warning text. Optionally the format may contain $version, which will
+# be replaced by the version of the file (if it could be obtained via
+# FILE_VERSION_FILTER)
+# The default value is: $file:$line: $text.
+
+WARN_FORMAT = "$file:$line: $text"
+
+# The WARN_LOGFILE tag can be used to specify a file to which warning and error
+# messages should be written. If left blank the output is written to standard
+# error (stderr).
+
+WARN_LOGFILE =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the input files
+#---------------------------------------------------------------------------
+
+# The INPUT tag is used to specify the files and/or directories that contain
+# documented source files. You may enter file names like myfile.cpp or
+# directories like /usr/src/myproject. Separate the files or directories with
+# spaces. See also FILE_PATTERNS and EXTENSION_MAPPING
+# Note: If this tag is empty the current directory is searched.
+
+INPUT = ../.. ../../ui
+
+# This tag can be used to specify the character encoding of the source files
+# that doxygen parses. Internally doxygen uses the UTF-8 encoding. Doxygen uses
+# libiconv (or the iconv built into libc) for the transcoding. See the libiconv
+# documentation (see: https://www.gnu.org/software/libiconv/) for the list of
+# possible encodings.
+# The default value is: UTF-8.
+
+INPUT_ENCODING = UTF-8
+
+# If the value of the INPUT tag contains directories, you can use the
+# FILE_PATTERNS tag to specify one or more wildcard patterns (like *.cpp and
+# *.h) to filter out the source-files in the directories.
+#
+# Note that for custom extensions or not directly supported extensions you also
+# need to set EXTENSION_MAPPING for the extension otherwise the files are not
+# read by doxygen.
+#
+# If left blank the following patterns are tested:*.c, *.cc, *.cxx, *.cpp,
+# *.c++, *.java, *.ii, *.ixx, *.ipp, *.i++, *.inl, *.idl, *.ddl, *.odl, *.h,
+# *.hh, *.hxx, *.hpp, *.h++, *.cs, *.d, *.php, *.php4, *.php5, *.phtml, *.inc,
+# *.m, *.markdown, *.md, *.mm, *.dox (to be provided as doxygen C comment),
+# *.doc (to be provided as doxygen C comment), *.txt (to be provided as doxygen
+# C comment), *.py, *.pyw, *.f90, *.f95, *.f03, *.f08, *.f18, *.f, *.for, *.vhd,
+# *.vhdl, *.ucf, *.qsf and *.ice.
+
+FILE_PATTERNS = *.cpp \
+ *.h
+
+# The RECURSIVE tag can be used to specify whether or not subdirectories should
+# be searched for input files as well.
+# The default value is: NO.
+
+RECURSIVE = NO
+
+# The EXCLUDE tag can be used to specify files and/or directories that should be
+# excluded from the INPUT source files. This way you can easily exclude a
+# subdirectory from a directory tree whose root is specified with the INPUT tag.
+#
+# Note that relative paths are relative to the directory from which doxygen is
+# run.
+
+EXCLUDE =
+
+# The EXCLUDE_SYMLINKS tag can be used to select whether or not files or
+# directories that are symbolic links (a Unix file system feature) are excluded
+# from the input.
+# The default value is: NO.
+
+EXCLUDE_SYMLINKS = NO
+
+# If the value of the INPUT tag contains directories, you can use the
+# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude
+# certain files from those directories.
+#
+# Note that the wildcards are matched against the file with absolute path, so to
+# exclude all test directories for example use the pattern */test/*
+
+EXCLUDE_PATTERNS =
+
+# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names
+# (namespaces, classes, functions, etc.) that should be excluded from the
+# output. The symbol name can be a fully qualified name, a word, or if the
+# wildcard * is used, a substring. Examples: ANamespace, AClass,
+# AClass::ANamespace, ANamespace::*Test
+#
+# Note that the wildcards are matched against the file with absolute path, so to
+# exclude all test directories use the pattern */test/*
+
+# These symbols by themselves generate 60MB and 1500 pages of documentation.
+# For shipping with builds this is not reasonable.
+
+EXCLUDE_SYMBOLS = BinaryNinja::LowLevelILInstructionAccessor \
+ BinaryNinja::LowLevelILInstructionAccessor* \
+ BinaryNinja::MediumLevelILInstructionAccessor \
+ BinaryNinja::MediumLevelILInstructionAccessor* \
+ BinaryNinja::HighLevelILInstructionAccessor \
+ BinaryNinja::HighLevelILInstructionAccessor* \
+
+
+#EXCLUDE_SYMBOLS = QProgressIndicator #Broke Exhale
+
+# The EXAMPLE_PATH tag can be used to specify one or more files or directories
+# that contain example code fragments that are included (see the \include
+# command).
+
+EXAMPLE_PATH = ../../examples
+
+# If the value of the EXAMPLE_PATH tag contains directories, you can use the
+# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp and
+# *.h) to filter out the source-files in the directories. If left blank all
+# files are included.
+
+EXAMPLE_PATTERNS =
+
+# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be
+# searched for input files to be used with the \include or \dontinclude commands
+# irrespective of the value of the RECURSIVE tag.
+# The default value is: NO.
+
+EXAMPLE_RECURSIVE = YES
+
+# The IMAGE_PATH tag can be used to specify one or more files or directories
+# that contain images that are to be included in the documentation (see the
+# \image command).
+
+IMAGE_PATH = _static/img
+
+# The INPUT_FILTER tag can be used to specify a program that doxygen should
+# invoke to filter for each input file. Doxygen will invoke the filter program
+# by executing (via popen()) the command:
+#
+# <filter> <input-file>
+#
+# where <filter> is the value of the INPUT_FILTER tag, and <input-file> is the
+# name of an input file. Doxygen will then use the output that the filter
+# program writes to standard output. If FILTER_PATTERNS is specified, this tag
+# will be ignored.
+#
+# Note that the filter must not add or remove lines; it is applied before the
+# code is scanned, but not when the output code is generated. If lines are added
+# or removed, the anchors will not be placed correctly.
+#
+# Note that for custom extensions or not directly supported extensions you also
+# need to set EXTENSION_MAPPING for the extension otherwise the files are not
+# properly processed by doxygen.
+
+INPUT_FILTER =
+
+# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern
+# basis. Doxygen will compare the file name with each pattern and apply the
+# filter if there is a match. The filters are a list of the form: pattern=filter
+# (like *.cpp=my_cpp_filter). See INPUT_FILTER for further information on how
+# filters are used. If the FILTER_PATTERNS tag is empty or if none of the
+# patterns match the file name, INPUT_FILTER is applied.
+#
+# Note that for custom extensions or not directly supported extensions you also
+# need to set EXTENSION_MAPPING for the extension otherwise the files are not
+# properly processed by doxygen.
+
+FILTER_PATTERNS =
+
+# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using
+# INPUT_FILTER) will also be used to filter the input files that are used for
+# producing the source files to browse (i.e. when SOURCE_BROWSER is set to YES).
+# The default value is: NO.
+
+FILTER_SOURCE_FILES = NO
+
+# The FILTER_SOURCE_PATTERNS tag can be used to specify source filters per file
+# pattern. A pattern will override the setting for FILTER_PATTERN (if any) and
+# it is also possible to disable source filtering for a specific pattern using
+# *.ext= (so without naming a filter).
+# This tag requires that the tag FILTER_SOURCE_FILES is set to YES.
+
+FILTER_SOURCE_PATTERNS =
+
+# If the USE_MDFILE_AS_MAINPAGE tag refers to the name of a markdown file that
+# is part of the input, its contents will be placed on the main page
+# (index.html). This can be useful if you have a project on for instance GitHub
+# and want to reuse the introduction page also for the doxygen output.
+
+USE_MDFILE_AS_MAINPAGE =
+
+#---------------------------------------------------------------------------
+# Configuration options related to source browsing
+#---------------------------------------------------------------------------
+
+# If the SOURCE_BROWSER tag is set to YES then a list of source files will be
+# generated. Documented entities will be cross-referenced with these sources.
+#
+# Note: To get rid of all source code in the generated output, make sure that
+# also VERBATIM_HEADERS is set to NO.
+# The default value is: NO.
+
+SOURCE_BROWSER = NO
+
+# Setting the INLINE_SOURCES tag to YES will include the body of functions,
+# classes and enums directly into the documentation.
+# The default value is: NO.
+
+INLINE_SOURCES = NO
+
+# Setting the STRIP_CODE_COMMENTS tag to YES will instruct doxygen to hide any
+# special comment blocks from generated source code fragments. Normal C, C++ and
+# Fortran comments will always remain visible.
+# The default value is: YES.
+
+STRIP_CODE_COMMENTS = YES
+
+# If the REFERENCED_BY_RELATION tag is set to YES then for each documented
+# entity all documented functions referencing it will be listed.
+# The default value is: NO.
+
+REFERENCED_BY_RELATION = NO
+
+# If the REFERENCES_RELATION tag is set to YES then for each documented function
+# all documented entities called/used by that function will be listed.
+# The default value is: NO.
+
+REFERENCES_RELATION = NO
+
+# If the REFERENCES_LINK_SOURCE tag is set to YES and SOURCE_BROWSER tag is set
+# to YES then the hyperlinks from functions in REFERENCES_RELATION and
+# REFERENCED_BY_RELATION lists will link to the source code. Otherwise they will
+# link to the documentation.
+# The default value is: YES.
+
+REFERENCES_LINK_SOURCE = NO
+
+# If SOURCE_TOOLTIPS is enabled (the default) then hovering a hyperlink in the
+# source code will show a tooltip with additional information such as prototype,
+# brief description and links to the definition and documentation. Since this
+# will make the HTML file larger and loading of large files a bit slower, you
+# can opt to disable this feature.
+# The default value is: YES.
+# This tag requires that the tag SOURCE_BROWSER is set to YES.
+
+SOURCE_TOOLTIPS = YES
+
+# If the USE_HTAGS tag is set to YES then the references to source code will
+# point to the HTML generated by the htags(1) tool instead of doxygen built-in
+# source browser. The htags tool is part of GNU's global source tagging system
+# (see https://www.gnu.org/software/global/global.html). You will need version
+# 4.8.6 or higher.
+#
+# To use it do the following:
+# - Install the latest version of global
+# - Enable SOURCE_BROWSER and USE_HTAGS in the configuration file
+# - Make sure the INPUT points to the root of the source tree
+# - Run doxygen as normal
+#
+# Doxygen will invoke htags (and that will in turn invoke gtags), so these
+# tools must be available from the command line (i.e. in the search path).
+#
+# The result: instead of the source browser generated by doxygen, the links to
+# source code will now point to the output of htags.
+# The default value is: NO.
+# This tag requires that the tag SOURCE_BROWSER is set to YES.
+
+USE_HTAGS = NO
+
+# If the VERBATIM_HEADERS tag is set the YES then doxygen will generate a
+# verbatim copy of the header file for each class for which an include is
+# specified. Set to NO to disable this.
+# See also: Section \class.
+# The default value is: YES.
+
+VERBATIM_HEADERS = NO
+
+#---------------------------------------------------------------------------
+# Configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+
+# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index of all
+# compounds will be generated. Enable this if the project contains a lot of
+# classes, structs, unions or interfaces.
+# The default value is: YES.
+
+ALPHABETICAL_INDEX = NO
+
+# The COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns in
+# which the alphabetical index list will be split.
+# Minimum value: 1, maximum value: 20, default value: 5.
+# This tag requires that the tag ALPHABETICAL_INDEX is set to YES.
+
+COLS_IN_ALPHA_INDEX = 5
+
+# In case all classes in a project start with a common prefix, all classes will
+# be put under the same header in the alphabetical index. The IGNORE_PREFIX tag
+# can be used to specify a prefix (or a list of prefixes) that should be ignored
+# while generating the index headers.
+# This tag requires that the tag ALPHABETICAL_INDEX is set to YES.
+
+IGNORE_PREFIX =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the HTML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_HTML tag is set to YES, doxygen will generate HTML output
+# The default value is: YES.
+
+GENERATE_HTML = YES
+
+# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. If a
+# relative path is entered the value of OUTPUT_DIRECTORY will be put in front of
+# it.
+# The default directory is: html.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_OUTPUT =
+
+# The HTML_FILE_EXTENSION tag can be used to specify the file extension for each
+# generated HTML page (for example: .htm, .php, .asp).
+# The default value is: .html.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_FILE_EXTENSION = .html
+
+# The HTML_HEADER tag can be used to specify a user-defined HTML header file for
+# each generated HTML page. If the tag is left blank doxygen will generate a
+# standard header.
+#
+# To get valid HTML the header file that includes any scripts and style sheets
+# that doxygen needs, which is dependent on the configuration options used (e.g.
+# the setting GENERATE_TREEVIEW). It is highly recommended to start with a
+# default header using
+# doxygen -w html new_header.html new_footer.html new_stylesheet.css
+# YourConfigFile
+# and then modify the file new_header.html. See also section "Doxygen usage"
+# for information on how to generate the default header that doxygen normally
+# uses.
+# Note: The header is subject to change so you typically have to regenerate the
+# default header when upgrading to a newer version of doxygen. For a description
+# of the possible markers and block names see the documentation.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_HEADER = header.html
+
+# The HTML_FOOTER tag can be used to specify a user-defined HTML footer for each
+# generated HTML page. If the tag is left blank doxygen will generate a standard
+# footer. See HTML_HEADER for more information on how to generate a default
+# footer and what special commands can be used inside the footer. See also
+# section "Doxygen usage" for information on how to generate the default footer
+# that doxygen normally uses.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_FOOTER = footer.html
+
+# The HTML_STYLESHEET tag can be used to specify a user-defined cascading style
+# sheet that is used by each HTML page. It can be used to fine-tune the look of
+# the HTML output. If left blank doxygen will generate a default style sheet.
+# See also section "Doxygen usage" for information on how to generate the style
+# sheet that doxygen normally uses.
+# Note: It is recommended to use HTML_EXTRA_STYLESHEET instead of this tag, as
+# it is more robust and this tag (HTML_STYLESHEET) will in the future become
+# obsolete.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_STYLESHEET =
+
+# The HTML_EXTRA_STYLESHEET tag can be used to specify additional user-defined
+# cascading style sheets that are included after the standard style sheets
+# created by doxygen. Using this option one can overrule certain style aspects.
+# This is preferred over using HTML_STYLESHEET since it does not replace the
+# standard style sheet and is therefore more robust against future updates.
+# Doxygen will copy the style sheet files to the output directory.
+# Note: The order of the extra style sheet files is of importance (e.g. the last
+# style sheet in the list overrules the setting of the previous ones in the
+# list). For an example see the documentation.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_EXTRA_STYLESHEET = doxygen-awesome-css/doxygen-awesome.css \
+ doxygen-awesome-css/doxygen-awesome-sidebar-only.css \
+ doxygen-awesome-css/doxygen-awesome-sidebar-only-darkmode-toggle.css \
+ custom.css
+
+# The HTML_EXTRA_FILES tag can be used to specify one or more extra images or
+# other source files which should be copied to the HTML output directory. Note
+# that these files will be copied to the base HTML output directory. Use the
+# $relpath^ marker in the HTML_HEADER and/or HTML_FOOTER files to load these
+# files. In the HTML_STYLESHEET file, use the file name only. Also note that the
+# files will be copied as-is; there are no commands or markers available.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_EXTRA_FILES = doxygen-awesome-css/doxygen-awesome-darkmode-toggle.js
+
+# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. Doxygen
+# will adjust the colors in the style sheet and background images according to
+# this color. Hue is specified as an angle on a colorwheel, see
+# https://en.wikipedia.org/wiki/Hue for more information. For instance the value
+# 0 represents red, 60 is yellow, 120 is green, 180 is cyan, 240 is blue, 300
+# purple, and 360 is red again.
+# Minimum value: 0, maximum value: 359, default value: 220.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_COLORSTYLE_HUE = 220
+
+# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of the colors
+# in the HTML output. For a value of 0 the output will use grayscales only. A
+# value of 255 will produce the most vivid colors.
+# Minimum value: 0, maximum value: 255, default value: 100.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_COLORSTYLE_SAT = 0
+
+# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to the
+# luminance component of the colors in the HTML output. Values below 100
+# gradually make the output lighter, whereas values above 100 make the output
+# darker. The value divided by 100 is the actual gamma applied, so 80 represents
+# a gamma of 0.8, The value 220 represents a gamma of 2.2, and 100 does not
+# change the gamma.
+# Minimum value: 40, maximum value: 240, default value: 80.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_COLORSTYLE_GAMMA = 120
+
+# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML
+# page will contain the date and time when the page was generated. Setting this
+# to YES can help to show when doxygen was last run and thus if the
+# documentation is up to date.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_TIMESTAMP = NO
+
+# If the HTML_DYNAMIC_MENUS tag is set to YES then the generated HTML
+# documentation will contain a main index with vertical navigation menus that
+# are dynamically created via JavaScript. If disabled, the navigation index will
+# consists of multiple levels of tabs that are statically embedded in every HTML
+# page. Disable this option to support browsers that do not have JavaScript,
+# like the Qt help browser.
+# The default value is: YES.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_DYNAMIC_MENUS = NO
+
+# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML
+# documentation will contain sections that can be hidden and shown after the
+# page has loaded.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_DYNAMIC_SECTIONS = NO
+
+# With HTML_INDEX_NUM_ENTRIES one can control the preferred number of entries
+# shown in the various tree structured indices initially; the user can expand
+# and collapse entries dynamically later on. Doxygen will expand the tree to
+# such a level that at most the specified number of entries are visible (unless
+# a fully collapsed tree already exceeds this amount). So setting the number of
+# entries 1 will produce a full collapsed tree by default. 0 is a special value
+# representing an infinite number of entries and will result in a full expanded
+# tree by default.
+# Minimum value: 0, maximum value: 9999, default value: 100.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_INDEX_NUM_ENTRIES = 100
+
+# If the GENERATE_DOCSET tag is set to YES, additional index files will be
+# generated that can be used as input for Apple's Xcode 3 integrated development
+# environment (see: https://developer.apple.com/xcode/), introduced with OSX
+# 10.5 (Leopard). To create a documentation set, doxygen will generate a
+# Makefile in the HTML output directory. Running make will produce the docset in
+# that directory and running make install will install the docset in
+# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find it at
+# startup. See https://developer.apple.com/library/archive/featuredarticles/Doxy
+# genXcode/_index.html for more information.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+GENERATE_DOCSET = YES
+
+# This tag determines the name of the docset feed. A documentation feed provides
+# an umbrella under which multiple documentation sets from a single provider
+# (such as a company or product suite) can be grouped.
+# The default value is: Doxygen generated docs.
+# This tag requires that the tag GENERATE_DOCSET is set to YES.
+
+DOCSET_FEEDNAME = "Binary Ninja C++ API"
+
+# This tag specifies a string that should uniquely identify the documentation
+# set bundle. This should be a reverse domain-name style string, e.g.
+# com.mycompany.MyDocSet. Doxygen will append .docset to the name.
+# The default value is: org.doxygen.Project.
+# This tag requires that the tag GENERATE_DOCSET is set to YES.
+
+DOCSET_BUNDLE_ID = com.vector35.binaryninja.docs
+
+# The DOCSET_PUBLISHER_ID tag specifies a string that should uniquely identify
+# the documentation publisher. This should be a reverse domain-name style
+# string, e.g. com.mycompany.MyDocSet.documentation.
+# The default value is: org.doxygen.Publisher.
+# This tag requires that the tag GENERATE_DOCSET is set to YES.
+
+DOCSET_PUBLISHER_ID = com.vector35
+
+# The DOCSET_PUBLISHER_NAME tag identifies the documentation publisher.
+# The default value is: Publisher.
+# This tag requires that the tag GENERATE_DOCSET is set to YES.
+
+DOCSET_PUBLISHER_NAME = Vector 35 Inc
+
+# If the GENERATE_HTMLHELP tag is set to YES then doxygen generates three
+# additional HTML index files: index.hhp, index.hhc, and index.hhk. The
+# index.hhp is a project file that can be read by Microsoft's HTML Help Workshop
+# (see: https://www.microsoft.com/en-us/download/details.aspx?id=21138) on
+# Windows.
+#
+# The HTML Help Workshop contains a compiler that can convert all HTML output
+# generated by doxygen into a single compiled HTML file (.chm). Compiled HTML
+# files are now used as the Windows 98 help format, and will replace the old
+# Windows help format (.hlp) on all Windows platforms in the future. Compressed
+# HTML files also contain an index, a table of contents, and you can search for
+# words in the documentation. The HTML workshop also contains a viewer for
+# compressed HTML files.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+GENERATE_HTMLHELP = NO
+
+# The CHM_FILE tag can be used to specify the file name of the resulting .chm
+# file. You can add a path in front of the file if the result should not be
+# written to the html output directory.
+# This tag requires that the tag GENERATE_HTMLHELP is set to YES.
+
+CHM_FILE =
+
+# The HHC_LOCATION tag can be used to specify the location (absolute path
+# including file name) of the HTML help compiler (hhc.exe). If non-empty,
+# doxygen will try to run the HTML help compiler on the generated index.hhp.
+# The file has to be specified with full path.
+# This tag requires that the tag GENERATE_HTMLHELP is set to YES.
+
+HHC_LOCATION =
+
+# The GENERATE_CHI flag controls if a separate .chi index file is generated
+# (YES) or that it should be included in the main .chm file (NO).
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTMLHELP is set to YES.
+
+GENERATE_CHI = NO
+
+# The CHM_INDEX_ENCODING is used to encode HtmlHelp index (hhk), content (hhc)
+# and project file content.
+# This tag requires that the tag GENERATE_HTMLHELP is set to YES.
+
+CHM_INDEX_ENCODING =
+
+# The BINARY_TOC flag controls whether a binary table of contents is generated
+# (YES) or a normal table of contents (NO) in the .chm file. Furthermore it
+# enables the Previous and Next buttons.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTMLHELP is set to YES.
+
+BINARY_TOC = NO
+
+# The TOC_EXPAND flag can be set to YES to add extra items for group members to
+# the table of contents of the HTML help documentation and to the tree view.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTMLHELP is set to YES.
+
+TOC_EXPAND = NO
+
+# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and
+# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated that
+# can be used as input for Qt's qhelpgenerator to generate a Qt Compressed Help
+# (.qch) of the generated HTML documentation.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+GENERATE_QHP = NO
+
+# If the QHG_LOCATION tag is specified, the QCH_FILE tag can be used to specify
+# the file name of the resulting .qch file. The path specified is relative to
+# the HTML output folder.
+# This tag requires that the tag GENERATE_QHP is set to YES.
+
+QCH_FILE =
+
+# The QHP_NAMESPACE tag specifies the namespace to use when generating Qt Help
+# Project output. For more information please see Qt Help Project / Namespace
+# (see: https://doc.qt.io/archives/qt-4.8/qthelpproject.html#namespace).
+# The default value is: org.doxygen.Project.
+# This tag requires that the tag GENERATE_QHP is set to YES.
+
+QHP_NAMESPACE = org.doxygen.Project
+
+# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating Qt
+# Help Project output. For more information please see Qt Help Project / Virtual
+# Folders (see: https://doc.qt.io/archives/qt-4.8/qthelpproject.html#virtual-
+# folders).
+# The default value is: doc.
+# This tag requires that the tag GENERATE_QHP is set to YES.
+
+QHP_VIRTUAL_FOLDER = doc
+
+# If the QHP_CUST_FILTER_NAME tag is set, it specifies the name of a custom
+# filter to add. For more information please see Qt Help Project / Custom
+# Filters (see: https://doc.qt.io/archives/qt-4.8/qthelpproject.html#custom-
+# filters).
+# This tag requires that the tag GENERATE_QHP is set to YES.
+
+QHP_CUST_FILTER_NAME =
+
+# The QHP_CUST_FILTER_ATTRS tag specifies the list of the attributes of the
+# custom filter to add. For more information please see Qt Help Project / Custom
+# Filters (see: https://doc.qt.io/archives/qt-4.8/qthelpproject.html#custom-
+# filters).
+# This tag requires that the tag GENERATE_QHP is set to YES.
+
+QHP_CUST_FILTER_ATTRS =
+
+# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this
+# project's filter section matches. Qt Help Project / Filter Attributes (see:
+# https://doc.qt.io/archives/qt-4.8/qthelpproject.html#filter-attributes).
+# This tag requires that the tag GENERATE_QHP is set to YES.
+
+QHP_SECT_FILTER_ATTRS =
+
+# The QHG_LOCATION tag can be used to specify the location of Qt's
+# qhelpgenerator. If non-empty doxygen will try to run qhelpgenerator on the
+# generated .qhp file.
+# This tag requires that the tag GENERATE_QHP is set to YES.
+
+QHG_LOCATION =
+
+# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files will be
+# generated, together with the HTML files, they form an Eclipse help plugin. To
+# install this plugin and make it available under the help contents menu in
+# Eclipse, the contents of the directory containing the HTML and XML files needs
+# to be copied into the plugins directory of eclipse. The name of the directory
+# within the plugins directory should be the same as the ECLIPSE_DOC_ID value.
+# After copying Eclipse needs to be restarted before the help appears.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+GENERATE_ECLIPSEHELP = NO
+
+# A unique identifier for the Eclipse help plugin. When installing the plugin
+# the directory name containing the HTML and XML files should also have this
+# name. Each documentation set should have its own identifier.
+# The default value is: org.doxygen.Project.
+# This tag requires that the tag GENERATE_ECLIPSEHELP is set to YES.
+
+ECLIPSE_DOC_ID = org.doxygen.Project
+
+# If you want full control over the layout of the generated HTML pages it might
+# be necessary to disable the index and replace it with your own. The
+# DISABLE_INDEX tag can be used to turn on/off the condensed index (tabs) at top
+# of each HTML page. A value of NO enables the index and the value YES disables
+# it. Since the tabs in the index contain the same information as the navigation
+# tree, you can set this option to YES if you also set GENERATE_TREEVIEW to YES.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+DISABLE_INDEX = YES
+
+# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index
+# structure should be generated to display hierarchical information. If the tag
+# value is set to YES, a side panel will be generated containing a tree-like
+# index structure (just like the one that is generated for HTML Help). For this
+# to work a browser that supports JavaScript, DHTML, CSS and frames is required
+# (i.e. any modern browser). Windows users are probably better off using the
+# HTML help feature. Via custom style sheets (see HTML_EXTRA_STYLESHEET) one can
+# further fine-tune the look of the index. As an example, the default style
+# sheet generated by doxygen has an example that shows how to put an image at
+# the root of the tree instead of the PROJECT_NAME. Since the tree basically has
+# the same information as the tab index, you could consider setting
+# DISABLE_INDEX to YES when enabling this option.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+GENERATE_TREEVIEW = NO
+
+# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values that
+# doxygen will group on one line in the generated HTML documentation.
+#
+# Note that a value of 0 will completely suppress the enum values from appearing
+# in the overview section.
+# Minimum value: 0, maximum value: 20, default value: 4.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+ENUM_VALUES_PER_LINE = 4
+
+# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be used
+# to set the initial width (in pixels) of the frame in which the tree is shown.
+# Minimum value: 0, maximum value: 1500, default value: 250.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+TREEVIEW_WIDTH = 250
+
+# If the EXT_LINKS_IN_WINDOW option is set to YES, doxygen will open links to
+# external symbols imported via tag files in a separate window.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+EXT_LINKS_IN_WINDOW = NO
+
+# If the HTML_FORMULA_FORMAT option is set to svg, doxygen will use the pdf2svg
+# tool (see https://github.com/dawbarton/pdf2svg) or inkscape (see
+# https://inkscape.org) to generate formulas as SVG images instead of PNGs for
+# the HTML output. These images will generally look nicer at scaled resolutions.
+# Possible values are: png (the default) and svg (looks nicer but requires the
+# pdf2svg or inkscape tool).
+# The default value is: png.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_FORMULA_FORMAT = png
+
+# Use this tag to change the font size of LaTeX formulas included as images in
+# the HTML documentation. When you change the font size after a successful
+# doxygen run you need to manually remove any form_*.png images from the HTML
+# output directory to force them to be regenerated.
+# Minimum value: 8, maximum value: 50, default value: 10.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+FORMULA_FONTSIZE = 10
+
+# Use the FORMULA_TRANSPARENT tag to determine whether or not the images
+# generated for formulas are transparent PNGs. Transparent PNGs are not
+# supported properly for IE 6.0, but are supported on all modern browsers.
+#
+# Note that when changing this option you need to delete any form_*.png files in
+# the HTML output directory before the changes have effect.
+# The default value is: YES.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+FORMULA_TRANSPARENT = YES
+
+# The FORMULA_MACROFILE can contain LaTeX \newcommand and \renewcommand commands
+# to create new LaTeX commands to be used in formulas as building blocks. See
+# the section "Including formulas" for details.
+
+FORMULA_MACROFILE =
+
+# Enable the USE_MATHJAX option to render LaTeX formulas using MathJax (see
+# https://www.mathjax.org) which uses client side JavaScript for the rendering
+# instead of using pre-rendered bitmaps. Use this if you do not have LaTeX
+# installed or if you want to formulas look prettier in the HTML output. When
+# enabled you may also need to install MathJax separately and configure the path
+# to it using the MATHJAX_RELPATH option.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+USE_MATHJAX = NO
+
+# When MathJax is enabled you can set the default output format to be used for
+# the MathJax output. See the MathJax site (see:
+# http://docs.mathjax.org/en/latest/output.html) for more details.
+# Possible values are: HTML-CSS (which is slower, but has the best
+# compatibility), NativeMML (i.e. MathML) and SVG.
+# The default value is: HTML-CSS.
+# This tag requires that the tag USE_MATHJAX is set to YES.
+
+MATHJAX_FORMAT = HTML-CSS
+
+# When MathJax is enabled you need to specify the location relative to the HTML
+# output directory using the MATHJAX_RELPATH option. The destination directory
+# should contain the MathJax.js script. For instance, if the mathjax directory
+# is located at the same level as the HTML output directory, then
+# MATHJAX_RELPATH should be ../mathjax. The default value points to the MathJax
+# Content Delivery Network so you can quickly see the result without installing
+# MathJax. However, it is strongly recommended to install a local copy of
+# MathJax from https://www.mathjax.org before deployment.
+# The default value is: https://cdn.jsdelivr.net/npm/mathjax@2.
+# This tag requires that the tag USE_MATHJAX is set to YES.
+
+MATHJAX_RELPATH = http://cdn.mathjax.org/mathjax/latest
+
+# The MATHJAX_EXTENSIONS tag can be used to specify one or more MathJax
+# extension names that should be enabled during MathJax rendering. For example
+# MATHJAX_EXTENSIONS = TeX/AMSmath TeX/AMSsymbols
+# This tag requires that the tag USE_MATHJAX is set to YES.
+
+MATHJAX_EXTENSIONS =
+
+# The MATHJAX_CODEFILE tag can be used to specify a file with javascript pieces
+# of code that will be used on startup of the MathJax code. See the MathJax site
+# (see: http://docs.mathjax.org/en/latest/output.html) for more details. For an
+# example see the documentation.
+# This tag requires that the tag USE_MATHJAX is set to YES.
+
+MATHJAX_CODEFILE =
+
+# When the SEARCHENGINE tag is enabled doxygen will generate a search box for
+# the HTML output. The underlying search engine uses javascript and DHTML and
+# should work on any modern browser. Note that when using HTML help
+# (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets (GENERATE_DOCSET)
+# there is already a search function so this one should typically be disabled.
+# For large projects the javascript based search engine can be slow, then
+# enabling SERVER_BASED_SEARCH may provide a better solution. It is possible to
+# search using the keyboard; to jump to the search box use <access key> + S
+# (what the <access key> is depends on the OS and browser, but it is typically
+# <CTRL>, <ALT>/<option>, or both). Inside the search box use the <cursor down
+# key> to jump into the search results window, the results can be navigated
+# using the <cursor keys>. Press <Enter> to select an item or <escape> to cancel
+# the search. The filter options can be selected when the cursor is inside the
+# search box by pressing <Shift>+<cursor down>. Also here use the <cursor keys>
+# to select a filter and <Enter> or <escape> to activate or cancel the filter
+# option.
+# The default value is: YES.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+SEARCHENGINE = NO
+
+# When the SERVER_BASED_SEARCH tag is enabled the search engine will be
+# implemented using a web server instead of a web client using JavaScript. There
+# are two flavors of web server based searching depending on the EXTERNAL_SEARCH
+# setting. When disabled, doxygen will generate a PHP script for searching and
+# an index file used by the script. When EXTERNAL_SEARCH is enabled the indexing
+# and searching needs to be provided by external tools. See the section
+# "External Indexing and Searching" for details.
+# The default value is: NO.
+# This tag requires that the tag SEARCHENGINE is set to YES.
+
+SERVER_BASED_SEARCH = NO
+
+# When EXTERNAL_SEARCH tag is enabled doxygen will no longer generate the PHP
+# script for searching. Instead the search results are written to an XML file
+# which needs to be processed by an external indexer. Doxygen will invoke an
+# external search engine pointed to by the SEARCHENGINE_URL option to obtain the
+# search results.
+#
+# Doxygen ships with an example indexer (doxyindexer) and search engine
+# (doxysearch.cgi) which are based on the open source search engine library
+# Xapian (see: https://xapian.org/).
+#
+# See the section "External Indexing and Searching" for details.
+# The default value is: NO.
+# This tag requires that the tag SEARCHENGINE is set to YES.
+
+EXTERNAL_SEARCH = NO
+
+# The SEARCHENGINE_URL should point to a search engine hosted by a web server
+# which will return the search results when EXTERNAL_SEARCH is enabled.
+#
+# Doxygen ships with an example indexer (doxyindexer) and search engine
+# (doxysearch.cgi) which are based on the open source search engine library
+# Xapian (see: https://xapian.org/). See the section "External Indexing and
+# Searching" for details.
+# This tag requires that the tag SEARCHENGINE is set to YES.
+
+SEARCHENGINE_URL =
+
+# When SERVER_BASED_SEARCH and EXTERNAL_SEARCH are both enabled the unindexed
+# search data is written to a file for indexing by an external tool. With the
+# SEARCHDATA_FILE tag the name of this file can be specified.
+# The default file is: searchdata.xml.
+# This tag requires that the tag SEARCHENGINE is set to YES.
+
+SEARCHDATA_FILE = searchdata.xml
+
+# When SERVER_BASED_SEARCH and EXTERNAL_SEARCH are both enabled the
+# EXTERNAL_SEARCH_ID tag can be used as an identifier for the project. This is
+# useful in combination with EXTRA_SEARCH_MAPPINGS to search through multiple
+# projects and redirect the results back to the right project.
+# This tag requires that the tag SEARCHENGINE is set to YES.
+
+EXTERNAL_SEARCH_ID =
+
+# The EXTRA_SEARCH_MAPPINGS tag can be used to enable searching through doxygen
+# projects other than the one defined by this configuration file, but that are
+# all added to the same external search index. Each project needs to have a
+# unique id set via EXTERNAL_SEARCH_ID. The search mapping then maps the id of
+# to a relative location where the documentation can be found. The format is:
+# EXTRA_SEARCH_MAPPINGS = tagname1=loc1 tagname2=loc2 ...
+# This tag requires that the tag SEARCHENGINE is set to YES.
+
+EXTRA_SEARCH_MAPPINGS =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_LATEX tag is set to YES, doxygen will generate LaTeX output.
+# The default value is: YES.
+
+GENERATE_LATEX = NO
+
+# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. If a
+# relative path is entered the value of OUTPUT_DIRECTORY will be put in front of
+# it.
+# The default directory is: latex.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_OUTPUT = latex
+
+# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be
+# invoked.
+#
+# Note that when not enabling USE_PDFLATEX the default is latex when enabling
+# USE_PDFLATEX the default is pdflatex and when in the later case latex is
+# chosen this is overwritten by pdflatex. For specific output languages the
+# default can have been set differently, this depends on the implementation of
+# the output language.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_CMD_NAME = latex
+
+# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to generate
+# index for LaTeX.
+# Note: This tag is used in the Makefile / make.bat.
+# See also: LATEX_MAKEINDEX_CMD for the part in the generated output file
+# (.tex).
+# The default file is: makeindex.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+MAKEINDEX_CMD_NAME = makeindex
+
+# The LATEX_MAKEINDEX_CMD tag can be used to specify the command name to
+# generate index for LaTeX. In case there is no backslash (\) as first character
+# it will be automatically added in the LaTeX code.
+# Note: This tag is used in the generated output file (.tex).
+# See also: MAKEINDEX_CMD_NAME for the part in the Makefile / make.bat.
+# The default value is: makeindex.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_MAKEINDEX_CMD = makeindex
+
+# If the COMPACT_LATEX tag is set to YES, doxygen generates more compact LaTeX
+# documents. This may be useful for small projects and may help to save some
+# trees in general.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+COMPACT_LATEX = NO
+
+# The PAPER_TYPE tag can be used to set the paper type that is used by the
+# printer.
+# Possible values are: a4 (210 x 297 mm), letter (8.5 x 11 inches), legal (8.5 x
+# 14 inches) and executive (7.25 x 10.5 inches).
+# The default value is: a4.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+PAPER_TYPE = a4
+
+# The EXTRA_PACKAGES tag can be used to specify one or more LaTeX package names
+# that should be included in the LaTeX output. The package can be specified just
+# by its name or with the correct syntax as to be used with the LaTeX
+# \usepackage command. To get the times font for instance you can specify :
+# EXTRA_PACKAGES=times or EXTRA_PACKAGES={times}
+# To use the option intlimits with the amsmath package you can specify:
+# EXTRA_PACKAGES=[intlimits]{amsmath}
+# If left blank no extra packages will be included.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+EXTRA_PACKAGES =
+
+# The LATEX_HEADER tag can be used to specify a personal LaTeX header for the
+# generated LaTeX document. The header should contain everything until the first
+# chapter. If it is left blank doxygen will generate a standard header. See
+# section "Doxygen usage" for information on how to let doxygen write the
+# default header to a separate file.
+#
+# Note: Only use a user-defined header if you know what you are doing! The
+# following commands have a special meaning inside the header: $title,
+# $datetime, $date, $doxygenversion, $projectname, $projectnumber,
+# $projectbrief, $projectlogo. Doxygen will replace $title with the empty
+# string, for the replacement values of the other commands the user is referred
+# to HTML_HEADER.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_HEADER =
+
+# The LATEX_FOOTER tag can be used to specify a personal LaTeX footer for the
+# generated LaTeX document. The footer should contain everything after the last
+# chapter. If it is left blank doxygen will generate a standard footer. See
+# LATEX_HEADER for more information on how to generate a default footer and what
+# special commands can be used inside the footer.
+#
+# Note: Only use a user-defined footer if you know what you are doing!
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_FOOTER =
+
+# The LATEX_EXTRA_STYLESHEET tag can be used to specify additional user-defined
+# LaTeX style sheets that are included after the standard style sheets created
+# by doxygen. Using this option one can overrule certain style aspects. Doxygen
+# will copy the style sheet files to the output directory.
+# Note: The order of the extra style sheet files is of importance (e.g. the last
+# style sheet in the list overrules the setting of the previous ones in the
+# list).
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_EXTRA_STYLESHEET =
+
+# The LATEX_EXTRA_FILES tag can be used to specify one or more extra images or
+# other source files which should be copied to the LATEX_OUTPUT output
+# directory. Note that the files will be copied as-is; there are no commands or
+# markers available.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_EXTRA_FILES =
+
+# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated is
+# prepared for conversion to PDF (using ps2pdf or pdflatex). The PDF file will
+# contain links (just like the HTML output) instead of page references. This
+# makes the output suitable for online browsing using a PDF viewer.
+# The default value is: YES.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+PDF_HYPERLINKS = YES
+
+# If the USE_PDFLATEX tag is set to YES, doxygen will use the engine as
+# specified with LATEX_CMD_NAME to generate the PDF file directly from the LaTeX
+# files. Set this option to YES, to get a higher quality PDF documentation.
+#
+# See also section LATEX_CMD_NAME for selecting the engine.
+# The default value is: YES.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+USE_PDFLATEX = YES
+
+# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \batchmode
+# command to the generated LaTeX files. This will instruct LaTeX to keep running
+# if errors occur, instead of asking the user for help. This option is also used
+# when generating formulas in HTML.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_BATCHMODE = NO
+
+# If the LATEX_HIDE_INDICES tag is set to YES then doxygen will not include the
+# index chapters (such as File Index, Compound Index, etc.) in the output.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_HIDE_INDICES = NO
+
+# If the LATEX_SOURCE_CODE tag is set to YES then doxygen will include source
+# code with syntax highlighting in the LaTeX output.
+#
+# Note that which sources are shown also depends on other settings such as
+# SOURCE_BROWSER.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_SOURCE_CODE = NO
+
+# The LATEX_BIB_STYLE tag can be used to specify the style to use for the
+# bibliography, e.g. plainnat, or ieeetr. See
+# https://en.wikipedia.org/wiki/BibTeX and \cite for more info.
+# The default value is: plain.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_BIB_STYLE = plain
+
+# If the LATEX_TIMESTAMP tag is set to YES then the footer of each generated
+# page will contain the date and time when the page was generated. Setting this
+# to NO can help when comparing the output of multiple runs.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_TIMESTAMP = NO
+
+# The LATEX_EMOJI_DIRECTORY tag is used to specify the (relative or absolute)
+# path from which the emoji images will be read. If a relative path is entered,
+# it will be relative to the LATEX_OUTPUT directory. If left blank the
+# LATEX_OUTPUT directory will be used.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_EMOJI_DIRECTORY =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the RTF output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_RTF tag is set to YES, doxygen will generate RTF output. The
+# RTF output is optimized for Word 97 and may not look too pretty with other RTF
+# readers/editors.
+# The default value is: NO.
+
+GENERATE_RTF = NO
+
+# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. If a
+# relative path is entered the value of OUTPUT_DIRECTORY will be put in front of
+# it.
+# The default directory is: rtf.
+# This tag requires that the tag GENERATE_RTF is set to YES.
+
+RTF_OUTPUT = rtf
+
+# If the COMPACT_RTF tag is set to YES, doxygen generates more compact RTF
+# documents. This may be useful for small projects and may help to save some
+# trees in general.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_RTF is set to YES.
+
+COMPACT_RTF = NO
+
+# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated will
+# contain hyperlink fields. The RTF file will contain links (just like the HTML
+# output) instead of page references. This makes the output suitable for online
+# browsing using Word or some other Word compatible readers that support those
+# fields.
+#
+# Note: WordPad (write) and others do not support links.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_RTF is set to YES.
+
+RTF_HYPERLINKS = NO
+
+# Load stylesheet definitions from file. Syntax is similar to doxygen's
+# configuration file, i.e. a series of assignments. You only have to provide
+# replacements, missing definitions are set to their default value.
+#
+# See also section "Doxygen usage" for information on how to generate the
+# default style sheet that doxygen normally uses.
+# This tag requires that the tag GENERATE_RTF is set to YES.
+
+RTF_STYLESHEET_FILE =
+
+# Set optional variables used in the generation of an RTF document. Syntax is
+# similar to doxygen's configuration file. A template extensions file can be
+# generated using doxygen -e rtf extensionFile.
+# This tag requires that the tag GENERATE_RTF is set to YES.
+
+RTF_EXTENSIONS_FILE =
+
+# If the RTF_SOURCE_CODE tag is set to YES then doxygen will include source code
+# with syntax highlighting in the RTF output.
+#
+# Note that which sources are shown also depends on other settings such as
+# SOURCE_BROWSER.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_RTF is set to YES.
+
+RTF_SOURCE_CODE = NO
+
+#---------------------------------------------------------------------------
+# Configuration options related to the man page output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_MAN tag is set to YES, doxygen will generate man pages for
+# classes and files.
+# The default value is: NO.
+
+GENERATE_MAN = NO
+
+# The MAN_OUTPUT tag is used to specify where the man pages will be put. If a
+# relative path is entered the value of OUTPUT_DIRECTORY will be put in front of
+# it. A directory man3 will be created inside the directory specified by
+# MAN_OUTPUT.
+# The default directory is: man.
+# This tag requires that the tag GENERATE_MAN is set to YES.
+
+MAN_OUTPUT = man
+
+# The MAN_EXTENSION tag determines the extension that is added to the generated
+# man pages. In case the manual section does not start with a number, the number
+# 3 is prepended. The dot (.) at the beginning of the MAN_EXTENSION tag is
+# optional.
+# The default value is: .3.
+# This tag requires that the tag GENERATE_MAN is set to YES.
+
+MAN_EXTENSION = .3
+
+# The MAN_SUBDIR tag determines the name of the directory created within
+# MAN_OUTPUT in which the man pages are placed. If defaults to man followed by
+# MAN_EXTENSION with the initial . removed.
+# This tag requires that the tag GENERATE_MAN is set to YES.
+
+MAN_SUBDIR =
+
+# If the MAN_LINKS tag is set to YES and doxygen generates man output, then it
+# will generate one additional man file for each entity documented in the real
+# man page(s). These additional files only source the real man page, but without
+# them the man command would be unable to find the correct page.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_MAN is set to YES.
+
+MAN_LINKS = NO
+
+#---------------------------------------------------------------------------
+# Configuration options related to the XML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_XML tag is set to YES, doxygen will generate an XML file that
+# captures the structure of the code including all documentation.
+# The default value is: NO.
+
+GENERATE_XML = YES
+
+# The XML_OUTPUT tag is used to specify where the XML pages will be put. If a
+# relative path is entered the value of OUTPUT_DIRECTORY will be put in front of
+# it.
+# The default directory is: xml.
+# This tag requires that the tag GENERATE_XML is set to YES.
+
+XML_OUTPUT =
+
+# If the XML_PROGRAMLISTING tag is set to YES, doxygen will dump the program
+# listings (including syntax highlighting and cross-referencing information) to
+# the XML output. Note that enabling this will significantly increase the size
+# of the XML output.
+# The default value is: YES.
+# This tag requires that the tag GENERATE_XML is set to YES.
+
+XML_PROGRAMLISTING = YES
+
+# If the XML_NS_MEMB_FILE_SCOPE tag is set to YES, doxygen will include
+# namespace members in file scope as well, matching the HTML output.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_XML is set to YES.
+
+XML_NS_MEMB_FILE_SCOPE = NO
+
+#---------------------------------------------------------------------------
+# Configuration options related to the DOCBOOK output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_DOCBOOK tag is set to YES, doxygen will generate Docbook files
+# that can be used to generate PDF.
+# The default value is: NO.
+
+GENERATE_DOCBOOK = NO
+
+# The DOCBOOK_OUTPUT tag is used to specify where the Docbook pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be put in
+# front of it.
+# The default directory is: docbook.
+# This tag requires that the tag GENERATE_DOCBOOK is set to YES.
+
+DOCBOOK_OUTPUT = docbook
+
+# If the DOCBOOK_PROGRAMLISTING tag is set to YES, doxygen will include the
+# program listings (including syntax highlighting and cross-referencing
+# information) to the DOCBOOK output. Note that enabling this will significantly
+# increase the size of the DOCBOOK output.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_DOCBOOK is set to YES.
+
+DOCBOOK_PROGRAMLISTING = NO
+
+#---------------------------------------------------------------------------
+# Configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_AUTOGEN_DEF tag is set to YES, doxygen will generate an
+# AutoGen Definitions (see http://autogen.sourceforge.net/) file that captures
+# the structure of the code including all documentation. Note that this feature
+# is still experimental and incomplete at the moment.
+# The default value is: NO.
+
+GENERATE_AUTOGEN_DEF = NO
+
+#---------------------------------------------------------------------------
+# Configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_PERLMOD tag is set to YES, doxygen will generate a Perl module
+# file that captures the structure of the code including all documentation.
+#
+# Note that this feature is still experimental and incomplete at the moment.
+# The default value is: NO.
+
+GENERATE_PERLMOD = NO
+
+# If the PERLMOD_LATEX tag is set to YES, doxygen will generate the necessary
+# Makefile rules, Perl scripts and LaTeX code to be able to generate PDF and DVI
+# output from the Perl module output.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_PERLMOD is set to YES.
+
+PERLMOD_LATEX = NO
+
+# If the PERLMOD_PRETTY tag is set to YES, the Perl module output will be nicely
+# formatted so it can be parsed by a human reader. This is useful if you want to
+# understand what is going on. On the other hand, if this tag is set to NO, the
+# size of the Perl module output will be much smaller and Perl will parse it
+# just the same.
+# The default value is: YES.
+# This tag requires that the tag GENERATE_PERLMOD is set to YES.
+
+PERLMOD_PRETTY = YES
+
+# The names of the make variables in the generated doxyrules.make file are
+# prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. This is useful
+# so different doxyrules.make files included by the same Makefile don't
+# overwrite each other's variables.
+# This tag requires that the tag GENERATE_PERLMOD is set to YES.
+
+PERLMOD_MAKEVAR_PREFIX =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+
+# If the ENABLE_PREPROCESSING tag is set to YES, doxygen will evaluate all
+# C-preprocessor directives found in the sources and include files.
+# The default value is: YES.
+
+ENABLE_PREPROCESSING = YES
+
+# If the MACRO_EXPANSION tag is set to YES, doxygen will expand all macro names
+# in the source code. If set to NO, only conditional compilation will be
+# performed. Macro expansion can be done in a controlled way by setting
+# EXPAND_ONLY_PREDEF to YES.
+# The default value is: NO.
+# This tag requires that the tag ENABLE_PREPROCESSING is set to YES.
+
+MACRO_EXPANSION = YES
+
+# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES then
+# the macro expansion is limited to the macros specified with the PREDEFINED and
+# EXPAND_AS_DEFINED tags.
+# The default value is: NO.
+# This tag requires that the tag ENABLE_PREPROCESSING is set to YES.
+
+EXPAND_ONLY_PREDEF = NO
+
+# If the SEARCH_INCLUDES tag is set to YES, the include files in the
+# INCLUDE_PATH will be searched if a #include is found.
+# The default value is: YES.
+# This tag requires that the tag ENABLE_PREPROCESSING is set to YES.
+
+SEARCH_INCLUDES = YES
+
+# The INCLUDE_PATH tag can be used to specify one or more directories that
+# contain include files that are not input files but should be processed by the
+# preprocessor.
+# This tag requires that the tag SEARCH_INCLUDES is set to YES.
+
+INCLUDE_PATH =
+
+# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard
+# patterns (like *.h and *.hpp) to filter out the header-files in the
+# directories. If left blank, the patterns specified with FILE_PATTERNS will be
+# used.
+# This tag requires that the tag ENABLE_PREPROCESSING is set to YES.
+
+INCLUDE_FILE_PATTERNS =
+
+# The PREDEFINED tag can be used to specify one or more macro names that are
+# defined before the preprocessor is started (similar to the -D option of e.g.
+# gcc). The argument of the tag is a list of macros of the form: name or
+# name=definition (no spaces). If the definition and the "=" are omitted, "=1"
+# is assumed. To prevent a macro definition from being undefined via #undef or
+# recursively expanded use the := operator instead of the = operator.
+# This tag requires that the tag ENABLE_PREPROCESSING is set to YES.
+
+PREDEFINED = DOXYGEN_INCLUDE_MAINPAGE
+
+# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then this
+# tag can be used to specify a list of macro names that should be expanded. The
+# macro definition that is found in the sources will be used. Use the PREDEFINED
+# tag if you want to use a different macro definition that overrules the
+# definition found in the source code.
+# This tag requires that the tag ENABLE_PREPROCESSING is set to YES.
+
+EXPAND_AS_DEFINED =
+
+# If the SKIP_FUNCTION_MACROS tag is set to YES then doxygen's preprocessor will
+# remove all references to function-like macros that are alone on a line, have
+# an all uppercase name, and do not end with a semicolon. Such function macros
+# are typically used for boiler-plate code, and will confuse the parser if not
+# removed.
+# The default value is: YES.
+# This tag requires that the tag ENABLE_PREPROCESSING is set to YES.
+
+SKIP_FUNCTION_MACROS = YES
+
+#---------------------------------------------------------------------------
+# Configuration options related to external references
+#---------------------------------------------------------------------------
+
+# The TAGFILES tag can be used to specify one or more tag files. For each tag
+# file the location of the external documentation should be added. The format of
+# a tag file without this location is as follows:
+# TAGFILES = file1 file2 ...
+# Adding location for the tag files is done as follows:
+# TAGFILES = file1=loc1 "file2 = loc2" ...
+# where loc1 and loc2 can be relative or absolute paths or URLs. See the
+# section "Linking to external documentation" for more information about the use
+# of tag files.
+# Note: Each tag file must have a unique name (where the name does NOT include
+# the path). If a tag file is not located in the directory in which doxygen is
+# run, you must also specify the path to the tagfile here.
+
+TAGFILES =
+
+# When a file name is specified after GENERATE_TAGFILE, doxygen will create a
+# tag file that is based on the input files it reads. See section "Linking to
+# external documentation" for more information about the usage of tag files.
+
+GENERATE_TAGFILE =
+
+# If the ALLEXTERNALS tag is set to YES, all external class will be listed in
+# the class index. If set to NO, only the inherited external classes will be
+# listed.
+# The default value is: NO.
+
+ALLEXTERNALS = NO
+
+# If the EXTERNAL_GROUPS tag is set to YES, all external groups will be listed
+# in the modules index. If set to NO, only the current project's groups will be
+# listed.
+# The default value is: YES.
+
+EXTERNAL_GROUPS = YES
+
+# If the EXTERNAL_PAGES tag is set to YES, all external pages will be listed in
+# the related pages index. If set to NO, only the current project's pages will
+# be listed.
+# The default value is: YES.
+
+EXTERNAL_PAGES = YES
+
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+
+# If the CLASS_DIAGRAMS tag is set to YES, doxygen will generate a class diagram
+# (in HTML and LaTeX) for classes with base or super classes. Setting the tag to
+# NO turns the diagrams off. Note that this option also works with HAVE_DOT
+# disabled, but it is recommended to install and use dot, since it yields more
+# powerful graphs.
+# The default value is: YES.
+
+CLASS_DIAGRAMS = NO
+
+# You can include diagrams made with dia in doxygen documentation. Doxygen will
+# then run dia to produce the diagram and insert it in the documentation. The
+# DIA_PATH tag allows you to specify the directory where the dia binary resides.
+# If left empty dia is assumed to be found in the default search path.
+
+DIA_PATH =
+
+# If set to YES the inheritance and collaboration graphs will hide inheritance
+# and usage relations if the target is undocumented or is not a class.
+# The default value is: YES.
+
+HIDE_UNDOC_RELATIONS = YES
+
+# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is
+# available from the path. This tool is part of Graphviz (see:
+# http://www.graphviz.org/), a graph visualization toolkit from AT&T and Lucent
+# Bell Labs. The other options in this section have no effect if this option is
+# set to NO
+# The default value is: NO.
+
+HAVE_DOT = NO
+
+# The DOT_NUM_THREADS specifies the number of dot invocations doxygen is allowed
+# to run in parallel. When set to 0 doxygen will base this on the number of
+# processors available in the system. You can set it explicitly to a value
+# larger than 0 to get control over the balance between CPU load and processing
+# speed.
+# Minimum value: 0, maximum value: 32, default value: 0.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_NUM_THREADS = 0
+
+# When you want a differently looking font in the dot files that doxygen
+# generates you can specify the font name using DOT_FONTNAME. You need to make
+# sure dot is able to find the font, which can be done by putting it in a
+# standard location or by setting the DOTFONTPATH environment variable or by
+# setting DOT_FONTPATH to the directory containing the font.
+# The default value is: Helvetica.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_FONTNAME = Helvetica
+
+# The DOT_FONTSIZE tag can be used to set the size (in points) of the font of
+# dot graphs.
+# Minimum value: 4, maximum value: 24, default value: 10.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_FONTSIZE = 10
+
+# By default doxygen will tell dot to use the default font as specified with
+# DOT_FONTNAME. If you specify a different font using DOT_FONTNAME you can set
+# the path where dot can find it using this tag.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_FONTPATH =
+
+# If the CLASS_GRAPH tag is set to YES then doxygen will generate a graph for
+# each documented class showing the direct and indirect inheritance relations.
+# Setting this tag to YES will force the CLASS_DIAGRAMS tag to NO.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+CLASS_GRAPH = NO
+
+# If the COLLABORATION_GRAPH tag is set to YES then doxygen will generate a
+# graph for each documented class showing the direct and indirect implementation
+# dependencies (inheritance, containment, and class references variables) of the
+# class with other documented classes.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+COLLABORATION_GRAPH = NO
+
+# If the GROUP_GRAPHS tag is set to YES then doxygen will generate a graph for
+# groups, showing the direct groups dependencies.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+GROUP_GRAPHS = NO
+
+# If the UML_LOOK tag is set to YES, doxygen will generate inheritance and
+# collaboration diagrams in a style similar to the OMG's Unified Modeling
+# Language.
+# The default value is: NO.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+UML_LOOK = NO
+
+# If the UML_LOOK tag is enabled, the fields and methods are shown inside the
+# class node. If there are many fields or methods and many nodes the graph may
+# become too big to be useful. The UML_LIMIT_NUM_FIELDS threshold limits the
+# number of items for each type to make the size more manageable. Set this to 0
+# for no limit. Note that the threshold may be exceeded by 50% before the limit
+# is enforced. So when you set the threshold to 10, up to 15 fields may appear,
+# but if the number exceeds 15, the total amount of fields shown is limited to
+# 10.
+# Minimum value: 0, maximum value: 100, default value: 10.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+UML_LIMIT_NUM_FIELDS = 10
+
+# If the TEMPLATE_RELATIONS tag is set to YES then the inheritance and
+# collaboration graphs will show the relations between templates and their
+# instances.
+# The default value is: NO.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+TEMPLATE_RELATIONS = NO
+
+# If the INCLUDE_GRAPH, ENABLE_PREPROCESSING and SEARCH_INCLUDES tags are set to
+# YES then doxygen will generate a graph for each documented file showing the
+# direct and indirect include dependencies of the file with other documented
+# files.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+INCLUDE_GRAPH = NO
+
+# If the INCLUDED_BY_GRAPH, ENABLE_PREPROCESSING and SEARCH_INCLUDES tags are
+# set to YES then doxygen will generate a graph for each documented file showing
+# the direct and indirect include dependencies of the file with other documented
+# files.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+INCLUDED_BY_GRAPH = NO
+
+# If the CALL_GRAPH tag is set to YES then doxygen will generate a call
+# dependency graph for every global function or class method.
+#
+# Note that enabling this option will significantly increase the time of a run.
+# So in most cases it will be better to enable call graphs for selected
+# functions only using the \callgraph command. Disabling a call graph can be
+# accomplished by means of the command \hidecallgraph.
+# The default value is: NO.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+CALL_GRAPH = NO
+
+# If the CALLER_GRAPH tag is set to YES then doxygen will generate a caller
+# dependency graph for every global function or class method.
+#
+# Note that enabling this option will significantly increase the time of a run.
+# So in most cases it will be better to enable caller graphs for selected
+# functions only using the \callergraph command. Disabling a caller graph can be
+# accomplished by means of the command \hidecallergraph.
+# The default value is: NO.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+CALLER_GRAPH = NO
+
+# If the GRAPHICAL_HIERARCHY tag is set to YES then doxygen will graphical
+# hierarchy of all classes instead of a textual one.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+GRAPHICAL_HIERARCHY = NO
+
+# If the DIRECTORY_GRAPH tag is set to YES then doxygen will show the
+# dependencies a directory has on other directories in a graphical way. The
+# dependency relations are determined by the #include relations between the
+# files in the directories.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DIRECTORY_GRAPH = NO
+
+# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images
+# generated by dot. For an explanation of the image formats see the section
+# output formats in the documentation of the dot tool (Graphviz (see:
+# http://www.graphviz.org/)).
+# Note: If you choose svg you need to set HTML_FILE_EXTENSION to xhtml in order
+# to make the SVG files visible in IE 9+ (other browsers do not have this
+# requirement).
+# Possible values are: png, jpg, gif, svg, png:gd, png:gd:gd, png:cairo,
+# png:cairo:gd, png:cairo:cairo, png:cairo:gdiplus, png:gdiplus and
+# png:gdiplus:gdiplus.
+# The default value is: png.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_IMAGE_FORMAT = png
+
+# If DOT_IMAGE_FORMAT is set to svg, then this option can be set to YES to
+# enable generation of interactive SVG images that allow zooming and panning.
+#
+# Note that this requires a modern browser other than Internet Explorer. Tested
+# and working are Firefox, Chrome, Safari, and Opera.
+# Note: For IE 9+ you need to set HTML_FILE_EXTENSION to xhtml in order to make
+# the SVG files visible. Older versions of IE do not have SVG support.
+# The default value is: NO.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+INTERACTIVE_SVG = NO
+
+# The DOT_PATH tag can be used to specify the path where the dot tool can be
+# found. If left blank, it is assumed the dot tool can be found in the path.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_PATH =
+
+# The DOTFILE_DIRS tag can be used to specify one or more directories that
+# contain dot files that are included in the documentation (see the \dotfile
+# command).
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOTFILE_DIRS =
+
+# The MSCFILE_DIRS tag can be used to specify one or more directories that
+# contain msc files that are included in the documentation (see the \mscfile
+# command).
+
+MSCFILE_DIRS =
+
+# The DIAFILE_DIRS tag can be used to specify one or more directories that
+# contain dia files that are included in the documentation (see the \diafile
+# command).
+
+DIAFILE_DIRS =
+
+# When using plantuml, the PLANTUML_JAR_PATH tag should be used to specify the
+# path where java can find the plantuml.jar file. If left blank, it is assumed
+# PlantUML is not used or called during a preprocessing step. Doxygen will
+# generate a warning when it encounters a \startuml command in this case and
+# will not generate output for the diagram.
+
+PLANTUML_JAR_PATH =
+
+# When using plantuml, the PLANTUML_CFG_FILE tag can be used to specify a
+# configuration file for plantuml.
+
+PLANTUML_CFG_FILE =
+
+# When using plantuml, the specified paths are searched for files specified by
+# the !include statement in a plantuml block.
+
+PLANTUML_INCLUDE_PATH =
+
+# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of nodes
+# that will be shown in the graph. If the number of nodes in a graph becomes
+# larger than this value, doxygen will truncate the graph, which is visualized
+# by representing a node as a red box. Note that doxygen if the number of direct
+# children of the root node in a graph is already larger than
+# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note that
+# the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH.
+# Minimum value: 0, maximum value: 10000, default value: 50.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_GRAPH_MAX_NODES = 50
+
+# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the graphs
+# generated by dot. A depth value of 3 means that only nodes reachable from the
+# root by following a path via at most 3 edges will be shown. Nodes that lay
+# further from the root node will be omitted. Note that setting this option to 1
+# or 2 may greatly reduce the computation time needed for large code bases. Also
+# note that the size of a graph can be further restricted by
+# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction.
+# Minimum value: 0, maximum value: 1000, default value: 0.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+MAX_DOT_GRAPH_DEPTH = 0
+
+# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent
+# background. This is disabled by default, because dot on Windows does not seem
+# to support this out of the box.
+#
+# Warning: Depending on the platform used, enabling this option may lead to
+# badly anti-aliased labels on the edges of a graph (i.e. they become hard to
+# read).
+# The default value is: NO.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_TRANSPARENT = NO
+
+# Set the DOT_MULTI_TARGETS tag to YES to allow dot to generate multiple output
+# files in one run (i.e. multiple -o and -T options on the command line). This
+# makes dot run faster, but since only newer versions of dot (>1.8.10) support
+# this, this feature is disabled by default.
+# The default value is: NO.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_MULTI_TARGETS = NO
+
+# If the GENERATE_LEGEND tag is set to YES doxygen will generate a legend page
+# explaining the meaning of the various boxes and arrows in the dot generated
+# graphs.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+GENERATE_LEGEND = YES
+
+# If the DOT_CLEANUP tag is set to YES, doxygen will remove the intermediate dot
+# files that are used to generate the various graphs.
+# The default value is: YES.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_CLEANUP = YES
diff --git a/api-docs/cppdocs/USEBUILDMINDOCS b/api-docs/cppdocs/Doxyfile-HTML
index e54da627..e54da627 100644
--- a/api-docs/cppdocs/USEBUILDMINDOCS
+++ b/api-docs/cppdocs/Doxyfile-HTML
diff --git a/api-docs/cppdocs/Makefile b/api-docs/cppdocs/Makefile
new file mode 100644
index 00000000..d354d169
--- /dev/null
+++ b/api-docs/cppdocs/Makefile
@@ -0,0 +1,23 @@
+# Makefile for C++ documentation
+
+PYTHON ?= poetry run python
+
+.PHONY: help
+help:
+ @echo "Please use \`make <target>\` where <target> is one of"
+ @echo " html to make standalone HTML files"
+ @echo " docset to make a Dash docset"
+
+.PHONY: clean
+clean:
+ rm -rf html
+ rm -rf docset
+ rm -rf xml
+
+.PHONY: html
+html:
+ $(PYTHON) ./build_min_docs.py
+
+.PHONY: docset
+docset:
+ $(PYTHON) ./build_min_docs.py --docset
diff --git a/api-docs/cppdocs/build_min_docs.py b/api-docs/cppdocs/build_min_docs.py
index 00a0767b..218ee280 100644
--- a/api-docs/cppdocs/build_min_docs.py
+++ b/api-docs/cppdocs/build_min_docs.py
@@ -12,6 +12,7 @@
__DOXYGEN_REQUIRED_VERSION__ = "1.9.4"
+import argparse
import os
import sys
import json
@@ -125,8 +126,8 @@ def minifier():
fp.close()
-def build_doxygen():
- if not os.path.exists('./USEBUILDMINDOCS'):
+def build_doxygen(args):
+ if not os.path.exists('./Doxyfile-HTML'):
print('No Doxyfile found. Are you in the right directory?')
sys.exit(1)
_, vers, _ = system_with_output("doxygen -V")
@@ -135,6 +136,12 @@ def build_doxygen():
print(f'Please use Doxygen {__DOXYGEN_REQUIRED_VERSION__} to build documentation')
sys.exit(1)
+ if args.docset:
+ stat, _, _ = system_with_output("doxygen2docset --help")
+ if stat != 0:
+ print(f"Please install https://github.com/chinmaygarde/doxygen2docset")
+ sys.exit(1)
+
print(f'DOXYGEN VERSION: {vers.strip()}')
if os.path.exists('./html/'):
@@ -145,22 +152,37 @@ def build_doxygen():
# doing it twice works (on macOS) ¯\_(ツ)_/¯
shutil.rmtree("./html/")
print(f'Building doxygen docs...')
- stat, out, err = system_with_output("doxygen USEBUILDMINDOCS")
+
+ if args.docset:
+ stat, out, err = system_with_output("doxygen Doxyfile-Docset")
+ else:
+ stat, out, err = system_with_output("doxygen Doxyfile-HTML")
print(f"Built Doxygen with status code {stat}")
print("Output dir is ./html/")
stat, out, err = system_with_output("cp _static/img/* html/")
print(f"Copied images with status code {stat}")
+ if args.docset:
+ stat, out, err = system_with_output("doxygen2docset --doxygen html --docset docset")
+ print(f"Created docset with status code {stat}")
def main():
- build_doxygen()
+ parser = argparse.ArgumentParser(prog=sys.argv[0])
+ parser.add_argument("--docset", action="store_true", default=False, help="Generate Dash docset")
+ args = parser.parse_args()
+
+ build_doxygen(args)
print("Minifying Output")
- minifier()
+ if os.path.exists("html/navtree.js"):
+ minifier()
for file in deletion_queue:
file = "./" + file
os.remove(file)
print(f'Was able to clear {len(deletion_queue)} "redundant" files')
- print(f'Done. Output is in ./html/')
+ if args.docset:
+ print(f'Done. Output is in ./docset/')
+ else:
+ print(f'Done. Output is in ./html/')
if __name__ == "__main__":
diff --git a/api-docs/source/conf.py b/api-docs/source/conf.py
index bc32e478..092710d5 100644
--- a/api-docs/source/conf.py
+++ b/api-docs/source/conf.py
@@ -102,6 +102,15 @@ Welcome to the Binary Ninja API documentation. The below methods are available
from the root of the `binaryninja` package, but most of the API is organized
into the modules shown in the left side-bar.
+These pages are intended as an API Reference. For a deeper explanation of how
+different parts of Binary Ninja work, explanations of concepts, or if you're
+new to Binary Ninja, you'll want to check out our [User Guide](https://docs.binary.ninja/).
+
+If you're new to our API, we also have a [Developer Guide](https://docs.binary.ninja/dev/index.html)
+which covers many of the concepts developers should know. There's also a
+[Cookbook](https://docs.binary.ninja/dev/cookbook.html) which contains many
+examples to get you started using our API.
+
You can also scroll to the end to view a class list of all available classes.
The search bar on the side works both online and offline.
diff --git a/docs/about/open-source.md b/docs/about/open-source.md
index 96b7d7f3..b71813bd 100644
--- a/docs/about/open-source.md
+++ b/docs/about/open-source.md
@@ -297,7 +297,7 @@ Please note that we offer no support for running Binary Ninja with modified Qt l
[sourcecodepro]: https://github.com/adobe-fonts/source-code-pro
[NotoColorEmoji license]: https://github.com/googlefonts/noto-emoji/blob/main/fonts/LICENSE
[NotoColorEmoji]: https://github.com/googlefonts/noto-emoji
-[sphinx license]: https://github.com/sphinx-doc/sphinx/blob/master/LICENSE
+[sphinx license]: https://github.com/sphinx-doc/sphinx/blob/master/LICENSE.rst
[sphinx]: http://www.sphinx-doc.org/en/stable/index.html
[sqlite license]: https://www.sqlite.org/copyright.html
[sqlite]: https://www.sqlite.org/index.html
@@ -701,7 +701,7 @@ Please note that we offer no support for running Binary Ninja with modified Qt l
[webpki]: https://github.com/briansmith/webpki
[webpki license]: https://github.com/briansmith/webpki/blob/main/LICENSE
[webpki-roots]: https://github.com/rustls/webpki-roots
-[webpki-roots license]: https://github.com/rustls/webpki-roots/blob/main/LICENSE
+[webpki-roots license]: https://github.com/rustls/webpki-roots/blob/main/webpki-roots/LICENSE
[which]: https://github.com/harryfei/which-rs.git
[which license]: https://github.com/harryfei/which-rs/blob/master/LICENSE.txt
[x509-signature]: https://github.com/paritytech/x509-signature
diff --git a/docs/dev/annotation.md b/docs/dev/annotation.md
index d952baa6..60cb9681 100644
--- a/docs/dev/annotation.md
+++ b/docs/dev/annotation.md
@@ -1,11 +1,11 @@
# Applying Annotations
-This document is organized into five sections describing how to work with various types of annotations in Binary Ninja using the API. Note that its [companion documentation](../guide/type.md) describes how to interact with many of the same elements via the UI.
+This document is organized into five sections describing how to work with various types of annotations in Binary Ninja using the API. Note that its [companion documentation](../guide/types/index.md) describes how to interact with many of the same elements via the UI.
1. [Symbols](#symbols) covers how to work with Symbols in a binary
1. [Types](#types) documents creating and interacting with types through the API
1. [Tags](#tags) describes how to create tags and bookmarks
-1. [Type Libraries](#type-libraries) explains how to work with Type Libraries, including multiple sources of information from which Binary Ninja can automatically source for type information from and how you can add to them
+1. [Type Libraries](typelibraries.md) explains how to work with Type Libraries, including multiple sources of information from which Binary Ninja can automatically source for type information from and how you can add to them
1. [Signature Libraries](#signature-library) explains how to work with the signature library which match statically compiled functions which are then matched with type libraries
## Symbols
@@ -20,7 +20,7 @@ From an API perspective there are several helper functions available for working
'newName'
```
-Other objects or variables may need a [symbol](https://api.binary.ninja/binaryninja.types.Symbol.html) created and applied (this can also be done even if not using a helper function on objects such as functions):
+Other objects or variables may need a [symbol](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol) created and applied (this can also be done even if not using a helper function on objects such as functions):
```py
>>> mysym = Symbol(SymbolType.FunctionSymbol, here, "myVariableName")
@@ -31,7 +31,7 @@ Other objects or variables may need a [symbol](https://api.binary.ninja/binaryni
Note that `here` and `bv` are used in many of the previous examples. These shortcuts and [several others](../guide/index.md#script-python-console) are only available when running in the Binary Ninja python console and are used here for convenience.
-Valid symbol types [include](https://api.binary.ninja/binaryninja.enums.SymbolType.html):
+Valid symbol types [include](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.SymbolType):
| SymbolType | Description |
| ---------- | ----------- |
@@ -439,7 +439,7 @@ Note that most of the APIs that take a Type object also take a C-style type stri
### Headers
-Importing a header goes through the same code path as parsing source directly. You will just have to read the file and specify the appropriate command-line arguments as an array. See [user type guide](../guide/type.md#import-header-file) for directions for choosing arguments.
+Importing a header goes through the same code path as parsing source directly. You will just have to read the file and specify the appropriate command-line arguments as an array. See [user type guide](../guide/types/typeimportexport.md#import-header-file) for directions for choosing arguments.
```python
>>> with open('C:\projects\stdafx.h', 'r') as f:
@@ -473,292 +473,7 @@ Exporting a header uses the `TypePrinter.print_all_types` api, and outputs a str
## Type Libraries
-Type Libraries are collections of type information (structs, enums, function types, etc.) stored in a file with the extension `.bntl`.
-
-Relative to the binaryninja executable, the default type library location is `../Resources/typelib` on macOS and `./typelib` on Linux and Windows. Individual .bntl files are organized in subdirectories named for the supported architecture. Users may include their own type libraries
-
-The information in a type library is contained in two key-value stores:
-
-1. named types: key is the type name, value is the type
-1. named objects: key is external symbol name, value is the type
-
-### How Binary Ninja Loads Type Libraries
-
-When a binary is opened, its platform is determined, all .bntl's are processed, and those matching the platform of the loaded binary are registered. A debug log will show:
-
-```
-Registered library 'libc.so.6' with platform 'linux-x86_64'
-```
-
-Then, those with either a filename or an alternative name matching the exact text of the binary's import command are imported, much like the native linker/loader. For example, in ELF, the .dynstr entry is used.
-
-```
-elf: searching for 'libc.so.6' in type libraries
-Type library 'libc.so.6' imported
-```
-
-Type libraries for linux are ideally named after their realname, preserving the library minor version from which they were generated, and the soname in the alternatives list. In practice, naming them after their soname suffices. Using the linkname with no alternatives will prevent your library from loading.
-
-This requested name should be a soname, like "libfoo.so.1" but could be a linkname like "libfoo.so". (The ldconfig tool is responsible for creating symlinks from soname to realnames, like `/usr/lib/libfoo.so.1` -> `/usr/lib/libfoo.so.1.0`. See [tldp.org](https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html) for more information.).
-
-Binary Ninja's logic for determining a match is straightforward:
-
-```
-typelibname.removesuffix('.bntl') == requestedname or requestedname in alternativenames
-```
-
-Therefore, without any alternative names, `libc.so.bntl` will not be loaded by Binary Ninja if an ELF requests libc.so.6.
-
-We recommend and use the following convention:
-
-Type libraries should be named for the filename from which they were generated with the phrase ".bntl" added. When the source library contains additional minor and release number, like `libfoo.so.1.2.3` Binary Ninja would not load the resulting type library `libfoo.so.1.2.3.bntl` for an ELF requesting soname `libfoo.so.1`. Therefore the alternative names list should include the most specific version numbers, incrementally stripped down to the soname, and finally a linkname for good measure.
-
-Example:
-
-`libfoo.so.1.2.3` is used to generated `libfoo.so.1.2.3.bntl`
-
-The alternative names list should have:
-
-```
-libfoo.so.1.2.3 <-- includes version, minor, release (most specific)
-libfoo.so.1.2 <-- includes version, minor (less specific)
-libfoo.so.1 <-- includes version (soname)
-libfoo.so <-- linkname
-```
-
-### Acquiring a Handle
-
-The platform class exposes handles to these imported type libraries with its `type_libraries` list and its `get_type_libraries_by_name()` function:
-
-```python
->>> bv.platform.type_libraries
-[<typelib 'libm.so.6':x86_64':x86_64>, <typelib 'SYSCALLS':x86_64]
->>> bv.platform.get_type_libraries_by_name('libm.so.6')
-[<typelib 'libm.so.6':x86_64>]
-```
-
-That requires the type library having been loaded. A more direct way is to load from a file path with the `load_from_file()` from `Typelibrary` class from `typelibrary` module:
-
-```python
->>> typelibrary.TypeLibrary.load_from_file('/path/to/libm_x86_64.so.6.bntl')
-<typelib 'libm_x86_64.so.6':x86_64>
-```
-
-### Contents of Libraries
-
-The following demonstrates attributes of interest on a loaded type library in variable `tl`:
-
-```python
- print(' name: %s' % tl.name)
- print(' arch: %s' % tl.arch)
- print(' guid: %s' % tl.guid)
- print('dependency_name: %s' % tl.dependency_name)
- print('alternate_names: %s' % tl.alternate_names)
- print(' platform_names: %s' % tl.platform_names)
-
- print(' named_objects: %d' % len(tl.named_objects))
- for (key, val) in tl.named_objects.items():
- print('\t"%s" %s' % (str(key), str(val)))
-
- print(' named_types: %d' % len(tl.named_types))
- for (key,val) in tl.named_types.items():
- print('\t"%s" %s' % (str(key), str(val)))
-```
-
-Named objects (via dictionary `.named_objects` are functions signatures and a module's exported variables. Named types (via dictionary `.named_types`) are the textual named you might use to declare a variable. For example,
-
-For example, `.named_objects['fegetexceptionflag']` looks up its function prototype: `int32_t (fexcept_t* flagp)` and `.named_types['fexcept_t']` looks up `uint16_t`, its typedef.
-
-### Creating
-
-You may also wish to use the [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py) example script included both online and offline in your installation path.
-
-Types entered by manual entry can be exported from the binary view using `export_type_to_library()`.
-
-Manual creation is achieved by creating a new type library, associating the correct platform and architecture, adding types, finalizing, and writing to a file. Example:
-
-```python
-arch = binaryninja.Architecture['x86_64']
-
-struct = Structure()
-struct.append(Type.pointer(arch, Type.char()), 'name')
-struct.append(Type.int(4), 'age')
-struct.append(Type.int(4), 'height')
-struct.append(Type.int(4), 'weight')
-
-typelib = binaryninja.typelibrary.TypeLibrary.new(arch, 'test.so.1.4')
-typelib.add_named_type('human', binaryninja.types.Type.structure_type(struct))
-typelib.add_alternate_name('test.so.1') #don't forget this step!
-typelib.add_alternate_name('test.so')
-typelib.finalize()
-typelib.write_to_file('test.so.1.bntl')
-```
-
-### Other Type Library Questions
-
-_What's a named type vs. just a type?_
-
-Some variable definitions have type information, but don't produce a type name useful for future definitions, examples:
-
-- `enum {A=1,B=2} foo;` : foo has type with no type name (it does have a variable name)
-- `struct {int A; int B;} bar;` : bar has type with no type name
-
-In C, enum and struct definitions can create a new type name as a byproduct of a definition by using a "tag name":
-
-- `enum MyEnum {A=1,B=2} foo;` : foo has the type named `MyEnum`
-- `struct MyStruct {int A; int B;} bar;` : bar has the type named `MyStruct`
-
-In the second set of examples, the types are named, and that name could be used to declare other variables, like `enum MyEnum bar2;` and `struct MyStruct bar2`.
-
-Functions' types are not named. The function name is considered the name of a function object, and the function's type is anonymous.
-
-In summary:
-
-```c
-typedef int foo; // type:int, name:foo
-
-// structs, without and with a "tag name"
-struct {int A; int B;} foo; // type:struct{int A, intB;}, name:<anonymous>
-struct MyStruct {int A; int B;} foo; // type:struct{int A, intB;}, name:MyStruct
-
-// enumerations, without and with a "tag name"
-enum {A=1,B=2} foo; // type:enum{A=1,B=2}, name:<anonymous>
-enum MyEnum {A=1,B=2} foo; // type:enum{A=1,B=2}, name:MyEnum
-
-// functions
-int main(int ac, char **av); // type int ()(int, char **), name:<anonymous>
-typedef int (MyFunc)(int ac, char **av); // type int ()(int, char **), name:MyFunc
-
-```
-
-_How does Binary Ninja decide when to use a typelibrary (.bntl) file?_
-
-Type Libraries are loaded when the corresponding library is imported by a BinaryView. (i.e. if an exe imports `ntdll.dll`, binja will look in the bv's platform for type libraries named ntdll.bntl and load the first one it finds)
-
-_What's the difference between a named type and a named object?_
-
-A named type is a type with a name that can identify it. For example, `color` is the name of type `enum {RED=0, ORANGE=1, YELLOW=2, ...}`.
-
-A named object is the name of an external/imported symbol for which the type library has type information. For example, `MessageBoxA` is the name of a function whose type is `int ()(HWND, LPCSTR, LPCSTR, UINT)`.
-
-_How do I find what type of type a type object is? How many are there?_
-
-I've seen "types of types", "sorts of types", "kinds of types", "classes of types" used to differentiate the varieties of possible types, and there are probably more. Binary Ninja uses "class", example:
-
-```
->>> type_obj.type_class
-<TypeClass.FunctionTypeClass: 8>
-```
-
-In [enums.py](https://api.binary.ninja/_modules/binaryninja/enums.html#TypeClass) we can see Binary Ninja currently thinks of types falling into 13 classes: `Void`, `Bool`, `Integer`, `Float`, `Structure`, `Enumeration`, `Pointer`, `Array`, `Function`, `VarArgs`, `Value`, `NamedTypeReference`, `WideCharType`.
-
-Compare this to LLDB, which also uses the term "class", and currently has 19 of them: `Array`, `BlockPointer`, `Builtin`, `Class`, `ComplexFloat`, `ComplexInteger`, `Enumeration`, `Function`, `MemberPointer`, `ObjCObject`, `ObjCInterface`, `ObjCObjectPointer`, `Pointer`, `Reference`, `Struct`, `Typedef`, `Union`, `Vector`, `Other`.
-
-Compare this to GDB, which uses the term "type code" and has 25 of them.
-
-_Where are function parameter names stored?_
-
-While technically not part of the type, having names of function parameters is very useful and can thus be optionally stored in a type.
-
-Function types (types with `.type_class == FunctionTypeClass`) have a `.parameters` attribute, a list of [`FunctionParameter`](https://api.binary.ninja/binaryninja.types.FunctionParameter.html) objects. When those objects have `.name==''` you get the bare bones function types like `int ()(int, char **)`. When those objects have their `.name` populated you get the more meaningful `int ()(int argc, char **argv)`.
-
-_How do I manually load a type library?_
-
-```
->>> bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))
-```
-
-_How can I manually load a type object?_
-
-```
->>> bv.import_library_object('_MySuperComputation')
-<type: int32_t (int32_t, int32_t, char*)>
-```
-
-_Why doesn't the types view show the types imported from type libraries?_
-
-Because the type libraries added to a binary view only makes their type information _available_ for use. The types view will show a type from a type library only after it is used (on demand).
-
-Try this experiment:
-
-- note `bv.type_libraries`, `bv.types`
-- add a type library with `bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))`
-- note that `bv.type_libraries` is extended, but `bv.types` is unchanged!
-- note `bv.get_type_by_name('Rectangle')` returns nothing
-- set the type of some data to `struct Rectangle` (using `y` in linear view or via any other method described above)
-- `bv.types` is extended, and the types view shows `struct Rectangle` in the auto types
-
-_What's a named type reference?_
-
-Named Type References are a way to refer to a type by name without having its declaration immediately available.
-
-For example, examine this struct from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
-
-```
-struct Rectangle2 {
- int width;
- int height;
- struct Point center;
-}
-```
-
-We don't know at this moment what a `struct Point is`. Maybe we've already added it. Maybe we'll add it later. Maybe it's in another type library. But we want to add a Rectangle now. So we leave the center field as a reference to the named type `struct Point`.
-
-Load the resulting `test.bntl` in your binary and try to set some data to type `struct Rectangle2` and you'll be met with this message:
-
-```
-TypeLibrary: failed to import type 'Point'; referenced but not present in library 'libtest.so.1`
-```
-
-This makes sense! Now go to types view and `define struct Point { int x; int y; }` and try again, success!
-
-```
-100001000 struct rectangle_unresolved data_100001000 =
-100001000 {
-100001000 int32_t width = 0x5f0100
-100001004 int32_t height = 0x5f030005
-100001008 struct Point center =
-100001008 {
-100001008 int32_t x = 0x655f686d
-10000100c int32_t y = 0x75636578
-100001010 }
-100001008 }
-```
-
-You should repeat the experiment using `struct Rectangle` and see that you're allowed to create variables with type containing _pointers_ to unresolved type references.
-
-_How are types represented?_
-
-By a hierarchy of objects from [api/python/types.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/types.py) referencing one another. The "glue" object is [`binaryninja.types.Type`](https://api.binary.ninja/binaryninja.types.Type.html#binaryninja.types.Type) and depending on the complexity of the type it represents (stored in its `.type_class` attribute), it could have an attribute with more information. For instance, if the `binaryninja.types.Type` has `.type_class == FunctionTypeClass` then its `.parameters` attribute is a list of [`binaryninja.types.FunctionParameter`](https://api.binary.ninja/binaryninja.types.FunctionParameter.html). See [typelib_dump.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_dump.py) for how this can work.
-
-As an example, here is the hierarchical representation of `type struct Rectangle` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py)
-
-```
-typelib.named_types["Rectangle"] =
-----------------------------------
-Type class=Structure
- Structure
- StructureMember "width"
- Type class=Integer width=4
- StructureMember "height"
- Type class=Integer width=4
- StructureMember "center"
- Type class=Pointer
- Type class=NamedTypeReference
- NamedTypeReference <named type: struct Point>
-```
-
-Here is the representation of `type int ()(int, int)` named `MyFunctionType` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
-
-_When do named objects get used?_
-
-When a binary is loaded and its external symbols is processed, the symbol names are searched against the named objects from type libraries. If there is a match, it obeys the type from the type library. Upon success, you'll see a message like:
-
-```
-type library test.bntl found hit for _DoSuperComputation
-```
-
-At this moment, there is no built in functionality to apply named objects to an existing Binary Ninja database.
+Type Libraries have outgrown this section and now live [in their own file](typelibraries.md)
## Signature Library
diff --git a/docs/dev/bnil-hlil.md b/docs/dev/bnil-hlil.md
new file mode 100644
index 00000000..157b6a59
--- /dev/null
+++ b/docs/dev/bnil-hlil.md
@@ -0,0 +1,158 @@
+# Binary Ninja Intermediate Language Series, Part 3: High Level IL
+# Binary Ninja Intermediate Language: High Level IL
+
+The High Level Intermediate Language (HLIL) is Binary Ninja's decompiler output. Much like [LLIL](./bnil-llil.md) and [MLIL](./bnil-mlil.md), this representation is tree based and has many of the same instructions. This representation is distinct in a few key ways.
+
+![BNIL-HLIL Selected](../img/BNIL-hlil.png)
+
+1. High level language concepts are recovered.
+1. Expressions are folded
+
+## Purposes of HLIL
+
+* Simplified representation
+* Small discrete operations
+* Enables source-level forms of queries and analysis
+
+In the rest of this article we will explore the instruction set.
+
+## The Instruction Set
+
+The instruction set is made up of [`HighLevelILInstruction`](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an HLIL instruction:+
+
+```
+>>> current_il_instruction
+<HighLevelILVarInit: uint64_t rax_2 = zx.q(rax_1 - 0x6c)>
+>>> type(current_il_instruction)
+<class 'binaryninja.highlevelil.HighLevelILVarInit'>
+```
+
+`current_il_instruction` is mapped to whatever il instruction is currently selected viewed and is not generally available to those writing plugins or scripts. You can see a full list of our [magic variables here](../guide/index.md#magic-console-variables).
+
+There are a number of properties that can be queried on the [`HighLevelILInstruction`](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction) object, and the validity of these properties changes depending on what the current operation is. The properties in HLIL are extremely similar to those in MLIL, with one notable exception being that `HLIL_CALL` instruction objects do not have a `.output` property, but instead `HLIL_CALL`s that have return values will be the `inst.right` of a `HighLevelILVarInit`, `HighLevelILVarAssign`, or similar.
+
+
+### Control Flow
+
+* `HLIL_JUMP` - Branch to the `dest` expression's address
+* `HLIL_CALL` - Branch to the `dest` expression function, saving the return address, with the list of parameters `params`
+* `HLIL_RET` - Return to the calling function.
+* `HLIL_NORET` - This instruction will never be executed, the instruction before it is a call that doesn't return
+* `HLIL_IF` - Branch to the `true`/`false` HLIL instruction identifier depending on the result of the `condition` expression
+* `HLIL_GOTO` - Branch to the `dest` expression id
+* `HLIL_TAILCALL` - This instruction calls the expression `dest` using `params` as input and `output` for return values
+not exist
+* `HLIL_SYSCALL` - Make a system/service call with parameters `params` and output `output`
+* `HLIL_WHILE` -
+* `HLIL_DO_WHILE` -
+* `HLIL_FOR` -
+* `HLIL_SWITCH` -
+* `HLIL_CASE` -
+* `HLIL_BREAK` -
+* `HLIL_CONTINUE` -
+
+### Variable Reads and Writes
+
+* `HLIL_VAR_DECLARE` - A declaration of `var`
+* `HLIL_VAR_INIT` - Initializes `dest` to the result of an expression `src`
+* `HLIL_ASSIGN` - Sets a variable `dest` to the result of an expression `src`
+* `HLIL_ASSIGN_UNPACK` -
+* `HLIL_VAR` - A variable expression `src`
+* `HLIL_VAR_PHI` - A `PHI` represents the combination of several prior versions of a variable when differnet basic blocks coalesce into a single destination and it's unknown which path was taken.
+* `HLIL_MEM_PHI` - A memory `PHI` represents memory modifications that could have occured down different source basic blocks similar to a `VAR_PHI`.
+* `HLIL_ADDRESS_OF` - The address of variable `src`
+* `HLIL_CONST` - A constant integral value `constant`
+* `HLIL_CONST_DATA` - A constant data reference `constant data reference`
+* `HLIL_CONST_PTR` - A constant integral value which is used as a pointer `constant`
+* `HLIL_EXTERN_PTR` - A symbolic pointer `constant` + `offset` to a symbol that exists outside the binary
+* `HLIL_FLOAT_CONST` - A floating point constant `constant`
+* `HLIL_IMPORT` - A `constant` integral value representing an imported address
+* `HLIL_LOW_PART` - `size` bytes from the low end of `src` expression
+* `HLIL_STRUCT_FIELD` -
+* `HLIL_ARRAY_INDEX` -
+* `HLIL_SPLIT` - A split pair of variables `high`:`low` which can be used a single expression
+* `HLIL_DEREF` - Dereferences `src`
+* `HLIL_DEREF_FIELD` -
+
+### Arithmetic Operations
+
+* `HLIL_ADD` - Adds `left` expression to `right` expression
+* `HLIL_ADC` - Adds with carry the `left` expression to the `right` expression with carry from the `carry` expression
+* `HLIL_SUB` - Subtracts the `right` expression from the `left` expression
+* `HLIL_SBB` - Subtraction with borrow the `right` expression from the `left` expression with carry from the `carry` expression
+* `HLIL_AND` - Bitwise AND `left` expression with the `right` expression
+* `HLIL_OR` - Bitwise OR `left` expression with the `right` expression
+* `HLIL_XOR` - Bitwise XOR `left` expression with the `right` expression
+* `HLIL_LSL` - Logical shift left the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_LSR` - Logical shift right the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_ASR` - Arithmetic shift right the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_ROL` - Rotate left the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_RLC` - Rotate left with carry the `left` expression and the `carry` expression by the number of bits stored in the `right` expression
+* `HLIL_ROR` - Rotate right the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_RRC` - Rotate right with carry the `left` expression and the `carry` expression by the number of bits stored in the `right` expression
+* `HLIL_MUL` - Single-precision multiply the `left` expression with the `right` expression
+* `HLIL_MULU_DP` - Double-precision unsigned multiply the `left` expression with the `right` expression, result expression is twice the size of the input expressions
+* `HLIL_MULS_DP` - Double-precision signed multiply the `left` expression with the `right` expression, result expression is twice the size of the input expressions
+* `HLIL_DIVU` - Unsigned single-precision divide `left` expression by the `right` expression
+* `HLIL_DIVU_DP` - Unsigned double-precision divide `left` expression by the `right` expression
+* `HLIL_DIVS` - Signed single-precision divide `left` expression by the `right` expression
+* `HLIL_DIVS_DP` - Signed double-precision divide `left` expression by the `right` expression
+* `HLIL_MODU` - Unsigned single-precision modulus of `left` expression by the `right` expression
+* `HLIL_MODU_DP` - Unsigned double-precision modulus of `left` expression by the `right` expression
+* `HLIL_MODS` - Signed single-precision modulus of `left` expression by the `right` expression
+* `HLIL_MODS_DP` - Signed double-precision modulus of `left` expression by the `right` expression
+* `HLIL_NEG` - Sign inversion of `src` expression
+* `HLIL_NOT` - Bitwise inversion of `src` expression
+* `HLIL_FADD` - IEEE754 floating point addition of `left` expression with `right` expression
+* `HLIL_FSUB` - IEEE754 floating point subtraction of `left` expression with `right` expression
+* `HLIL_FMUL` - IEEE754 floating point multiplication of `left` expression with `right` expression
+* `HLIL_FDIV` - IEEE754 floating point division of `left` expression with `right` expression
+* `HLIL_FSQRT` - IEEE754 floating point square root of `left` expression with `right` expression
+* `HLIL_FNEG` - IEEE754 floating point sign negation of `src` expression
+* `HLIL_FABS` - IEEE754 floating point absolute value of `src` expression
+* `HLIL_FLOAT_TO_INT` - IEEE754 floating point to integer conversion of `src` expression
+* `HLIL_INT_TO_FLOAT` - Integer to IEEE754 floating point conversion of `src` expression
+* `HLIL_FLOAT_CONV` - Convert bytes in `src` expression to IEEE754 floating point
+* `HLIL_ROUND_TO_INT` - Rounds the IEEE754 floating point number `src` expression
+* `HLIL_FLOOR` - Computes the floating point floor of the IEEE754 number in `src`
+* `HLIL_CEIL` - Computes the floating point floor of the IEEE754 number in `src`
+* `HLIL_FTRUNC` - Computes the floating point truncation of the IEEE754 number in `src`
+* `HLIL_SX` - Sign extends the `src` expression
+* `HLIL_ZX` - Zero extends the `src` expression
+* `HLIL_ADD_OVERFLOW` - Calculates overflow of the addition of `left` expression with `right` expression
+* `HLIL_BOOL_TO_INT` - Converts a bool `src` to an integer
+
+### Comparison Instructions
+
+* `HLIL_CMP_E` - Compare expression evaluates to true if `left` expression is equal to `right`
+* `HLIL_CMP_NE` - Compare expression evaluates to true if `left` expression is not equal to `right`
+* `HLIL_CMP_SLT` - Compare expression evaluates to true if `left` expression is signed less than `right`
+* `HLIL_CMP_ULT` - Compare expression evaluates to true if `left` expression is unsigned less than `right`
+* `HLIL_CMP_SLE` - Compare expression evaluates to true if `left` expression is signed less than or equal to `right`
+* `HLIL_CMP_ULE` - Compare expression evaluates to true if `left` expression is unsigned less than or equal to `right`
+* `HLIL_CMP_SGE` - Compare expression evaluates to true if `left` expression is signed greater than or equal to `right`
+* `HLIL_CMP_UGE` - Compare expression evaluates to true if `left` expression is unsigned greater than or equal to `right`
+* `HLIL_CMP_SGT` - Compare expression evaluates to true if `left` expression is signed greater than `right`
+* `HLIL_CMP_UGT` - Compare expression evaluates to true if `left` expression is unsigned greater than `right`
+* `HLIL_TEST_BIT` - Test if bit `right` in expression `left` is set
+* `HLIL_FCMP_E` - Floating point compare expressions - evaluates to true if `left` expression is equal to `right`
+* `HLIL_FCMP_NE` - Floating point compare expressions - evaluates to true if `left` expression is not equal to `right`
+* `HLIL_FCMP_LT` - Floating point compare expressions - evaluates to true if `left` expression is less than `right`
+* `HLIL_FCMP_LE` - Floating point compare expressions - evaluates to true if `left` expression is less than or equal to `right`
+* `HLIL_FCMP_GE` - Floating point compare expressions - evaluates to true if `left` expression is greater than or equal to `right`
+* `HLIL_FCMP_GT` - Floating point compare expressions - evaluates to true if `left` expression is greater than `right`
+* `HLIL_FCMP_O` - Floating point compare expressions - evaluates to true if both `left` and `right` expressions are ordered (not NaN)
+* `HLIL_FCMP_UO` - Floating point compare expressions - evaluates to true if either `left` or `right` expression is unordered (NaN)
+
+### Miscellaneous Instructions
+
+* `HLIL_NOP` - No operation
+* `HLIL_BP` - Breakpoint instruction
+* `HLIL_TRAP` - Interrupt/trap instruction with `vector` expression
+* `HLIL_INTRINSIC` - Intrinsic instruction defined by the architecture
+* `HLIL_UNDEF` - The expression performs undefined behavior
+* `HLIL_UNIMPL` - The expression is not implemented
+* `HLIL_UNIMPL_MEM` - The expression is not implemented but does access `src` memory
+* `HLIL_BLOCK` -
+* `HLIL_LABEL` -
+* `HLIL_UNREACHABLE` - \ No newline at end of file
diff --git a/docs/dev/bnil-llil.md b/docs/dev/bnil-llil.md
index df520e4e..97ce11bc 100644
--- a/docs/dev/bnil-llil.md
+++ b/docs/dev/bnil-llil.md
@@ -1,6 +1,6 @@
# Binary Ninja Intermediate Language: Low Level IL
-Make sure to checkout the [BNIL overview](bnil-overview.md) first if you haven't already. Or feel free to skip to [part 2](bnil-mlil.md) which covers MLIL. This developer guide is intended to cover some of the mechanics of the LLIL to distinguish it from the other ILs in the BNIL family.
+Make sure to checkout the [BNIL overview](bnil-overview.md) first if you haven't already. Or feel free to skip to [part 2](bnil-mlil.md) which covers MLIL, or [part 3](bnil-hlil.md) which covers HLIL. This developer guide is intended to cover some of the mechanics of the LLIL to distinguish it from the other ILs in the BNIL family.
If you've already read the introduction, let's get right into the details of LLIL!
@@ -12,11 +12,11 @@ The Lifted IL is very similar to the LLIL and is primarily of interest for Archi
Since doing is the easiest way to learn let's start with a simple example binary and step through analyzing it using the python console.
-![Low Level IL Option >](../img/llil_option.png)
+![Low Level IL Option >](../img/llil-option.png)
- Download [chal1](../files/chal1) and open it with Binary Ninja
- - Next, bring up the `Low Level IL` view by clicking in the options pane at the bottom of the screen
- (or alternatively, use the `i` key)
+ - Next, bring up the `Low Level IL` view by clicking in the view drop down at the top of the pane
+ (or alternatively, use the `i` key to cycle view levels)
- Navigate to main (`g`, then "main", or double-click it in the function list)
- Finally, bring up the python console using: `~`
@@ -38,7 +38,7 @@ This will print out all the LLIL instructions in the current function. How does
First we use the global magic variable `current_function` which gives us the python object [`function.Function`](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function) for whatever function is currently selected in the UI. The variable is only usable from the python console, and shouldn't be used for headless plugins. In a script you can either use the function that was passed in if you [registered your plugin](https://api.binary.ninja/binaryninja.plugin-module.html#binaryninja.plugin.PluginCommand.register_for_function) to handle functions, or you can compute the function based on [a specific address](https://api.binary.ninja/binaryninja.binaryview-module.html?highlight=get_functions_at#binaryninja.binaryview.BinaryView.get_functions_at), or maybe even just iterate over all the functions in a BinaryView (`for func in bv.functions:`).
-Next we get the [`lowlevelil.LowLevelILFunction`](http://api.binary.ninja/binaryninja.lowlevelil.LowLevelILFunction.html) from the `Function` class: `current_function.low_level_il`. Iterating over the `LowLevelILFunction` class provides access to the [`lowlevelil.LowLevelILBasicBlock`](http://api.binary.ninja/binaryninja.lowlevelil.LowLevelILBasicBlock.html) classes for this function. Inside the loop we can now iterate over the `LowLevelILBasicBlock` class which provides access to the individual [`lowlevelil.LowLevelILInstruction`](http://api.binary.ninja/binaryninja.lowlevelil.LowLevelILInstruction.html) classes.
+Next we get the [`lowlevelil.LowLevelILFunction`](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILFunction) from the `Function` class: `current_function.low_level_il`. Iterating over the `LowLevelILFunction` class provides access to the [`lowlevelil.LowLevelILBasicBlock`](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILBasicBlock) classes for this function. Inside the loop we can now iterate over the `LowLevelILBasicBlock` class which provides access to the individual [`lowlevelil.LowLevelILInstruction`](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILInstruction) classes.
Finally, we can print out the attributes of the instruction. We first print out `address` which is the address of the corresponding assembly language instruction. Next, we print the `instr_index`, this you can think of as the address of the IL instruction. Since translating assembly language is a many-to-many relationship, we may see multiple IL instructions needed to represent a single assembly language instruction, and thus each IL instruction needs to have its own index separate from its address. Finally, we print out the instruction text.
diff --git a/docs/dev/bnil-mlil.md b/docs/dev/bnil-mlil.md
index ee7c1d91..bdade82c 100644
--- a/docs/dev/bnil-mlil.md
+++ b/docs/dev/bnil-mlil.md
@@ -24,7 +24,7 @@ In the rest of this article we will explore the variable object, the type object
## The Variable Object
-First, it's important to understand what we mean when we talk about a MLIL variable. Continuing from our example above we can get a [`Variable`](https://api.binary.ninja/binaryninja.function.Variable.html) object.
+First, it's important to understand what we mean when we talk about a MLIL variable. Continuing from our example above we can get a [`Variable`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.Variable) object.
```
>>> inst.output
@@ -36,7 +36,7 @@ First, it's important to understand what we mean when we talk about a MLIL varia
Variables in MLIL have a very specific meaning, that is not completely obvious at first. They represent a single storage location within the scope of a single function. To those not well versed in program analysis, a storage location is where a value is located at a given point in time. In the process of compilation a compiler conducts a step called _Register Allocation_; this is the process of figuring out how to map the potentially infinite number of variables specified in the original source code to a finite set of registers. When there are more variables and intermediate values than registers available, the compiler _spills_ them on to the stack. Thus a single high-level-language variable can be mapped across a number of storage locations. A variable can simultaneously be in multiple registers and on the stack at the same time. However, unlike high-level-language variables, MLIL variables represent one and only one storage location. Binary Ninja's High Level IL (HLIL) will be responsible for storing this mapping.
-So let's look at the properties available on a [`Variable`](https://api.binary.ninja/binaryninja.function.Variable.html) object.
+So let's look at the properties available on a [`Variable`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.Variable) object.
### `source_type`
@@ -59,7 +59,7 @@ enum VariableSourceType
### `storage`
-The `storage` property changes meaning depending on the [`VariableSourceType`](https://api.binary.ninja/binaryninja.enums.VariableSourceType.html). When a variable is of type `RegisterVariableSourceType`, its `storage` property represents the index into the register list for the given architecture. If the `source_type` is `StackVariableSourceType`, its `storage` property represents the stack offset of the variable.
+The `storage` property changes meaning depending on the [`VariableSourceType`](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.VariableSourceType). When a variable is of type `RegisterVariableSourceType`, its `storage` property represents the index into the register list for the given architecture. If the `source_type` is `StackVariableSourceType`, its `storage` property represents the stack offset of the variable.
```
>>> var
@@ -95,7 +95,7 @@ Type objects are described in detail in the next section.
## The Type Object
-Type objects are very similar to standard C types. A Type object's type can be determined through the object’s `type_class` property. Valid types are in the [`TypeClass`](https://api.binary.ninja/binaryninja.enums.TypeClass.html) enumeration:
+Type objects are very similar to standard C types. A Type object's type can be determined through the object’s `type_class` property. Valid types are in the [`TypeClass`](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.TypeClass) enumeration:
```
enum TypeClass
@@ -168,7 +168,7 @@ A value type is simply a constant value. It is used mainly in demangling for typ
### FunctionTypeClass
-The function type describes the return type, parameter list, and calling convention of a [function](https://api.binary.ninja/binaryninja.function.Function.html), among many other properties.
+The function type describes the return type, parameter list, and calling convention of a [function](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function), among many other properties.
* `can_return` - boolean value indicating if the function can return
* `calling_convention` - the calling convention this function uses
@@ -193,7 +193,7 @@ Array types function similarly to pointer types however the array type knows how
### EnumerationTypeClass
-`Enumeration` types function much the same way they do in C, providing a mapping between a name and corresponding constant. The object itself contains a `members` property and a list of [`EnumerationMember`](https://api.binary.ninja/binaryninja.types.EnumerationMember.html) objects each containing a name and value.
+`Enumeration` types function much the same way they do in C, providing a mapping between a name and corresponding constant. The object itself contains a `members` property and a list of [`EnumerationMember`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.EnumerationMember) objects each containing a name and value.
### StructureTypeClass
@@ -219,7 +219,7 @@ Most of the above should be self-explanatory except for the `UnknownNamedTypeCla
## The Instruction Set
-The instruction set is made up of [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil.MediumLevelILInstruction.html) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an MLIL instruction:
+The instruction set is made up of [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an MLIL instruction:
```
>>> inst = current_mlil[8]
@@ -230,7 +230,7 @@ The instruction set is made up of [`MediumLevelILInstruction`](https://api.binar
`current_mlil` is mapped to whatever function is currently being viewed and is not generally available to those writing plugins, as your plugin could be headless. The bracket operators tell the API to get the MLIL instruction at index 8 for the current function.
-There are a number of properties that can be queried on the [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil.MediumLevelILInstruction.html) object, and the validity of these properties changes depending on what the current operation is. If we look at the `operation` of `inst` we can see it is a `MLIL_CALL` instruction.
+There are a number of properties that can be queried on the [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction) object, and the validity of these properties changes depending on what the current operation is. If we look at the `operation` of `inst` we can see it is a `MLIL_CALL` instruction.
```
>>> inst.operation
diff --git a/docs/dev/bnil-overview.md b/docs/dev/bnil-overview.md
index 480b9873..b0ffefe2 100644
--- a/docs/dev/bnil-overview.md
+++ b/docs/dev/bnil-overview.md
@@ -12,7 +12,7 @@ Except that overview isn't telling the whole story! The real stack of BNIL _actu
![BNIL-Stack](../img/BNIL.png)
-This short introduction is a very brief guide to BNIL with much more details in [Part 1: LLIL](bnil-llil.md) and [Part 2: MLIL](bnil-mlil.md).
+This short introduction is a very brief guide to BNIL with much more details in [Part 1: LLIL](bnil-llil.md), [Part 2: MLIL](bnil-mlil.md), and [Part 3: HLIL](bnil-hlil.md).
## Summary
@@ -20,10 +20,10 @@ While the image above shows a bit of the logical relationships between each IL i
- Lifted IL is intended to be a straight-forward translation from native instruction semantics to LLIL instructions. Note that Lifted IL and LLIL share the same instructions and are substantively similar with a few small differences.
- Low Level IL (LLIL) is converted from Lifted IL, LLIL removes NOP instructions and folds flags into conditional instructions but otherwise contains the same operations as Lifted IL.
-- Low Level IL SSA Form is an [SSA](conceps.md#static-single-assignment-basics) form of LLIL.
+- Low Level IL SSA Form is an [SSA](concepts.md#static-single-assignment-basics) form of LLIL.
- Mapped Medium Level IL is a translation layer between LLIL that is rarely needed for analysis but is useful for the translation process.
- Medium Level IL (MLIL) translates registers and memory accesses into variables, types are associated with variables, platform information is used to generate call sites with types (both inferred and explicit) and parameters, data flow is calculated and constants are propagated.
-- Medium Level IL SSA Form is an [SSA](conceps.md#static-single-assignment-basics) form of MLIL.
+- Medium Level IL SSA Form is an [SSA](concepts.md#static-single-assignment-basics) form of MLIL.
- High Level IL (HLIL) [builds on](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function.request_debug_report) (use the `high_level_il` report type) MLIL by adding higher level control flow instructions, a number of dead-code and variable passes as well as other simplification/folding. It also includes an [AST](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction.ast).
@@ -117,7 +117,7 @@ Here's what that instruction might look like when selected with the IL Hierarchy
Be warned though! HLIL in particular is very tree-based. LLIL and MLIL are much safer to use the above paradigm of simply iterating through top-level instructions.
-Make sure to also check out the specifics of each IL level for more details: [LLIL](https://docs.binary.ninja/dev/bnil-llil.html), [MLIL](https://docs.binary.ninja/dev/bnil-mlil.html) (HLIL not yet complete)
+Make sure to also check out the specifics of each IL level for more details: [LLIL](bnil-llil.md), [MLIL](bnil-mlil.md), [HLIL](bnil-hlil.md)
## Visitors
diff --git a/docs/dev/concepts.md b/docs/dev/concepts.md
index 5dcf0a3a..daf120b1 100644
--- a/docs/dev/concepts.md
+++ b/docs/dev/concepts.md
@@ -1,12 +1,5 @@
# Important Concepts
-## Mapping between ILs
-
-ILs in general are critical to how Binary Ninja analyzes binaries and we have much more [in-depth](bnil-overview.md) documentation for BNIL (or Binary Ninja Intermediate Language -- the name given to the family of ILs that Binary Ninja uses). However, one important concept to summarize here is that the translation between each layer of IL is many-to-many. Going from disassembly to LLIL to MLIL can result in more or less instructions at each step. Additionally, at higher levels, data can be copied, moved around, etc. You can see this in action in the UI when you select a line of HLIL and many LLIL or disassembly instructions are highlighted.
-
-APIs that query these mappings are plural. So for example, while `current_hlil.llil` will give a single mapping, `current_hlil.llils` will return a list that may contain multiple mappings.
-
-![Mapping between ILs ><](../img/ilmapping.png "Mapping between ILs")
## REPL versus Scripts
@@ -24,15 +17,29 @@ Another difference in the REPL / scripting console is that the scripting console
![Scriping Console ><](../img/console.png "Python Scripting Console")
-## Operating on IL versus Native
+## Auto vs User
+
+In the Binary Ninja API, there are often two parallel sets of functions with `_auto_` and `_user_` in their names. For example: [add_user_segment](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.add_user_segment) and [add_auto_segment](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.add_auto_segment). So what's the difference? Auto functions are those that are expected to be run _automatically_, every time the file is loaded. So for example, if you're writing a [custom file loader](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/nsf.py) that will parse a particular binary format, you would use `_auto_` functions because each time the file is opened your loader will be used. The results of auto functions are **not** saved in a `.bndb` database because it's expected that whatever produced them originally will again when the file is re-opened or analyzed. This means that even if you're writing a plugin to make changes on a file during analysis, you likely want to use the `_user_` set of APIs so that the changes your plugin causes will separately be saved to the database as if they were done by a user.
+
+## Concepts for ILs
+
+### Mapping between ILs
+
+ILs in general are critical to how Binary Ninja analyzes binaries and we have much more [in-depth](bnil-overview.md) documentation for BNIL (or Binary Ninja Intermediate Language -- the name given to the family of ILs that Binary Ninja uses). However, one important concept to summarize here is that the translation between each layer of IL is many-to-many. Going from disassembly to LLIL to MLIL can result in more or less instructions at each step. Additionally, at higher levels, data can be copied, moved around, etc. You can see this in action in the UI when you select a line of HLIL and many LLIL or disassembly instructions are highlighted.
+
+APIs that query these mappings are plural. So for example, while `current_hlil.llil` will give a single mapping, `current_hlil.llils` will return a list that may contain multiple mappings.
+
+![Mapping between ILs ><](../img/ilmapping.png "Mapping between ILs")
+
+### Operating on IL versus Native
Generally speaking, scripts should operate on ILs. The available information far surpasses the native addresses and querying properties and using APIs almost always beats directly manipulating bytes. However, when it comes time to change the binary, there are some operations that can only be done at a simple virtual address. So for example, the [comment](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.set_comment_at) or [tag](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.add_tag) APIs (among others) work off of native addressing irrespective of IL level.
-## Instruction Index vs Expression Index
+### Instruction Index vs Expression Index
It is easy to confuse ExpressionIndex and InstructionIndex properties in the API. While they [are both integers](https://github.com/Vector35/binaryninja-api/blob/dev/python/highlevelil.py#L49-L50) they mean different things and it's important to keep them straight. The Instruction Index is a unique index for that given IL level for that given function. However, because BNIL is [tree-based](bnil-overview.md), when there are nested expresses the expression index may be needed. These indexes are also unique per-function and per-IL level, but they are _distinct_ from instruction indexes even though they may occasionally be similar since they each start at 0 for a given function!
-## Static Single Assignment Basics
+### Static Single Assignment Basics
Our [BNIL Overview](bnil-overview.md) mentions Static Single Assignment (SSA) without explaining what it is. You can of course always check out [Wikipedia](https://en.wikipedia.org/wiki/Static_single-assignment_form), but here's a quick summary of what it is, why we expose multiple SSA forms of our ILs and how you can use it to improve your plugin writing with BNIL.
@@ -86,4 +93,39 @@ One reason that having an "end" might be useful in a function (as opposed to the
So how do you tell Binary Ninja how big a function is? The answer is you don't directly, but you can instead direct its analysis. For example, if a function is improperly not marked as a noreturn function, edit the function properties via the right-click menu and set the property and all calls to it will end analysis at that point in any callees.
-Likewise, you can do things like change memory permissions, patch in invalid instructions, [change an indirect branch's targets](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/jump_table.py), or use [UIDF](https://binary.ninja/2020/09/10/user-informed-dataflow.html) to influence analysis such that it ends where desired. \ No newline at end of file
+Likewise, you can do things like change memory permissions, patch in invalid instructions, [change an indirect branch's targets](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/jump_table.py), or use [UIDF](https://binary.ninja/2020/09/10/user-informed-dataflow.html) to influence analysis such that it ends where desired.
+
+## Working with Strings
+
+### Unicode Support
+
+If you're opening a file with non-ascii string encodings, make sure to use one of the "open with options" [methods](../guide/index.md#loading-files) and choose the appropriate code pages. These settings are under the `analysis` / `unicode` section of the settings dialog. If you're not sure which code page you should be enabling, consider using a library like [chardet](https://chardet.readthedocs.io/en/latest/usage.html). For example, here's a file both with and without the "CJK Unified Ideographs" block being enabled:
+
+![Sample Binary Without CJK Unified Ideographs](../img/hanyu-no-codepage.png "Sample Binary Without CJK Unified Ideographs")
+
+![Sample Binary With CJK Unified Ideographs](../img/hanyu-with-codepage.png "Sample Binary With CJK Unified Ideographs")
+
+???+ Warning "Tip"
+ Note that there is a small bug and some string length calculations will be off with certain characters as shown above.
+
+### Wide Strings in the UI
+
+Many Windows applications use wide (UTF-16 or UTF-32) strings. By default these should be identified during initial string analysis as long as the default settings are still enabled.
+
+![Unicode settings](../img/unicode-settings.png "Unicode Settings")
+
+However, you can always change a variable to a `wchar_t` with `[SHIFT] a` and to a `wchar32_t` with `[CTRL-SHIFT] a` in the UI.
+
+### "Strings" versus Strings
+
+The strings view in Binary Ninja are based on all identified strings found in a manner similar to the command-line "strings" tool (with `-a` if you're using a GPL Binutils version). However, this is not the same as a string having a string type in Binary Ninja!
+
+Several settings under analysis limits are relevant to identifying these strings:
+
+ - Maximum String Length: The maximum string length that will be copied (defaults to 16384)
+ - Minimum String Length: The minimum string length for strings created during auto-analysis (defaults to 4)
+ - Maximum String Search: Maximum number of strings before string identification halts (defaults to 1048576)
+
+### Custom String Formats
+
+There is currently no support for custom types with different encoding mechanisms. Follow [#1334](https://github.com/Vector35/binaryninja-api/issues/1334) for more updates on when that feature is added. That said, it is possible to use a custom [DataRenderer](https://api.binary.ninja/binaryninja.datarender-module.html#binaryninja.datarender.DataRenderer) to improve the rendering using a custom type, but those strings will still not show up in the strings list or when included as variables in decompilation, only in linear view. \ No newline at end of file
diff --git a/docs/dev/cookbook.md b/docs/dev/cookbook.md
index 61cd6386..abd1a089 100644
--- a/docs/dev/cookbook.md
+++ b/docs/dev/cookbook.md
@@ -7,31 +7,110 @@ One of the best ways to learn a complicated API is to simply find the right exam
- [Gist Collection](https://gist.github.com/psifertex/6fbc7532f536775194edd26290892ef7): Jordan's collection of python examples usually created for (or contributed by) customers
- [Offline examples](https://github.com/Vector35/binaryninja-api/tree/dev/python/examples): These examples are especially useful because they're included in your offline install as well, just look in the examples/python subfolder wherever Binary Ninja installed
- That said, most of those examples tend to be more complex and so the following recipes are meant to be simple but useful building-blocks with which to learn useful techniques:
+ That said, most of those examples tend to be more complex and so the following recipes are meant to be simple but useful building-blocks with which to learn useful techniques. Many of them also make use of the built-in Python console's [magic variables](../guide/index.md#magic-console-variables):
## Recipes
-### Accessing cross references
+#### Getting all functions in a binary
-This recipe is useful for iterating over all of the HLIL cross-references of a given interesting function:
+```python
+for func in bv.functions:
+ print(func.name)
+ print(func.start)
+ print(func.parameter_vars)
+ print(func.function_type)
+```
+
+#### Getting a specific function
```python
-for ref in current_function.caller_sites:
- print(ref.hlil)
+func = bv.get_functions_by_name(here)[0] # Multiple functions can share the same name!
+func = bv.get_function_at(here) # Shortcut for the next one
+func = bv.get_functions_at(here)[0] # Binary Ninja support functions that overlap!
+func = bv.get_function_containing(here) # Functions that contain the given address
+# Just a note that using address to work with functions is fine
+# But when working with ILs, addresses are approximate and can change for any given instruction
```
-But what if you don't have that function yet?
+#### All forms of a function:
+
+```python
+for func in bv.functions:
+ low_level_il = func.llil
+ low_level_il_ssa = func.llil.ssa_form
-### Getting a function by name
+ medium_level_il = func.mlil
+ medium_level_il_ssa = func.mlil.ssa_form
+
+ # Decompilation:
+ high_level_il = func.hlil
+ high_level_il_ssa = func.hlil.ssa_form
+
+ base_function = <any>_level_il.source_function # Some helpers are only on the base function object!
+```
+
+#### All decompiled instructions in a binary
```python
-bv.get_functions_by_name('_start')
+for func in bv.functions:
+ for inst in func.hlil.instructions:
+ print(f"{inst.address} : {inst}")
```
-### Finding the function with the most bytes
+or
```python
-max(bv.functions, key=lambda x: x.total_bytes)
+for func in bv.functions:
+ for bb in func.hlil:
+ for inst in bb:
+ print(f"{inst.address} : {inst}")
+```
+
+or
+
+```python
+for inst in bv.hlil_instructions:
+ print(f"{inst.address} : {inst}")
+```
+
+#### Getting the decompiled instruction at an address
+
+```python
+func = bv.get_functions_containing(here)[0] # You should probably be more robust than this
+llil_inst = func.get_llil_at(here) # LLIL have the "closest" mapping to actual addresses, but you should still consider this volatile/fuzzy
+hlil_inst = llil_inst.hlil # This is also very approximate
+
+# What's "more correct" walking down instead:
+hlil_inst.mlil # Approximate "direct" mapping down
+hlil_inst.mlils # All mlil instructions that contributed to this hlil instruction - most correct!
+hlil_inst.llil # Approximate "direct" mapping down
+hlil_inst.llils # All llil instructions that contributed to this hlil instruction - most correct!
+# Be careful when working with address and mappings! We try to make them work as well as possible
+# (and in most cases using the direct mapping is _fine_)
+# But you should always be aware that they are approximate and can change!
+```
+
+
+#### All callers of a function
+
+```python
+current_function.callers
+```
+
+#### All locations where a function is called
+
+```python
+for site in current_function.caller_sites:
+ addr = site.address
+ inst = site.hlil
+```
+
+#### All calls and call instructions in a function:
+
+```python
+for site in current_function.call_sites:
+ addr = site.address
+ inst = site.hlil
```
### Finding the most "connected" function
@@ -42,6 +121,12 @@ As defined by having the highest sum of incoming and outgoing calls. Adjust acco
max(bv.functions, key=lambda x: len(x.callers + x.callees))
```
+### Finding the largest function (by most bytes)
+
+```python
+max(bv.functions, key=lambda x: x.total_bytes)
+```
+
### Querying possible values of a function parameter
Is that memcpy length a bit too big?
@@ -67,6 +152,64 @@ Make sure to check out the much more in-depth [applying annotations](annotation.
current_function.type = Type.function(Type.void(), [])
```
+### Accessing cross references
+
+This recipe is useful for iterating over all of the HLIL cross-references of a given interesting function:
+
+```python
+for ref in current_function.caller_sites:
+ print(ref.hlil)
+```
+
+#### Common variable APIs
+
+```python
+for func in bv.functions:
+ all_vars = func.vars # This isn't the most meaningful thing to do, because....
+ hlil_vars = func.hlil.vars # ...you probably only want the variables used in the IL you're looking at
+ hlil_aliased_vars = func.hlil.aliased_vars # ...but don't forget about aliased variables!
+ parameter_vars = func.parameter_vars # ...or parameter variables!
+
+ var = hlil_vars[0]
+ if var.source_type == StackVariableSourceType:
+ print(var.storage) # var.storage is the variables stack offset, but ONLY IF the source type is `StackVariableSourceType`
+
+ # There are many ways to *estimate* the size of a variable on the stack
+ print(var.offset_to_next_variable) # Distance to the next variable that Binary Ninja has identified on the stack
+ print(abs(var.storage)) # Absolute maximum size the variable can be until it overwrites the saved return pointer!
+ print(abs(var.type.width)) # If Binary Ninja gave the variable a type, or you manually applied a type, then you can get the size from that type
+
+ # SSA
+ hlil_ssa_vars = func.hlil.ssa_vars # You can also get ssa variables
+ def_inst = func.hlil.ssa_form.get_ssa_variable_definition(ssa_vars[0]) # But if you want definitions, you need to use the ssa form
+ use_insts = func.hlil.ssa_form.get_ssa_variable_uses(ssa_vars[0]) # There's only ever one ssa definition, but potentially many uses
+```
+
+#### Working with Tags
+
+```python
+# Data tags
+bv.add_tag(here, "Crashes", "Description")
+
+# Function tags
+current_function.add_tag("Important", "Look at this later!")
+
+# Function address tags
+current_function.add_tag("Bug", "I think there's an overflow here?", here)
+```
+
+#### Logging
+
+```python
+log.log_debug("Debug logs are hidden by default")
+log.log_info("Info logs are displayed in the console")
+log.log_warn("Warning logs will print in yellow text")
+log.log_error("Errors are red!")
+log.log_alert("This pops up a dialogue box!")
+
+log.log_error("You can add your own filter group easily to any of these APIs", "My Log Group")
+```
+
### Find a variable's definition and all uses using SSA
```python
diff --git a/docs/dev/flags.md b/docs/dev/flags.md
index 2aabd244..e87c6a2d 100644
--- a/docs/dev/flags.md
+++ b/docs/dev/flags.md
@@ -182,9 +182,9 @@ This also means that you can mark instructions as producers of a group of many f
You, the architecture author:
* inform Binja of your architecture's flags by defining:
- * flag names
- * flag "roles" which are just their textbook behavior, if they qualify
- * flag "write types" which groups of flags often set together
+ * flag names
+ * flag "roles" which are just their textbook behavior, if they qualify
+ * flag "write types" which groups of flags often set together
* assign instructions as flag **producers** by passing `flag=` keyword parameter during lifting
* assign instructions as flag **consumers** by passing IL flag expressions as operands during lifting
diff --git a/docs/dev/index.md b/docs/dev/index.md
index d9abcde6..7407d7bb 100644
--- a/docs/dev/index.md
+++ b/docs/dev/index.md
@@ -1,6 +1,6 @@
# Using the Binary Ninja API
-Welcome to the Binary Ninja API documentation. Much like the [User Manual](../guide/index.md), some larger sections have been split off into their own sections on the left, while the table of contents for this documentation is on the right.
+Welcome to the Binary Ninja API documentation. Much like the [User Guide](../guide/index.md), some larger sections have been split off into their own sections on the left, while the table of contents for this documentation is on the right.
## Language Specific Bindings
@@ -34,5 +34,5 @@ The C++ API is what the Binary Ninja UI itself is built using so it's a robust a
The Rust API is still experimental and lacks complete coverage for all core APIs. Documentation is available at:
- - [Rust API](https://github.com/Vector35/binaryninja-api/tree/dev/rust)
+ - [Rust API](https://dev-rust.binary.ninja/)
diff --git a/docs/dev/plugins.md b/docs/dev/plugins.md
index 79a39982..f489f94b 100644
--- a/docs/dev/plugins.md
+++ b/docs/dev/plugins.md
@@ -206,7 +206,7 @@ class, and you should only ever handle Refs or bare pointers. When in doubt, fee
Managing build infrastructure to build cross-platform native plugins can be a headache even for stables, let alone
trying to track all dev releases. To help with that, we've published an [example plugin](https://github.com/CouleeApps/binja-ci-tests) that includes GitHub
-actions to build on MacOS, Linux, and Windows. Combining this with something like a [plugin loader](https://github.com/rikodot/binja_native_plugin_loader) can simplify
+actions to build on MacOS, Linux, and Windows. Combining this with something like a [plugin loader](https://github.com/rikodot/binja_native_sigscan_loader) can simplify
both publishing and using native plugins.
### UI Plugins
diff --git a/docs/dev/themes.md b/docs/dev/themes.md
index 1c2931ed..0f2b7caf 100644
--- a/docs/dev/themes.md
+++ b/docs/dev/themes.md
@@ -1,4 +1,4 @@
-User themes are loaded from JSON files (with the `.bntheme` extension) found in the `themes` or `community-themes` subdirectories of your [user folder](../guide/index.md#user-folder). The default, full path to these folders is the following on each supported platform:
+User themes are loaded from JSON files (with the `.bntheme` extension) found in the `themes` or `community-themes` (consider cloning the [community themes repo](https://github.com/Vector35/community-themes)) subdirectories of your [user folder](../guide/index.md#user-folder). The default, full path to these folders is the following on each supported platform:
- macOS: `~/Library/Application Support/Binary Ninja/{themes,community-themes}`
- Windows: `%APPDATA%\Binary Ninja\{themes,community-themes}`
@@ -110,37 +110,33 @@ Colors marked "*required*" must be specified. Unmarked colors will hold default
#### Tokens
-![Tokens Diagram](../img/themedocs-tokens.png)
+![Tokens Theme Diagram](../img/themes-tokens.png)
-1. `addressColor` (*required*) - Used to color memory addresses, e.g. `0x100003c5b`
-2. `modifiedColor` (*required*)
-3. `insertedColor` (*required*)
-4. `notPresentColor` (*required*)
-5. `selectionColor` (*required*)
-6. `outlineColor` (*required*)
-7. `registerColor` (*required*) - Used to color register names in code views, e.g. `rax`
-8. `numberColor` (*required*) - Used to color number literals in code view, e.g. `0xf0`
-9. `codeSymbolColor` (*required*) - Used to color local function names in code views, e.g. `sub_100003c50`
-10. `dataSymbolColor` (*required*) - Used to color data symbols in code views, e.g. `data_100003e2c`
-11. `stackVariableColor` (*required*) - Used to color stack variables in code views, e.g `var_8`
-12. `importColor` (*required*) - Used to color imported function names in code views, e.g. `printf`
-13. `instructionHighlightColor` (*required*)
-14. `relatedInstructionHighlightColor`
-15. `tokenHighlightColor` (*required*)
-16. `annotationColor` (*required*) - Used to color annotations, such as hints
-17. `commentColor` - Used to color comments
-18. `opcodeColor` (*required*) - Used to color instruction opcodes in code views
-19. `stringColor` (*required*) - Used to color string literals in code views, e.g. `"Hello, world!"`
-20. `typeNameColor` (*required*) - Used to color user-defined type names in code views, e.g. `my_struct`
-21. `fieldNameColor` (*required*) - Used to color structure member names in code views
-22. `keywordColor` (*required*) - Used to color keywords in code views, e.g. `for` in HLIL
-23. `uncertainColor` (*required*) - Used to color uncertain data in code views, such as variable types with low confidence
-24. `exportColor`
-25. `nameSpaceColor`
-26. `nameSpaceSeparatorColor`
-27. `operationColor`
-28. `gotoLabelColor`
-29. `tokenSelectionColor`
+1. `addressColor` (*required*) - Used to color memory address tokens (e.g. `0x100003c5b`)
+2. `registerColor` (*required*) - Used to color register names (e.g. `rax`)
+3. `numberColor` (*required*) - Used to color number literals (e.g. `0xf0`)
+4. `codeSymbolColor` (*required*) - Used to color local function names (e.g. `sub_100003c50`)
+5. `dataSymbolColor` (*required*) - Used to color data symbols (e.g. `data_100003e2c`)
+6. `stackVariableColor` (*required*) - Used to color stack variables (e.g `var_8`)
+7. `importColor` (*required*) - Used to color imported function names (e.g. `printf`)
+8. `annotationColor` (*required*) - Used to color annotations (e.g. hints), not shown in picture above
+9. `commentColor` - Used to color code comments
+10. `opcodeColor` (*required*) - Used to color instruction opcodes (e.g. `ebfe`)
+11. `stringColor` (*required*) - Used to color string literals (e.g. `"Hello, world!"`)
+12. `typeNameColor` (*required*) - Used to color user-defined type names (e.g. `my_struct`)
+13. `fieldNameColor` (*required*) - Used to color structure member names
+14. `keywordColor` (*required*) - Used to color keywords (e.g. `for` in HLIL)
+15. `uncertainColor` (*required*) - Used to color uncertain data (e.g. variable types with low confidence)
+16. `exportColor` - Used to color exported symbols, not shown in picture above
+17. `nameSpaceColor` - Used to color a namespace, not shown in picture above
+18. `nameSpaceSeparatorColor` - Used to color the separator between a namespace and the rest of the symbol, not shown in picture above
+19. `operationColor` - *Currently unused*
+20. `gotoLabelColor` - Used to color a `goto`'s label, not shown in picture above
+21. `tokenSelectionColor` - Used to draw the background of tokens selected with click-and-drag
+22. `outlineColor` (*required*) - Used to draw a box around tokens selected with click-and-drag
+23. `tokenHighlightColor` (*required*) - Used to color the background of a token that has been selected with a single click or an arrow key
+24. `instructionHighlightColor` (*required*) - Used to color the background of an instruction that has been selected with a single click or an arrow key
+25. `relatedInstructionHighlightColor` - Used to color the background of instructions related to an instruction that has been selected with a single click or an arrow key
The following colors are used for the Rainbow Braces setting (`ui.rainbowBraces`):
@@ -153,20 +149,24 @@ The following colors are used for the Rainbow Braces setting (`ui.rainbowBraces`
#### Hex View
-![Hex View Diagram](../img/themedocs-hexview.png)
+![Hex View Theme Diagram](../img/themes-hex.png)
Each byte in hex view is given a background color based on its value. Values between `0x00` and `0xFF` will use a color interpolated between the `Dark` and `Light` colors specified below.
-1. `backgroundHighlightDarkColor` - Used as the background color for bytes of value `0x00`
-2. `backgroundHighlightLightColor` - Used as the background color for bytes of value `0xFF`
-3. `boldBackgroundHighlightDarkColor` (*required*)
-4. `boldBackgroundHighlightLightColor` (*required*)
-5. `alphanumericHighlightColor` (*required*) - Used to color alphanumeric characters in hex views, takes precedence over printableHighlightColor
-6. `printableHighlightColor` (*required*) - Used to color printable characters in hex views
+1. `alphanumericHighlightColor` (*required*) - Used to color bytes that are alphanumeric characters if Color Highlight/ASCII and Printable is enabled in view options (default)
+2. `printableHighlightColor` (*required*) - Used to color bytes that are non-alphanumeric printable characters if Color Highlight/ASCII and Printable is enabled in view options (default)
+3. `modifiedColor` (*required*) - Used to color bytes that have been modified if Color Highlight/Modification is enabled in view options
+4. `insertedColor` (*required*) - Used to color bytes that have been inserted if Color Highlight/Modification is enabled in view options
+5. `notPresentColor` (*required*) - Used to color bytes that do not have a value
+5. `backgroundHighlightDarkColor` (*required*) - Used as the background color for bytes of value `0x00` if Contrast/Normal is enabled in view options (default)
+6. `backgroundHighlightLightColor` (*required*) - Used as the background color for bytes of value `0xFF` if Contrast/Normal is enabled in view options (default)
+7. `boldBackgroundHighlightDarkColor` (*required*) - Used as the background color for bytes of value `0x00` if Contrast/High is enabled in view options
+8. `boldBackgroundHighlightLightColor` (*required*) - Used as the background color for bytes of value `0xFF` if Contrast/High is enabled in view options
+9. `selectionColor` (*required*) - Used as the background color on any bytes that have been selected via click-and-drag
#### Linear View
-![Linear View Diagram](../img/themedocs-linearview.png)
+![Linear View Theme Diagram](../img/themes-linear.png)
1. `linearDisassemblyFunctionHeaderColor` (*required*) - Used as the background for function
headers in linear view
@@ -179,7 +179,7 @@ Each byte in hex view is given a background color based on its value. Values bet
#### Graph View
-![Graph View Diagram](../img/themedocs-graphview.png)
+![Graph View Theme Diagram](../img/themes-graph.png)
Both the graph background and individual graph nodes are actually painted as a gradient. To get a flat background instead, set the `Dark` and `Light` colors to the same color value.
@@ -201,7 +201,7 @@ Both the graph background and individual graph nodes are actually painted as a g
#### Highlighting
-![Highlighting Diagram](../img/themedocs-highlighting.png)
+![Highlighting Theme Diagram](../img/themes-highlighting.png)
1. `blackStandardHighlightColor` (*required*)
2. `blueStandardHighlightColor` (*required*)
@@ -215,24 +215,24 @@ Both the graph background and individual graph nodes are actually painted as a g
#### Tab Bar
-1. `tabBarTabActiveColor`
-2. `tabBarTabHoverColor`
-3. `tabBarTabInactiveColor`
-4. `tabBarTabBorderColor`
-5. `tabBarTabGlowColor`
+1. `tabBarTabActiveColor` - Used to color the background of the currently active tab
+2. `tabBarTabHoverColor` - Used to color the background of any tab the mouse is currently hovering over
+3. `tabBarTabInactiveColor` - Used to color the background of any inactive tab
+4. `tabBarTabBorderColor` - Used to draw the border around the currently active tab
+5. `tabBarTabGlowColor` - Used to draw a glow or shadow around the border of the currently active tab
#### Feature Map
-1. `featureMapBaseColor`
-2. `featureMapNavLineColor`
-3. `featureMapNavHighlightColor`
-4. `featureMapDataVariableColor`
-5. `featureMapAsciiStringColor`
-6. `featureMapUnicodeStringColor`
-7. `featureMapFunctionColor`
-8. `featureMapImportColor`
-9. `featureMapExternColor`
-10. `featureMapLibraryColor`
+1. `featureMapBaseColor` - Used to color the background
+2. `featureMapNavLineColor` - Used to color the line(s) that represent where you are in the binary
+3. `featureMapNavHighlightColor` - Used as a highlight outside of the navigation line(s)
+4. `featureMapDataVariableColor` - Used to highlight any area containing data variables
+5. `featureMapAsciiStringColor` - Used to highlight any area containing ASCII strings
+6. `featureMapUnicodeStringColor` - Used to highlight any area containing Unicode strings
+7. `featureMapFunctionColor` - Used to highlight any area containing functions
+8. `featureMapImportColor` - Used to highlight any area containing imported functions that are not from a library (see below)
+9. `featureMapExternColor` - Used to highlight any area containing symbols that are externs
+10. `featureMapLibraryColor` - Used to highlight any area containing symbolic functions or functions that are imported from a library
#### Side Bar
@@ -245,11 +245,13 @@ Both the graph background and individual graph nodes are actually painted as a g
#### Mini-Graph
-1. `miniGraphOverlayColor`
+![Mini-Graph Theme Diagram](../img/themes-minigraph.png)
+
+1. `miniGraphOverlayColor` - Used to color the area of the mini graph that is currently being displayed in graph view
#### Script Console
-![Hex View Diagram](../img/themedocs-console.png)
+![Console Theme Diagram](../img/themes-console.png)
1. `scriptConsoleOutputColor` - Used to color normal output in the console
2. `scriptConsoleWarningColor` - Used to color warnings in the console
@@ -258,12 +260,20 @@ Both the graph background and individual graph nodes are actually painted as a g
#### Panes
-1. `activePaneBackgroundColor`
-2. `inactivePaneBackgroundColor`
+![Panes Theme Diagram](../img/themes-panes.png)
+
+The image above shows an active pane on the left and an inactive pane on the right.
+
+1. `activePaneBackgroundColor` - Used to color the background of a pane that is active
+2. `inactivePaneBackgroundColor` - Used to color the background of a pane that is inactive
#### Status Bar
-1. `statusBarServerConnectedColor`
-2. `statusBarServerDisconnectedColor`
-3. `statusBarServerWarningColor`
-4. `statusBarProjectColor`
+![Status Bar Theme Diagram](../img/themes-statusbar.png)
+
+The image above shows the Enterprise button in the "connected" state (connected to a server named "dev") with an open project (named "Alex's Stuff").
+
+1. `statusBarServerConnectedColor` - Used for the Enterprise button while connected to a server
+2. `statusBarServerDisconnectedColor` - Used for the Enterprise button while disconnected from a server
+3. `statusBarServerWarningColor` - Used for the Enterprise button when there is an issue with the server connection
+4. `statusBarProjectColor` - Used for the Project button
diff --git a/docs/dev/typelibraries.md b/docs/dev/typelibraries.md
new file mode 100644
index 00000000..dccb9102
--- /dev/null
+++ b/docs/dev/typelibraries.md
@@ -0,0 +1,288 @@
+## Type Libraries
+
+Type Libraries are collections of type information (structs, enums, function types, etc.) stored in a file with the extension `.bntl`.
+
+Relative to the binaryninja executable, the default type library location is `../Resources/typelib` on macOS and `./typelib` on Linux and Windows. Individual .bntl files are organized in subdirectories named for the supported architecture. Users may include their own type libraries in the `typelib` folder in their [user folder](../guide/index.md#user-folder).
+
+The information in a type library is contained in two key-value stores:
+
+1. named types: key is the type name, value is the type
+1. named objects: key is external symbol name, value is the type
+
+## How Binary Ninja Loads Type Libraries
+
+When a binary is opened, its platform is determined, all .bntl's are processed, and those matching the platform of the loaded binary are registered. A debug log will show:
+
+```
+Registered library 'libc.so.6' with platform 'linux-x86_64'
+```
+
+Then, those with either a filename or an alternative name matching the exact text of the binary's import command are imported, much like the native linker/loader. For example, in ELF, the .dynstr entry is used.
+
+```
+elf: searching for 'libc.so.6' in type libraries
+Type library 'libc.so.6' imported
+```
+
+Type libraries for linux are ideally named after their realname, preserving the library minor version from which they were generated, and the soname in the alternatives list. In practice, naming them after their soname suffices. Using the linkname with no alternatives will prevent your library from loading.
+
+This requested name should be a soname, like "libfoo.so.1" but could be a linkname like "libfoo.so". (The ldconfig tool is responsible for creating symlinks from soname to realnames, like `/usr/lib/libfoo.so.1` -> `/usr/lib/libfoo.so.1.0`. See [tldp.org](https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html) for more information.).
+
+Binary Ninja's logic for determining a match is straightforward:
+
+```
+typelibname.removesuffix('.bntl') == requestedname or requestedname in alternativenames
+```
+
+Therefore, without any alternative names, `libc.so.bntl` will not be loaded by Binary Ninja if an ELF requests libc.so.6.
+
+We recommend and use the following convention:
+
+Type libraries should be named for the filename from which they were generated with the phrase ".bntl" added. When the source library contains additional minor and release number, like `libfoo.so.1.2.3` Binary Ninja would not load the resulting type library `libfoo.so.1.2.3.bntl` for an ELF requesting soname `libfoo.so.1`. Therefore the alternative names list should include the most specific version numbers, incrementally stripped down to the soname, and finally a linkname for good measure.
+
+Example:
+
+`libfoo.so.1.2.3` is used to generated `libfoo.so.1.2.3.bntl`
+
+The alternative names list should have:
+
+```
+libfoo.so.1.2.3 <-- includes version, minor, release (most specific)
+libfoo.so.1.2 <-- includes version, minor (less specific)
+libfoo.so.1 <-- includes version (soname)
+libfoo.so <-- linkname
+```
+
+## Acquiring a Handle
+
+The platform class exposes handles to these imported type libraries with its `type_libraries` list and its `get_type_libraries_by_name()` function:
+
+```python
+>>> bv.platform.type_libraries
+[<typelib 'libm.so.6':x86_64':x86_64>, <typelib 'SYSCALLS':x86_64]
+>>> bv.platform.get_type_libraries_by_name('libm.so.6')
+[<typelib 'libm.so.6':x86_64>]
+```
+
+That requires the type library having been loaded. A more direct way is to load from a file path with the `load_from_file()` from `Typelibrary` class from `typelibrary` module:
+
+```python
+>>> typelibrary.TypeLibrary.load_from_file('/path/to/libm_x86_64.so.6.bntl')
+<typelib 'libm_x86_64.so.6':x86_64>
+```
+
+## Contents of Libraries
+
+The following demonstrates attributes of interest on a loaded type library in variable `tl`:
+
+```python
+ print(' name: %s' % tl.name)
+ print(' arch: %s' % tl.arch)
+ print(' guid: %s' % tl.guid)
+ print('dependency_name: %s' % tl.dependency_name)
+ print('alternate_names: %s' % tl.alternate_names)
+ print(' platform_names: %s' % tl.platform_names)
+
+ print(' named_objects: %d' % len(tl.named_objects))
+ for (key, val) in tl.named_objects.items():
+ print('\t"%s" %s' % (str(key), str(val)))
+
+ print(' named_types: %d' % len(tl.named_types))
+ for (key,val) in tl.named_types.items():
+ print('\t"%s" %s' % (str(key), str(val)))
+```
+
+Named objects (via dictionary `.named_objects` are functions signatures and a module's exported variables. Named types (via dictionary `.named_types`) are the textual named you might use to declare a variable. For example,
+
+For example, `.named_objects['fegetexceptionflag']` looks up its function prototype: `int32_t (fexcept_t* flagp)` and `.named_types['fexcept_t']` looks up `uint16_t`, its typedef.
+
+## Creating
+
+You may also wish to use the [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py) example script included both online and offline in your installation path.
+
+Types entered by manual entry can be exported from the binary view using `export_type_to_library()`.
+
+Manual creation is achieved by creating a new type library, associating the correct platform and architecture, adding types, finalizing, and writing to a file. Example:
+
+```python
+arch = binaryninja.Architecture['x86_64']
+
+struct = Structure()
+struct.append(Type.pointer(arch, Type.char()), 'name')
+struct.append(Type.int(4), 'age')
+struct.append(Type.int(4), 'height')
+struct.append(Type.int(4), 'weight')
+
+typelib = binaryninja.typelibrary.TypeLibrary.new(arch, 'test.so.1.4')
+typelib.add_named_type('human', binaryninja.types.Type.structure_type(struct))
+typelib.add_alternate_name('test.so.1') #don't forget this step!
+typelib.add_alternate_name('test.so')
+typelib.finalize()
+typelib.write_to_file('test.so.1.bntl')
+```
+
+## Other Type Library Questions
+
+_What's a named type vs. just a type?_
+
+Some variable definitions have type information, but don't produce a type name useful for future definitions, examples:
+
+- `enum {A=1,B=2} foo;` : foo has type with no type name (it does have a variable name)
+- `struct {int A; int B;} bar;` : bar has type with no type name
+
+In C, enum and struct definitions can create a new type name as a byproduct of a definition by using a "tag name":
+
+- `enum MyEnum {A=1,B=2} foo;` : foo has the type named `MyEnum`
+- `struct MyStruct {int A; int B;} bar;` : bar has the type named `MyStruct`
+
+In the second set of examples, the types are named, and that name could be used to declare other variables, like `enum MyEnum bar2;` and `struct MyStruct bar2`.
+
+Functions' types are not named. The function name is considered the name of a function object, and the function's type is anonymous.
+
+In summary:
+
+```c
+typedef int foo; // type:int, name:foo
+
+// structs, without and with a "tag name"
+struct {int A; int B;} foo; // type:struct{int A, intB;}, name:<anonymous>
+struct MyStruct {int A; int B;} foo; // type:struct{int A, intB;}, name:MyStruct
+
+// enumerations, without and with a "tag name"
+enum {A=1,B=2} foo; // type:enum{A=1,B=2}, name:<anonymous>
+enum MyEnum {A=1,B=2} foo; // type:enum{A=1,B=2}, name:MyEnum
+
+// functions
+int main(int ac, char **av); // type int ()(int, char **), name:<anonymous>
+typedef int (MyFunc)(int ac, char **av); // type int ()(int, char **), name:MyFunc
+
+```
+
+_How does Binary Ninja decide when to use a typelibrary (.bntl) file?_
+
+Type Libraries are loaded when the corresponding library is imported by a BinaryView. (i.e. if an exe imports `ntdll.dll`, binja will look in the bv's platform for type libraries named ntdll.bntl and load the first one it finds)
+
+_What's the difference between a named type and a named object?_
+
+A named type is a type with a name that can identify it. For example, `color` is the name of type `enum {RED=0, ORANGE=1, YELLOW=2, ...}`.
+
+A named object is the name of an external/imported symbol for which the type library has type information. For example, `MessageBoxA` is the name of a function whose type is `int ()(HWND, LPCSTR, LPCSTR, UINT)`.
+
+_How do I find what type of type a type object is? How many are there?_
+
+I've seen "types of types", "sorts of types", "kinds of types", "classes of types" used to differentiate the varieties of possible types, and there are probably more. Binary Ninja uses "class", example:
+
+```
+>>> type_obj.type_class
+<TypeClass.FunctionTypeClass: 8>
+```
+
+In [enums.py](https://api.binary.ninja/_modules/binaryninja/enums.html#TypeClass) we can see Binary Ninja currently thinks of types falling into 13 classes: `Void`, `Bool`, `Integer`, `Float`, `Structure`, `Enumeration`, `Pointer`, `Array`, `Function`, `VarArgs`, `Value`, `NamedTypeReference`, `WideCharType`.
+
+Compare this to LLDB, which also uses the term "class", and currently has 19 of them: `Array`, `BlockPointer`, `Builtin`, `Class`, `ComplexFloat`, `ComplexInteger`, `Enumeration`, `Function`, `MemberPointer`, `ObjCObject`, `ObjCInterface`, `ObjCObjectPointer`, `Pointer`, `Reference`, `Struct`, `Typedef`, `Union`, `Vector`, `Other`.
+
+Compare this to GDB, which uses the term "type code" and has 25 of them.
+
+_Where are function parameter names stored?_
+
+While technically not part of the type, having names of function parameters is very useful and can thus be optionally stored in a type.
+
+Function types (types with `.type_class == FunctionTypeClass`) have a `.parameters` attribute, a list of [`FunctionParameter`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.FunctionParameter) objects. When those objects have `.name==''` you get the bare bones function types like `int ()(int, char **)`. When those objects have their `.name` populated you get the more meaningful `int ()(int argc, char **argv)`.
+
+_How do I manually load a type library?_
+
+```
+>>> bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))
+```
+
+_How can I manually load a type object?_
+
+```
+>>> bv.import_library_object('_MySuperComputation')
+<type: int32_t (int32_t, int32_t, char*)>
+```
+
+_Why doesn't the types view show the types imported from type libraries?_
+
+Because the type libraries added to a binary view only makes their type information _available_ for use. The types view will show a type from a type library only after it is used (on demand).
+
+Try this experiment:
+
+- note `bv.type_libraries`, `bv.types`
+- add a type library with `bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))`
+- note that `bv.type_libraries` is extended, but `bv.types` is unchanged!
+- note `bv.get_type_by_name('Rectangle')` returns nothing
+- set the type of some data to `struct Rectangle` (using `y` in linear view or via any other method described above)
+- `bv.types` is extended, and the types view shows `struct Rectangle` in the auto types
+
+_What's a named type reference?_
+
+Named Type References are a way to refer to a type by name without having its declaration immediately available.
+
+For example, examine this struct from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
+
+```
+struct Rectangle2 {
+ int width;
+ int height;
+ struct Point center;
+}
+```
+
+We don't know at this moment what a `struct Point is`. Maybe we've already added it. Maybe we'll add it later. Maybe it's in another type library. But we want to add a Rectangle now. So we leave the center field as a reference to the named type `struct Point`.
+
+Load the resulting `test.bntl` in your binary and try to set some data to type `struct Rectangle2` and you'll be met with this message:
+
+```
+TypeLibrary: failed to import type 'Point'; referenced but not present in library 'libtest.so.1`
+```
+
+This makes sense! Now go to types view and `define struct Point { int x; int y; }` and try again, success!
+
+```
+100001000 struct rectangle_unresolved data_100001000 =
+100001000 {
+100001000 int32_t width = 0x5f0100
+100001004 int32_t height = 0x5f030005
+100001008 struct Point center =
+100001008 {
+100001008 int32_t x = 0x655f686d
+10000100c int32_t y = 0x75636578
+100001010 }
+100001008 }
+```
+
+You should repeat the experiment using `struct Rectangle` and see that you're allowed to create variables with type containing _pointers_ to unresolved type references.
+
+_How are types represented?_
+
+By a hierarchy of objects from [api/python/types.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/types.py) referencing one another. The "glue" object is [`binaryninja.types.Type`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Type) and depending on the complexity of the type it represents (stored in its `.type_class` attribute), it could have an attribute with more information. For instance, if the `binaryninja.types.Type` has `.type_class == FunctionTypeClass` then its `.parameters` attribute is a list of [`binaryninja.types.FunctionParameter`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.FunctionParameter). See [typelib_dump.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_dump.py) for how this can work.
+
+As an example, here is the hierarchical representation of `type struct Rectangle` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py)
+
+```
+typelib.named_types["Rectangle"] =
+----------------------------------
+Type class=Structure
+ Structure
+ StructureMember "width"
+ Type class=Integer width=4
+ StructureMember "height"
+ Type class=Integer width=4
+ StructureMember "center"
+ Type class=Pointer
+ Type class=NamedTypeReference
+ NamedTypeReference <named type: struct Point>
+```
+
+Here is the representation of `type int ()(int, int)` named `MyFunctionType` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
+
+_When do named objects get used?_
+
+When a binary is loaded and its external symbols is processed, the symbol names are searched against the named objects from type libraries. If there is a match, it obeys the type from the type library. Upon success, you'll see a message like:
+
+```
+type library test.bntl found hit for _DoSuperComputation
+```
+
+At this moment, there is no built in functionality to apply named objects to an existing Binary Ninja database.
diff --git a/docs/dev/uidf.md b/docs/dev/uidf.md
index a6422246..8a421dfa 100644
--- a/docs/dev/uidf.md
+++ b/docs/dev/uidf.md
@@ -1,8 +1,8 @@
## User Informed Data Flow
-Binary Ninja now implements User-Informed DataFlow (UIDF) to improve the static reverse engineering experience of our users. This feature allows users to set the value of a variable at the Medium-level IL layer and have the internal dataflow engine propagate it through the control-flow graph of the function. Besides constant values, Binary Ninja supports various `PossibleValueSet` states as containers to help inform complex variable values.
+Binary Ninja now implements User-Informed DataFlow (UIDF) to improve the static reverse engineering experience of our users. This feature allows users to set the value of a variable and have the internal dataflow engine propagate it through the control-flow graph of the function. Besides constant values, Binary Ninja supports various `PossibleValueSet` states as containers to help inform complex variable values.
-## Usage
+## Sample Usage
For the purpose of demonstration, we are going to use a simple [crackme](https://github.com/Vector35/uidf-example).
@@ -14,18 +14,18 @@ Let's first look at `rax_2`. We see that the conditional at Medium Level IL (MLI
First, note the definition site of `rax_2` is instruction 7 and then right click there to see "Set User Variable Value...". Users can also bind the action to a hotkey or access it via the command palette.
-![Right click options](../img/right-click-uidf.png)
+![Right click options](../img/uidf-right-click.png)
The dialog box to set the variable value contains two fields:
* `PossibleValueSet` type: `PossibleValueSet` is used to represent the values that a variable can take during analysis. This can also be representative of the values that the variable would take during concrete execution of the program. For instance if the variable value is `<const 0x0>`, it implies that the mapped register would always contain the value `0x0` during the lifetime of the variable. `UndeterminedValue` on the other hand suggests that the analysis could not figure out an appropriate value and representation in the available `PossibleValueSet`s. For the program analysis folks, this is analogous to the top of the dataflow lattice. An `EntryValue` represents the bottom. `PossibleValueSet`s provide complex container types such as `InSetOfValues`, `SignedRangeValue`, `UnsignedRangeValue`, etc.
* Value: Represents the concrete value which is to be informed to the analysis. Please refer to the parse_possiblevalueset [documentation](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.parse_possiblevalueset) for a detailed description of the parser rules for the various `PossibleValueSet`s.
-![Options when setting PossibleValueSet](../img/options-setting-uidf.png)
+![Options when setting PossibleValueSet](../img/uidf-options-setting.png)
-The parser checks if the string can be parsed into a [`PossibleValueSet`](https://api.binary.ninja/binaryninja.function.PossibleValueSet.html). The behavior of this parser is similar to the `Goto Address` dialog box or the [`parse_expression` API](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.parse_expression). This enables the use of keywords such as `$here`, `$start/$end`, etc.
+The parser checks if the string can be parsed into a [`PossibleValueSet`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.PossibleValueSethtml). The behavior of this parser is similar to the `Goto Address` dialog box or the [`parse_expression` API](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.parse_expression). This enables the use of keywords such as `$here`, `$start/$end`, etc.
-And of course, like everything else in Binary Ninja you can accomplish this using the API. `PossibleValueSet`s can be created through instantiation of the [`PossibleValueSet`](https://api.binary.ninja/binaryninja.function.PossibleValueSet.html) class or through parsing a value string:
+And of course, like everything else in Binary Ninja, you can accomplish this using the API. `PossibleValueSet`s can be created through instantiation of the [`PossibleValueSet`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.PossibleValueSet) class or through parsing a value string:
```python
>>> # Creating a PossibleValueSet object through instance creation
@@ -62,7 +62,7 @@ Let's set the value of the variable `rax_2` to `ConstantValue <0x0>`. Here's how
Looking at the binary this input should lead to "Incorrect" output. Setting the variable value automatically triggers a re-analysis of the function. This leads to a dataflow analysis pass over the function seeded with the user-informed value for that specific variable. On hovering over the variable token, we see the value that it takes is the one we informed.
-![Hover over value](../img/hover-uidf.png)
+![Hover over value](../img/uidf-hover.png)
The API makes it easy to query for the value of the conditional to check if it has been statically evaluated. We can also get a list of all the currently informed variable values through the API:
@@ -74,13 +74,24 @@ The API makes it easy to query for the value of the conditional to check if it h
>>>
```
+## Variable View Sidebar
+
+The variable sidebar also supports both setting and seeing the values of UIDF variables. Note that because the UIDF values are location-sensitive you'll want to make sure you've clicked into an appropriate location in the MLIL or HLIL to see the appropriate values annotated in the variable view.
+
+![UIDF in Variable Sidebar](../img/uidf-hlil-before.png)
+
+## Jump Table Example
+
+???+ Warning "Tip"
+ Since these docs were originally written, this jump table no longer behaves the same way and is automatically solved during Binary Ninja's normal analysis. The documentation is being left in for illustrative purposes as it's still a valuable consideration even if this exact example no longer applies.
+
Let us see the High Level IL (HLIL) representation of `main` before UIDF:
-![HLIL before UIDF](../img/hlil-before-uidf.png)
+![HLIL before UIDF](../img/uidf-hlil-before.png)
Below is the HLIL of `main` after UIDF. If constant propagation leads to conditionals which can be evaluated at analysis time, its value is set to `if (true) or if (false)` at the MLIL layer. More so, the branch of the conditional where the control flow is guaranteed to not reach is eliminated from HLIL. The sub-graph of the CFG which results in the "Correct" output is eliminated. Here, HLIL benefits from dataflow calculations made at MLIL and the updated CFG is indicative of that.
-![HLIL after UIDF](../img/hlil-after-uidf.png)
+![HLIL after UIDF](../img/uidf-hlil-after.png)
We believe that UIDF is great for experimenting around with during the initial phase of the RE life cycle. If the value for a variable at a location is already informed, right-clicking on the variable at any usage site where the variable has the same SSA version will show an option to "Clear User Variable Value". This clears the informed value and triggers reanalysis. And as always, you can just use undo if setting the user variable value was the last action (using CMD/CTRL+Z).
@@ -100,7 +111,7 @@ Another example of using UIDF would be to construct jump-tables with known bound
Now, with the introduction of UIDF, there's another easy way to help inform the jump-table analysis. Consider the MLIL representation for an indirect jump as shown below:
-![Indirect jump](../img/jump-table-uidf.png)
+![Indirect jump](../img/uidf-jump-table.png)
Let us inform value for the variable `eax` to be in the range `1` to `0x13`.
@@ -113,12 +124,12 @@ Let us inform value for the variable `eax` to be in the range `1` to `0x13`.
A jump table will be created with a base of `0x804891c` with 14 possible targets for the jump at 0x804855b. Below is a cropped screenshot of the resulting HLIL which consists of a switch construct which depends on the variable value. This [binary](http://pages.cs.wisc.edu/~xmeng/Testsuite.tar.gz) is available on [BN Cloud](https://cloud.binary.ninja/bn/fb2131dd-e726-4009-8428-80f9f0b5e8ae) and is originally written by [Xiaozhu Meng](http://pages.cs.wisc.edu/~xmeng).
-![Correct switch after UIDF](../img/correct-switch-after-uidf.png)
+![Correct switch after UIDF](../img/uidf-correct-switch-after.png)
## Design notes
-Static-only reverse engineering limits the ability to test hypothesis formulated during the initial analysis phase. To that end, analysts usually turn to emulation/debugging to experiment with a binary. This can often be time-consuming if the focus is on checking dependencies between program variables or for verifying the dataflow, or worse, may be impossible for some platforms that are difficult to dynamically analyze. With UIDF, we aim to provide our users with the ability to interact with the dataflow engine more richly and partly achieve the same results without leaving the flow graph or linear analysis window. UIDF could also aid in better understanding targets of indirect jumps or fixing jump tables. Research [[1](#ref1),[2](#ref2)] shows that it is imperative that binary analysis tools adopt a more user-guided approach to solve RE/VR tasks and UIDF tries to be a step up that slope. We aim to continue work in this direction!
+Static-only reverse engineering limits the ability to test hypotheses formulated during the initial analysis phase. To that end, analysts usually turn to emulation/debugging to experiment with a binary. This can often be time-consuming if the focus is on checking dependencies between program variables or for verifying the dataflow, or worse, may be impossible for some platforms that are difficult to dynamically analyze. With UIDF, we aim to provide our users with the ability to interact with the dataflow engine more richly and partly achieve the same results without leaving the flow graph or linear analysis window. UIDF could also aid in better understanding targets of indirect jumps or fixing jump tables. Research [[1](https://acmccs.github.io/papers/p347-shoshitaishviliA.pdf),[2](https://dl.acm.org/doi/fullHtml/10.1145/3290607.3313040)] shows that it is imperative that binary analysis tools adopt a more user-guided approach to solve RE/VR tasks and UIDF tries to be a step up that slope. We aim to continue work in this direction!
-UIDF primarily operates on the MLIL layer. Binary Ninja performs constant propagation, resolves call parameters and lifts stack load/stores into a variables. This combined with the SSA form enables an effective dataflow analysis pipeline. MLIL also provides control over dead-code elimination and allows us to prevent removal of redundant instructions (eg. variable definitions for informed variables) and basic blocks (removed due to the resulting dataflow). Binary Ninja's tiered IL representation allows the higher layers to benefit from simplifying transformations at the lower layers. Through fixing jump tables or branch elimination, UIDF influences HLIL output as a user would expect without having drastic changes to the MLIL representation.
+UIDF primarily operates on the MLIL layer. Binary Ninja performs constant propagation, resolves call parameters and lifts stack load/stores into a variables. However, the UI can apply a UIDF constraint on an HLIL variable or MLIL variable and apply it appropriately. This combined with the SSA form enables an effective dataflow analysis pipeline. MLIL also provides control over dead-code elimination and allows us to prevent removal of redundant instructions (eg. variable definitions for informed variables) and basic blocks (removed due to the resulting dataflow). Binary Ninja's tiered IL representation allows the higher layers to benefit from simplifying transformations at the lower layers. Through fixing jump tables or branch elimination, UIDF influences HLIL output as a user would expect without having drastic changes to the MLIL representation.
-Looking towards the future, improvements to the dataflow solver engine would inherently increase the efficacy of UIDF. This could include support for more operations on the complex [`PossibleValueSet`](https://api.binary.ninja/binaryninja.function.PossibleValueSet.html) containers or the ability to play well with program structure such as loops.
+Looking towards the future, improvements to the dataflow solver engine would inherently increase the efficacy of UIDF. This could include support for more operations on the complex [`PossibleValueSet`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.PossibleValueSet) containers or the ability to play well with program structure such as loops.
diff --git a/docs/dev/workflows.md b/docs/dev/workflows.md
index 678f6510..7ff91503 100644
--- a/docs/dev/workflows.md
+++ b/docs/dev/workflows.md
@@ -13,7 +13,6 @@ This capability is experimental with no guarantees of API stability or future co
- [What is Workflows](#what-is-workflows)
- [Getting Started](#getting-started)
- - [Availability](#availability)
- [Enable](#enable)
- [Explore](#explore)
- [Examples](#examples)
diff --git a/docs/docs.css b/docs/docs.css
index 8ca8e887..6b61a79f 100644
--- a/docs/docs.css
+++ b/docs/docs.css
@@ -131,31 +131,16 @@
}
:root {
- --md-text-font: "Roboto";
- --md-code-font: "Roboto Mono";
+ --md-text-font: "Roboto";
+ --md-code-font: "Roboto Mono";
}
.juxtapose {
margin-bottom: 1rem;
}
-code,
-.codehilite {
- background-color: #eee;
-}
-
-.admonition.warning .admonition-title,
-.admonition.warning {
- background-color: #d73726 !important;
- border-color: #d73726;
- color: #fff !important;
-}
-
-.md-typeset.admonition.tip .admonition-title,
-.md-typeset.admonition.tip {
- background-color: #6e6e6e !important;
- border-color: #6e6e6e !important;
- color: #fff !important;
+.jx-knightlab {
+ display: none !important;
}
img[alt$=">"] {
@@ -179,63 +164,6 @@ img[alt$="><"] {
}
-/*
-@media only screen and (min-width: 76.25em) {
- .md-main__inner {
- max-width: none;
- }
- .md-sidebar--primary {
- left: 0;
- }
- .md-sidebar--secondary {
- right: 0;
- margin-left: 0;
- -webkit-transform: none;
- transform: none;
- }
- .wy-nav-content {
- max-width: 100%;
- }
-}
-*/
-
-pre {
- overflow-x: auto;
-}
-
-.wy-side-nav-search {
- background-color: #d73726;
- color: #fff;
-}
-
-.wy-menu-vertical p.caption {
- color: #9b9b9b;
-}
-
-.toctree-l1 a:visited,
-.toctree-l1 a:hover,
-.toctree-l1 a {
- color: #ccc;
-}
-
-.wy-nav-top {
- background-color: #d73726 !important;
- color: #fff !important;
-}
-
-.wy-nav-top a:visited,
-.wy-nav-top a:hover,
-.wy-nav-top a,
-.wy-side-nav-search a:visited,
-.wy-side-nav-search a:hover,
-.wy-side-nav-search a {
- color: #fff;
-}
-
-#image-slider {
- background-color: #000;
-}
-
.lslide {
margin: 0px !important;
text-align: center;
@@ -248,10 +176,8 @@ pre {
overflow: hidden;
}
-ol#inline-slides-text li#currentline {
- background-color: #6e6e6e;
- color: #fff;
- font-weight: bold;
+pre {
+ overflow-x: auto;
}
ol#inline-slides-text li {
@@ -303,51 +229,21 @@ h3#all-settings+p+div table tbody tr>td:nth-child(6) {
white-space: break-spaces;
}
-.md-header {
- background-color: #d73726;
-}
-
-.md-tabs {
- background-color: #d73726;
- color: #ffffff;
-}
-
-.headerlink,
-.md-typeset a,
-.md-nav__link,
-.md-nav__item {
- color: #d73726;
-}
-
-a.md-tabs__link,
-a.md_tabs__link:visited {
- color: #ffffff;
-}
-
-.md_tabs__link:hover {
- color: #cccccc;
-}
-
-.headerlink:hover,
-.md-typeset a:hover,
-.md-nav__link:hover,
-.md-nav__item:hover {
- color: #000000;
-}
-
-.md-source,
-.md-source:visited,
-.md-header__button,
-.md-header__button:visited {
- color: #ffffff;
-}
-
-
.md-grid {
max-width: 95%;
}
-/* TODO: Cleanup above hacks and replace with fully theme-aware code like below. */
+[data-md-color-scheme="slate"] {
+ --md-primary-fg-color: #d73726;
+ --md-primary-fg-color--light: #ECB7B7;
+ --md-primary-fg-color--dark: #990000;
+ --md-code-fg-color: #ecb7b7;
+ /* To use a red hue instead
+ * --md-hue: 15;
+ */
+ --md-typeset-a-color: rgb(215, 55, 38);
+ --md-nav-primary: rgb(215, 55, 38);
+}
[data-md-color-scheme="binja"] {
--md-primary-fg-color: #d73726;
@@ -356,7 +252,8 @@ a.md_tabs__link:visited {
--md-primary-fg-color--dark: #990000;
--md-code-fg-color: rgb(215, 55, 38);
--md-code-bg-color: hsla(0, 0%, 96%, 1);
- --md-typeset-a-color: #000000;
+ --md-typeset-a-color: rgb(215, 55, 38);
+ --md-nav-primary: rgb(215, 55, 38);
}
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 2d446cee..adb41b0e 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -1,22 +1,24 @@
# Getting Started
-Welcome to Binary Ninja. This introduction document is meant to quickly guide you over some of the most common uses of Binary Ninja. If you're interested in more detailed information, check out the [User Manual](./guide/index.md).
+Welcome to Binary Ninja! This introduction document is meant to quickly guide you over some of the most common uses of Binary Ninja. If you're interested in more detailed information, check out the [User Guide](./guide/index.md).
+
+![main ><](./img/main.png "Main"){ width="800" }
-![main](./img/main.png "Main")
## Installing Binary Ninja
-The download links you receive after purchasing expire after 72 hours but as long as you have [active support](https://binary.ninja/faq/#updates) you can [request download links](https://binary.ninja/recover/) any time!
+The download links you receive after purchasing expire after 72 hours but as long as you have [active support](https://binary.ninja/faq/#updates) you can [request download links](https://binary.ninja/recover/) any time.
+
### Linux
-Because Linux install locations can vary widely, we do not assume that Binary Ninja has been installed in any particular folder on Linux. Instead, first unzip the installation zip wherever you wish to install BN. Next, for paid versions, run `./binaryninja/scripts/linux-setup.sh`. This sets up file associations, icons, and adds BN's Python library to your python path. Adding the library to your path is most helpful for headless functionality in commercial licenses, but even on non-commercial plugins it can help IDE's find the type information to make plugin development easier. Run the script with `-h` to see customization options.
+Because Linux install locations can vary widely, we do not assume that Binary Ninja has been installed in any particular folder on Linux. Instead, first unzip the installation zip wherever you wish to install Binary Ninja. Next, for paid versions, run `./binaryninja/scripts/linux-setup.sh`. This sets up file associations, icons, and adds Binary Ninja's Python library to your Python path. Adding the library to your path is most helpful for headless functionality in the commercial editions, but even on the Non-Commercial edition it can help your IDE find the api sources to make plugin development easier. Run the script with `-h` to see customization options.
-### MacOS
+### macOS
-To install on MacOS, simply drag-and-drop the app bundle from the DMG to the desired location.
+To install on macOS, simply drag-and-drop the app bundle from the DMG to the desired location.
### Windows
-To install on Windows, use the installer linked from the email you received after purchase. You'll need to choose whether to install globally or to your local user path during the install process.
+To install on Windows, use the installer linked from the email you received after purchase. During the install process, you'll need to choose whether to install globally or to your local user path.
## License
@@ -30,47 +32,47 @@ While there are [more ways than shown here](./guide/index.md#loading-files), the
- File Open
- Run via CLI
-But you can also change how analysis happens using [open with options](./guide/index.md#loading-files).
+You can change analysis settings by using [Open with Options](./guide/index.md#loading-files).
## UI Basics
-![Overview](./img/overview.png "Overview")
+![Overview ><](./img/overview.png "Overview"){ width="800" }
By default, you'll see four main areas in Binary Ninja:
1. Symbol List (one of many [sidebar panels](./guide/index.md#the-sidebar))
-1. [Cross References](./guide/index.md#cross-references-pane)
+1. [Cross References](./guide/index.md#cross-references)
1. Main View (defaults to High Level IL and can have many [panes](./guide/index.md#tiling-panes))
1. [Feature Map](./guide/index.md#feature-map)
-Not enabled by default but can be made visible is the global area which includes the [scripting console](./guide/index.md#script-python-console) and log window.
+Not enabled by default but can be made visible is the bottom bar which includes the [scripting console](./guide/index.md#script-python-console) and log window.
-Make sure to check out the many view options available in the various ☰ ("hamburger") menus. However, most configuration settings are available in the [settings](./guide/settings.md) menu. (`[CMD/CTRL] ,` is the hotkey for settings) in the top right of each pane allows for additional customization, including locking the pane to a single function.
+Make sure to check out the many view options available in the various ☰ ("hamburger") menus. Many configuration settings are also available in the [Settings](./guide/settings.md) menu (hotkey: `[CMD/CTRL] ,`).
### Interacting
-![command palette](./img/command-palette.png "Command Palette")
+![command palette ><](./img/command-palette.png "Command Palette"){ width="800" }
-One of the most useful features of Binary Ninja is that everything can be quickly and easily accessed through a [command-palette](./guide/index.md#command-palette) (`[CMD/CTRL] p`). You'll be surprised how often it saves you from looking through menus to find out just what you need. Also, any action in the command-palette can be assigned to a [custom hotkey](./guide/index.md#custom-hotkeys). That said, here are a few of the more useful default hotkeys:
+One of the most useful features of Binary Ninja is that everything can be quickly and easily accessed through the [command palette](./guide/index.md#command-palette) (`[CMD/CTRL] p`). You'll be surprised how often it saves you from looking through menus to find out just what you need. Any action in the command palette can be assigned to a [custom hotkey](./guide/index.md#custom-hotkeys). Here are a few of the more useful ones:
- `[ESC]` : Navigate backward
- - `[SPACE]` : Toggle between linear view and [graph view](./guide/index.md#graph-view)
- - `[F5]`, `[TAB]` : Toggle between Pseudo C and disassembly view
+ - `[SPACE]` : Toggle between Linear View and [Graph View](./guide/index.md#graph-view)
+ - `[F5]`, `[TAB]` : Toggle between Pseudo C and Disassembly in the current view
- `g` : Go to an address or symbol
- `n` : Name a symbol
- `;` : Add a comment
- `i` : Cycle between disassembly, LLIL, MLIL and HLIL
- `y` : Change type of the currently selected element
+ - `a` : Create a C String at the currently selected address
- `1`, `2`, `4`, `8` : Change type of a data variable to the indicated width in bytes (creates a variable if none exists)
- `d` : Switch between data variables of various widths
- `r` : Change the data type to single ASCII character
- - `o` : Create a pointer data type
-For more hotkeys, see the [User Manual](./guide/index.md).
+For more hotkeys, see the [User Guide](./guide/index.md).
## Intermediate Languages
-Binary Ninja is one of the most advanced binary analysis platforms, and it has a unique stack of related intermediate languages. If that gets you excited, you'll surely want to check out the [developer guide](./dev/bnil-overview.md) for more information. If it doesn't mean anything to you, no worries, here's a few tips to make your life easier. The default view is "High Level IL". It looks and reads almost like pseudo code. There's a few extra notations (usually just around comparisons for whether they are signed or not, or between moves of data indicating the size of the operation) but it should otherwise be very understandable.
+Binary Ninja is one of the most advanced binary analysis platforms, and it has a unique stack of related intermediate languages. If that gets you excited, you'll surely want to check out the [developer guide](./dev/bnil-overview.md) for more information. If it doesn't mean anything to you, no worries, here's a few tips to make your life easier. The default view is "High Level IL". It looks and reads almost like pseudo code. There are a few extra annotations that make it more expressive, like how comparisons show whether they are signed or not, and when data is moved the size of the operation is indicated.
Many of the IL behaviors and views are customizable via settings. If you prefer disassembly or even [Pseudo C](./guide/index.md#pseudo-c) as your default view, no worries, just check out the `UI`/`view.graph` and `view.linear` settings. Likewise, there are several settings available under the "hlil" heading.
@@ -82,7 +84,7 @@ Plugins can be installed by one of two methods, either automatically by using th
Binary Ninja includes a debugger that can debug executables on Windows, Linux, and macOS.
-For more detailed information, see the [debugger guide](./guide/debugger.md).
+For more detailed information, see the [debugger guide](./guide/debugger/index.md).
## Updates
@@ -94,4 +96,4 @@ By default, Binary Ninja is configured to automatically update itself to any new
- Watch our [Binary Ninja Basics](https://www.youtube.com/watch?v=xKBQatwshs0&list=PLCVV6Y9LmwOgqqT5obf0OmN9fp5495bLr) videos (or any other [videos on our channel](https://www.youtube.com/watch?v=xKBQatwshs0&list=PLCVV6Y9LmwOgqqT5obf0OmN9fp5495bLr&index=1))
- Join one of our [live streams](https://www.youtube.com/@vector35/live)
- Attend one of our [trainings](https://binary.ninja/training/)
-- Read the rest of the more detailed [User Manual](./guide/index.md)
+- Read the rest of the more detailed [User Guide](./guide/index.md)
diff --git a/docs/guide/index.md b/docs/guide/index.md
index 476e214d..58717818 100644
--- a/docs/guide/index.md
+++ b/docs/guide/index.md
@@ -1,15 +1,16 @@
-# User Manual
+# User Guide
-Welcome to the Binary Ninja User Manual. You'll notice two menus here. On the right is the table of contents for this main page of the user manual. On the left are links to larger topics that have their own pages, including:
+Welcome to the Binary Ninja User Guide. You'll notice two menus here. On the right is the table of contents for this main page of the user manual. On the left are links to larger topics that have their own pages, including:
- [Plugins](plugins.md)
- [Settings](settings.md)
-- [Types](type.md)
-- [C++ Types](cpp.md)
-- [Debug Info](debuginfo.md)
-- [Debugger](debugger.md)
-- [Objective C](objectivec.md)
+- [Projects](projects.md)
- [Troubleshooting](troubleshooting.md)
+- [Objective-C](objectivec.md)
+- [Debugger](debugger/index.md)
+- [Migration Guide](migration/index.md)
+- [Types](types/index.md)
+[comment]: <> (When changing this list, make sure to update mkdocs.yml as well)
## Directories
@@ -25,7 +26,7 @@ Binaries are installed in the following locations by default:
- Windows (user install): `%LOCALAPPDATA%\Vector35\BinaryNinja`
???+ Warning "Tip"
- If you want a silent install on windows, because we use the [NSIS](https://nsis.sourceforge.io/Docs/) installer, simply use: `BinaryNinjaInstaller.exe /S`
+ If you want a silent install on Windows, because we use the [NSIS](https://nsis.sourceforge.io/Docs/) installer, simply use: `BinaryNinjaInstaller.exe /S`
???+ Danger "Warning"
Do not put any user content in the install-path of Binary Ninja. The auto-update process of Binary Ninja WILL remove any files included in these locations.
@@ -40,7 +41,7 @@ While the default user folders are listed below, you can override these paths on
The contents of the user folder includes:
-- `lastrun`: A text file containing the directory of the last BinaryNinja binary path -- very useful for plugins to resolve the install locations in non-default settings or on Linux
+- `lastrun`: A text file containing the directory of the last Binary Ninja binary path -- very useful for plugins to resolve the install locations in non-default settings or on Linux
- `license.dat`: License file
- `plugins/`: Folder containing all manually installed user plugins
- `repositories/`: Folder containing files and plugins managed by the [Plugin Manager API](https://api.binary.ninja/binaryninja.pluginmanager-module.html)
@@ -55,19 +56,20 @@ The following files and folders may be created in the user folder but are not cr
- `symbols/`: Used to store automatically downloaded PDBs
- `update/`: Used to store update caches for pending updates
- `snippets/`: Used to store snippets created using the official Snippet plugin
-- `themes/`: For user themes or user-modified versions of official themes
-- `types/platform`: This folder can contain additional user [platform types](type.md#platform-types)
-- `community-themes/`: Can also be used to store themes, useful to clone the [plugin theme collection](https://github.com/vector35/community-themes) directly into your user folder
+- `themes/`: For user themes or user-modified versions of official themes (see [Creating Themes](../dev/themes.md))
+- `types/platform`: This folder can contain additional user [platform types](types/platformtypes.md)
+- `typelib`: This folder can contain additional user [Type Libraries](../dev/annotation.md#type-libraries)
+- `community-themes/`: Can also be used to store themes, particularly so you can clone the [community theme collection](https://github.com/vector35/community-themes) directly into your user folder
### QSettings Locations
-Some settings such as window locations, saved checkboxes, recent file lists, disassembly settings, dialog histories are stored in QSettings.
+Some settings such as window locations, saved checkboxes, recent file lists, disassembly settings, dialog histories are stored in `QSettings`.
If you ever have the need to flush these, you can find the install locations as described in the [QT documentation](https://doc.qt.io/qt-6/qsettings.html#platform-specific-notes).
## License
-![license pop-up >](../img/license-popup.png "License Popup")
+![license pop-up >](../img/license-popup.png "License Popup"){ width="400" }
When you first run Binary Ninja, it will prompt you for your license key. You should have received your license key via email after your purchase. If not, please contact [support](https://binary.ninja/support).
@@ -79,9 +81,9 @@ Because Linux install locations can vary widely, we do not assume that Binary Ni
## Loading Files
-You can load files in many ways:
+![open with options ><](../img/open-with-options.png "Open with Options"){ width="600" }
-![open with options](../img/open-with-options.png "Open with Options")
+You can load files in many ways:
1. Drag-and-drop a file onto the Binary Ninja window (hold `[CMD/CTRL-SHIFT]` while dropping to use the `Open with Options` workflow)
2. Use the `File/Open` menu or `Open` button on the start screen (`[CMD/CTRL] o`)
@@ -101,7 +103,7 @@ You can load files in many ways:
## Saving Files
-![save choies >](../img/save-choices.png "Save Menu Choices")
+![save choices >](../img/save-choices.png "Save Menu Choices"){ width="400" }
There are five menu items that can be used to save some combination of a raw file or a file's analysis information. Analysis information is saved into files that end in `.bndb` and have the same prefix as the original file. The default behavior for each of the "save" menu choices is described below:
@@ -116,17 +118,54 @@ There are five menu items that can be used to save some combination of a raw fil
- If you choose to save the analysis database, it behaves similarly to "Save" above, except for the cases that save without prompt. In those cases, you will _always_ be prompted for a filename.
- If you choose to save the file contents only, you will be prompted for a filename to which to save the current contents of the binary view, including any modifications.
-3. "Save All" - Used to save multiple tabs worth of analysis data only. Does not save file contents.
+3. "Save All" - Used to save multiple tabs worth of analysis data only. Does not save file contents.
4. "Save Analysis Database" - Will prompt to select a database to save analysis information if none is currently selected and in use, and will save without a prompt if one has already been selected.
- ![save with options >](../img/save-with-options.png "Save With Options")
-
5. "Save Analysis Database With Options" - Allows for saving a `.bndb` without additional undo information, or by cleaning up some internal snapshot information to decrease the file size.
+![save with options](../img/save-with-options.png "Save With Options"){ width="600" }
+
+## New Files
+
+When you create a new file, you're given the [hex view](index.md#hex-view) of an empty file. From here you can manually type in hexadecimal or ascii values, or paste in data in a variety of ways. To type in hex, make sure the left-side is focused, to type in ascii, just focus the right-side using the mouse or the "tab" key. The only way to enter a tab character into the ascii section is to enter "09" in the hex side.
+
+To paste, right click anywhere in the view, select "Paste From," and choose whichever option matches the data you copied. For example, the string `\x01\x02\x03\x04` can be pasted as an Escape String, while `01020304` is Raw Hex.
+
+From here, you can save the contents of your new binary to disk and reopen it for auto-analysis. Of course, you could also switch out of hex view and start creating functions yourself.
+
+## New Tab
+
+![new tab ><](../img/newtab-personal.png "New Tab"){ width="800" }
+
+The New Tab is the first view shown when starting the application. It contains a set of buttons with common actions for loading and creating files,
+and a list of recent files you've opened.
+
+![new tab ><](../img/newtab-compact.png "New Tab Compact Mode"){ width="700" }
+
+A "Compact Mode" exists which presents only file paths. This can be enabled and disabled from the right-click menu. Additionally, within Binary Ninja settings, `CompactBase` mode can be enabled, which only shows the filenames.
+
+### Recent Files
+
+Recent files can be opened on double click. They can also be navigated using the arrow keys, and opened via pressing enter. Opening a recent file using `[SHIFT+ENTER]` will open that file with the Open With Options dialog.
+
+The Recent files list can be cleared via using the Command Palette (`[CTRL] + P`) action `Clear Recently Opened`.
+
+Hotkeys (macOS: `[CMD] + 0` - `[CMD] + 9`, Windows/Linux: `[CTRL] + 0` - `[CTRL + 9]`) can also be used to quickly open a file. The hotkey for a given entry will be shown on the right.
+
+### Commercial/Enterprise Features
+
+![new tab](../img/newtab-projects.png "New Tab Projects Version"){ width="700" }
+
+On Commercial and Enterprise, the New Tab file list also contains a separate tab for Recent Projects. These tabs can be docked, rearranged, split, or unified, and their split is adjustable. Layout changes will be saved.
+
+While Projects themselves are presented in their own tab, files opened in Projects will be located in the usual Recent Files list.
+
+Project names are formatted as `[Project] Project Name Here` while project files are formatted as `[Project Name Here] File Name Here`.
+
## Status Bar
-![status bar >](../img/status-bar.png "Status Bar") <!-- this image needs updating to reflect new status bar -->
+![status bar](../img/status-bar.png "Status Bar"){ width="800" }
The status bar provides current information about the open file as well as some interactive controls. Summary features are listed below:
@@ -135,7 +174,7 @@ The status bar provides current information about the open file as well as some
* Cursor offset or selection - interactive control that can be clicked to change its display format, or also to copy the current address or selection in a number of different formats (see the below screenshot)
* File Contents Lock - interactive control to prevent accidental changes to the underlying file
-![address indicator](../img/address-indicator.png "Status Bar") <!-- this image needs updating to reflect new status bar -->
+![address indicator](../img/address-indicator.png "Status Bar")
## Analysis
@@ -159,49 +198,238 @@ Additionally, using the [open with options](#loading-files) feature allows for c
## Navigating
-![navigation >](../img/navigation.png "Navigation")
-Navigating code in Binary Ninja is usually a case of just double-clicking where you want to go. Addresses, references, functions, jump edges etc, can all be double-clicked to navigate. Additionally, the `g` hotkey can navigate to a specific address in the current view. Syntax for this field is very flexible. Full expressions can be entered including basic arithmetic, dereferencing, and name resolution (function names, data variable names, segment names, etc). Numerics default to hexadecimal but that can be controlled as well if you wish to use octal decimal or other base/radix. Full documentation on the syntax of this field can be found [here](https://api.binary.ninja/binaryninja.binaryview-module.html?highlight=parse_expression#binaryninja.binaryview.BinaryView.parse_expression).
+![navigation >](../img/navigation.png "Navigation"){ width="600" }
+Navigating code in Binary Ninja is usually a case of just double-clicking where you want to go. Addresses, references, functions, jump edges etc., can all be double-clicked to navigate. Additionally, the `g` hotkey can navigate to a specific address in the current view. Syntax for this field is very flexible. Full expressions can be entered including basic arithmetic, dereferencing, and name resolution (function names, data variable names, segment names, etc.). Numerics default to hexadecimal, but that can be controlled as well if you wish to use octal decimal or other base/radix. Full documentation on the syntax of this field can be found [here](https://api.binary.ninja/binaryninja.binaryview-module.html?highlight=parse_expression#binaryninja.binaryview.BinaryView.parse_expression).
-Additionally, middle-clicking (scroll-wheel clicking) items that can be double-clicked can be used to navigate to that location in a new Split Pane. Shift + middle-click can also be used to navigate to that location in a new Tab. These bindings can be configured in the Settings ([ui.middleClickNavigationAction](settings.md#ui.middleClickNavigationAction), [ui.middleClickShiftNavigationAction](settings.md#ui.middleClickShiftNavigationAction)). These "Split and Navigate" actions can also be accessed in the Context (right-click) menu, and can be separately bound to keys in the Keybindings view.
+Additionally, middle-clicking (scroll-wheel clicking) items that can be double-clicked can be used to navigate to that location in a new Split Pane. Shift + middle-click can also be used to navigate to that location in a new Tab. These bindings can be configured in the Settings ([`ui.middleClickNavigationAction`](settings.md#ui.middleClickNavigationAction), [`ui.middleClickShiftNavigationAction`](settings.md#ui.middleClickShiftNavigationAction)). These "Split and Navigate" actions can also be accessed in the Context (right-click) menu, and can be separately bound to keys in the Keybindings view.
There's also [many](#using-the-keyboard) keyboard-based navigation options.
### Switching Views
-![graph view >](../img/view-choices.png "Different Views")
+![graph view](../img/view-choices.png "Different Views")
-Switching views happens multiple ways. In some instances, it is automatic (clicking a data reference from graph view will navigate to linear view as data is not shown in the graph view), and there are multiple ways to manually change views as well. While navigating, you can use the view hotkeys (see below) to switch to a specific view at the same location as the current selection. Alternatively, the view menu in the header at the top of each pane can be used to change views without navigating to any given location.
+Switching views happens multiple ways. In some instances, it is automatic, such as clicking a data reference from graph view. This will navigate to linear view as data is not shown in the graph view. While navigating, you can use the [view hotkeys](#default-hotkeys) to switch to a specific view at the same location as the current selection. Next you can use the [command palette](#command-palette). Additionally, the view menu in the header at the top of each pane can be used to change views without navigating to any given location. Finally, you can also use the `View` application menu.
## The Sidebar
-![the sidebar >](../img/sidebar.png "The Sidebar")
+![the sidebar ><](../img/sidebars.png "The Sidebar"){ width = "800" }
+
+Once you have a file open, the sidebar lets you quickly access the most common features as sidebar panels and keeps them available while you work. These panels can be moved both upper left (1) and upper right (2) as well as to the bottom left (3), bottom right (4), and along the bottom left (5) and bottom right (5) in the middle.
+
+ - 1-2: This section is where the majority of the primarily vertical panels reside. You can only have on larger item here at a time visible. The default behavior is for a click on another panel icon to hide the previous panel. However, this default can be overridden by using `[SHIFT]` click. If overridden, both the old panel and the new panel will be visible.
+ - 3-4: This section is primarily for smaller panels where you may wish to toggle multiple on or off. Clicking a panel here will toggle its visibility without impacting other panels. Note that despite 4 not having any items in it by default, when you drag a panel icon to this region, you'll see the separator that separates 1/2 from 3/4 appear.
+ - 5-6: Primarily for horizontal content, the bottom-most panel icon regions behave much like sections 1-2 except they are applied to two regions in the bottom of the window. Clicking a different icon in this region will switch to that panel, or hide that panel entirely if it is already selected.
+
+Here's a more detailed look into each of those panels:
+
+### Symbols
+
+The Symbols List is a powerful symbol organization and navigation tool. It allows sorting symbols by a variety of attributes, organizing them into folders (both manually, and automatically via the [API](https://api.binary.ninja/binaryninja.component-module.html#binaryninja.component.Component)), and much more.
+
+???+ Warning "Tip"
+ Searching in the symbol list doesn't require focusing the search box. That the filter list here (and in the string panel) is a "fuzzy" search. Each space-separated keyword is used as a substring match and order matters. So: "M C N" for example would match `MyClassName`.
+
+#### Columns
+
+![symbols list >](../img/symbols-header-menu.png "Symbols List Header Menu"){ width="600" }
+
+The Symbol List shows the following columns by default:
+
+- `Name`: the [short name](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.CoreSymbol) of the symbol (can be changed to the [raw name](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.CoreSymbol) in the menu icon for the Symbol List)
+- `Address`: the virtual address for the symbol
+- `Kind`: may be one of "Folder", Function", "Data", and "Bare Symbol"
+- `Section`: the section of the binary the symbol appears in
+
+Additionally, the following columns are hidden by default and can be enabled by right-clicking the header:
+
+- `Total Bytes`: tn the case of functions, the sum of size of basic blocks
+
+These columns can be re-arranged, hidden, and used for sorting.
+
+Sort by a given column simply by clicking it. Click it again to toggle between ascending and descending sort order.
+
+Columns can be re-arranged via dragging.
+
+#### New Folder with Selection
+"New Folder with Selection" will create a new folder containing the selected items.
+When this is done within a folder, the folder will be created within the shared parent.
+
+![symbols list >](../img/symbols-right-click.png "Symbols List: Right clicking with several symbols selected, and then clicking 'New Folder with Selection'"){ width="600" }
+
+#### Via Dragging
+
+Dragging several items onto another non-folder item will create a folder containing the dragged items and the item they were dropped on.
+
+#### Moving Items into Folders
+
+Dragging several items onto or into a folder will move the items into that folder.
+
+#### "Remove from Folder"
+
+The "Remove from Folder" context menu option will move a given item or items to the root of the tree.
+
+### Types
+
+The Types View can be used as a sidebar panel or as a pane in the main view. The UI is exactly the same except for the default vertical versus horizontal. For more details, see the [Types View](types/basictypes.md#types-view) documentation.
+
+### Tags/Bookmarks
+
+![tags ><](../img/tags.png "Tags"){ width="600" }
+
+The tags panel allows you to both change existing tag categories, add your own categories, and also review any existing tags or bookmarks. Bookmarks are just tags with default hotkeys bound to them for both setting them and navigating them. The default keybinding to set a bookmark is `[CTRL-ALT] 1` through `[CTRL-ALT] 0` representing Bookmarks 1-10. The default hotkeys for navigating them are `[CTRL] 1` through `[CTRL] 0`. See the [keybindings](#custom-hotkeys) section for information on changing the default keybindings.
+
+### Memory Map
+
+![memory map ><](../img/memory-map.png "Memory Map"){ width="600" }
+
+The "Memory Map" pane and sidebar widget show segments and sections currently present in the binary, allows some modification of automatically added sections, and allows adding, modifying, and deleting user segments and sections.
+
+![memory map icon <](../img/memory-map-icon.png "Memory Map Icon")
+
+To access it, use either the icon in the sidebar to open the panel, or use the view drop-down in the main pane, or use the command-palette!
+
+When a segment is selected (highlighted in blue) related sections will be outlined (white border).
+
+Likewise, when a section is selected, related segments will be outlined.
+
+The sorting order of segments and sections can be changed by clicking on any column header.
+
+### External Links
+
+![External Links](../img/external-links.png "External Links"){ width="400" }
+
+External Links allow files in projects to connect to one another, so you could, for example, have an analysis database of an executable as well as multiple libraries it imports and follow references between the two. See the [projects documentation](projects.md#external-links) for more information.
+
+### Mini-Graph
+
+![mini graph](../img/mini-graph.png "Mini-Graph"){ width="400" }
+
+The Mini Graph only shows content when the currently selected main pane contains a [Graph view](#graph-view). The preview region is shown as a gray box that can be dragged to navigate the larger graph.
+
+### Cross References
+
+The Cross References view in the lower-left section of the sidebar shows all cross-references to the currently selected address, address range, variable or type. This pane will change depending on whether an entire line is selected (all cross-references to that address/type/variable are shown), or whether a specific token within the line is selected. For instance if you click on the symbol `memmove` in `call memmove` it will display all known cross-references to `memmove`, whereas if you click on the line the `call` instruction is on, you will only get cross-references to the address of the call instruction. Cross-references can be either incoming or outgoing, and they can be either data, code, type, or variable.
+
+![Cross References](../img/cross-reference-tree.png "xrefs"){ width="600" }
+
+#### Code References
+
+Code references are references to or from code, but not necessarily _to_ code. Code References can reference, code, data, or structure types. Code References are inter-procedural, and unfortunately due to speed considerations we currently only show disassembly (rather than an IL) when displaying these types of references. In a future version we hope to address this limitation.
+
+#### Data References
+
+Data References are references created _by_ data (i.e. pointers), not necessarily _to_ data. Outgoing Data References are what is pointed to by the currently selected data. Incoming Data References are the set of data pointers which point to this address.
+
+#### Variable References
+
+Variable References are all the set of uses of a given variable. As these references are intraprocedural we're able to show the currently viewed IL in the preview.
+
+#### Type References
+
+Type References are references to types and type members made by other types, perhaps more accurately called Type-to-Type-References.
+
+#### Tree-based Layout
+The cross-references pane comes in two different layouts: tree-based (default and shown above) and table-based (this can be toggled through the context menu or the command palette). The tree-based layout provides the most condensed view, allowing users to quickly see (for instance) how many references are present to the current selection overall and by function. It also allows collapsing to quickly hide uninteresting results.
+
+#### Table-based Layout
+
+![xrefs](../img/cross-reference-table.png "xrefs table"){ width="600" }
+
+The table-based layout provides field-based sorting and multi-select. Clicking the `Filter` text expands the filter pane, showing options for filtering the current results.
+
+#### Cross-Reference Filtering
+
+![xrefs](../img/cross-reference-filter.png "xrefs filter"){ width="500" }
+
+The first of the two drop down boxes allows the selection of incoming, outgoing, or both incoming and outgoing (default). The second allows selection of code, data, type, or variable or any combination thereof. The text box allows regular expression matching of results. When a filter is selected the `Filter` display changes from `Filter (<total-count>)` to `Filter (<total-filtered>/<total-count>)`
+
+#### Cross-Reference Pinning
+
+![xrefs](../img/cross-reference-panel-pin.png "xrefs panel pin"){ width="600" }
+
+By default, Binary Ninja's cross-reference pane is dynamic, allowing quick navigation to relevant references. Sometimes you might rather have the current references stick around, so they can be used as a sort of work-list. This workflow is supported in four different ways. First is the `Pin` checkbox (which is only visible if the `Filter` drop-down is open). This prevents the list of cross-references from being updated even after the current selection is changed.
+
+Alternatively clicking the `Pin Cross References to New Pane` button at the top right of the cross references pane in the sidebar, selecting `Pin Cross References` in the context menu or command palette, or using the `SHIFT+X` shortcut pops up a `Pinned Cross References` pane. This pane has a static address range which can only be updated through the `Pin Cross References` action. The third way would be to select (or multi-select in table view) a set of cross-references then right-click `Tag Selected Rows`. The tag pane can then be used to navigate those references. Tags allow for persistent lists to be saved to an analysis database whereas the other options only last for the current session.
+
+#### Cross-Reference Hotkeys
+
+* `x` - Focus the cross-references pane
+* `[SHIFT] x` Create a new pinned cross-references pane
+* `[OPTION/ALT] x` - Navigate to the next cross-reference
+* `[OPTION/ALT-SHIFT] x` - Navigate to the previous cross-reference
+
+The following are only available when the cross-references pane is in focus:
+
+* `[CMD/CTRL] f` - Open the filter dialog
+* `[ESC]` - Clear the search dialog
+* `[CMD/CTRL] a` - Select all cross-references
+* `[ARROW UP/DOWN]` - Select (but don't navigate) next/previous cross-reference
+* `[ENTER]` - Navigate to the selected reference
+
+### Console
+
+![console](../img/console.png "Console"){ width="800" }
+
+The Console panel by default only contains a single Python scripting console, however it is possible to create additional consoles using the `Create Python Console` command palette item.
+
+For many more details about using the python console, see below in the [Python console documentation](#script-python-console).
+
+### Variables
+
+![Variables](../img/variables.png "Variables"){ width="400" }
+
+The Variables sidebar panel will show local variables from the currently selected function. Possible variable values include:
+
+ - Register Variables (R)
+ - Stack Variables (S)
+ - Flag Variables (F)
+ - Data Variables (D)
+
+ Note that this sidebar is sensitive to function. Possible value set values will be shown for variables based on the currently selected offset in the function.
+
+### Stack
+
+![Stack](../img/stack.png "Stack"){ width="400" }
+
+The Stack sidebar panel shows the currently selected function's stack layout. You can create variables using the [usual](types/type.md#direct-ui-manipulation) hotkeys as well as using the right-click menu (which also shows the hotkeys).
+
+### Strings
-Once you have a file open, the sidebar lets you quickly access the most common features and keeps them available while you work, including:
+![Strings](../img/strings.png "Strings"){ width="700" }
-- symbols
-- types
-- function-specific local variables
-- context-sensitive stack state
-- strings
-- tags/bookmarks
-- a mini-graph of the current function
-- cross-references to the current selection
+The Strings sidebar panel shows all identified strings in the binary. See [working with strings](../dev/concepts.md#working-with-strings) for more information on how these strings are identified.
+
+### Find
+
+![Find](../img/find.png "Find"){ width="700" }
+
+The normal find dialog also exists as a sidebar panel that allows persistent, tabbed results. The `Filter` drop-down allows further filtering of identified results and supports regular expressions (though the main find search types do not).
+
+The search types are available from a drop-down next to the text input field and include:
+
+ - Escaped: Escaped strings such as `OneString\x09\Tabsx09Another`
+ - Hex: All values much be valid hex characters such as `ebfffc390` and the bytes will only be searched for in this particular order
+ - Raw: A simple string search that matches the exact string as specified
+ - Text: Searches the decompilation or whatever view is currently selected for disassembly, BNIL, or Pseudo C
+ - Constant: Useful for searching for a constant where the byte ordering is handled for you, such as `0x01020304`
+
+### Logs
+
+![Logs](../img/logs.png "Logs"){ width="700" }
+
+The log window lets you search and filter through logs. You can search by text or filter by loggers to identify messages of interest. By default, only the logs for a specific BinaryView that's open as well as any Global logs will show up but this setting can either be changed through the right-click menu or the drop down menu in the upper-right of the log window.
## Tiling Panes
-![tiling panes >](../img/tiling-panes.png "Tiling Panes")
+![tiling panes ](../img/tiling-panes.png "Tiling Panes"){ width="1000" }
Binary Ninja displays binaries in panes, whether shown as disassembly, hex, IL, or decompiler output. Tiling these panes allows for a wide variety of information to be displayed at the same time.
Each pane has display options at the top and can be split and synchronized with other panes (or groups of panes). The ☰ ("hamburger") menu in the top right of each pane allows for additional customization, including locking the pane to a single function.
-<!--
-TODO: Document pane synchronization, splitting, etc in more detail.
-### Synchronizing Panes
--->
-
## Feature Map
-![tiling panes <](../img/featuremap.png "Feature Map")
+![tiling panes >](../img/featuremap.png "Feature Map"){ width="100" }
The Feature Map is also displayed on the right of the main pane area. It provides a visual summary of the entire binary with different colors representing data variables, code, strings, functions/code, imports, externs, and libraries. It can be moved or hidden via the right-click menu. Note that these colors are theme-aware and will change if your theme does, but on the default Ninja Edit theme:
@@ -216,15 +444,15 @@ The Feature Map is also displayed on the right of the main pane area. It provide
### Command Palette
-![command palette](../img/command-palette.png "Command Palette")
+![command palette](../img/command-palette.png "Command Palette"){ width="800" }
One great feature for quickly navigating through a variety of options and actions is the `command palette`. Inspired by similar features in [Sublime](https://sublime-text-unofficial-documentation.readthedocs.io/en/sublime-text-2/extensibility/command_palette.html) and [VS Code](https://code.visualstudio.com/docs/getstarted/userinterface#_command-palette), the command-palette is a front end into an application-wide, context-sensitive action system that all actions, plugins, and hotkeys in the system are routed through.
-To trigger it, simply use the `[CMD/CTRL] p` hotkey. Note that the command-palette is context-sensitive and therefore some actions (for example, `Display as - Binary`) may only be available depending on your current view or selection. This is also available to plugins. For example, a plugin may use [PluginCommand.register](https://api.binary.ninja/binaryninja.plugin-module.html#binaryninja.plugin.PluginCommand.register) with the optional `is_valid` callback to determine when the action should be available.
+To trigger it, simply use the `[CMD/CTRL] p` hotkey. Note that the command-palette is context-sensitive and therefore some actions (for example, `Display as - Binary`) may only be available depending on your current view or selection. This is also available to plugins. For example, a plugin may use [`PluginCommand.register`](https://api.binary.ninja/binaryninja.plugin-module.html#binaryninja.plugin.PluginCommand.register) with the optional `is_valid` callback to determine when the action should be available.
### Custom Hotkeys
-![keybindings](../img/keybindings.png "Keybindings")
+![keybindings](../img/keybindings.png "Keybindings"){ width="800" }
Any action in the [action system](#command-palette) can have a custom hotkey mapped to it. To access the keybindings menu, use the `[CMD/CTRL-SHIFT] b` hotkey, via the `Edit / Keybindings...` (`Binary Ninja / Preferences / Keybindings...` on macOS) menu, or the `Keybindings` [command palette](#command-palette) entry. Any overlapping keybindings will be highlighted. Click the `Keybinding` column header to sort by keybindings in order to see what bindings are overlapping.
@@ -256,10 +484,11 @@ To search in the keybindings list, just click to make sure it's focused and star
- `t` : Switch to type view
- `y` : Change type of currently selected element
- `a` : Change the data type to an ASCII string
- - `[SHIFT] a` : Change the data type to a wchar_t string
- - `[CTRL-SHIFT] a` : Change the data type to a wchar32_t string
+ - `[SHIFT] a` : Change the data type to a `wchar_t` string
+ - `[OPT-SHIFT] a` (macOS) : Change the data type to a `wchar32_t` string
+ - `[CTRL-SHIFT] a` (Windows/Linux) : Change the data type to a `wchar32_t` string
- `1`, `2`, `4`, `8` : Change type directly to a data variable of the indicated widths
- - `f` : Switch data variable between floating point types of various precisions
+ - `f` : Switch data variable between floating point types of varying precision
- `d` : Switch between data variables of various widths
- `r` : Change the data type to single ASCII character
- `o` : Create a pointer data type
@@ -269,17 +498,17 @@ To search in the keybindings list, just click to make sure it's focused and star
- `[CMD-SHIFT] -` (macOS) : Graph view zoom out
- `[CTRL-SHIFT] +` (Windows/Linux) : Graph view zoom in
- `[CTRL-SHIFT] -` (Windows/Linux) : Graph view zoom out
- - Other hotkeys specifically for working with types are listed in the [type guide](type.md#direct-ui-manipulation)
+ - Other hotkeys specifically for working with types are listed in the [type guide](types/type.md#direct-ui-manipulation)
## Graph View
-![graph view](../img/graphview.png "Graph View")
+![graph view](../img/graphview.png "Graph View"){ width="800" }
Binary Ninja offers a graph view that groups the basic blocks of disassembly into visually distinct blocks with edges showing control flow between them.
Features of the graph view include:
-- Ability to double click edges to quickly jump between locations
+- Ability to double-click edges to quickly jump between locations
- Zoom (CTRL-mouse wheel)
- Zoom to Fit - Zooms out until the whole graph is visible (`w`)
- Zoom to Cursor - Zooms to 100% at the position of the cursor (`z`)
@@ -287,15 +516,15 @@ Features of the graph view include:
- Horizontal Scrolling (Bottom scroll bar as well as SHIFT-mouse wheel)
- Individual highlighting of arguments, addresses, immediate values, types, etc.
- Full type signature of current function shown in an interactive header:
- - Selecting elements in the header highlights them in the graph view
- - Change type (`y`) and Rename (`n`) shortcuts work on elements in the header
- - Reanalyze function button on left edge of the header
+ - Selecting elements in the header highlights them in the graph view
+ - Change type (`y`) and Rename (`n`) shortcuts work on elements in the header
+ - Reanalyze function button on left edge of the header
- Edge colors indicate whether the path is the true (green) or false (red) case of a conditional jump (a color-blind option in the preferences is useful for those with red-green color blindness) and blue for unconditional branches
- Context menu that can trigger some function-wide actions as well as some specific to the highlighted instruction (such as inverting branch logic or replacing a specific function with a NOP)
## View Options
-![options ><](../img/options.png "View options")
+![options >](../img/options.png "View options"){ width="400" }
Each of the views (Hex, Graph, Linear) have a variety of options configurable from the ☰ menu on the top right of the view pane.
@@ -335,7 +564,7 @@ Current options include:
## Hex View
-![hex >](../img/hex.png "hex view")
+![hex](../img/hex.png "hex view"){ width="800" }
The hexadecimal view is useful for viewing raw binary files that may or may not even be executable binaries and allows direct editing of the binary contents in place, regardless of the type of the binary. Any changes made in hex view will be reflected in all other [open views](#tiling-panes) of the same binary. The lock button on the right edge of the bottom status bar must be toggled off (🔓) to perform any direct editing in hex view -- this is to prevent unintended modification of the binary by accidental pasting or typing.
@@ -344,142 +573,18 @@ The hex view is particularly good for transforming data in various ways via the
???+ Warning "Tip"
Any changes made in the Hex view will take effect immediately in any other views open into the same file (new views can be created via the `Split to new tab`, or `Split to new window` options under `View`, or via [splitting panes](#tiling-panes)). This can, however, cause large amounts of re-analysis so be warned before making large edits or transformations in a large binary file.
-## Cross References Pane
-
-The Cross References view in the lower-left section of the sidebar shows all cross-references to the currently selected address, address range, variable or type. This pane will change depending on whether an entire line is selected (all cross-references to that address/type/variable are shown), or whether a specific token within the line is selected. For instance if you click on the symbol `memmove` in `call memmove` it will display all known cross-references to `memmove`, whereas if you click on the line the `call` instruction is on, you will only get cross-references to the address of the call instruction. Cross-references can be either incoming or outgoing, and they can be either data, code, type, or variable.
-
-![Cross References](../img/cross-reference-tree.png "xrefs")
-
-### Code References
-
-Code references are references to or from code, but not necessarily _to_ code. Code References can reference, code, data, or structure types. Code References are inter-procedural, and unfortunately due to speed considerations we currently only show disassembly (rather than an IL) when displaying these types of references. In a future version we hope to address this limitation.
-
-### Data References
-
-Data References are references created _by_ data (i.e. pointers), not necessarily _to_ data. Outgoing Data References are what is pointed to by the currently selected data. Incoming Data References are the set of data pointers which point to this address.
-
-### Variable References
-
-Variable References are all the set of uses of a given variable. As these references are intra-procedural we're able to show the currently viewed IL in the preview.
-
-### Type References
-
-Type References are references to types and type members made by other types, perhaps more accurately called Type-to-Type-References.
-
-### Tree-based Layout
-The cross-references pane comes in two different layouts: tree-based (default and shown above) and table-based (this can be toggled through the context menu or the command palette). The tree-based layout provides the most condensed view, allowing users to quickly see (for instance) how many references are present to the current selection overall and by function. It also allows collapsing to quickly hide uninteresting results.
-
-### Table-based Layout
-
-![xrefs](../img/cross-reference-table.png "xrefs table")
-
-The table-based layout provides field-based sorting and multi-select. Clicking the `Filter` text expands the filter pane, showing options for filtering the current results.
-
-### Cross-Reference Filtering
-
-![xrefs >](../img/cross-reference-filter.png "xrefs filter")
-
-The first of the two drop down boxes allows the selection of incoming, outgoing, or both incoming and outgoing (default). The second allows selection of code, data, type, or variable or any combination thereof. The text box allows regular expression matching of results. When a filter is selected the `Filter` display changes from `Filter (<total-count>)` to `Filter (<total-filtered>/<total-count>)`
-
-### Cross-Reference Pinning
-
-![xrefs >](../img/cross-reference-panel-pin.png "xrefs panel pin")
-
-By default Binary Ninja's cross-reference pane is dynamic, allowing quick navigation to relevant references. Sometimes you might rather have the current references stick around so they can be used as a sort of work-list. This workflow is supported in four different ways. First is the `Pin` checkbox (which is only visible if the `Filter` drop-down is open). This prevents the list of cross-references from being updated even after the current selection is changed.
-
-Alternatively clicking the `Pin Cross References to New Pane` button at the top right of the cross references pane in the sidebar, selecting `Pin Cross References` in the context menu or command palette, or using the `SHIFT+X` shortcut pops up a `Pinned Cross References` pane. This pane has a static address range which can only be updated through the `Pin Cross References` action. The third way would be to select (or multi-select in table view) a set of cross-references then right-click `Tag Selected Rows`. The tag pane can then be used to navigate those references. Tags allow for persistent lists to be saved to an analysis database whereas the other options only last for the current session.
-
-
-### Cross-Reference Hotkeys
-
-* `x` - Focus the cross-references pane
-* `[SHIFT] x` Create a new pinned cross-references pane
-* `[OPTION/ALT] x` - Navigate to the next cross-reference
-* `[OPTION/ALT-SHIFT] x` - Navigate to the previous cross-reference
-
-The following are only available when the cross-references pane is in focus:
-
-* `[CMD/CTRL] f` - Open the filter dialog
-* `[ESC]` - Clear the search dialog
-* `[CMD/CTRL] a` - Select all cross-references
-* `[ARROW UP/DOWN]` - Select (but don't navigate) next/previous cross-reference
-* `[ENTER]` - Navigate to the selected reference
-
## Linear View
-![linear](../img/linear.png "Linear View")
+![linear](../img/linear.png "Linear View"){ width="1000" }
Linear view is a hybrid view between a graph-based disassembly window and the raw hex view. It lists the entire binary's memory in a linear fashion and is especially useful when trying to find sections of a binary that were not properly identified as code or even just examining data.
Linear view is commonly used for identifying and adding type information for unknown data. To this end, as you scroll, you'll see data and code interspersed. Much like the graph view, you can turn on and off addresses via the command palette `Show Address` or the ☰ menu on the top right of the linear view pane. Many other [options](#view-options) are also available.
-## Symbols List
-
-The Symbols List is a powerful symbol organization and navigation tool. It allows sorting symbols by a variety of attributes,
-organizing them into folders (both manually, and automatically via the [API](https://api.binary.ninja/binaryninja.component-module.html#binaryninja.component.Component)), and much more.
-
-???+ Warning "Tip"
- Searching in the symbol list doesn't require focusing the search box. That the filter list here (and in the string panel) is a "fuzzy" search. Each space-separated keyword is used as a substring match and order matters. So: "M C N" for example would match "MyClassName".
-
-### Columns
-
-The Symbol List shows the following columns by default:
-
-- `Name`: the [short name](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.CoreSymbol) of the symbol (can be changed to the [raw name](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.CoreSymbol) in the menu icon for the Symbol List)
-- `Address`: the virtual address for the symbol
-- `Kind`: may be one of "Folder", Function", "Data", and "Bare Symbol"
-- `Section`: the section of the binary the symbol appears in
-
-Additionally, the following columns are hidden by default and can be enabled by right-clicking the header:
-
-![symbols list >](../img/symbols_header_menu.png "Symbols List Header Menu")
-
-- `Total Bytes`: tn the case of functions, the sum of size of basic blocks
-
-These columns can be re-arranged, hidden, and used for sorting.
-
-Sort by a given column simply by clicking it. Click it again to toggle between ascending and descending sort order.
-
-Rearrange columns by dragging them into the order you'd prefer:
-
-![symbols list >](../img/symbols_header_drag.png "Symbols List: Dragging a column")
-
-### New Folder with Selection
-"New Folder with Selection" will create a new folder containing the selected items.
-When this is done within a folder, the folder will be created within the shared parent.
-
-![symbols list >](../img/symbols_right_click_NFwS.png "Symbols List: Right clicking with several symbols selected, and then clicking 'New Folder with Selection'")
-
-### Via Dragging
-
-Dragging several items onto another non-folder item will create a folder containing the dragged items and the item they were dropped on.
-
-### Moving Items into Folders
-
-Dragging several items onto or into a folder will move the items into that folder.
-
-![symbols list >](../img/symbols_dragtocreate.png "Symbols List: Dragging several functions onto another function")
-
-### "Remove from Folder"
-
-The "Remove from Folder" context menu option will move a given item or items to the root of the tree.
-
-## Memory Map
-
-![memory map >](../img/memory-map.png "Memory Map")
-
-The "Memory Map" sidebar widget shows segments and sections currently present in the binary, allows some modification of automatically added sections, and allows adding, modifying, and deleting user segments and sections.
-
-When a segment is selected (highlighted in blue) related sections will be outlined (white border).
-
-Likewise, when a section is selected, related segments will be outlined.
-
-The sorting order of segments and sections can be changed by clicking on any column header.
-
## Edit Function Properties Dialog
-![Edit Function Properties Dialog ><](../img/efp_dialog_diagram.png "Edit Function Properties Dialog")
+![Edit Function Properties Dialog >](../img/efp-dialog-diagram.png "Edit Function Properties Dialog"){ width="600" }
The “Edit Function Properties” dialog provides the ability to easily configure some of a function’s more advanced properties. It can be opened via the context menu when a function is focused in the graph or linear views, or via the command palette. An overview of the UI is as follows:
@@ -497,6 +602,8 @@ The “Edit Function Properties” dialog provides the ability to easily configu
1. **Calling convention.** The calling convention this function uses. All calling conventions for the function’s architecture are available as choices.
1. **Stack adjustment.** How many _extra_ bytes does this function remove from the stack upon return?
1. **Has variable arguments.** Does this function accept a variable number of arguments?
+1. **Can return.** Functions that cannot return will halt disassembly on branches where they are called
+1. **Pure.** Functions that are pure are assumed to have no side effects and may be inlined if their return value is trivial
1. **Inline during analysis.** Causes the function to be [inlined](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function.inline_during_analysis) during analysis.
1. **Clobbered registers.** The list of registers that this function clobbers; individual registers can be checked or unchecked.
1. **Return registers.** The list of registers that this function returns data in; individual registers can be checked or unchecked.
@@ -504,7 +611,7 @@ The “Edit Function Properties” dialog provides the ability to easily configu
## High Level IL
-![HLIL Scoping Options >](../img/hlil-scope.png "HLIL Scoping Options")
+![HLIL Scoping Options >](../img/hlil-scope.png "HLIL Scoping Options"){ width="400" }
Binary Ninja features a decompiler that produces High Level IL (HLIL) as output. HLIL is not intended to be a representation of the code in C, but some users prefer to have a more C-like scoping style.
@@ -512,31 +619,31 @@ You can control the way HLIL appears in the settings.
The different options are shown below:
-![HLIL Scoping Display](../img/hlil-braces.png "HLIL Scoping Display")
+![HLIL Scoping Display](../img/hlil-braces.png "HLIL Scoping Display"){ width="500" }
## Pseudo C
-![Pseudo C >](../img/pseudo-c.png "Pseudo C View")
+![Pseudo C](../img/pseudo-c.png "Pseudo C View"){ width="800" }
-Binary Ninja offers an option to render the HLIL as a decompilation to "Pseudo C". This decompilation is intended to be more familiar to the user than the HLIL. It is not necessarily intended to be "compliant" C or even recompilable. In some cases, it may be possible to edit it into a form that a C compiler will accept, but the amount of effort required will vary widely and no guarantee is made that it will be possible in all cases.
+Binary Ninja offers an option to render the HLIL as a decompilation to "Pseudo C". This decompilation is intended to be more familiar to the user than the HLIL. It is not necessarily intended to be "compliant" C or even recompilable. In some cases, it may be possible to edit it into a form that a C compiler will accept, but the amount of effort required will vary widely, and no guarantee is made that it will be possible in all cases.
## Dead Store Elimination
Binary Ninja tries to be conservative with eliminating unused variables on the stack. When the analysis finds a variable that cannot be eliminated but does not appear to be used, the assignment will appear grayed out in the decompiler output. The first two lines of the function below show this:
-![Dead Stores](../img/dead-store-example.png "Dead Stores")
+![Dead Stores](../img/dead-store-example.png "Dead Stores"){ width="500" }
-In this case, these variables are actually unused and can be eliminated. You can tell Binary Ninja to do this by right clicking on the variable and choosing "Allow" from the "Dead Store Elimination" submenu.
+In this case, these variables are actually unused and can be eliminated. You can tell Binary Ninja to do this by right-clicking on the variable and choosing "Allow" from the "Dead Store Elimination" submenu.
-![Dead Store Elimination Menu](../img/dead-store-menu.png "Dead Store Elimination Menu")
+![Dead Store Elimination Menu](../img/dead-store-menu.png "Dead Store Elimination Menu"){ width="500" }
Performing this action on both variables in the example results in the following output:
-![Dead Store Elimination Results](../img/dead-store-after.png "Dead Store Elimination Results")
+![Dead Store Elimination Results](../img/dead-store-after.png "Dead Store Elimination Results"){ width="500" }
## Merging and Splitting Variables
-Binary Ninja can not always determine when two variables are simple copies of one another. When this condition occurs these variables can be merged in one of two ways.
+Binary Ninja automatically splits all variables that the analysis determines to be safely splittable. This allows the user to assign different types to different uses of the same register or memory location. Sometimes, however, the code is more clear if two or more of these variables are merged together into a single variable.
### Merge Variable Here
@@ -544,9 +651,9 @@ The `Merge Variable Here` action is bound to the hotkey `+` (i.e. `Shift + =` )
### Merge Variables
-For more complicated situations you can select the variable in question and use the "Merge Variables" dialog. By default this dialog is bound to the `=` hotkey. The dialog provides you with a searchable list of variables that can be merged or unmerged.
+For more complicated situations you can select the variable in question and use the "Merge Variables" dialog. By default, this dialog is bound to the `=` hotkey. The dialog provides you with a searchable list of variables that can be merged or unmerged.
-![Merge Variables](../img/merge-variables.png)
+![Merge Variables](../img/merge-variables.png){ width="400" }
There are 3 categories of variables that you can select from.
@@ -556,9 +663,32 @@ There are 3 categories of variables that you can select from.
Any of these merges can be undone if you determine them to be done in error by either using "Undo" or by bringing up this dialog again and unchecking the variables in question.
+### Removing Merges
+
+To unmerge a variable, either select "Split Merged Variable" from the context menu, or reenter the "Merge Variables..."
+dialog and deselect the variables that should no longer be merged.
+
+### Split Variables
+
+![Split Variable >](../img/split-var.png "Split Variable"){ width="200" }
+
+Variables that have multiple definitions can be manually split into multiple variables by clicking on the
+variable at a definition site and selecting "Split Variable at Definition" from the context menu.
+
+!!! Warning "Warning"
+ Splitting a variable manually can cause IL and decompilation to be incorrect. There are some
+ patterns where variables can be safely split semantically but analysis cannot determine that
+ it is safe, and this feature is provided to allow variable splitting to be performed in these
+ cases.
+
+Manually split variables will initially provide the selected definition as a separate variable, and all other
+definitions will be automatically resolved into one or more other variables. If some of the definitions should
+have been included as part of the same variable, use "Merge Variables..." from the context menu after splitting
+to select which of the other definitions should be merged.
+
## Script (Python) Console
-![console >](../img/console.png "Console")
+![console](../img/console.png "Console"){ width="800" }
The integrated script console is useful for small scripts that aren't worth writing as full plugins.
@@ -567,7 +697,7 @@ To trigger the console, either use `<BACKTICK>`, or use the `View`/`Python Conso
???+ Warning "Tip"
Note that `<BACKTICK>` will work in most contexts to open the console and focus its command line, unless the UI focus is in an editor widget.
-![console >](../img/console-split.png "Console Split")
+![console](../img/console-split.png "Console Split"){ width="800" }
When both the Script Console and the Log view are open, the title of both acts as a tab that can be dragged to either a tabbed view showing only one at a time (the default) or a split view showing both. Currently, the console and log views are part of a "Global Area", meaning they are always visible in the same position when switching between open binary tabs in the same window. This means they can only dock with each other, and not with the sidebar or the main pane view area. It is possible to open additional scripting consoles via the `Create Python Console` action in the [command palette](#command-palette), and these new consoles will appear as additional tabs in the topmost, leftmost tab in the global area. Note that `<BACKTICK>` will always focus the original main scripting console, and while any of the other created consoles can be closed (using the button that will appear when hovering over the right edge of its tab), the original one cannot be closed.
@@ -581,37 +711,37 @@ The scripting console is not a full IDE, but it has several convenience features
### Magic Console Variables
-The interactive python prompt also has several built-in "magic" functions and variables. Some are read-only, and some are writable to provide convenient interacitivty between the UI and console:
+The interactive python prompt also has several built-in "magic" functions and variables. Some are read-only, and some are writable to provide convenient interactivity between the UI and console:
- `here` / `current_address`: address of the current selection. It's settable too and will navigate the UI if changed
- `current_selection`: a tuple of the start and end addresses of the current selection. It's settable and will change the current selection
- `current_raw_offset`: the file offset that corresponds the current address. It's settable and will navigate to the corresponding file offset
-- `bv` / `current_view` / : the current [BinaryView](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView)
-- `current_function`: the current [Function](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function)
-- `current_basic_block`: the current [BasicBlock](https://api.binary.ninja/binaryninja.basicblock-module.html#binaryninja.basicblock.BasicBlock)
-- `current_llil`: the current [LowLevelILFunction](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILFunction)
-- `current_mlil`: the current [MediumLevelILFunction](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILFunction)
-- `current_hlil`: the current [HighLevelILFunction](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILFunction)
+- `bv` / `current_view` / : the current [`BinaryView`](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView)
+- `current_function`: the current [`Function`](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function)
+- `current_basic_block`: the current [`BasicBlock`](https://api.binary.ninja/binaryninja.basicblock-module.html#binaryninja.basicblock.BasicBlock)
+- `current_llil`: the current [`LowLevelILFunction`](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILFunction)
+- `current_mlil`: the current [`MediumLevelILFunction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILFunction)
+- `current_hlil`: the current [`HighLevelILFunction`](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILFunction)
- `write_at_cursor(data)`: function that writes data to the start of the current selection
- `get_selected_data()`: function that returns the data in the current selection
-- `current_il_index`: the current index of the IL instruction. It can be LLIL/MLIL/HLIL depending which one is shown in the UI
-- `current_il_instruction`: the current IL instruction. It can be LLIL/MLIL/HLIL depending which one is shown in the UI
-- `current_il_function`: the current IL function. It can be LLIL/MLIL/HLIL depending which one is shown in the UI
-- `current_il_basic_block`: the current IL basic block. It can be LLIL/MLIL/HLIL depending which one is shown in the UI
-- `current_token`: the current selected [InstructionTextToken](https://api.binary.ninja/binaryninja.architecture-module.html#binaryninja.architecture.InstructionTextToken). None if no token is selected
-- `current_data_var`: the current selected [DataVariable](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.DataVariable). None if no data variable is selected
-- `current_sections`: the list of [Section](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.Section)s that the current address is in. This the list can be empty
-- `current_segment`: the [Segment](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.Segment) that the current address is in.
+- `current_il_index`: the current index of the IL instruction. It can be LLIL/MLIL/HLIL depending on which one is shown in the UI
+- `current_il_instruction`: the current IL instruction. It can be LLIL/MLIL/HLIL depending on which one is shown in the UI
+- `current_il_function`: the current IL function. It can be LLIL/MLIL/HLIL depending on which one is shown in the UI
+- `current_il_basic_block`: the current IL basic block. It can be LLIL/MLIL/HLIL depending on which one is shown in the UI
+- `current_token`: the current selected [`InstructionTextToken`](https://api.binary.ninja/binaryninja.architecture-module.html#binaryninja.architecture.InstructionTextToken). None if no token is selected
+- `current_data_var`: the current selected [`DataVariable`](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.DataVariable). None if no data variable is selected
+- `current_sections`: the list of [`Section`](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.Section)s that the current address is in. This the list can be empty
+- `current_segment`: the [`Segment`](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.Segment) that the current address is in.
- `current_comment`: the comment at the current address. Writing to it sets comment at the current address
-- `current_symbol`: the [Symbol](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol) at the current address. None if there is no symbol
-- `current_symbols`: the list of [Symbol](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol)s at the current address
-- `current_var`: the current selected [Variable](https://api.binary.ninja/binaryninja.variable-module.html?highlight=variable#binaryninja.variable.Variable) in a function. Not to be confused with `current_data_var`
-- `current_ui_context`: the current [UIContext](https://api.binary.ninja/cpp/class_u_i_context.html)
-- `current_ui_view_frame`: the current [ViewFrame](https://api.binary.ninja/cpp/class_view_frame.html)
-- `current_ui_view`: the current [View](https://api.binary.ninja/cpp/class_view.html)
-- `current_ui_action_handler`: the current [UIActionHandler](https://api.binary.ninja/cpp/class_u_i_action_handler.html)
-- `current_ui_view_location`: the current [ViewLocation](https://api.binary.ninja/cpp/class_view_location.html)
-- `current_ui_action_context`: the current [UIActionContext](https://api.binary.ninja/cpp/struct_u_i_action_context.html)
+- `current_symbol`: the [`Symbol`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol) at the current address. None if there is no symbol
+- `current_symbols`: the list of [`Symbol`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol)s at the current address
+- `current_var`: the current selected [`Variable`](https://api.binary.ninja/binaryninja.variable-module.html?highlight=variable#binaryninja.variable.Variable) in a function. Not to be confused with `current_data_var`
+- `current_ui_context`: the current [`UIContext`](https://api.binary.ninja/cpp/class_u_i_context.html)
+- `current_ui_view_frame`: the current [`ViewFrame`](https://api.binary.ninja/cpp/class_view_frame.html)
+- `current_ui_view`: the current [`View`](https://api.binary.ninja/cpp/class_view.html)
+- `current_ui_action_handler`: the current [`UIActionHandler`](https://api.binary.ninja/cpp/class_u_i_action_handler.html)
+- `current_ui_view_location`: the current [`ViewLocation`](https://api.binary.ninja/cpp/class_view_location.html)
+- `current_ui_action_context`: the current [`UIActionContext`](https://api.binary.ninja/cpp/struct_u_i_action_context.html)
### startup.py
@@ -631,7 +761,7 @@ The "Run Script..." option in the File Menu allows loading a python script from
within the console. It can also be run via the Command Palette or bound to a key.
The script will have access to the same variables the Python console does, including the built-in special functions and
-variables defined by BinaryNinja, and any variables you have already defined within the console. It may be helpful to
+variables defined by Binary Ninja, and any variables you have already defined within the console. It may be helpful to
think of it as an equivalent to pasting the contents of the script within the console.
While `__name__` in the console is set to `'__console__'`, within a script it will be set to `'__main__'`. `__file__` is not
@@ -650,7 +780,7 @@ Note
Plugins can be installed by one of two methods. First, they can be installed via the Plugin Manager accessed via the `Plugins` / `Manage Plugins` menu or `[CMD/CTRL] m` hotkey.
-![plugin manager >](../img/plugin-manager.png "Plugin Manager")
+![plugin manager](../img/plugin-manager.png "Plugin Manager"){ width="1000" }
Second, they can be manually installed by adding the plugin (either a `.py` file or a folder implementing a python module with a `__init__.py` file) to the appropriate path:
@@ -662,10 +792,10 @@ For more detailed information on using plugins, see the [plugin guide](plugins.m
## Loading PDBs
-Binary Ninja supports loading PDB files through a built in PDB loader. It will automatically search for a corresponding PDB file whenever you load a Windows executable or library that was compiled with a PDB. The PDB loader will search a variety of places for PDBs, in the following order, if the files exist and match the guid in the analyzed file:
+Binary Ninja supports loading PDB files through a built-in PDB loader. It will automatically search for a corresponding PDB file whenever you load a Windows executable or library that was compiled with a PDB. The PDB loader will search a variety of places for PDBs, in the following order, if the files exist and match the GUID in the analyzed file:
-1. Look in symbol servers defined in the `_NT_SYMBOL_PATH` environment variable, as defined by [Microsoft's documentation](https://learn.microsoft.com/en-us/windows/win32/debug/using-symsrv).
-2. Look for the file at the path specified in the loaded binary. E.g. when `C:\Users\foo\foo.exe` was compiled, it stored `C:\Users\foo\foo.pdb` as metadata inside `foo.exe`, so `C:\Users\foo\foo.pdb` will be loaded if it exists (and matches the guid).
+1. Look in symbol servers defined in the `_NT_SYMBOL_PATH` environment variable, as defined by [Microsoft's documentation](https://learn.microsoft.com/en-us/windows/win32/debug/using-symsrv).
+2. Look for the file at the path specified in the loaded binary. E.g. when `C:\Users\foo\foo.exe` was compiled, it stored `C:\Users\foo\foo.pdb` as metadata inside `foo.exe`, so `C:\Users\foo\foo.pdb` will be loaded if it exists (and matches the guid).
3. Look in the same directory as the opened file/bndb (e.g. If you have opened `C:\foo.exe` or `C:\foo.bndb`, the PDB plugin looks for `C:\foo.pdb`)
4. Look in the local symbol store. This is the directory specified by `pdb.files.localStoreAbsolute` in the settings, if it exists. Otherwise, this is a folder relative to the Binary Ninja user directory, specified by the `pdb.files.localStoreRelative` setting (and possibly the `BN_USER_DIRECTORY` environment variable). This directory has the structure `<symbol store>\foo.pdb\<guid>\foo.pdb`, equivalent to a regular symbol server.
5. Attempt to connect and download the PDB from the list of symbol servers specified in setting `pdb.files.symbolServerList`, in order.
@@ -688,15 +818,15 @@ The PDB loader comes with a couple configuration options which enable and disabl
Binary Ninja now comes with a debugger plugin that can debug executables on Windows, Linux, and macOS.
-For more detailed information on plugins, see the [debugger guide](debugger.md).
+For more detailed information on plugins, see the [debugger guide](debugger/index.md).
## Updates
Binary Ninja automatically updates itself by default. This functionality can be disabled in the `Update Channel` dialog (`[CMD/CTRL] p`, `Update Channel`, or under the `Preferences` sub menu available under `Edit` on Linux and Windows, and the Application menu on macOS) preferences by turning off the `Update to latest version automatically` option. Regardless of whether automatic updates are enabled, it is always possible to check for updates by selecting `Check for Updates...` from either the command palette or under `Help` menu on Linux and Windows, and the Application menu on macOS.
-Updates are silently downloaded in the background and when complete an option to restart is displayed in the status bar. When an update is available but has not been applied, a blue up arrow will appear in the status bar. Clicking this arrow will apply the update once it ensures it has the lastest update, downloading it if necessary. Once the update is complete, a green arrow will appear in its place with the message "Restart to Apply Update". Even if the arrow is not clicked, once the arrow is green, Binary Ninja will replace itself with the new version as it launches whenever it is restarted.
+Updates are silently downloaded in the background and when complete an option to restart is displayed in the status bar. When an update is available but has not been applied, a blue up arrow will appear in the status bar. Clicking this arrow will apply the update once it ensures it has the latest update, downloading it if necessary. Once the update is complete, a green arrow will appear in its place with the message "Restart to Apply Update". Even if the arrow is not clicked, once the arrow is green, Binary Ninja will replace itself with the new version as it launches whenever it is restarted.
-On windows, this is achieved through a separate launcher that loads first and replaces the installation before launching the new version which you'll notice as a separate window. On macOS and Linux, the original installation is overwritten after the update occurs as these operating systems allow files to be replaced while running. The update on restart is thus immediate.
+On Windows, this is achieved through a separate launcher that loads first and replaces the installation before launching the new version which you'll notice as a separate window. On macOS and Linux, the original installation is overwritten after the update occurs as these operating systems allow files to be replaced while running. The update on restart is thus immediate.
Note
???+ Warning "Tip"
@@ -704,7 +834,7 @@ Note
### Development Branch
-Binary Ninja [stable builds](https://binary.ninja/changelog) releases happen on semi-regular intervals throughout the year. However, we also make development builds available to customers with active support. Simply use the update dialog, and select one of the "Development" channels in the `Update Channel` field.
+Binary Ninja [stable builds](https://binary.ninja/changelog) releases happen on semiregular intervals throughout the year. However, we also make development builds available to customers with active support. Simply use the update dialog, and select one of the "Development" channels in the `Update Channel` field.
## Support
diff --git a/docs/guide/migration/index.md b/docs/guide/migration/index.md
new file mode 100644
index 00000000..83309c50
--- /dev/null
+++ b/docs/guide/migration/index.md
@@ -0,0 +1,21 @@
+# Migrating from Other Tools
+
+Thank you for trying Binary Ninja! We know that it can be a bit different from what you're used to, so this page dedicated to getting you oriented in your new favorite decompiler!
+
+If you haven't already installed Binary Ninja, you can follow our [installation guide](../../getting-started.md#installing-binary-ninja).
+
+And be sure to check out some of our additional resource below before you click away!
+
+We have quick start guides for the following:
+
+- [New Users](../../getting-started.md)
+- [IDA Pro Users](migrationguideida.md)
+- [Ghidra Users](migrationguideghidra.md)
+
+## Additional Resources
+
+We love our community! Feel free to hang with us and chat in our [Public Slack Server](https://slack.binary.ninja). Our community is great about answering questions for each other, but one of our engineers will often get to your question first as well. We have a lot of different channels for different levels of engineers, different interests, topics, and so on.
+
+Our community has also generated a tremendous number of [community plugins](https://github.com/Vector35/community-plugins) that provide support for new architectures, automate different types of analysis, and even some that provide new and advanced visualizations for your programs. That repo also contains instructions for how to get your own plugin into our [plugin manager](../plugins.md#plugin-manager).
+
+If you think you've found a bug or have a suggestion for us, tell us over on [GitHub](https://github.com/Vector35/binaryninja-api). There are [discussions](https://github.com/Vector35/binaryninja-api/discussions) over there if you'd prefer to ask us something on GitHub instead of Slack. GitHub also hosts the vast majority of our [API and scripting examples](../../dev/cookbook.md) to help you start automating tasks! If you're really passionate about getting something fixed, we have [a _ton_ of open source repos](https://github.com/Vector35/binaryninja-api?tab=readme-ov-file#related-repositories) to contribute to, including every single one of our core architecture plugins.
diff --git a/docs/guide/migration/migrationguideghidra.md b/docs/guide/migration/migrationguideghidra.md
new file mode 100644
index 00000000..88f32675
--- /dev/null
+++ b/docs/guide/migration/migrationguideghidra.md
@@ -0,0 +1,119 @@
+# Migrating from Ghidra
+
+## Starting Binary Ninja
+
+Binary Ninja starts with the [New Tab Page](../index.md#new-tab) open. From here, you can optionally [start a project](../projects.md#creating-a-project) to work with multiple files, navigate your offline docs from the help menu, or just [open existing files](../index.md#loading-files) (including drag-and-drop!).
+
+## Decompiler Settings
+
+Binary Ninja likes to stay out of your way as much as possible, but sometimes you need to dig into the settings and change how a file is analyzed. If you have a file that can be opened with default settings, you won't get prompted for any additional input. Binary Ninja will automatically analyze the entire file — including running [linear sweep](https://binary.ninja/2017/11/06/architecture-agnostic-function-detection-in-binaries.html) — and provide you with linear decompilation for the whole file (like Ghidra's linear disassembly, but as decomp by default).
+
+If you're opening a [Universal Mach-O](https://en.wikipedia.org/wiki/Universal_binary), the Open with Options dialogue will appear so that you can choose which architecture to open (in the top right). If you have a default architecture you want to open whenever you open a universal binary, you can set your preference in a setting called [Universal Mach-O Architecture Preference](../settings.md#all-settings). You'll also see the Open with Options dialogue when Binary Ninja is unable to recognize the file type or otherwise needs user input to analyze the file (can't find the entry point, needs you to provide some memory mappings, etc).
+
+It's worth digging into Binary Ninja's [settings](../settings.md) and seeing what's available to tune, but if you ever want to change a setting for a single binary, you can Open (it) with Options. Go to File -> Open with Options, and any settings you change will apply to only that file.
+
+<!-- TODO : Can you analyze a file while Ghidra is running its analysis?
+## Analyzing While Analyzing -->
+
+## Keybindings
+
+Binary Ninja's keybindings are very different from Ghidra. Thankfully, [Binary Ninja's action system](https://binary.ninja/2024/02/15/command-palette.html) allows you to easily find actions and view the keybindings extremely easily. It'll also save you from digging through unfamiliar right-click menus while helping you learn any new keybindings. All actions can have their keybinding set, changed, or removed in the [keybindings menu](../index.md#default-hotkeys).
+
+Some of the most useful default keybindings are as follows:
+
+Analysis Keybindings:
+
+| Action | Keybinding |
+|----------------------|--------------------|
+| Rename | `N` |
+| Set Type | `Y` |
+| Go to | `G` |
+| Toggle Disasm/Decomp | `[TAB]` |
+| Toggle Graph/Linear | `[SPACE]` |
+| Toggle Hex View | `H` |
+| Insert Comment | `;` |
+| Manage Plugins | `[CTRL/⌘-SHIFT-B]` |
+| Open Command Palette | `[CTRL/⌘-P]` |
+| Open Python Console | `\`` |
+
+Types Keybindings:
+
+| Action | Keybinding |
+|----------------------|------------|
+| Set Type | Y |
+| Make C String | A |
+| Make Magic Struct | S |
+| Open Types Menu | T |
+| Make 1-byte elements | 1 |
+| Make 2-byte elements | 2 |
+| Make 4-byte elements | 4 |
+| Make 8-byte elements | 8 |
+| Make array | * |
+
+Common System Keybindings:
+
+| Action | Keybinding |
+|-------------------|--------------------|
+| Open File | `[CTRL/⌘-O]` |
+| Open with Options | `[CTRL/⌘-SHIFT-O]` |
+| Save | `[CTRL/⌘-S]` |
+| Undo | `[CTRL/⌘-Z]` |
+| Redo | `[CTRL/⌘-SHIFT-Z]` |
+| Find | `[CTRL/⌘-F]` |
+| Open Settings | `[CTRL/⌘-,]` |
+| Open Keybindings | `[CTRL/⌘-SHIFT-B]` |
+
+## Layout
+
+Binary Ninja's layout is also a bit different from what you're used to in Ghidra, but thankfully Binary Ninja's UI is flexible enough to allow us to build something that will feel familiar.
+
+### Theme
+
+This doesn't exactly have to do with your layout, but it go a long way towards making the interface feel a bit more familiar. We have an expansive list of [community themes](https://github.com/Vector35/community-themes), and [a guide](../../dev/themes.md) and a [blog post](https://binary.ninja/2021/07/08/creating-great-themes.html) on how to make your own. The built-in "Classic" theme should feel nostalgic, but if you're looking for a light theme that's slightly easier on the eyes, try out Summer or Solarized Light.
+
+### Feature Map
+
+Binary Ninja's [feature map](../index.md#feature-map) lives on the right side of your main view area. If you'd rather not see it, you can right-click it and select "Hide Feature Map."
+
+### Sidebars
+
+Our sidebars have a whole host of customization options, so make sure to check out [their dedicated docs](../index.md#the-sidebar) to maximize your workflow.
+
+That said, I'll walk you through how to set up your sidebars to get it looking very similar to what you're used to in Ghidra.
+
+#### Program Tree
+
+But first, there are a couple caveats. Binary Ninja does not have an exact 1-to-1 widget for everything in Ghidra. The Program Tree is one of those elements; it's a little bit like our memory map, but it's also kinda not. Our new Binary Ninja layout assumes you've closed the program tree in Ghidra. Now Binary Ninja and Ghidra's sidebars are starting to match by having the symbols view on the top (which we start as a flat listing for you to organize into file yourself), and a different sidebar panel below it. Be sure to check out the options in the Symbols list's hamburger menu (the three lines in the top right).
+
+#### Cross References and Types Manager
+
+We show cross references by default, but you can toggle that just by clicking it off on the left side under the divider line. If you want to match how Ghidra has it's types showing on the bottom, you can simply drag the types widget to beneath the divider line on the left side. Whenever you open your sidebar, both areas will open together. The Types sidebar also shows you the full type definition when you select a type.
+
+#### Main Area
+
+Time for the main event!
+
+Ghidra shows you a linear view on the left, and single-function-at-a-time decompilation on the right. We already gave you linear decompilation of the whole Binary here by default, so there are three last things to do:
+
+1. Create a new pane by pressing the icon in the top right that looks like a rectangle with a line through it. The two panes are now synced by address, as you’d expect.
+2. In the left pane, find the drop down that says "High Level IL", and switch down to disassembly. You should now have linear disassembly on the left, and linear decompilation on the right.
+3. The final touch is to go back to the decompilation pane on the right and find the hamburger menu for that pane in the top right, and then select “Single Function View.”
+
+Now the UI should be looking extremely familiar. Read our last couple of tips below, don't forget to use the command palette to find what you want to do, and you'll be off analyzing binaries in no time!
+
+#### Saving Layouts
+
+Now that you've done all this hard work to make the perfect layout, it would be a shame to lose it! Thankfully, we make it easy. Go to the `Window` → `Layout` → `Save Current Layout...` and give it a name, or select `Save Current Layout as Default`. Named layouts let you quickly swap between different kinds of work.
+
+## What You'll Love
+
+...about switching to Binary Ninja! We know leaving your old tool behind can be hard, and there will be things you miss, but we think there are a lot of features packed into Binary Ninja that you'll love. Here are a couple we think you'll appreciate:
+
+ - [Updates every day](../index.md#updates) on the dev branch (nearly) - accepted PRs can be in everyone's hands within hours.
+ - [Our awesome native Python API](../../dev/cookbook.md) (and [C++](https://api.binary.ninja/cpp/), and [Rust](https://dev-rust.binary.ninja/))
+ - [The speed](https://binary.ninja/2022/05/31/3.1-the-performance-release.html)
+ - ...not needing to manage Java installations
+
+---
+
+Don't forget to check out our [additional resources](index.md#additional-resources)!
diff --git a/docs/guide/migration/migrationguideida.md b/docs/guide/migration/migrationguideida.md
new file mode 100644
index 00000000..88914439
--- /dev/null
+++ b/docs/guide/migration/migrationguideida.md
@@ -0,0 +1,66 @@
+# Migrating from IDA
+
+## Starting Binary Ninja
+
+Binary Ninja starts with the [New Tab Page](../index.md#new-tab) open. From here, you can optionally [start a project](../projects.md#creating-a-project) to work with multiple files, [create new files](../index.md#new-files) to paste in data, or just [open existing files](../index.md#loading-files) (including drag-and-drop!).
+
+## Decompiler Settings
+
+Binary Ninja likes to stay out of your way as much as possible, but sometimes you need to dig into the settings and change how a file is analyzed. If you have a file that can be opened with default settings, you won't get prompted for any additional input. Binary Ninja will automatically analyze the entire file — including running [linear sweep](https://binary.ninja/2017/11/06/architecture-agnostic-function-detection-in-binaries.html) — and provide you with linear decompilation for the whole file (like IDA's linear disassembly, but as decomp by default).
+
+If you're opening a [Universal Mach-O](https://en.wikipedia.org/wiki/Universal_binary), the Open with Options dialogue will appear so that you can choose which architecture to open (in the top right). If you have a default architecture you want to open whenever you open a universal binary, you can set your preference in a setting called [Universal Mach-O Architecture Preference](../settings.md#all-settings). You'll also see the Open with Options dialogue when Binary Ninja is unable to recognize the file type or otherwise needs user input to analyze the file (can't find the entry point, needs you to provide some memory mappings, etc).
+
+It's worth digging into Binary Ninja's [settings](../settings.md) and seeing what's available to tune, but if you ever want to change a setting for a single binary, you can Open (it) with Options. Go to File -> Open with Options, and any settings you change will apply to only that file.
+
+<!-- TODO : Can you analyze a file while IDA is running its analysis?
+## Analyzing While Analyzing -->
+
+## Keybindings
+
+Most of the keybindings you're used to are the same. Any "actions" (renaming, setting types, opening cross-references, etc) you might want to perform can be found in the [command palette](../index.md#command-palette), which will save you from digging through unfamiliar right-click menus and help you learn any new keybindings. You can even [add your own actions](https://binary.ninja/2024/02/15/command-palette.html#how-do-i-register-actions-with-the-command-palette-myself) with ease. All actions can have their keybinding set, changed, or removed in the [keybindings menu](../index.md#default-hotkeys).
+
+Some major exceptions are:
+
+- Save is `[CTRL/⌘-S]`.
+- All our find options are under `[CTRL/⌘-F]`.
+- The "subviews" keybindings are:
+ - `T` for Types
+ - `H` to toggle to/from Hex View
+ - `[TAB]` to toggle to/from disassembly
+
+## Theme
+
+We like our dark themes, but understand they're not for everyone. We have an expansive list of [community themes](https://github.com/Vector35/community-themes), and [a guide](../../dev/themes.md) and a [blog post](https://binary.ninja/2021/07/08/creating-great-themes.html) on how to make your own. The built-in "Classic" theme should feel nostalgic, but if you're looking for a light theme that's slightly easier on the eyes, try out Summer or Solarized Light.
+
+## Layout
+
+Binary Ninja's layout is very similar to what you're used to in IDA, but there's one setting you might want to change and a handful of improvements to look out for as well.
+
+### Feature Map
+
+If you want the [feature map](../index.md#feature-map) back to where you're used to, right-click it, find "Feature Map Location" and change it to the top. That said, take notice that Binary Ninja's feature map is 2d: both directions you move your cursor changes the address in Binary Ninja. The exact number of bytes that fit across the width of the feature map scales to the size of the binary. You can disable this in the right-click menu by selecting "Linear Feature Map."
+
+We also have an entropy map, if you need it, but it's tucked away in [triage view](https://binary.ninja/2019/04/01/hackathon-2019-summary.html#triage-mode-rusty).
+
+### Sidebars
+
+Our sidebars have a whole host of customization options, so make sure to check out [their dedicated docs](../index.md#the-sidebar) to maximize your workflow.
+
+#### Main Area
+
+Binary Ninja shows you linear decompilation by default for the whole binary. However, some people strongly prefer the "single function at a time" workflow, so we made an option for that too. Find the small hamburger menu (the three line pop-out menu) in the top right of your view and select “Single Function View.”
+
+Check out the [tiling panes](../index.md#tiling-panes) docs for more information.
+
+## What You'll Love
+
+...about switching to Binary Ninja! We know leaving your old tool behind can be hard, and there will be things you miss, but we think there are a lot of features packed into Binary Ninja that you'll love. Here are a couple we think you'll appreciate:
+
+ - Decompilation for every architecture, including [ones you bring yourself](https://binary.ninja/2020/01/08/guide-to-architecture-plugins-part1.html)
+ - [Updates every day](../index.md#updates) on the dev branch (nearly)
+ - [Our awesome native Python API](../../dev/cookbook.md) (and [C++](https://api.binary.ninja/cpp/), and [Rust](https://dev-rust.binary.ninja/))
+ - [**So** much open source](https://github.com/Vector35/binaryninja-api?tab=readme-ov-file#related-repositories) (that includes our architecture modules!)
+
+---
+
+Don't forget to check out our [additional resources](index.md#additional-resources)!
diff --git a/docs/guide/objectivec.md b/docs/guide/objectivec.md
index f101d7a5..4178fc0e 100644
--- a/docs/guide/objectivec.md
+++ b/docs/guide/objectivec.md
@@ -31,14 +31,14 @@ analysis. _If you have already marked up Objective-C structures or modified
function types yourself, be aware that they may be overwritten when this action
is run._
-![](../img/objc_analyze_action.png)
+![](../img/objc-analyze-action.png)
### Workflow
To utilize function call cleanup, the workflows feature must be enabled, and the
Objective-C workflow must be chosen when loading a binary for analysis.
-![](../img/objc_workflow_selected.png)
+![](../img/objc-workflow-selected.png)
This will automatically apply structure analysis as the binary is analyzed and
also translate `objc_msgSend` calls to direct method calls, where possible.
diff --git a/docs/guide/plugins.md b/docs/guide/plugins.md
index e7e8ec48..0807f069 100644
--- a/docs/guide/plugins.md
+++ b/docs/guide/plugins.md
@@ -12,7 +12,7 @@ Note that plugins installed via the [PluginManager API](https://api.binary.ninja
## Plugin Manager
-![Plugin Manager >](../img/plugin-manager.png "Plugin Manager")
+![Plugin Manager](../img/plugin-manager.png "Plugin Manager"){ width="1000" }
Plugins can be installed directly via the GUI from Binary Ninja. You can launch the plugin manager via any of the following methods:
diff --git a/docs/guide/projects.md b/docs/guide/projects.md
new file mode 100644
index 00000000..8f4366c1
--- /dev/null
+++ b/docs/guide/projects.md
@@ -0,0 +1,122 @@
+# Projects
+
+Projects provide a way to keep and organize related binaries, databases, and resources in a managed format.
+
+???+ Important "Supported Editions"
+ Projects are only available in the Commercial and Enterprise editions of Binary Ninja
+
+## Creating a Project
+
+A new project can be created by either selecting `New Project` from the new tab page or `File > New Project` from the application toolbar. After creation, the new project will be opened automatically.
+
+## Opening a Project
+
+Existing projects can be opened by:
+
+- Opening the `.bnpm` (or `.bnpr` on macOS) like any other file in Binary Ninja
+- Double-clicking the project from the "Recent Projects" list in a new tab
+
+When a project is first opened, a new window will be created for it. This window is permanently tied to this project, meaning that it will only contain files associated with this project.
+
+## Structure on Disk
+
+A project has a few components stored on disk:
+
+- A top-level `.bnpr` directory that contains everything
+- A `project.bnpm` project metadata file
+- Optionally a `settings.json` file if project settings have been modified
+- A `data` directory that contains the data for files in the project
+
+## Project Browser
+
+The primary method of interaction with a project is through the "Project Browser" UI.
+
+![Project View](../img/projects.png "Projects")
+
+1. The name of the project
+2. Edit project details
+3. Description of project
+4. Import files to the project
+5. Import a folder to the project
+6. View and modify project-level settings
+7. Tab for project file tree
+8. Tab for Recent project file list
+9. Refresh project
+10. Filter the current view for files and folders
+11. Project contents tree
+12. Info widget showing details about the currently selected items
+13. Description of currently selected item
+
+### Adding Files to a Project
+
+There are a handful of ways to add files to a project:
+
+- Drag and drop files and folders directly into the project browser
+- Using the `Import Files` button, select files to add to the currently selected folder
+- Using the `Import Folder` button, select a folder to recursively import under the selected folder
+
+### Exporting Files from a Project
+
+To export files/folders from a project, select any number of files and folders in the project browser and choose `Export Selected` from the context menu or `Project Browser - Export Selected` from the command palette.
+
+### Batch Analysis
+
+Files in a project can be batch-analyzed easily from the project browser. Simply select the files to analyze and choose `Analyze Selected` from the context menu or `Project Browser - Analyze Selected` from the command palette. This will create a BNDB for each selected file, unless it is a BNDB itself.
+
+## Project Settings
+
+Project level settings let you set project-wide settings that apply to every file in the project. See the [settings documentation](settings.md) for more information.
+
+## External Links
+
+![External Links](../img/external-links.png "External Links"){ width="400" }
+
+In the `External Links` sidebar widget, there is a top level entry for each defined `External Library`. Additionally, there is a special top-level entry: `<No Library>`, that contains all `External Locations` that are yet to be assigned to an `External Library`.
+
+
+
+### External Libraries
+
+An External Library represents a full library, optionally backed by a project file (e.g. `libc.so` which is backed by `libc.bndb`).
+
+
+#### Creating an External Library
+
+![Creating External Library](../img/external-links-edit-external-library.png "Creating External Library"){ width="800" }
+
+Creating an `External Library` can be done via context menu or command palette action `Create External Library...` with the `External Links` sidebar widget focused. This will open a dialog that lets you specify the name and (optionally) the file backing the new library. `External Libraries` are identified by a unique name that is immutable after creation.
+
+
+#### Editing an External Library
+
+Editing an existing `External Library` can be done via context menu or command palette action `Edit External Library...` with a library entry selected. This uses the same dialog as creation, but the "name" field is not editable.
+
+
+#### Removing an External Library
+
+Removing an `External Library` can be done via context menu or command palette action `Remove External Library...` with a library entry selected. This will delete the `External Library`, and all associated `External Locations` will have their library unassigned.
+
+
+### External Locations
+
+An External Location represents a symbol in a `Binary View` that points to an external target address and/or symbol in an `External Library` (e.g. `strcpy` points to `strcpy` in `libc.so`). When attempting to navigate to the symbol that is the source of an `External Location` with an `External Library` assigned, you will instead navigate to the destination address or symbol in the `External Library`, if it is backed by a file.
+
+
+#### Creating an External Location
+
+![Creating External Location](../img/external-links-edit-external-location.png "Creating External Location"){ width="600" }
+
+
+Creating an `External Location` can be done via context menu or command palette action `Create External Location...` with the `External Links` sidebar widget focused. This will open a dialog that lets you specify the internal symbol that is the source of the link, (optionally) the library that the `External Location` points to, and the external symbol and/or address. `External Locations` must always have at least one of the external symbol or address populated.
+
+
+#### Editing an External Location
+
+Editing an `External Location` can be done via context menu or command palette action `Edit External Location...` with a location entry selected. This uses the same dialog as creation, but the "internal symbol" field is not editable.
+
+To easily change the assigned library for one or more `External Locations`, you can select and drag them to the desired `External Library` top-level entry.
+
+
+#### Removing an External Location
+
+Removing an `External Location` can be done via context menu or command palette action `Remove External Location...` with a location entry selected.
diff --git a/docs/guide/settings.md b/docs/guide/settings.md
index 7a8714fe..02284f73 100644
--- a/docs/guide/settings.md
+++ b/docs/guide/settings.md
@@ -2,7 +2,7 @@
## UI
-![settings >](../img/settings.png "Settings")
+![settings](../img/settings.png "Settings"){ width="800" }
Binary Ninja provides various settings which are available via the `[CMD/CTRL] ,` hotkey for *User* settings and the `[CMD/CTRL] .` hotkey for *Resource* settings which apply to the current BinaryView. These settings allow a wide variety of customization of the user interface and functional aspects of the analysis environment.
@@ -30,29 +30,30 @@ All settings are uniquely identified with an identifier string. Identifiers are
## All Settings
|Category|Setting|Description|Type|Default|Scope|Key|
|---|---|---|---|---|---|---|
+|analysis|Alternate Type Propagation|Enable an alternate approach for function type propagation. This setting is experimental and may be useful for some binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.alternateTypePropagation'>analysis.alternateTypePropagation</a>|
+|analysis|Automatic Name Variables|Automatically name variables according to their usage.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.autoNameVariables'>analysis.autoNameVariables</a>|
|analysis|Disallow Branch to String|Enable the ability to halt analysis of branch targets that fall within a string reference. This setting may be useful for malformed binaries.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.conservative.disallowBranchToString'>analysis.conservative.disallowBranchToString</a>|
+|analysis|Correlated Memory Value Propagation|Attempt to propagate the value of an expression from a memory definition to a usage. Currently this feature is simplistic and the scope is a single basic block. This setting is experimental and may be useful for some binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.correlatedMemoryValuePropagation'>analysis.correlatedMemoryValuePropagation</a>|
|analysis|Purge Original Filename Path|When saving a database, remove all path information from the Original Filename field|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='analysis.database.purgeOriginalFilenamePath'>analysis.database.purgeOriginalFilenamePath</a>|
|analysis|Purge Snapshots|When saving a database, purge old snapshots keeping only the current snapshot.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='analysis.database.purgeSnapshots'>analysis.database.purgeSnapshots</a>|
|analysis|Purge Undo History|When saving a database, purge current and existing undo history.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='analysis.database.purgeUndoHistory'>analysis.database.purgeUndoHistory</a>|
|analysis|Suppress Reanalysis|Disable function reanalysis on database load when the product version or analysis settings change.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.database.suppressReanalysis'>analysis.database.suppressReanalysis</a>|
|analysis|External Debug Info File|Separate file to attempt to parse and import debug information from.|`string`| |[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.debugInfo.external'>analysis.debugInfo.external</a>|
|analysis|Import Debug Information|Attempt to parse and apply debug information from each file opened.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.debugInfo.internal'>analysis.debugInfo.internal</a>|
-|analysis|Alternate Type Propagation|Enable an alternate approach for function type propagation. This setting is experimental and may be useful for some binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.alternateTypePropagation'>analysis.experimental.alternateTypePropagation</a>|
-|analysis|Correlated Memory Value Propagation|Attempt to propagate the value of an expression from a memory definition to a usage. Currently this feature is simplistic and the scope is a single basic block. This setting is experimental and may be useful for some binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.correlatedMemoryValuePropagation'>analysis.experimental.correlatedMemoryValuePropagation</a>|
|analysis|Early Stack Constant Propagation|Propagate constants stored on the stack during Low Level IL analysis. This allows stack offsets to be resolved when stack pointer updates use constants placed on the stack.|`string`|`inlined`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.earlyStackConstantPropagation'>analysis.experimental.earlyStackConstantPropagation</a>|
| | | enum: Do not perform early constant propagation for stack variables|`enum`|`off`| | |
| | | enum: Only perform early constant propagation when one or more functions have been inlined into the function|`enum`|`inlined`| | |
| | | enum: Always perform early constant propagation for stack variables|`enum`|`on`| | |
|analysis|Gratuitous Function Update|Force the function update cycle to always end with an IncrementalAutoFunctionUpdate type.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.gratuitousFunctionUpdate'>analysis.experimental.gratuitousFunctionUpdate</a>|
-|analysis|Heuristic Value Range Clamping|Use DataVariable state inferencing to help determine the possible size of a lookup table.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.heuristicRangeClamp'>analysis.experimental.heuristicRangeClamp</a>|
|analysis|Keep Dead Code Branches|Keep unreachable code branches and associated basic blocks in HLIL.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.keepDeadCodeBranches'>analysis.experimental.keepDeadCodeBranches</a>|
-|analysis|Return Value Propagation|Propagate and use constant return values from functions in the caller in order to simplify downstream expressions.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.returnValuePropagation'>analysis.experimental.returnValuePropagation</a>|
-|analysis|Translate Windows CFG Calls|Attempt to identify and translate calls to `_guard_dispatch_icall_nop` to improve analysis of control flow guard binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.translateWindowsCfgCalls'>analysis.experimental.translateWindowsCfgCalls</a>|
|analysis|Extract Types From Mangled Names|Attempt to extract types from mangled names using the demangler. This can lead to recovering inaccurate parameters.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.extractTypesFromMangledNames'>analysis.extractTypesFromMangledNames</a>|
|analysis|Always Analyze Indirect Branches|When using faster analysis modes, perform full analysis of functions containing indirect branches.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.forceIndirectBranches'>analysis.forceIndirectBranches</a>|
+|analysis|Heuristic Value Range Clamping|Use DataVariable state inferencing to help determine the possible size of a lookup table.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.heuristicRangeClamp'>analysis.heuristicRangeClamp</a>|
|analysis|Aggressive Condition Complexity Removal Threshold|High Level IL tuning parameter.|`number`|`64`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.aggressiveConditionComplexityRemovalThreshold'>analysis.hlil.aggressiveConditionComplexityRemovalThreshold</a>|
+|analysis|Graph Optimizer Limit|High Level IL tuning parameter.|`number`|`64`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.graphOptimizerLimit'>analysis.hlil.graphOptimizerLimit</a>|
|analysis|Max Condition Complexity|High Level IL tuning parameter.|`number`|`1024`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.maxConditionComplexity'>analysis.hlil.maxConditionComplexity</a>|
|analysis|Max Condition Reduce Iterations|High Level IL tuning parameter.|`number`|`1024`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.maxConditionReduceIterations'>analysis.hlil.maxConditionReduceIterations</a>|
+|analysis|Maximum Expression Count|High Level IL tuning parameter.|`number`|`1048576`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.maxExpressionCount'>analysis.hlil.maxExpressionCount</a>|
|analysis|Max Intermediate Condition Complexity|High Level IL tuning parameter.|`number`|`1048576`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.maxIntermediateConditionComplexity'>analysis.hlil.maxIntermediateConditionComplexity</a>|
|analysis|Eliminate Pure Calls during HLIL Optimization|Whether or not pure calls (calls to functions with no side-effects) are removed during HLIL optimizations.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.pureCallElimination'>analysis.hlil.pureCallElimination</a>|
|analysis|Strict Memory Ordering|Prevents reordering of memory reads during HLIL optimization.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.strictMemoryOrdering'>analysis.hlil.strictMemoryOrdering</a>|
@@ -77,6 +78,8 @@ All settings are uniquely identified with an identifier string. Identifiers are
|analysis|Low Entropy Threshold for Linear Sweep|Regions in the binary at or below this threshold are not included in the search space for linear sweep.|`number`|`0.025`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.linearSweep.entropyThresholdLow'>analysis.linearSweep.entropyThresholdLow</a>|
|analysis|Max Linear Sweep Work Queues|The number of binary regions under concurrent analysis.|`number`|`64`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.linearSweep.maxWorkQueues'>analysis.linearSweep.maxWorkQueues</a>|
|analysis|Permissive Linear Sweep|Permissive linear sweep searches all executable segments regardless of read/write permissions. By default, linear sweep searches sections that are ReadOnlyCodeSectionSemantics, or if no sections are defined, segments that are read/execute.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.linearSweep.permissive'>analysis.linearSweep.permissive</a>|
+|analysis|Program's Exit Symbol List|A list of common 'exit' symbols to search for when 'Navigate to Program's Main' is enabled.|`array`|[`_cexit`, `_exit`, `_o__cexit`, `_o_exit`, `common_exit`, `doexit`, `exit`]|[`SettingsUserScope`]|<a id='analysis.mainFunctionDetection.exitSymbols'>analysis.mainFunctionDetection.exitSymbols</a>|
+|analysis|Program's Main Symbol List|A list of common 'main' symbols to search for when 'Navigate to Program's Main' is enabled.|`array`|[`WinMain`, `_main`, `main`, `wWinMain`]|[`SettingsUserScope`]|<a id='analysis.mainFunctionDetection.mainSymbols'>analysis.mainFunctionDetection.mainSymbols</a>|
|analysis|Load/Store Splitting|Controls splitting of oversized variable field accesses into appropriately sized accesses|`string`|`validFieldsOnly`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.mlil.loadStoreSplitting'>analysis.mlil.loadStoreSplitting</a>|
| | | enum: Do not split oversized accesses to fields|`enum`|`off`| | |
| | | enum: Split oversized accesses to valid fields and hide accessed gaps/alignment/padding bytes|`enum`|`validFieldsOnly`| | |
@@ -88,10 +91,12 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | enum: Perform full analysis of the binary.|`enum`|`full`| | |
|analysis|Builtin Outlining of Constant Expressions|Enable outlining of constant expression compiler emitted builtins.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.outlining.builtins'>analysis.outlining.builtins</a>|
|analysis|Autorun Pointer Sweep|Automatically run pointer sweep when opening a binary for analysis.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.pointerSweep.autorun'>analysis.pointerSweep.autorun</a>|
+|analysis|Return Value Propagation|Propagate and use constant return values from functions in the caller in order to simplify downstream expressions.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.returnValuePropagation'>analysis.returnValuePropagation</a>|
|analysis|Autorun Function Signature Matcher|Automatically run the function signature matcher when opening a binary for analysis.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.signatureMatcher.autorun'>analysis.signatureMatcher.autorun</a>|
|analysis|Auto Function Analysis Suppression|Enable suppressing analysis of automatically discovered functions.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.suppressNewAutoFunctionAnalysis'>analysis.suppressNewAutoFunctionAnalysis</a>|
|analysis|Tail Call Heuristics|Attempts to recover function starts that may be obscured by tail call optimization (TCO). Specifically, branch targets within a function are analyzed as potential function starts.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.tailCallHeuristics'>analysis.tailCallHeuristics</a>|
|analysis|Tail Call Translation|Performs tail call translation for jump instructions where the target is an existing function start.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.tailCallTranslation'>analysis.tailCallTranslation</a>|
+|analysis|Translate Windows CFG Calls|Attempt to identify and translate calls to `_guard_dispatch_icall_nop` to improve analysis of control flow guard binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.translateWindowsCfgCalls'>analysis.translateWindowsCfgCalls</a>|
|analysis|Padding Threshold|Specify the minimum number of undefined bytes in a structure type before __padding notation is used when rendering the type to text. This setting does not affect exporting types to a file, where the __padding notation will always be used.|`number`|`1024`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.types.paddingThreshold'>analysis.types.paddingThreshold</a>|
|analysis|Type Parser|Specify the implementation used for parsing types from text.|`string`|`ClangTypeParser`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.types.parserName'>analysis.types.parserName</a>|
| | | |`enum`|`ClangTypeParser`| | |
@@ -102,7 +107,8 @@ All settings are uniquely identified with an identifier string. Identifiers are
|analysis|UTF-16 Encoding|Whether or not to consider UTF-16 code points when searching for strings.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.unicode.utf16'>analysis.unicode.utf16</a>|
|analysis|UTF-32 Encoding|Whether or not to consider UTF-32 code points when searching for strings.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.unicode.utf32'>analysis.unicode.utf32</a>|
|analysis|UTF-8 Encoding|Whether or not to consider UTF-8 code points when searching for strings.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.unicode.utf8'>analysis.unicode.utf8</a>|
-|arch|MIPS Disassembly Pseudo-Op|Enable use of pseudo-op instructions in MIPS disassembly.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='arch.mips.disassembly.pseudo_ops'>arch.mips.disassembly.pseudo_ops</a>|
+|arch|AARCH64 Alignment Requirement|Require instructions be on 4-byte aligned addresses to be disassembled.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='arch.aarch64.disassembly.alignRequired'>arch.aarch64.disassembly.alignRequired</a>|
+|arch|MIPS Disassembly Pseudo-Op|Enable use of pseudo-op instructions in MIPS disassembly.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='arch.mips.disassembly.pseudoOps'>arch.mips.disassembly.pseudoOps</a>|
|arch|x86 Disassembly Case|Specify the case for opcodes, operands, and registers.|`boolean`|`True`|[`SettingsUserScope`]|<a id='arch.x86.disassembly.lowercase'>arch.x86.disassembly.lowercase</a>|
|arch|x86 Disassembly Separator|Specify the token separator between operands.|`string`|`, `|[`SettingsUserScope`]|<a id='arch.x86.disassembly.separator'>arch.x86.disassembly.separator</a>|
|arch|x86 Disassembly Syntax|Specify disassembly syntax for the x86/x86_64 architectures.|`string`|`BN_INTEL`|[`SettingsUserScope`]|<a id='arch.x86.disassembly.syntax'>arch.x86.disassembly.syntax</a>|
@@ -113,12 +119,13 @@ All settings are uniquely identified with an identifier string. Identifiers are
|corePlugins|ARMv7 Architecture|Enable the built-in ARMv7 architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.armv7'>corePlugins.architectures.armv7</a>|
|corePlugins|MIPS Architecture|Enable the built-in MIPS architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.mips'>corePlugins.architectures.mips</a>|
|corePlugins|PowerPC Architecture|Enable the built-in PowerPC architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.powerpc'>corePlugins.architectures.powerpc</a>|
+|corePlugins|RISC-V Architecture|Enable the built-in RISC-V architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.riscv'>corePlugins.architectures.riscv</a>|
|corePlugins|x86/x86_64 Architecture|Enable the built-in x86/x86_64 architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.x86'>corePlugins.architectures.x86</a>|
|corePlugins|Crypto Plugin|Enable the built-in crypto plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.crypto'>corePlugins.crypto</a>|
|corePlugins|Database Viewer (Debug)|Enable the built-in Database Viewer plugin. Be aware this is a debug feature and may not be well-behaved.|`boolean`|`False`|[`SettingsUserScope`]|<a id='corePlugins.databaseViewer'>corePlugins.databaseViewer</a>|
|corePlugins|Debugger|Enable the built-in debugger plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.debugger'>corePlugins.debugger</a>|
-|corePlugins|DWARF Export Plugin|Enable the experimental DWARF export plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.dwarfExport'>corePlugins.dwarfExport</a>|
-|corePlugins|DWARF Import Plugin|Enable the experimental DWARF import plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.dwarfImport'>corePlugins.dwarfImport</a>|
+|corePlugins|DWARF Export Plugin|Enable the DWARF export plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.dwarfExport'>corePlugins.dwarfExport</a>|
+|corePlugins|DWARF Import Plugin|Enable the DWARF import plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.dwarfImport'>corePlugins.dwarfImport</a>|
|corePlugins|PDB Import Plugin|Enable the built-in PDB import plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.pdbImport'>corePlugins.pdbImport</a>|
|corePlugins|DECREE Platform|Enable the built-in DECREE platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.decree'>corePlugins.platforms.decree</a>|
|corePlugins|EFI Platform|Enable the built-in EFI platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.efi'>corePlugins.platforms.efi</a>|
@@ -126,7 +133,9 @@ All settings are uniquely identified with an identifier string. Identifiers are
|corePlugins|Linux Platform|Enable the built-in Linux platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.linux'>corePlugins.platforms.linux</a>|
|corePlugins|macOS Platform|Enable the built-in macOS platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.mac'>corePlugins.platforms.mac</a>|
|corePlugins|Windows Platform|Enable the built-in Windows platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.windows'>corePlugins.platforms.windows</a>|
+|corePlugins|Windows Kernel Platform|Enable the built-in Window Kernel platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.windows_kernel'>corePlugins.platforms.windows_kernel</a>|
|corePlugins|Triage Plugin|Enable the built-in triage plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.triage'>corePlugins.triage</a>|
+|corePlugins|Type Archive Inspector (Debug)|Enable the built-in Type Archive Inspector plugin. Be aware this is a debug feature and may not be well-behaved.|`boolean`|`False`|[`SettingsUserScope`]|<a id='corePlugins.typeArchiveViewer'>corePlugins.typeArchiveViewer</a>|
|corePlugins|ELF View|Enable the built-in ELF view module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.view.elf'>corePlugins.view.elf</a>|
|corePlugins|Mach-O View|Enable the built-in Mach-O view module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.view.macho'>corePlugins.view.macho</a>|
|corePlugins|PE/COFF View|Enable the built-in PE/COFF view module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.view.pe'>corePlugins.view.pe</a>|
@@ -190,6 +199,7 @@ All settings are uniquely identified with an identifier string. Identifiers are
|python|Python Virtual Environment Site-Packages|The 'site-packages' directory for your python virtual environment.|`string`| |[`SettingsUserScope`]|<a id='python.virtualenv'>python.virtualenv</a>|
|rendering|Show variable and integer annotations|Show variable and integer annotations in disassembly i.e. {var_8}|`boolean`|`True`|[`SettingsUserScope`]|<a id='rendering.annotations'>rendering.annotations</a>|
|rendering|Show All Expression Types in Debug Reports|Enables the "Show All Expression Types" option in debug reports.|`boolean`|`False`|[`SettingsUserScope`]|<a id='rendering.debug.types'>rendering.debug.types</a>|
+|rendering|Add New Lines Around Scopes|Add extra newlines in HLIL between closing scopes and the following instructions.|`number`|`0`|[`SettingsUserScope`]|<a id='rendering.hlil.newLinesAroundScopes'>rendering.hlil.newLinesAroundScopes</a>|
|rendering|HLIL Scoping Style|Controls the display of new scopes in HLIL.|`string`|`default`|[`SettingsUserScope`]|<a id='rendering.hlil.scopingStyle'>rendering.hlil.scopingStyle</a>|
| | | enum: Default BNIL scoping style.|`enum`|`default`| | |
| | | enum: Braces around scopes, same line.|`enum`|`braces`| | |
@@ -212,10 +222,11 @@ All settings are uniquely identified with an identifier string. Identifiers are
|triage|Always Prefer Triage Summary View|Always prefer opening binaries in Triage Summary view, even when performing full analysis.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='triage.preferSummaryView'>triage.preferSummaryView</a>|
|triage|Prefer Triage Summary View for Raw Files|Prefer opening raw files in Triage Summary view.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='triage.preferSummaryViewForRaw'>triage.preferSummaryViewForRaw</a>|
|ui|Allow Welcome Popup|By default, the welcome window will only show up when it has changed and this install has not seen it. However, disabling this setting will prevent even that.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.allowWelcome'>ui.allowWelcome</a>|
-|ui|Enable the new Symbols UI (Experimental)|Enables the new Symbols UI. The upgraded UI supports Folders, displaying addresses, and much more. Be aware that this is a feature preview and may still have issues.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.components.enabled'>ui.components.enabled</a>|
|ui|Dock Window Title Bars|Enable to display title bars for dockable windows attached to a main window.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.docks.titleBars'>ui.docks.titleBars</a>|
+|ui|Developer Tools|Enables Qt UI development tooling. Requires a restart and creates a new sidebar icon that can be enabled.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.experimental.uiDeveloperTools'>ui.experimental.uiDeveloperTools</a>|
|ui|Feature Map|Enable the feature map which displays a visual overview of the BinaryView.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.featureMap.enable'>ui.featureMap.enable</a>|
|ui|Feature Map File-Backed Only Mode|Exclude mapped regions that are not backed by a load file.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.featureMap.fileBackedOnly'>ui.featureMap.fileBackedOnly</a>|
+|ui|Linear Feature Map|Show feature map in one dimension instead of two.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.featureMap.linear'>ui.featureMap.linear</a>|
|ui|Feature Map Location|Location of the feature map.|`string`|`right`|[`SettingsUserScope`]|<a id='ui.featureMap.location'>ui.featureMap.location</a>|
| | | enum: Feature map appears on the right side of the window.|`enum`|`right`| | |
| | | enum: Feature map appears at the top of the window.|`enum`|`top`| | |
@@ -235,13 +246,13 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | |`enum`|`Universal`| | |
| | | |`enum`|`PE`| | |
| | | |`enum`|`COFF`| | |
-|ui|Programmer's Main Symbol List|A list of common 'main' symbols to search for when 'Navigate to Programmer's Main' is enabled.|`array`|[`main`, `_main`, `WinMain`]|[`SettingsUserScope`]|<a id='ui.files.navigation.mainSymbols'>ui.files.navigation.mainSymbols</a>|
|ui|Navigate to Programmer's Main|Detect and navigate to the 'main' function, rather than the entry point, after opening a binary.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.files.navigation.preferMain'>ui.files.navigation.preferMain</a>|
|ui|Restore Recent Open with Options|Restores previously modified settings in the 'Open with Options' dialog when opening or reopening files (databases excluded). Load options are only included when reopening the same file.|`string`|`disable`|[`SettingsUserScope`]|<a id='ui.files.restore.viewOptions'>ui.files.restore.viewOptions</a>|
| | | enum: Only restore settings for files with existing history.|`enum`|`strict`| | |
| | | enum: Restore settings for files with existing history and propagate most recently used settings for new files.|`enum`|`flexible`| | |
| | | enum: Disable the settings history for 'Open with Options'.|`enum`|`disable`| | |
|ui|Restore View State for File|Restores the last view state when reopening a file. The view state includes the layout and location.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.files.restore.viewState'>ui.files.restore.viewState</a>|
+|ui|'Save All' for Databases Only|Only save existing databases when using 'Save All'|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.files.saveAllOnlyDatabases'>ui.files.saveAllOnlyDatabases</a>|
|ui|Font Antialiasing Style|Which antialiasing style should be used when drawing fonts.|`string`|`subpixel`|[`SettingsUserScope`]|<a id='ui.font.antialiasing'>ui.font.antialiasing</a>|
| | | enum: Perform subpixel antialiasing on fonts.|`enum`|`subpixel`| | |
| | | enum: Avoid subpixel antialiasing on fonts if possible.|`enum`|`grayscale`| | |
@@ -249,11 +260,11 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | enum: No font antialiasing.|`enum`|`none`| | |
|ui|Application Font Name|The font to be used in UI elements, e.g. buttons, text fields, etc.|`string`|`Inter`|[`SettingsUserScope`]|<a id='ui.font.app.name'>ui.font.app.name</a>|
|ui|Application Font Size|The desired font size (in points) for interface elements.|`number`|`12`|[`SettingsUserScope`]|<a id='ui.font.app.size'>ui.font.app.size</a>|
-|ui|Emoji Font Name|The font to be used in for rendering emoji.|`string`|`Segoe UI Emoji` (Windows), `Apple Color Emoji` (macOS), `Noto Color Emoji` (Linux)|[`SettingsUserScope`]|<a id='ui.font.emoji.name'>ui.font.emoji.name</a>|
+|ui|Emoji Font Name|The font to be used in for rendering emoji.|`string`|`Apple Color Emoji`|[`SettingsUserScope`]|<a id='ui.font.emoji.name'>ui.font.emoji.name</a>|
|ui|Emoji Font Style|The subfamily of the emoji font that should be used.|`string`| |[`SettingsUserScope`]|<a id='ui.font.emoji.style'>ui.font.emoji.style</a>|
|ui|Allow Bold View Fonts|Should bold view fonts be allowed?|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.font.view.bold'>ui.font.view.bold</a>|
|ui|View Font Name|The font to be used in disassembly views, the hex editor, and anywhere a monospaced font is appropriate.|`string`|`Roboto Mono`|[`SettingsUserScope`]|<a id='ui.font.view.name'>ui.font.view.name</a>|
-|ui|View Font Size|The desired font size (in points) for the view font.|`number`|`12` (macOS), `10` (Windows), `11` (Linux)|[`SettingsUserScope`]|<a id='ui.font.view.size'>ui.font.view.size</a>|
+|ui|View Font Size|The desired font size (in points) for the view font.|`number`|`12`|[`SettingsUserScope`]|<a id='ui.font.view.size'>ui.font.view.size</a>|
|ui|View Line Spacing|How much additional spacing should be inserted between baselines in views.|`number`|`1`|[`SettingsUserScope`]|<a id='ui.font.view.spacing'>ui.font.view.spacing</a>|
|ui|View Font Style|The subfamily (e.g. Regular, Medium) of the view font that should be used.|`string`| |[`SettingsUserScope`]|<a id='ui.font.view.style'>ui.font.view.style</a>|
|ui|Input Field History Limit|Controls the number of history entries to store for input dialogs.|`number`|`50`|[`SettingsUserScope`]|<a id='ui.inputHistoryCount'>ui.inputHistoryCount</a>|
@@ -274,6 +285,10 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | enum: Split to new pane and navigate|`enum`|`NewPane`| | |
| | | enum: Split to new tab and navigate|`enum`|`NewTab`| | |
| | | enum: Split to new window and navigate|`enum`|`NewWindow`| | |
+|ui|New Tab Compact Mode|Display mode for files in Recent File list|`string`|`Normal`|[`SettingsUserScope`]|<a id='ui.newtab.compactMode'>ui.newtab.compactMode</a>|
+| | | enum: Show both basename and full path.|`enum`|`Normal`| | |
+| | | enum: Show only the basename|`enum`|`CompactBase`| | |
+| | | enum: Show only the filepath|`enum`|`CompactFile`| | |
|ui|Desired Maximum Columns for Split Panes|Number of horizontal splits (columns) before defaulting to a vertical split.|`number`|`2`|[`SettingsUserScope`]|<a id='ui.panes.columnCount'>ui.panes.columnCount</a>|
|ui|Show Pane Headers|Enable to display headers containing the current view and options at the top of every pane. When headers are disabled, use the Command Palette or keyboard shortcuts to manage panes.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.panes.headers'>ui.panes.headers</a>|
|ui|Preferred Location for New Panes|Default corner for placement of new panes. Split will occur horizontally up to the maximum column setting, then vertically in the corner specified by this setting.|`string`|`bottomRight`|[`SettingsUserScope`]|<a id='ui.panes.newPaneLocation'>ui.panes.newPaneLocation</a>|
@@ -296,39 +311,49 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | |`enum`|`Target`| | |
|ui|Scripting Provider History Size|Specify the maximum number of lines contained in the scripting history.|`number`|`1000`|[`SettingsUserScope`]|<a id='ui.scripting.historySize'>ui.scripting.historySize</a>|
|ui|Display Settings Identifiers|Display setting identifiers in the UI settings view.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.settings.displayIdentifiers'>ui.settings.displayIdentifiers</a>|
-|ui|Default Sidebar Content on Open|Specify a sidebar widget to automatically activate in the content area when opening a file.|`string`|`Symbols`|[`SettingsUserScope`]|<a id='ui.sidebar.defaultContentWidget'>ui.sidebar.defaultContentWidget</a>|
+|ui|Default Sidebar Content on Open|Specify the sidebar widgets to automatically activate when opening a file.|`array`|[`Cross References`, `Symbols`]|[`SettingsUserScope`]|<a id='ui.sidebar.defaultWidgets'>ui.sidebar.defaultWidgets</a>|
| | | |`enum`|`None`| | |
| | | |`enum`|`Symbols`| | |
| | | |`enum`|`Types`| | |
-| | | |`enum`|`Variables`| | |
-| | | |`enum`|`Stack`| | |
-| | | |`enum`|`Strings`| | |
| | | |`enum`|`Tags`| | |
| | | |`enum`|`Memory Map`| | |
+| | | |`enum`|`External Links`| | |
| | | |`enum`|`Debugger`| | |
-|ui|Default Sidebar Reference on Open|Specify a sidebar widget to automatically activate in the reference area when opening a file.|`string`|`Cross References`|[`SettingsUserScope`]|<a id='ui.sidebar.defaultReferenceWidget'>ui.sidebar.defaultReferenceWidget</a>|
-| | | |`enum`|`None`| | |
| | | |`enum`|`Mini Graph`| | |
| | | |`enum`|`Cross References`| | |
+| | | |`enum`|`Other (Compatibility)`| | |
+| | | |`enum`|`Console`| | |
+| | | |`enum`|`Variables`| | |
+| | | |`enum`|`Stack`| | |
+| | | |`enum`|`Strings`| | |
+| | | |`enum`|`Find`| | |
+| | | |`enum`|`Log`| | |
+| | | |`enum`|`Debugger Modules`| | |
+| | | |`enum`|`Stack Trace`| | |
+|ui|Extend Left Sidebar to Bottom of Window|When the left sidebar is open, the sidebar contents will extend to the bottom of the window. If not set, the bottom area will extend to the left edge of the window even when the left sidebar is open.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.sidebar.extendLeftToBottom'>ui.sidebar.extendLeftToBottom</a>|
+|ui|Extend Right Sidebar to Bottom of Window|When the right sidebar is open, the sidebar contents will extend to the bottom of the window. If not set, the bottom area will extend to the right edge of the window even when the right sidebar is open.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.sidebar.extendRightToBottom'>ui.sidebar.extendRightToBottom</a>|
+|ui|Sidebar Icon Size|Size of the icons in the sidebar.|`string`|`standard`|[`SettingsUserScope`]|<a id='ui.sidebar.iconSize'>ui.sidebar.iconSize</a>|
+| | | enum: Compact icons to maximize available screen space.|`enum`|`compact`| | |
+| | | enum: Default icon size.|`enum`|`standard`| | |
+| | | enum: Large icons for more visibility.|`enum`|`large`| | |
+|ui|Left Sidebar Reference Area Toggle Mode|Clicking on sidebar icons below the divider in the left sidebar will toggle the visibility of the icon clicked, regardless of how many sidebar icons are already active in that area. This mode can be used regardless of this setting by shift clicking the sidebar icon.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.sidebar.leftReferenceAreaToggleMode'>ui.sidebar.leftReferenceAreaToggleMode</a>|
|ui|Sidebar Mode|Select how the sidebar should react to tab changes.|`string`|`perTab`|[`SettingsUserScope`]|<a id='ui.sidebar.mode'>ui.sidebar.mode</a>|
| | | enum: Sidebar layout and size is per tab and is remembered when moving between tabs.|`enum`|`perTab`| | |
| | | enum: Sidebar widgets are per tab but the size of the sidebar is static and does not change.|`enum`|`staticSize`| | |
| | | enum: Sidebar layout is fully static and stays in the current layout when moving between tabs.|`enum`|`static`| | |
|ui|Open Sidebar on Startup|Open sidebar to default widgets when Binary Ninja is initially launched.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.sidebar.openOnStartup'>ui.sidebar.openOnStartup</a>|
-|ui|Show Exported Data Variables|Show exported data variables in the symbol list.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showExportedDataVars'>ui.symbolList.showExportedDataVars</a>|
-|ui|Show Exported Functions|Show exported functions in the symbol list.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showExportedFunctions'>ui.symbolList.showExportedFunctions</a>|
-|ui|Show Imports|Show imports in the symbol list.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showImports'>ui.symbolList.showImports</a>|
-|ui|Show Local Data Variables|Show local data variables in the symbol list.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showLocalDataVars'>ui.symbolList.showLocalDataVars</a>|
-|ui|Show Local Functions|Show local functions in the symbol list.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showLocalFunctions'>ui.symbolList.showLocalFunctions</a>|
+|ui|Right Sidebar Reference Area Toggle Mode|Clicking on sidebar icons below the divider in the right sidebar will toggle the visibility of the icon clicked, regardless of how many sidebar icons are already active in that area. This mode can be used regardless of this setting by shift clicking the sidebar icon.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.sidebar.rightReferenceAreaToggleMode'>ui.sidebar.rightReferenceAreaToggleMode</a>|
|ui|Max Tab Filename Length|Truncate filenames longer than this in tab titles.|`number`|`25`|[`SettingsUserScope`]|<a id='ui.tabs.maxFileLength'>ui.tabs.maxFileLength</a>|
|ui|Color Blind Mode|Choose colors that are visible to those with red/green color blindness.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.theme.colorBlind'>ui.theme.colorBlind</a>|
-|ui|Show Entry/Exit Indicators on Blocks|Draws an extra line to indicate which blocks in Graph View are entry / exit points in the function. Blocks that do not return have their indicators drawn in a different color.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.theme.entryExitBlockIndicators'>ui.theme.entryExitBlockIndicators</a>|
-|ui|Theme|Customize the appearance and style of Binary Ninja.|`string`|`Dark`|[`SettingsUserScope`]|<a id='ui.theme.name'>ui.theme.name</a>|
+|ui|Theme|Customize the appearance and style of Binary Ninja.|`string`|`Ninja Edit`|[`SettingsUserScope`]|<a id='ui.theme.name'>ui.theme.name</a>|
| | | |`enum`|`Classic`| | |
| | | |`enum`|`Dark`| | |
| | | |`enum`|`High Contrast`| | |
| | | |`enum`|`Ninja Dark`| | |
+| | | |`enum`|`Ninja Edit`| | |
| | | |`enum`|`Reflection`| | |
+| | | |`enum`|`Slushee Dark`| | |
+| | | |`enum`|`Slushee Light`| | |
| | | |`enum`|`Solarized Dark`| | |
| | | |`enum`|`Solarized Light`| | |
| | | |`enum`|`Summer`| | |
@@ -337,7 +362,7 @@ All settings are uniquely identified with an identifier string. Identifiers are
|ui|Comment Width|Maximum width of comment before wrapping, in characters. A value of 0x0 means no wrapping.|`number`|`80`|[`SettingsUserScope`]|<a id='ui.view.common.commentWidth'>ui.view.common.commentWidth</a>|
|ui|Disassembly Width|Maximum width of disassembly output, in characters. Not used in cases where disassembly width is automatically calculated, e.g. Linear View.|`number`|`80`|[`SettingsUserScope`]|<a id='ui.view.common.disassemblyWidth'>ui.view.common.disassemblyWidth</a>|
|ui|Maximum Symbol Name Length|Maximum allowed length of symbol names (in characters) before truncation is used.|`number`|`64`|[`SettingsUserScope`]|<a id='ui.view.common.maxSymbolWidth'>ui.view.common.maxSymbolWidth</a>|
-|ui|Graph View IL Carousel|Specify the IL view types and order for use with the 'Cycle IL' actions in Graph view.|`array`|[`Disassembly`, `LowLevelIL`, `MediumLevelIL`, `HighLevelIL`]|[`SettingsUserScope`]|<a id='ui.view.graph.carousel'>ui.view.graph.carousel</a>|
+|ui|Graph View IL Carousel|Specify the IL view types and order for use with the 'Cycle IL' actions in Graph view.|`array`|[`Disassembly`, `HighLevelIL`, `LowLevelIL`, `MediumLevelIL`]|[`SettingsUserScope`]|<a id='ui.view.graph.carousel'>ui.view.graph.carousel</a>|
| | | |`enum`|`Disassembly`| | |
| | | |`enum`|`LowLevelIL`| | |
| | | |`enum`|`LiftedIL`| | |
@@ -349,6 +374,7 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | |`enum`|`HighLevelIL`| | |
| | | |`enum`|`HighLevelILSSAForm`| | |
| | | |`enum`|`PseudoC`| | |
+|ui|Show Entry/Exit Indicators on Blocks|Draws an extra line to indicate which blocks in Graph View are entry / exit points in the function. Blocks that do not return have their indicators drawn in a different color.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.view.graph.entryExitBlockIndicators'>ui.view.graph.entryExitBlockIndicators</a>|
|ui|Default IL for Graph View|Default IL for graph view. Other settings (e.g. 'ui.files.restore.viewState') have precedence over the default behavior.|`string`|`Disassembly`|[`SettingsUserScope`]|<a id='ui.view.graph.il'>ui.view.graph.il</a>|
| | | |`enum`|`Disassembly`| | |
| | | |`enum`|`LowLevelIL`| | |
@@ -389,10 +415,20 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | |`enum`|`HighLevelIL`| | |
| | | |`enum`|`HighLevelILSSAForm`| | |
| | | |`enum`|`PseudoC`| | |
-|ui|Default filter for types view|Default type filter to use in types view.|`string`|`user`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.types.defaultTypeFilter'>ui.view.types.defaultTypeFilter</a>|
-| | | |`enum`|`all`| | |
-| | | |`enum`|`user`| | |
-|ui|TypeView Line Numbers|Controls the display of line numbers in the types view.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.view.types.lineNumbers'>ui.view.types.lineNumbers</a>|
+|ui|Display Raw Symbol Name|Display the original, unaltered name of a symbol as extracted from a load file. The name may be mangled.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.displayRawNames'>ui.view.symbols.displayRawNames</a>|
+|ui|Display Short Symbol Name|Display a shortened version of the full, human-readable representation of the symbol name.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.displayShortNames'>ui.view.symbols.displayShortNames</a>|
+|ui|Hide Auto Symbols|Hide all symbols that are not explicitly defined by a user.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.hideAutoSymbols'>ui.view.symbols.hideAutoSymbols</a>|
+|ui|Symbols Hierarchy Mode|Enables hierarchical organization of symbols in the UI.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.view.symbols.hierarchyMode'>ui.view.symbols.hierarchyMode</a>|
+|ui|Seamless Navigation|Enables uninterrupted navigation on item selection without losing focus.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.seamlessNavigation'>ui.view.symbols.seamlessNavigation</a>|
+|ui|Show Exported Data Variables|Show exported data variables in the symbols view.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showExportedDataVariables'>ui.view.symbols.showExportedDataVariables</a>|
+|ui|Show Exported Functions|Show exported functions in the symbols view.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showExportedFunctions'>ui.view.symbols.showExportedFunctions</a>|
+|ui|Show Folders First|Show folders at the top of the view when sorting items in symbols view.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showFoldersFirst'>ui.view.symbols.showFoldersFirst</a>|
+|ui|Show Imports|Show imports in the symbols view.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showImports'>ui.view.symbols.showImports</a>|
+|ui|Show Local Data Variables|Show local data variables in the symbols view.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showLocalDataVariables'>ui.view.symbols.showLocalDataVariables</a>|
+|ui|Show Local Functions|Show local functions in the symbols view.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showLocalFunctions'>ui.view.symbols.showLocalFunctions</a>|
+|ui|Maximum Lines for Wrapping in Editor|The maximum number of lines in rendered types before line wrapping is always disabled.|`number`|`10000`|[`SettingsUserScope`]|<a id='ui.view.types.maxLinesForWrapping'>ui.view.types.maxLinesForWrapping</a>|
+|ui|Maximum Types in Editor|The maximum number of types to render in the type editor in Types View.|`number`|`100`|[`SettingsUserScope`]|<a id='ui.view.types.maxTypesInEditor'>ui.view.types.maxTypesInEditor</a>|
+|ui|Enable the new Type Browser UI|Enables the new Types UI, with support for using Type Archives and Type Libraries from the UI.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.view.types.useTypeBrowser'>ui.view.types.useTypeBrowser</a>|
|ui|Possible Value Set Function Complexity Limit|Function complexity limit for showing possible value set information. Complexity is calculated as the total number of outgoing edges in the function's MLIL SSA form.|`number`|`25`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.variables.pvsComplexityLimit'>ui.view.variables.pvsComplexityLimit</a>|
|ui|File Path in Window Title|Controls whether the window title includes the full file path for the current file.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.window.title.showPath'>ui.window.title.showPath</a>|
|updates|Update Channel Preferences|Select update channel and version.|`string`|`None`|[]|<a id='updates.channelPreferences'>updates.channelPreferences</a>|
diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index 740c1ee0..83fd3a0b 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -204,7 +204,7 @@ The following environment variables may be helpful when troubleshooting issues:
## File Associations
-With the addition of projects and type archives, Binary Ninja now includes support for `.bnpr` (project folders, openable on MacOS), `.bnpm` (project metadata, openable on all platforms), and `.bnta` (type archives, openable on all platforms) file formats. If installed fresh, these file associations will automatically be created. However, when using the built-in updater, the association is not currently added. To manually create the association, use the following:
+With the addition of [projects](../guide/projects.md) and [type archives](../guide/types/typearchives.md), Binary Ninja now includes support for `.bnpr` (project folders, openable on MacOS), `.bnpm` (project metadata, openable on all platforms), and `.bnta` (type archives, openable on all platforms) file formats. If installed fresh, these file associations will automatically be created. However, when using the built-in updater, the association is not currently added. To manually create the association, use the following:
### MacOS file associations
diff --git a/docs/guide/type.md b/docs/guide/type.md
deleted file mode 100644
index 15a77d2a..00000000
--- a/docs/guide/type.md
+++ /dev/null
@@ -1,363 +0,0 @@
-# Working with Types, Structures, and Symbols
-
-This document is organized into two sections describing how to work with types in Binary Ninja. The [first section](#basic-types) is how apply and create types.
-
-The second [section](#working-with-types) is how to interact with any type, regardless of its source.
-
-For more about type libraries, signature library, and how to interact with types through the API, see the [applying annotations](../dev/annotation.md) section of the developer guide.
-
-## Basic Types
-
-The biggest culprit of bad decompilation is often missing type information. Therefore, some of the most important actions you can take while reverse engineering is renaming symbols/variables, applying types, and creating new types to apply.
-
-### Renaming Symbols and Variables
-
-![Rename a function >](../img/rename.png "Renaming a function")
-
-Some binaries helpfully have symbol information in them which makes reverse engineering easier. Of course, even if the binary doesn't come with symbol information, you can always add your own. From the UI, just select the function, variable, member, or register you want to change and press `n`. This works on variables as well.
-
-### Applying Structures and Types
-
-Simply select an appropriate token (variable or memory address), and press `y` to bring up the change type dialog. Types can be applied on both disassembly and all levels of IL. Any variables that are shared between the ILs will be updated as types are applied.
-
-![Changing a type](../img/change-type.png "Changing a type")
-
-## Types View
-
-To see all types in a Binary View, use the types view. It can be accessed from the menu `View > Types`. Alternatively, you can access it with the `t` hotkey from most other views, or using `[CMD/CTRL] p` to access the command-palette and typing "types". This is the most common interface for creating structures, unions and types using C-style syntax.
-
-The types view is also available in the sidebar with the `{…}` icon.
-
-For many built-in file formats you'll notice that common headers are already enumerated in the types view. These headers are applied when viewing the binary in [linear view](./index.md#linear-view) and will show the parsed binary data into that structure or type making them particularly useful for binary parsing even of non-executable file formats.
-
-![Types View](../img/types-view.png "Types View")
-
-### Structure Access Annotations
-
-Types view now annotates code references to structure offsets. It uses the same convention as in the graph/linear view. For example, the `__offset(0x8).q` token means the code references the offset 0x8 of this structure, and the size of the access is a qword. This will make it easier to see which offsets of a structure are being used, and aid in the process of creating structure members.
-
-![Type View Accesses](../img/type-view-accesses.png "Type View Accesses")
-
-### Shortcuts
-
-From within the Types view, you can use the following hotkeys to create new types, structures, or unions. Alternatively, you can use the right-click menu to access these options and more.
-
-![Types Right Click Menu >](../img/types-right-click-menu.png "Types Right Click Menu")
-
-* `s` - Create new structure
-* `i` - Create new type
-* `[SHIFT] s` - Creating a new union
-* `1`, `2`, `4`, `8`: The number hotkeys will create a create an integer of the specified size. This additionally works on selections.
-* `d`: If you want to cycle through the different integer sizes, repeatedly pressing `d` has the same effect as pressing the numbers in order.
-* `-`: To quickly toggle integers between signed and unsigned integers, you can use the `-` hotkey.
-
-
-The shortcuts for editing existing elements are:
-
-* `y` - Edit type / field
-* `n` - Rename type / field
-* `l` - Set structure size
-* `u` - undefine field
-
-### Attributes
-
-Structs support the attribute `__packed` to indicate that there is no padding. Additionally, function prototypes support the following keywords to indicate their calling convention or other features:
-
-``` text
-__cdecl
-__stdcall
-__fastcall
-__convention
-__noreturn
-```
-
-To use the `__convention` keyword, pass in the convention name as a parameter argument:
-
-```
-__convention("customconvention")
-```
-
-
-#### Examples
-
-``` C
-enum _flags
-{
- F_X = 0x1,
- F_W = 0x2,
- F_R = 0x4
-};
-```
-
-``` C
-struct Header __packed
-{
- char *name;
- uint32_t version;
- void (* callback)();
- uint16_t size;
- enum _flags flags;
-};
-```
-
-
-## Working With Types
-
-There are two main ways to interact with types from within a binary view. The first is to use the [types view](#types-view), and the second is to take advantage of the [smart structures workflow](#smart-structures-workflow) or otherwise annotate types directly in a disassembly or IL view.
-
-### Direct UI manipulation
-
-The simplest way to directly manipulate types in disassembly is by viewing an existing variable or sequence of bytes in linear view and using the following hotkeys:
-
-
- - `1`, `2`, `4`, `8`: The number hotkeys will create a data variable at the current location if none exists, and then change the size of the variable to an integer in the size of bytes specified in the hotkey.
- - `d`: If you want to cycle through the different integer sizes, repeatedly pressing `d` has the same effect as pressing the numbers in order.
- - `-`: To quickly toggle integers between signed and unsigned integers, you can use the `-` hotkey.
- - `a`: This hotkey sets or creates the current variable to a character array up until and including the next null byte.
- - `o`: `o` will set or create the current variable to be a pointer reference.
- - `*`: If you have a selection of identical variables, `*` will convert them into an array of elements. If you have no selection, the "Create Array" dialog will be shown allowing you to create an array of specific type and count at the current location.
-![Create Array Dialog](../img/create_array.png "Create Array Dialog")
- - `s`: `s` is a magic hotkey described in the next section in greater detail
- - `m`: Used to apply an enumeration display at an integer (more details [below](#enumeration-selector))
-
- Note that you can apply these types to a region of memory as well, not just a single variable. So selecting a large block of bytes and pressing `2` `*` for example will create an array of `int16_t` sized elements.
-
-### Enumeration Selector
-
-![Select Enum Dialog](../img/select_enum_member.png "Select Enum Dialog")
-
-The Enum Dialog, with a default hotkey of `m` can be used to both change the type for data variables, arguments, and local variables to an enum type and also to change the Display Type of constant integers to any matching enumeration members.
-
-When used on an integer, all matching enumeration members will be shown.
-
-1. Filter box to search large lists of matching enums
-1. "New Enum" button to allow creation of a new enum
-1. Enum preview (can also be used to edit an existing enum by double clicking a given line)
-1. Currently selected enum/member (when the enum is selected, the preview will update, and you can also right-click here to change the type)
-1. Name of currently selected enum
-1. Checkbox (set by default) that hides enums with no matching members for the current integer.
-
-However in instances where the hotkey is used on other variables, the display will only be used to apply the enum type to the selection and does not allow editing.
-
-![Apply Enum Type](../img/apply_enum.png "Apply Enum Type")
-
-### Smart Structures Workflow
-
-"Smart Structures" feature enables automatic creation of a structure and its members directly from the disassembly/IL view using the `s` hotkey.
-It simplifies the traditional workflow in which the user first creates a type in the types view and then applies it to disassembly.
-It works in the following ways:
-
-| View | Selection | Current Type | Behavior |
-|--------------------|--------------------------------------------------------------|----------------------|-----------------------------------------------------------------------------------|
-| Linear/Graph | A variable | Not a struct/struct\* | Create structure dialog |
-| Linear/Graph | A variable that is the result an allocation routine | Not a struct/struct\* | Create structure with allocation size |
-| Linear/Graph/Types | A variable, data variable, or a type name | struct/struct\* | Create all members for structure |
-| Linear/Graph/Types | A StructOffsetToken token, e.g., `__offset(0x18)` | N/A | Create current member for structure |
-
-Below are detailed explanation of it:
-
-1. In linear/graph view, if the selection is a variable that is not a structure, a dialog pops up and asks you to create a structure. You can specify the structure's name and size. There is also a checkbox that asks you whether the variable's type should be the structure itself or a pointer to the structure.
-2. In linear/graph view, if the selection is a variable that is not a structure, and it happens to be the result of a memory allocation routine, e.g., `malloc`, a new structure will be created and its size is automatically determined (if possible). The variable's type will be a pointer to the structure.
-3. In linear/graph/types view, If you select a variable whose type is a structure, or a pointer to a structure, BN will try to create all structure field at any offset that has been accessed in the code.
-4. In linear/graph/types view, If you select a StructOffsetToken, BN will try to create a structure member at the current offset.
-
-The automatic member creation mentioned in #3 and #4 takes into consideration both incoming and outgoing type information for the accessed offsets and selects the most confident one as the type for the offset.
-When no type information can be used to create the structure member, we fall back to creating an integer type based on the size of accesses. For example, if we see an access of size 4, we will create an `int32_t`. In case there are different sizes of accesses, we do not create the member. You will need to examine the conflicting size information and decide how to create a member.
-
-
-
-Consider the following example (created using [taped](../files/taped) from the 2011 Ghost in the Shellcode CTF if you'd like to play along at home):
-
-| Step | Preview |
-|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------|
-| Go to address `0x8048e20` and switch to HLIL. | <img src="../img/taped/1.png" alt="Structure Workflow 1"/> |
-| Select variable `var_18` and press `s`. <br/>Since `calloc` is a known allocation routine and the allocation size can be determined to be 0x30, a new structure, `struct_1` is created with size 0x30. | <img src="../img/taped/2.png" alt="Structure Workflow 2"/> |
-| Select an offset, e.g., `__offset(0x4).d` and press `s`. A member will be automatically created. | <img src="../img/taped/3.png" alt="Structure Workflow 3"/> |
-| Alternatively, select the `var_18` or the type name `struct_1` and press `s`. All members in the `struct_1` will be automatically created. | <img src="../img/taped/4.png" alt="Structure Workflow 4"/> |
-| Viewing the automatically created structure members. | <img src="../img/taped/5.png" alt="Structure Workflow 5"/> |
-
-
-The `s` hotkey also works when working with structures in the linear view. Its behavior differs based on the current selection:
-
-
-| Selection | Behavior |
-|--------------------------------------------------------------|-----------------------------------------------------------------------------------|
-| A single byte | Create structure dialog |
-| A range of bytes | Create structure with selection size |
-| A range of bytes covering existing data variables | Create structure with selection size and add existing data vars as struct members |
-
-
-In linear view, if the selection is a single byte outside any function, it will pop up the create structure dialog. If the selection is a range of bytes, a structure of the selection size is created and the start of the selection. If the selection covers any existing data variables, these data variables will become members within the newly created structure.
-
-This also works within data variables with structure type. For example, if the selection is a range of bytes within a structure, a new structure will be created within the existing structure.
-
-
-### Import BNDB File
-
-The Import BNDB File feature imports types from a previous BNDB into your currently open file. In addition, it will apply types for matching symbols in functions and variables. Import BNDB *will not* port symbols from a BNDB with symbols to one without -- the names must already match. Matching functions and porting symbols is beyond the scope of this feature.
-
-![Importing a BNDB](../img/import-bndb.png "Importing a BNDB")
-
-#### Usage
-
-To use this feature select `Import From BNDB` from the `Analysis` menu, use the [command palette](index.md#command-palette), or [bind a hotkey](index.md#custom-hotkeys) and select the BNDB you'd like to import. Wait for the BNDB to load then you'll be presented with a list of things to import.
-
-* Types - Various types to be imported from the source BNDB
-* Functions - Attempt to find target functions whose symbol already matches the symbol of the source BNDB and apply their type
-* Function to Imports - Attempt to find target Imports whose symbol matches the Functions symbols in the source BNDB and apply their type
-* Data Variables - Attempt to find target DataVariables with symbols that match DataVariables in the source BNDB and apply their type
-
-This feature enables a number of workflows:
-
-#### Porting Analysis Between Target Versions
-
-If you're working with version 1 of a file which has symbols and you now want to port your work over to version 2 (as long as they both have symbols). This isn't going to be perfect as this feature isn't interactive and doesn't take into account changes in parameter counts or ordering, so *use this with caution*.
-
-#### Quickly Defining Externs
-
-If you have a binary with externs which don't have TypeLibraries this can allow you to quickly import them (and their types) from another source, this is especially effective when you have debug information for the dependent libraries
-
-### Import Header File
-
-If you already have a collection of headers containing types you want to use, you can import them directly. You can specify the compiler flags that would be used if a compiler were compiling a source file that uses this header. Specifically this means you can/should specify:
-
-- `-isystem<path>` for various system header paths
-- `-I<path>` for various user header paths
-- `-D<macro>=<value>` for macro definitions
-- `-x c -std=c99` to specify C99 mode
-- Other Clang-compatible command-line flags are accepted (eg `-fms-extensions`, `-fms-compatibility`, etc)
-
-You can specify that types from system headers, accessed via `#include <header.h>`, will be in the results. Otherwise, only files from user headers, accessed via `#include "header.h"` will be used.
-
-You can also specify Define Binary Ninja Macros, which makes the type parser include the various parser extensions that Binary Ninja allows in the Type View editors, eg `__packed`, `__padding`, `__syscall`, etc. You probably only want to use this option when importing a header file exported using [Export Header File](#export-header-file).
-
-After specifying the file(s) and flag(s), pressing Preview will give a list of all the types and functions defined in the file(s). You may check or uncheck the box next to any of the types/functions to control whether they will be imported to your analysis.
-
-If there were any parse errors, those will be shown instead of a list of types. Generally speaking, what this means is you're missing either header search paths or compile definitions. See the section below on [finding system headers](#finding-system-headers).
-
-After pressing Import, all the checked types/functions will be added to your analysis. Imported types will override any existing types you had defined so they are disabled by default as indicated via the `Exists Already` column. Imported functions will replace signatures of any functions in your analysis whose name matches signatures found in the header.
-
-![Importing a header file](../img/import-header.png "Importing a header file")
-
-#### Finding System Headers
-
-Since you need to specify the include paths for system headers, you will need to deduce them for the target platform of your analysis. Here are a few tricks that may help:
-
-##### Systems with GCC/Clang (macOS, Linux, etc)
-
-On these systems, you can run a command to print the default search path for compilation:
-
- gcc -Wp,-v -E -
- clang -Wp,-v -E -
-
-For the directories printed by this command, you should include them with `-isystem<path>` in the order specified.
-
-For example on macOS, with Xcode 13:
-
- $ clang -Wp,-v -E -
- clang -cc1 version 13.0.0 (clang-1300.0.29.3) default target arm64-apple-darwin21.6.0
- ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/local/include"
- ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/Library/Frameworks"
- #include "..." search starts here:
- #include <...> search starts here:
- /usr/local/include
- /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
- /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
- /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
- /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks (framework directory)
- End of search list.
-
-From this example, the flags would be: (note: not including the framework directory line)
-
- -isystem/usr/local/include
- -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
- -isystem/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
- -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
-
-Another example on Arch Linux:
-
- $ gcc -Wp,-v -E -
- ignoring nonexistent directory "/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/../../../../x86_64-pc-linux-gnu/include"
- #include "..." search starts here:
- #include <...> search starts here:
- /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
- /usr/local/include
- /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
- /usr/include
- End of search list.
-
-From this example, the flags would be:
-
- -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
- -isystem/usr/local/include
- -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
- -isystem/usr/include
-
-##### For Windows
-
-For windows, there's no easy command to list all the include paths so you have to piece them together from the `Include Directory` property in a Visual Studio project. You also want to include `-x c -std=c99` since Windows headers include lots of C++ types that the type importer currently does not support.
-
-You will end up with something like the following for user mode:
-
- -x c -std=c99
- -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
-
-Or, for kernel mode:
-
- -x c -std=c99
- -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km"
-
-##### Cross-Platform Targets
-
-If you are analyzing a target that is for a different operating system, you need to both find the header include paths for that system, and copy (or mount) them to a location accessible by the computer running Binary Ninja.
-
-### Export Header File
-
-If you want to compile code using the structures you defined during your analysis, you can export all the types to a C-compatible header file that can be used via `#include` by a C compiler. You can also import this header in another analysis session via [Import Header File](#import-header-file), just be sure to enable `Define Binary Ninja Macros` when doing so.
-
-## Platform Types
-
-Binary Ninja pulls type information from a variety of sources. The highest-level source are the platform types loaded for the given platform (which includes operating system and architecture). There are two sources of platform types. The first are shipped with the product in a [binary path](./index.md#directories). The second location is in your [user folder](./index.md#user-folder) and is intended for you to put custom platform types.
-
-???+ Danger "Warning"
- Do NOT make changes to platform types in the binary path as they will be overwritten any time Binary Ninja updates.
-
-Platform types are used to define types that should be available to all programs available on that particular platform. They are only for global common types. Consider, for example, that you might want to add the following on windows:
-
-```
-typedef uint8_t u8;
-```
-
-You could write this type into:
-
-```
-/home/user/.binaryninja/types/platform/windows-x86.c
-```
-
-And any time you opened a 32bit windows binary, that type would be available to use. However, please note that these are not substitutes for [Type Libraries](../dev/annotation.md#type-libraries). Type Libraries are used to provide a collection of types for a given library such as a libc, or common DLL.
-
-???+ Warning "Tip"
- If you don't know the specific platform (and thus filename) you need to create for a given file, just enter `bv.platform` in the scripting console.
-
-### Common Types
-
-You may wish to provide types that are common across multiple architectures or platforms. The easiest way to do this is to use a `#include "filename.c"` line in the specific platform so that any common types will be loaded.
-
-For example, something like:
-
-```
-$ pwd
-/home/user/.binaryninja/types/platform
-$ cat windows-x86.c
-#include "windows.c"
-$ cat windows-x86_64.c
-#include "windows.c"
-$ cat windows.c
-typedef uint8_t u8;
-```
diff --git a/docs/guide/types/basictypes.md b/docs/guide/types/basictypes.md
new file mode 100644
index 00000000..b9530ddb
--- /dev/null
+++ b/docs/guide/types/basictypes.md
@@ -0,0 +1,173 @@
+# Basic Type Editing
+
+The biggest culprit of bad decompilation is often missing type information. Therefore, some of the most important actions you can take while reverse engineering is renaming symbols/variables, applying types, and creating new types to apply.
+
+## Renaming Symbols and Variables
+
+![Rename a function](../../img/rename.png "Renaming a function")
+
+Some binaries helpfully have symbol information in them which makes reverse engineering easier. Of course, even if the binary doesn't come with symbol information, you can always add your own. From the UI, just select the function, variable, member, or register you want to change and press `n`.
+
+## Applying / Changing Structures and Types
+
+Simply select an appropriate token (function, parameter, variable or memory address), and press `y` to bring up the change type dialog. Types can be applied on both disassembly and all levels of IL. Any variables that are shared between the ILs will be updated as types are applied.
+
+![Changing a type](../../img/change-type.png "Changing a type")
+
+## Types View
+
+![Types View](../../img/types-view.png "Types View")
+
+The Types View is the main view for organizing and modifying types in Binary Ninja.
+You can access it in a number of different ways:
+
+- Open it in the sidebar with the {T} icon
+- Open it in the sidebar in the Command Palette under "Focus Types"
+- Switch the current view pane to it by selecting "Types" under the view type menu
+- Switch the current view pane in the Command Palette under "Types"
+
+The Types View comprises two main views: the [Type List](#the-type-list) and the [Type Editor](#the-type-editor).
+There is also a search box that filters the Type List, and a menu button that shows the context menu
+for the active view.
+
+### The Type List
+
+![Types View](../../img/types-list.png "Types View")
+
+The Type List shows you both the types available in your analysis session and types from
+the [various other places](#type-containers) related to your analysis that can be imported.
+Types you select in the Type List will be shown in the Type Editor view, and you can view
+multiple types at once by clicking with Shift or Ctrl (Cmd on macOS). Selected types will
+show cross-references in the [cross-references sidebar pane](../index.md#cross-references).
+You can edit selected types in the Type Editor, or if you double-click a type
+(or use Change Type in the context menu), you can edit them as C source.
+
+Types in the list have their class indicated by icons:
+
+* **S**: Structure types
+* **C**: Class types (a variant of structure types)
+* **U**: Union types (a variant of structure types)
+* **E**: Enumeration types
+* **T**: All other types
+
+#### Type List Actions
+
+* Type Creation
+ * **Create Types from C Source** - Open a text box where you can enter C source type and structure definitions
+ * **Create New Structure** - Create a new blank structure type
+ * **Create New Enumeration** - Create a new blank enumeration type
+ * **Create New Union** - Create a new blank union type
+* Type Editing
+ * **Rename Type** - Rename the currently selected type
+ * **Change Type** - Edit the currently selected type in a text box with C source
+* Type Archives
+ * **Create Type Archive** - Create a [Type Archive](typearchives.md) and attach it to your analysis
+ * **Attach Type Archive** - Attach an existing [Type Archive](typearchives.md) to your analysis
+ * **Detach Type Archive** - Detach an attached [Type Archive](typearchives.md) and disassociate all types from it
+ * **Push Types to Archive** - Push the selected types to a [Type Archive](typearchives.md)
+ * **Pull Types from Archive** - Pull the selected types from a [Type Archive](typearchives.md)
+ * **Disassociate Types from Archive** - Disassociate, or break connections between, the selected types and their associated [Type Archive](typearchives.md)
+* Type Libraries
+ * **Import Type** - Import a type from a [Type Library](../../dev/annotation.md#type-libraries) into your analysis
+ * **Import Type by GUID** - (Windows binary analyses only) Import a COM type by its GUID
+ * **Add Type Library** - Add an existing [Type Library](../../dev/annotation.md#type-libraries) to your analysis
+* Settings
+ * **Search** - Change how the search box filters types
+ * **Type Names** - Search only filters by names of types (default)
+ * **Type and Member Names** - Search filters by both names of types and names of members in structure types
+ * **Full Definition Text** - Search filters by matching the full text representation of types (can be slow for large numbers of types)
+
+#### Type Containers
+
+All of the type containers described in the [type introduction](index.md) are available in the Types View along with `User Types` in a section of its own.
+
+* **User Types**: In your analysis: Types created by you, either manually or through actions/plugins
+* **System Types**: In your analysis: Types created by analysis or imported during analysis, such as from Libraries or Debug Info
+* **Archive**: Types in an attached [Type Archive](typearchives.md). You can edit and delete them, without affecting the types in your analysis, and you can push/pull them into your analysis.
+* **Library**: Types in a [Type Library](../../dev/annotation.md#type-libraries). You cannot edit them, but you can import them into your analysis.
+* **Debug Info**: Types found in [Debug Info](debuginfo.md). You cannot edit them here, but they are copied into the System Types where you can edit them.
+* **Platform**: Types from the analyzed binary's [Platform](platformtypes.md). You cannot edit them here, but they are copied into the System Types where you can edit them.
+
+![Types Containers](../../img/types-containers.png "Type Containers")
+
+### The Type Editor
+
+The Type Editor is the primary interface for editing types used in your analysis. It shows
+whichever types you select in the Type List above, and allows you to edit them in many ways.
+Types are shown in C syntax with various [annotations](#type-annotations). Structure members
+have their offsets indicated on the left, and empty space between structure members is shown
+with `??` marks indicating individual bytes. Selecting members in a structure will show
+[cross-references](../index.md#cross-references) to those members, and double-clicking
+the name of a type will take you to its definition.
+
+#### Type Editor Actions
+
+* Modifying Types
+ * **Change Type** - Edit an entire type, or structure member, as C source
+ * **Rename** - Rename a type or structure member
+ * **Undefine** - Delete a type from your analysis, or delete a structure member
+ * **Set Structure Size** - Manually specify a structure's size, alignment, and packing
+* Creating Structure Members
+ * **Type > Make 8-bit Integer** - Create `uint8_t` members in selection
+ * **Type > Make 16-bit Integer** - Create `uint16_t` members in selection
+ * **Type > Make 32-bit Integer** - Create `uint32_t` members in selection
+ * **Type > Make 64-bit Integer** - Create `uint64_t` members in selection
+ * **Type > Invert Integer Sign** - Toggle integer signedness, e.g. between `uint8_t` and `int8_t`
+ * **Type > Cycle Integer Size** - Change integer member size in order: `uint8_t`, `uint16_t`, `uint32_t`, `uint64_t`
+ * **Type > Make 32-bit Float** - Create `float` members in selection
+ * **Type > Make 64-bit Float** - Create `double` members in selection
+ * **Type > Cycle Float Size** - Change float member size in order: `float`, `double`
+ * **Type > Make Pointer** - Create `void*` members in selection
+ * **Type > Make C String** - Create `char*` members in selection
+ * **Type > Make UTF-16 String** - Create `wchar16*` members in selection
+ * **Type > Make UTF-32 String** - Create `wchar32*` members in selection
+* Utility
+ * **Add Cross Reference from** - Manually add a cross-reference to a type (or member) from an address in the analysis
+* Settings
+ * **Show Inherited Members** - When working with [structures with inheritance](cpp.md#derived-classes), show members from base classes in child classes
+ * **Wrap Lines** - Soft-wrap long text lines
+
+### Type Annotations
+
+The Types view now annotates code references to structure offsets. It uses the same convention as in the graph/linear view. For example, the `__offset(0x8).q` token means the code references the offset 0x8 bytes into this structure, and the size of the access is a qword. This will make it easier to see which offsets of a structure are being used, and aid in the process of creating structure members.
+
+## Attributes
+
+Structs support the attribute `__packed` to indicate that there is no padding. Additionally, function prototypes support the following keywords to indicate their calling convention or other features:
+
+``` text
+__cdecl
+__stdcall
+__fastcall
+__convention
+__noreturn
+```
+
+To use the `__convention` keyword, pass in the convention name as a parameter argument:
+
+```
+__convention("customconvention")
+```
+
+
+## Examples
+
+``` C
+enum _flags
+{
+ F_X = 0x1,
+ F_W = 0x2,
+ F_R = 0x4
+};
+```
+
+``` C
+struct Header __packed
+{
+ char *name;
+ uint32_t version;
+ void (* callback)();
+ uint16_t size;
+ enum _flags flags;
+};
+```
diff --git a/docs/guide/cpp.md b/docs/guide/types/cpp.md
index 1da8d817..455e59fd 100644
--- a/docs/guide/cpp.md
+++ b/docs/guide/types/cpp.md
@@ -16,17 +16,17 @@ A derived class can be defined using the Create Structure dialog. From the Types
dialog can be opened with a default hotkey of `s` or by using the add menu on the right of
the sidebar.
-![Create Structure menu](../img/create_struct_menu.png "Create Structure menu")
+![Create Structure menu](../../img/create-struct-menu.png "Create Structure menu")
First, enter the offset and name of the base structure below the "Base structures" list. The
offset should be where in the derived structure to place the base structure's members, which
will usually be zero for single inheritance.
-![Adding a base structure](../img/create_derived_struct_1.png "Adding a base structure")
+![Adding a base structure](../../img/create-derived-struct-1.png "Adding a base structure")
Click the add button to add the base structure to the new structure.
-![Base structure added](../img/create_derived_struct_2.png "Base structure added")
+![Base structure added](../../img/create-derived-struct-2.png "Base structure added")
The offset will automatically update to be just after the added structure in case you need to
add additional base structures. Click the Create button to create the new structure.
@@ -146,11 +146,11 @@ struct __base(Foo, 0) Bar
## Template Simplifier
-The [`analysis.types.templateSimplifier`](settings.md#analysis.types.templateSimplifier) setting can be helpful when working with C++ symbols.
+The [`analysis.types.templateSimplifier`](../settings.md#analysis.types.templateSimplifier) setting can be helpful when working with C++ symbols.
<div class="juxtapose">
- <img src="../img/before-template-simplification.png" data-label="Before Simplification"/>
- <img src="../img/after-template-simplification.png" data-label="After Simplification"/>
+ <img src="../../img/before-template-simplification.png" data-label="Before Simplification"/>
+ <img src="../../img/after-template-simplification.png" data-label="After Simplification"/>
</div>
## Example
@@ -342,7 +342,7 @@ adding `Animal` as a base structure and then adding `Flying`. The Create Structu
automatically adjust the offset as you add structures. The dialog should look like this after
the base structures are added:
-![Multiple base structures](../img/create_multi_derived_struct.png "Multiple base structures")
+![Multiple base structures](../../img/create-multi-derived-struct.png "Multiple base structures")
After defining and adding the additional member, the `Bird` structure looks like this:
@@ -574,7 +574,7 @@ when navigating the C++ program. For example, clicking on the `make_sound` membe
structure will populate the cross references view with the list of functions that implement the
method:
-![Virtual function table references](../img/vtable_cross_refs.png "Virtual function table references")
+![Virtual function table references](../../img/vtable-cross-refs.png "Virtual function table references")
These cross references are aware of context when viewed from code. For example, in the following
function:
@@ -596,7 +596,7 @@ void Cat::approach(struct Cat* this)
Clicking on `make_sound` will populate the cross references with *only* the functions that are
in `Cat` or derived classes of `Cat`:
-![Virtual function table references with context](../img/vtable_cross_refs_context.png "Virtual function table references with context")
+![Virtual function table references with context](../../img/vtable-cross-refs-context.png "Virtual function table references with context")
## Offset Pointers
diff --git a/docs/guide/debuginfo.md b/docs/guide/types/debuginfo.md
index 0c10943b..c994843c 100644
--- a/docs/guide/debuginfo.md
+++ b/docs/guide/types/debuginfo.md
@@ -8,7 +8,7 @@ Currently debug info plugins are limited to types, function signatures, and data
Out of the box, Binary Ninja supports PDBs and DWARF.
-For PDBs, Binary Ninja will automatically try to source from specified local folders and Microsoft's symbol server ([see the PDB settings for more information](settings.md#all-settings)).
+For PDBs, Binary Ninja will automatically try to source from specified local folders and Microsoft's symbol server ([see the PDB settings for more information](../settings.md#all-settings)).
For DWARF, this includes DWARF information compiled in to ELF binaries, DWARF information in external ELF files (`.dwo`, `.debug`, etc), DWARF information compiled in to Mach-O's, and DWARF information in external `.dSYM` files as well. Support for DWARF information in PEs is [planned](https://github.com/Vector35/binaryninja-api/issues/1555).
diff --git a/docs/guide/types/index.md b/docs/guide/types/index.md
new file mode 100644
index 00000000..acf1046c
--- /dev/null
+++ b/docs/guide/types/index.md
@@ -0,0 +1,18 @@
+# Working with Types, Structures, and Symbols
+
+There's so many things to learn about working with Types in Binary Ninja that we've organized it into several sections!
+
+- [Basic Type Editing](basictypes.md): Brief overview of the basics
+- [Working with Types](type.md): Interacting with types in disassembly and decompilation
+- [Importing/Exporting Types](typeimportexport.md): How to import or export types from header files, archives, or other BNDBs
+
+Additionally, several types of containers for type information are documented here:
+
+- [Debug Info](debuginfo.md): Debug Info can provide additional type information (examples include DWARF and PDB files)
+- [Type Libraries](typelibraries.md): Type Libraries contain types from commonly-used dynamic libraries
+- [Platform Types](platformtypes.md): Types that automatically apply to a platform
+- [Type Archives](typearchives.md): How you can use type archives to share types between analysis databases
+- [Signature Libraries](../../dev/annotation.md#signature-library): Signature libraries are used to match names of functions with signatures for code that is statically compiled
+- [Platform Types](platformtypes.md): Platform types are base types that apply to all binaries on a particular platform
+
+Additionally, make sure to see the [applying annotations](../../dev/annotation.md) section of the developer guide for information about using the API with types and covering the creation of many of the items described below. \ No newline at end of file
diff --git a/docs/guide/types/platformtypes.md b/docs/guide/types/platformtypes.md
new file mode 100644
index 00000000..286615e6
--- /dev/null
+++ b/docs/guide/types/platformtypes.md
@@ -0,0 +1,42 @@
+# Platform Types
+
+Binary Ninja pulls type information from a variety of sources. The highest-level source are the platform types loaded for the given platform (which includes operating system and architecture). There are two sources of platform types. The first are shipped with the product in a [binary path](../index.md#directories). The second location is in your [user folder](../index.md#user-folder) and is intended for you to put custom platform types.
+
+???+ Danger "Warning"
+ Do NOT make changes to platform types in the binary path as they will be overwritten any time Binary Ninja updates.
+
+Platform types are used to define types that should be available to all programs available on that particular platform. They are only for global common types. Consider, for example, that you might want to add the following on windows:
+
+```
+typedef uint8_t u8;
+```
+
+You could write this type into:
+
+```
+/home/user/.binaryninja/types/platform/windows-x86.c
+```
+
+And any time you opened a 32bit windows binary, that type would be available to use. However, please note that these are not substitutes for [Type Libraries](../../dev/annotation.md#type-libraries). Type Libraries are used to provide a collection of types for a given library such as a libc, or common DLL.
+
+???+ Warning "Tip"
+ If you don't know the specific platform (and thus filename) you need to create for a given file, just enter `bv.platform` in the scripting console.
+
+## Common Types
+
+You may wish to provide types that are common across multiple architectures or platforms. The easiest way to do this is to use a `#include "filename.c"` line in the specific platform so that any common types will be loaded.
+
+The base path for these files is in your [user folder](../index.md#user-folder) inside of a "types/platform" subfolder.
+
+For example, something like:
+
+```
+$ pwd
+/home/user/.binaryninja/types/platform
+$ cat windows-x86.c
+#include "windows.c"
+$ cat windows-x86_64.c
+#include "windows.c"
+$ cat windows.c
+typedef uint8_t u8;
+```
diff --git a/docs/guide/types/type.md b/docs/guide/types/type.md
new file mode 100644
index 00000000..5526efa1
--- /dev/null
+++ b/docs/guide/types/type.md
@@ -0,0 +1,88 @@
+# Working with Types, Structures, and Symbols in Decompilation
+
+There are two main ways to interact with types in decompilation or disassembly. The first is to use the [types view](basictypes.md#types-view), and the second is to take advantage of the [smart structures workflow](#smart-structures-workflow) or otherwise annotate types directly in a disassembly or IL view.
+
+## Direct UI manipulation
+
+The simplest way to directly manipulate types in disassembly is by viewing an existing variable or sequence of bytes in linear view and using the following hotkeys:
+
+ - `1`, `2`, `4`, `8`: The number hotkeys will create a data variable at the current location if none exists, and then change the size of the variable to an integer in the size of bytes specified in the hotkey.
+ - `d`: If you want to cycle through the different integer sizes, repeatedly pressing `d` has the same effect as pressing the numbers in order.
+ - `-`: To quickly toggle integers between signed and unsigned integers, you can use the `-` hotkey.
+ - `a`: This hotkey sets or creates the current variable to a character array up until and including the next null byte.
+ - `o`: `o` will set or create the current variable to be a pointer reference.
+ - `*`: If you have a selection of identical variables, `*` will convert them into an array of elements. If you have no selection, the "Create Array" dialog will be shown allowing you to create an array of specific type and count at the current location.
+![Create Array Dialog](../../img/create-array.png "Create Array Dialog")
+ - `s`: `s` is a magic hotkey described in the next section in greater detail
+ - `m`: Used to apply an enumeration display at an integer (more details [below](#enumeration-selector))
+
+ Note that you can apply these types to a region of memory as well, not just a single variable. So selecting a large block of bytes and pressing `2` `*` for example will create an array of `int16_t` sized elements.
+
+## Enumeration Selector
+
+![Select Enum Dialog](../../img/select-enum-member.png "Select Enum Dialog")
+
+The Enum Dialog, with a default hotkey of `m` can be used to both change the type for data variables, arguments, and local variables to an enum type and also to change the Display Type of constant integers to any matching enumeration members.
+
+When used on an integer, all matching enumeration members will be shown.
+
+1. Filter box to search large lists of matching enums
+1. "New Enum" button to allow creation of a new enum
+1. Enum preview (can also be used to edit an existing enum by double clicking a given line)
+1. Currently selected enum/member (when the enum is selected, the preview will update, and you can also right-click here to change the type)
+1. Name of currently selected enum
+1. Checkbox (set by default) that hides enums with no matching members for the current integer.
+
+However in instances where the hotkey is used on other variables, the display will only be used to apply the enum type to the selection and does not allow editing.
+
+## Smart Structures Workflow
+
+![Auto Create Members](../../img/auto-create-members.png "Automatically Creating Struct Members")
+
+"Smart Structures" feature enables automatic creation of a structure and its members directly from the disassembly/IL view using the `s` hotkey.
+It simplifies the traditional workflow in which the user first creates a type in the types view and then applies it to disassembly.
+It works in the following ways:
+
+| View | Selection | Current Type | Behavior |
+|--------------------|--------------------------------------------------------------|----------------------|-----------------------------------------------------------------------------------|
+| Linear/Graph | A variable | Not a struct/struct\* | Create structure dialog |
+| Linear/Graph | A variable that is the result an allocation routine | Not a struct/struct\* | Create structure with allocation size |
+| Linear/Graph/Types | A variable, data variable, or a type name | struct/struct\* | Create all members for structure |
+| Linear/Graph/Types | A StructOffsetToken token, e.g., `__offset(0x18)` | N/A | Create current member for structure |
+
+Below are detailed explanation of it:
+
+1. In linear/graph view, if the selection is a variable that is not a structure, a dialog pops up and asks you to create a structure. You can specify the structure's name and size. There is also a checkbox that asks you whether the variable's type should be the structure itself or a pointer to the structure.
+2. In linear/graph view, if the selection is a variable that is not a structure, and it happens to be the result of a memory allocation routine, e.g., `malloc`, a new structure will be created and its size is automatically determined (if possible). The variable's type will be a pointer to the structure.
+3. In linear/graph/types view, If you select a variable whose type is a structure, or a pointer to a structure, BN will try to create all structure field at any offset that has been accessed in the code.
+4. In linear/graph/types view, If you select a StructOffsetToken, BN will try to create a structure member at the current offset.
+
+The automatic member creation mentioned in #3 and #4 takes into consideration both incoming and outgoing type information for the accessed offsets and selects the most confident one as the type for the offset.
+When no type information can be used to create the structure member, we fall back to creating an integer type based on the size of accesses. For example, if we see an access of size 4, we will create an `int32_t`. In case there are different sizes of accesses, we do not create the member. You will need to examine the conflicting size information and decide how to create a member.
+
+
+
+Consider the following example (created using [taped](../../files/taped) from the 2011 Ghost in the Shellcode CTF if you'd like to play along at home):
+
+| Step | Preview |
+|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------|
+| Go to address `0x8048e20` and switch to HLIL. | <img src="../../img/taped/1.png" alt="Structure Workflow 1"/> |
+| Select variable `var_18` and press `s`. <br/>Since `calloc` is a known allocation routine and the allocation size can be determined to be 0x30, a new structure, `struct_1` is created with size 0x30. | <img src="../../img/taped/2.png" alt="Structure Workflow 2"/> |
+| Select an offset, e.g., `__offset(0x4).d` and press `s`. A member will be automatically created. | <img src="../../img/taped/3.png" alt="Structure Workflow 3"/> |
+| Alternatively, select the `var_18` or the type name `struct_1` and press `s`. All members in the `struct_1` will be automatically created. | <img src="../../img/taped/4.png" alt="Structure Workflow 4"/> |
+| Viewing the automatically created structure members. | <img src="../../img/taped/5.png" alt="Structure Workflow 5"/> |
+
+
+The `s` hotkey also works when working with structures in the linear view. Its behavior differs based on the current selection:
+
+
+| Selection | Behavior |
+|--------------------------------------------------------------|-----------------------------------------------------------------------------------|
+| A single byte | Create structure dialog |
+| A range of bytes | Create structure with selection size |
+| A range of bytes covering existing data variables | Create structure with selection size and add existing data vars as struct members |
+
+
+In linear view, if the selection is a single byte outside any function, it will pop up the create structure dialog. If the selection is a range of bytes, a structure of the selection size is created and the start of the selection. If the selection covers any existing data variables, these data variables will become members within the newly created structure.
+
+This also works within data variables with structure type. For example, if the selection is a range of bytes within a structure, a new structure will be created within the existing structure.
diff --git a/docs/guide/types/typearchives.md b/docs/guide/types/typearchives.md
new file mode 100644
index 00000000..ce605c0d
--- /dev/null
+++ b/docs/guide/types/typearchives.md
@@ -0,0 +1,47 @@
+# Type Archives
+
+Type Archives are files you can use to share types between analysis databases. You can create them and manage their contents in [Types View](./basictypes.md#the-type-list).
+
+![Type Archives](../../img/type-archives.png "Type Archives"){ width="400" }
+
+## Creating and Attaching
+
+Using the context menu in the [Type List](basictypes.md#the-type-list) in Types View, you can create Type Archives using **Create Type Archive**. Simply pick a file location, and one will be created and attached to your analysis. Once you have done this, you can attach that Type Archive to other analyses in the same menu, by instead using **Attach Type Archive**. If you don't want to use a specific Type Archive in your analysis, you can right-click it in the Type List and use **Detach Type Archive**, which will remove any associations made to types it contains, but will not remove any types in your analysis.
+
+???+ Tip "Tip"
+ Type Archives have an associated Platform (e.g. windows-x86_64), which will determine
+ various Platform-specific type details, like pointer width. You may attach a
+ Type Archive to files with a different Platform, but note that these details may
+ cause issues with any types pulled from the Type Archive.
+
+Attached Type Archives are remembered in saved analysis databases, and will be attached on reopen, provided the file still exists. If the Type Archive file is moved (or deleted), then the Type List will report the Type Archive as Disconnected (but still attached). You can reconnect the Type Archive by using **Connect Type Archive** and pointing Binary Ninja at the new location of the Type Archive file.
+
+Enterprise users can create Type Archives in Remote Projects in the same manner, and all changes made to Type Archives in Remote Projects will be automatically synced with the Collaboration Server. Updates made by you are sent immediately, whereas updates made by other users on your server are fetched periodically in the background every 30 seconds (configurable by the `collaboration.autoPollInterval` setting). Once changes have been fetched, you can pull them into your analysis in the same way as described below. You may also attach Type Archives created outside your Remote Project, but note they will not be synced to the Collaboration Server.
+
+## Managing Types
+
+Once you have one or more Type Archives created and attached, you can start using them to store and share types between your analyses:
+
+1. In one analysis, create some types and use **Push Types to Archive** to add them to a Type Archive
+2. In another analysis, you can use **Pull Types from Archive** to import those types from the Type Archive
+3. Now, in either analysis, you can [make changes to those types](basictypes.md#the-type-editor) and once again use **Push Types to Archive** to send the changes to the Type Archive
+4. And after doing so, you can open the other analysis and use **Pull Types from Archive** to receive those changes from the Type Archive
+5. If you push changes to a Type Archive and, before pulling them in the other analysis, change them there as well, you will have to choose which version of the individual types you want to use. Either push or pull the specific types and, when prompted, confirm your choice to use that version.
+
+If you want to rename a type in the Type Archive, you can use **Rename Type** in the context menu in the Type List. You can either rename it in your analysis, and then push the type, or rename it directly in the Type Archive, and then pull the type. Note that renaming a type will cause updates for other types that reference it, which may also need to be pushed or pulled afterward.
+
+If you want to delete a type in the Type Archive, you can select it in the Type List under the Type Archive, and use **Undefine Type**. This will not delete it from your analysis, and indeed if you had instead deleted it from your analysis, it would not have been deleted in the Type Archive. If you delete the type in either place, the association will no longer apply and changes made to the type will not be shown as needing to be pushed or pulled.
+
+If you want to manually disassociate a type in your analysis from a Type Archive, you can use **Disassociate Types from Archive**, and then no changes made to that type, either in the analysis, or in the Type Archive, will be shown as needing to be pushed or pulled.
+
+![Type Archives >](../../img/type-archives-status.png "Type Archives Status"){ width="500" }
+
+When you have pushed or pulled types from a Type Archive, you will see their status reflected in the Type List:
+
+1. Normal type, not associated with a Type Archive
+2. Type associated with a Type Archive with no changes
+3. Type associated with a Type Archive with changes made in the analysis that can be pushed to the Type Archive
+4. Type associated with a Type Archive with changes made in the Type Archive that can be pulled into the analysis
+5. Type associated with a Type Archive with changes made both in the analysis and the Type Archive, that will need you to choose which version to keep
+6. Type associated with a Type Archive that is missing
+
diff --git a/docs/guide/types/typeimportexport.md b/docs/guide/types/typeimportexport.md
new file mode 100644
index 00000000..43fbfa90
--- /dev/null
+++ b/docs/guide/types/typeimportexport.md
@@ -0,0 +1,184 @@
+# Importing Type Information
+
+Type information can be imported from a variety of sources. If you have header files, you can [import a header](#import-header-file). If your types exist in an existing BNDB, you can use [import from a bndb](#import-bndb-file). With the introduction of [type archives](typearchives.md) we recommend migrating away from importing via BNDB to type archives as they allow types to remain synced between different databases.
+
+## Import BNDB File
+
+The Import BNDB File feature imports types from a previous BNDB into your currently open file. In addition, it will apply types for matching symbols in functions and variables. Import BNDB *will not* port symbols from a BNDB with symbols to one without -- the names must already match. Matching functions and porting symbols is beyond the scope of this feature.
+
+![Importing a BNDB](../../img/import-bndb.png "Importing a BNDB")
+
+### Usage
+
+To use this feature select `Import From BNDB` from the `Analysis` menu, use the [command palette](../index.md#command-palette), or [bind a hotkey](../index.md#custom-hotkeys) and select the BNDB you'd like to import. Wait for the BNDB to load then you'll be presented with a list of things to import.
+
+* Types - Various types to be imported from the source BNDB
+* Functions - Attempt to find target functions whose symbol already matches the symbol of the source BNDB and apply their type
+* Function to Imports - Attempt to find target Imports whose symbol matches the Functions symbols in the source BNDB and apply their type
+* Data Variables - Attempt to find target DataVariables with symbols that match DataVariables in the source BNDB and apply their type
+
+This feature enables a number of workflows:
+
+### Porting Analysis Between Target Versions
+
+If you're working with version 1 of a file which has symbols and you now want to port your work over to version 2 (as long as they both have symbols). This isn't going to be perfect as this feature isn't interactive and doesn't take into account changes in parameter counts or ordering, so *use this with caution*.
+
+### Quickly Defining Externs
+
+If you have a binary with externs which don't have TypeLibraries this can allow you to quickly import them (and their types) from another source, this is especially effective when you have debug information for the dependent libraries
+
+## Import Header File
+
+If you already have a collection of headers containing types you want to use, you can import them directly. You can specify the compiler flags that would be used if a compiler were compiling a source file that uses this header. Specifically this means you can/should specify:
+
+- `-isystem<path>` for various system header paths
+- `-I<path>` for various user header paths
+- `-D<macro>=<value>` for macro definitions
+- `-x c -std=c99` to specify C99 mode
+- Other Clang-compatible command-line flags are accepted (eg `-fms-extensions`, `-fms-compatibility`, etc)
+
+You can specify that types from system headers, accessed via `#include <header.h>`, will be in the results. Otherwise, only files from user headers, accessed via `#include "header.h"` will be used.
+
+You can also specify Define Binary Ninja Macros, which makes the type parser include the various parser extensions that Binary Ninja allows in the Type View editors, eg `__packed`, `__padding`, `__syscall`, etc. You probably only want to use this option when importing a header file exported using [Export Header File](#export-header-file).
+
+After specifying the file(s) and flag(s), pressing Preview will give a list of all the types and functions defined in the file(s). You may check or uncheck the box next to any of the types/functions to control whether they will be imported to your analysis.
+
+If there were any parse errors, those will be shown instead of a list of types. Generally speaking, what this means is you're missing either header search paths or compile definitions. See the section below on [finding system headers](#finding-system-headers).
+
+After pressing Import, all the checked types/functions will be added to your analysis. Imported types will override any existing types you had defined so they are disabled by default as indicated via the `Exists Already` column. Imported functions will replace signatures of any functions in your analysis whose name matches signatures found in the header.
+
+![Importing a header file](../../img/import-header.png "Importing a header file")
+
+### Finding System Headers
+
+Since you need to specify the include paths for system headers, you will need to deduce them for the target platform of your analysis. Here are a few tricks that may help:
+
+#### Systems with GCC/Clang (macOS, Linux, etc)
+
+On these systems, you can run a command to print the default search path for compilation:
+
+ gcc -Wp,-v -E -
+ clang -Wp,-v -E -
+
+For the directories printed by this command, you should include them with `-isystem<path>` in the order specified.
+
+For example on macOS, with Xcode 13:
+
+ $ clang -Wp,-v -E -
+ clang -cc1 version 13.0.0 (clang-1300.0.29.3) default target arm64-apple-darwin21.6.0
+ ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/local/include"
+ ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/Library/Frameworks"
+ #include "..." search starts here:
+ #include <...> search starts here:
+ /usr/local/include
+ /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
+ /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
+ /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
+ /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks (framework directory)
+ End of search list.
+
+From this example, the flags would be: (note: not including the framework directory line)
+
+ -isystem/usr/local/include
+ -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
+ -isystem/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
+ -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
+
+Another example on Arch Linux:
+
+ $ gcc -Wp,-v -E -
+ ignoring nonexistent directory "/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/../../../../../../../../x86_64-pc-linux-gnu/include"
+ #include "..." search starts here:
+ #include <...> search starts here:
+ /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
+ /usr/local/include
+ /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
+ /usr/include
+ End of search list.
+
+From this example, the flags would be:
+
+ -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
+ -isystem/usr/local/include
+ -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
+ -isystem/usr/include
+
+##### For Windows
+
+For windows, there's no easy command to list all the include paths so you have to piece them together from the `Include Directory` property in a Visual Studio project. You also want to include `-x c -std=c99` since Windows headers include lots of C++ types that the type importer currently does not support.
+
+You will end up with something like the following for user mode:
+
+ -x c -std=c99
+ -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
+
+Or, for kernel mode:
+
+ -x c -std=c99
+ -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km"
+
+Note that some header files might require manually including a specific `windows.h` header which necessitates specifying a target platform to get the appropriate includes:
+
+ --target=x86_64-pc-windows-msvc
+ -x c -std=c99
+ -include"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um\windows.h"
+ -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
+
+
+##### Cross-Platform Targets
+
+If you are analyzing a target that is for a different operating system, you need to both find the header include paths for that system, and copy (or mount) them to a location accessible by the computer running Binary Ninja.
+
+### Export Header File
+
+If you want to compile code using the structures you defined during your analysis, you can export all the types to a C-compatible header file that can be used via `#include` by a C compiler. You can also import this header in another analysis session via [Import Header File](#import-header-file), just be sure to enable `Define Binary Ninja Macros` when doing so.
+
+## Platform Types
+
+Binary Ninja pulls type information from a variety of sources. The highest-level source are the platform types loaded for the given platform (which includes operating system and architecture). There are two sources of platform types. The first are shipped with the product in a [binary path](../index.md#directories). The second location is in your [user folder](../index.md#user-folder) and is intended for you to put custom platform types.
+
+???+ Danger "Warning"
+ Do NOT make changes to platform types in the binary path as they will be overwritten any time Binary Ninja updates.
+
+Platform types are used to define types that should be available to all programs available on that particular platform. They are only for global common types. Consider, for example, that you might want to add the following on windows:
+
+```
+typedef uint8_t u8;
+```
+
+You could write this type into:
+
+```
+/home/user/.binaryninja/types/platform/windows-x86.c
+```
+
+And any time you opened a 32bit windows binary, that type would be available to use. However, please note that these are not substitutes for [Type Libraries](../../dev/annotation.md#type-libraries). Type Libraries are used to provide a collection of types for a given library such as a libc, or common DLL.
+
+???+ Warning "Tip"
+ If you don't know the specific platform (and thus filename) you need to create for a given file, just enter `bv.platform` in the scripting console.
+
+### Common Types
+
+You may wish to provide types that are common across multiple architectures or platforms. The easiest way to do this is to use a `#include "filename.c"` line in the specific platform so that any common types will be loaded.
+
+For example, something like:
+
+```
+$ pwd
+/home/user/.binaryninja/types/platform
+$ cat windows-x86.c
+#include "windows.c"
+$ cat windows-x86_64.c
+#include "windows.c"
+$ cat windows.c
+typedef uint8_t u8;
+```
diff --git a/docs/guide/types/typelibraries.md b/docs/guide/types/typelibraries.md
new file mode 100644
index 00000000..28e0b4fb
--- /dev/null
+++ b/docs/guide/types/typelibraries.md
@@ -0,0 +1,37 @@
+# Type Libraries
+
+Type Libraries are collections of type information (structs, enums, function types, etc.), corresponding to specific dynamic libraries that are imported into your analysis. You can browse and import them in the [Types View](./basictypes.md#the-type-list).
+
+__image of Type List showing a couple imported type libraries, with one expanded showing its types__
+
+## Usage
+
+Most of your usage of Type Libraries will be performed automatically by Binary Ninja when you analyze a binary. They are automatically imported based on the libraries that your binary uses. Any library functions or global variables your binary references will have their type signature imported, and any structures those functions and variables reference are imported as well.
+
+__image of linear view showing a bunch of imported functions from a type library__
+
+Compared to [Platform Types](./platformtypes.md), only Type Libraries needed by your binary will be imported into your analysis. If you want to manually import additional Type Libraries (e.g. if your binary dynamically loads a library), you can use the **Import Type Library** action in [Types View](./basictypes.md#the-type-list). Just pick a Type Library from the list shown, and it will be added to the list where you can import types from it.
+
+If you want to use types from a Type Library that have not yet been imported, you can select them in the [Types View](./basictypes.md#the-type-list) and use the **Import Types** action. They will be copied into your analysis's System Types and you can use them in your own structure and function annotations.
+
+## Design and Purpose
+
+Type Libraries contain details about a specific library that is imported by binaries. They contain information about the types used in the library:
+* Types
+ * Structures, Classes, Unions
+ * Enumerations
+ * Typedefs
+* Objects
+ * Function Signatures
+ * Global Variables
+
+Type Libraries are named after the source library they are providing types for. When a binary is opened, Binary Ninja finds all of its linked library dependencies, and looks up Type Libraries for them. Those with a File Name or Alternative Name matching the exact text of a library used by the binary will be imported into the analysis. You can see this process in the Log:
+
+ elf: searching for 'libc.so.6' in type libraries
+ Type library 'libc.so.6' imported
+
+The [Developer Guide](../../dev/typelibraries.md) contains more details about the implementation details of the Type Library format.
+
+## Creating and Modifying
+
+Type Libraries are read-only by design, so while you cannot modify the ones built into Binary Ninja, you can create your own and use them as replacements. While there is no User Interface for doing this, there are plenty of APIs available. Check the [Developer Guide](../../dev/typelibraries.md) for details on how to create a Type Library.
diff --git a/docs/img/BNIL-hlil.png b/docs/img/BNIL-hlil.png
index 07c96dd9..fc5469b2 100644
--- a/docs/img/BNIL-hlil.png
+++ b/docs/img/BNIL-hlil.png
Binary files differ
diff --git a/docs/img/BNIL-llil.png b/docs/img/BNIL-llil.png
index 2b5c56e0..a887ac48 100644
--- a/docs/img/BNIL-llil.png
+++ b/docs/img/BNIL-llil.png
Binary files differ
diff --git a/docs/img/BNIL-mlil.png b/docs/img/BNIL-mlil.png
index 22b0f371..6b865366 100644
--- a/docs/img/BNIL-mlil.png
+++ b/docs/img/BNIL-mlil.png
Binary files differ
diff --git a/docs/img/BNIL-overview.png b/docs/img/BNIL-overview.png
index aef8e665..7c2370e6 100644
--- a/docs/img/BNIL-overview.png
+++ b/docs/img/BNIL-overview.png
Binary files differ
diff --git a/docs/img/BNIL.png b/docs/img/BNIL.png
index 19dafbdf..a89a7481 100644
--- a/docs/img/BNIL.png
+++ b/docs/img/BNIL.png
Binary files differ
diff --git a/docs/img/address-indicator.png b/docs/img/address-indicator.png
index 91aae584..e41f9d69 100644
--- a/docs/img/address-indicator.png
+++ b/docs/img/address-indicator.png
Binary files differ
diff --git a/docs/img/after-template-simplification.png b/docs/img/after-template-simplification.png
index a463b46f..26fbd59d 100755..100644
--- a/docs/img/after-template-simplification.png
+++ b/docs/img/after-template-simplification.png
Binary files differ
diff --git a/docs/img/apply_enum.png b/docs/img/apply_enum.png
deleted file mode 100644
index 0d1c60ae..00000000
--- a/docs/img/apply_enum.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/auto-create-members.png b/docs/img/auto-create-members.png
index b9a25fa1..b1637f9e 100644
--- a/docs/img/auto-create-members.png
+++ b/docs/img/auto-create-members.png
Binary files differ
diff --git a/docs/img/auto-create-one-member.png b/docs/img/auto-create-one-member.png
deleted file mode 100644
index cc0a7250..00000000
--- a/docs/img/auto-create-one-member.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/before-template-simplification.png b/docs/img/before-template-simplification.png
index 35800a39..cd7fb1b1 100755..100644
--- a/docs/img/before-template-simplification.png
+++ b/docs/img/before-template-simplification.png
Binary files differ
diff --git a/docs/img/change-type.png b/docs/img/change-type.png
index 3e7c85b0..cc917fd3 100644
--- a/docs/img/change-type.png
+++ b/docs/img/change-type.png
Binary files differ
diff --git a/docs/img/clear-var-value.png b/docs/img/clear-var-value.png
index 165b7cc4..b2e337e2 100644
--- a/docs/img/clear-var-value.png
+++ b/docs/img/clear-var-value.png
Binary files differ
diff --git a/docs/img/command-palette.png b/docs/img/command-palette.png
index 014071df..0f95e8ce 100644
--- a/docs/img/command-palette.png
+++ b/docs/img/command-palette.png
Binary files differ
diff --git a/docs/img/console-split.png b/docs/img/console-split.png
index f7753252..e0170049 100644
--- a/docs/img/console-split.png
+++ b/docs/img/console-split.png
Binary files differ
diff --git a/docs/img/console.png b/docs/img/console.png
index e4401dea..bd021410 100644
--- a/docs/img/console.png
+++ b/docs/img/console.png
Binary files differ
diff --git a/docs/img/controls.png b/docs/img/controls.png
deleted file mode 100644
index 03dc4cf2..00000000
--- a/docs/img/controls.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/correct-switch-after-uidf.png b/docs/img/correct-switch-after-uidf.png
deleted file mode 100644
index 308af9ab..00000000
--- a/docs/img/correct-switch-after-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create-array.png b/docs/img/create-array.png
new file mode 100644
index 00000000..3e1b5ca2
--- /dev/null
+++ b/docs/img/create-array.png
Binary files differ
diff --git a/docs/img/create-derived-struct-1.png b/docs/img/create-derived-struct-1.png
new file mode 100644
index 00000000..d07ea3f8
--- /dev/null
+++ b/docs/img/create-derived-struct-1.png
Binary files differ
diff --git a/docs/img/create-derived-struct-2.png b/docs/img/create-derived-struct-2.png
new file mode 100644
index 00000000..1b9a7377
--- /dev/null
+++ b/docs/img/create-derived-struct-2.png
Binary files differ
diff --git a/docs/img/create-multi-derived-struct.png b/docs/img/create-multi-derived-struct.png
new file mode 100644
index 00000000..aee72270
--- /dev/null
+++ b/docs/img/create-multi-derived-struct.png
Binary files differ
diff --git a/docs/img/create-struct-menu.png b/docs/img/create-struct-menu.png
new file mode 100644
index 00000000..fff0ec8e
--- /dev/null
+++ b/docs/img/create-struct-menu.png
Binary files differ
diff --git a/docs/img/create_array.png b/docs/img/create_array.png
deleted file mode 100644
index 5e2f7c03..00000000
--- a/docs/img/create_array.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create_derived_struct_1.png b/docs/img/create_derived_struct_1.png
deleted file mode 100644
index b4e6f9b0..00000000
--- a/docs/img/create_derived_struct_1.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create_derived_struct_2.png b/docs/img/create_derived_struct_2.png
deleted file mode 100644
index ebac72ed..00000000
--- a/docs/img/create_derived_struct_2.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create_multi_derived_struct.png b/docs/img/create_multi_derived_struct.png
deleted file mode 100644
index ffa49058..00000000
--- a/docs/img/create_multi_derived_struct.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create_struct_menu.png b/docs/img/create_struct_menu.png
deleted file mode 100644
index d4eeb130..00000000
--- a/docs/img/create_struct_menu.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/cross-reference-filter.png b/docs/img/cross-reference-filter.png
index c62e9d56..40087e70 100644
--- a/docs/img/cross-reference-filter.png
+++ b/docs/img/cross-reference-filter.png
Binary files differ
diff --git a/docs/img/cross-reference-panel-pin.png b/docs/img/cross-reference-panel-pin.png
index d5cde0ab..26e6ab4b 100644
--- a/docs/img/cross-reference-panel-pin.png
+++ b/docs/img/cross-reference-panel-pin.png
Binary files differ
diff --git a/docs/img/cross-reference-table.png b/docs/img/cross-reference-table.png
index c6700d38..7b64a5f4 100644
--- a/docs/img/cross-reference-table.png
+++ b/docs/img/cross-reference-table.png
Binary files differ
diff --git a/docs/img/cross-reference-tree.png b/docs/img/cross-reference-tree.png
index bedb7c20..d5c55d7d 100644
--- a/docs/img/cross-reference-tree.png
+++ b/docs/img/cross-reference-tree.png
Binary files differ
diff --git a/docs/img/dead-store-after.png b/docs/img/dead-store-after.png
index 24047d08..572eed31 100644
--- a/docs/img/dead-store-after.png
+++ b/docs/img/dead-store-after.png
Binary files differ
diff --git a/docs/img/dead-store-example.png b/docs/img/dead-store-example.png
index 2f5a5159..c063b814 100644
--- a/docs/img/dead-store-example.png
+++ b/docs/img/dead-store-example.png
Binary files differ
diff --git a/docs/img/dead-store-menu.png b/docs/img/dead-store-menu.png
index 71a1a48c..8bb00f6e 100644
--- a/docs/img/dead-store-menu.png
+++ b/docs/img/dead-store-menu.png
Binary files differ
diff --git a/docs/img/efp-dialog-diagram.png b/docs/img/efp-dialog-diagram.png
new file mode 100644
index 00000000..ebd8a96b
--- /dev/null
+++ b/docs/img/efp-dialog-diagram.png
Binary files differ
diff --git a/docs/img/efp_dialog_diagram.png b/docs/img/efp_dialog_diagram.png
deleted file mode 100644
index 0185a3a7..00000000
--- a/docs/img/efp_dialog_diagram.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/external-links-edit-external-library.png b/docs/img/external-links-edit-external-library.png
new file mode 100644
index 00000000..e63aa3da
--- /dev/null
+++ b/docs/img/external-links-edit-external-library.png
Binary files differ
diff --git a/docs/img/external-links-edit-external-location.png b/docs/img/external-links-edit-external-location.png
new file mode 100644
index 00000000..cbb502ef
--- /dev/null
+++ b/docs/img/external-links-edit-external-location.png
Binary files differ
diff --git a/docs/img/external-links-right-click-library.png b/docs/img/external-links-right-click-library.png
new file mode 100644
index 00000000..b51c6432
--- /dev/null
+++ b/docs/img/external-links-right-click-library.png
Binary files differ
diff --git a/docs/img/external-links.png b/docs/img/external-links.png
new file mode 100644
index 00000000..cecc227a
--- /dev/null
+++ b/docs/img/external-links.png
Binary files differ
diff --git a/docs/img/featuremap.png b/docs/img/featuremap.png
index 226ba48e..0ba5a3fd 100644
--- a/docs/img/featuremap.png
+++ b/docs/img/featuremap.png
Binary files differ
diff --git a/docs/img/find.png b/docs/img/find.png
new file mode 100644
index 00000000..ab081ee7
--- /dev/null
+++ b/docs/img/find.png
Binary files differ
diff --git a/docs/img/functionlist.png b/docs/img/functionlist.png
deleted file mode 100644
index a6c6f441..00000000
--- a/docs/img/functionlist.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/graphview.png b/docs/img/graphview.png
index dc71df7e..8f9febee 100644
--- a/docs/img/graphview.png
+++ b/docs/img/graphview.png
Binary files differ
diff --git a/docs/img/hanyu-no-codepage.png b/docs/img/hanyu-no-codepage.png
new file mode 100644
index 00000000..1855bc1f
--- /dev/null
+++ b/docs/img/hanyu-no-codepage.png
Binary files differ
diff --git a/docs/img/hanyu-with-codepage.png b/docs/img/hanyu-with-codepage.png
new file mode 100644
index 00000000..37a87b38
--- /dev/null
+++ b/docs/img/hanyu-with-codepage.png
Binary files differ
diff --git a/docs/img/hex.png b/docs/img/hex.png
index c657ab5a..2ccf58c7 100644
--- a/docs/img/hex.png
+++ b/docs/img/hex.png
Binary files differ
diff --git a/docs/img/hlil-after-uidf.png b/docs/img/hlil-after-uidf.png
deleted file mode 100644
index 314e76dc..00000000
--- a/docs/img/hlil-after-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/hlil-before-uidf.png b/docs/img/hlil-before-uidf.png
deleted file mode 100644
index b05daf74..00000000
--- a/docs/img/hlil-before-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/hlil-braces.png b/docs/img/hlil-braces.png
index 74fbaaca..551c4e97 100644
--- a/docs/img/hlil-braces.png
+++ b/docs/img/hlil-braces.png
Binary files differ
diff --git a/docs/img/hlil-hierarchy-call.png b/docs/img/hlil-hierarchy-call.png
index 184537de..c4cb60ca 100644
--- a/docs/img/hlil-hierarchy-call.png
+++ b/docs/img/hlil-hierarchy-call.png
Binary files differ
diff --git a/docs/img/hlil-scope.png b/docs/img/hlil-scope.png
index d16393a1..62658cea 100644
--- a/docs/img/hlil-scope.png
+++ b/docs/img/hlil-scope.png
Binary files differ
diff --git a/docs/img/hover-uidf.png b/docs/img/hover-uidf.png
deleted file mode 100644
index a9fe6d0b..00000000
--- a/docs/img/hover-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/ilmapping.png b/docs/img/ilmapping.png
index d80a3ab5..bdfc028f 100644
--- a/docs/img/ilmapping.png
+++ b/docs/img/ilmapping.png
Binary files differ
diff --git a/docs/img/import-bndb.png b/docs/img/import-bndb.png
index 4fce92ed..96134c3e 100644
--- a/docs/img/import-bndb.png
+++ b/docs/img/import-bndb.png
Binary files differ
diff --git a/docs/img/import-header.png b/docs/img/import-header.png
index f86b71e8..2158f8e0 100644
--- a/docs/img/import-header.png
+++ b/docs/img/import-header.png
Binary files differ
diff --git a/docs/img/jump-table-uidf.png b/docs/img/jump-table-uidf.png
deleted file mode 100644
index 6d4e8d04..00000000
--- a/docs/img/jump-table-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/keybindings.png b/docs/img/keybindings.png
index 4f4f2a61..f918bc6b 100644
--- a/docs/img/keybindings.png
+++ b/docs/img/keybindings.png
Binary files differ
diff --git a/docs/img/license-popup.png b/docs/img/license-popup.png
index 558d025b..a003bb3d 100644
--- a/docs/img/license-popup.png
+++ b/docs/img/license-popup.png
Binary files differ
diff --git a/docs/img/linear.png b/docs/img/linear.png
index 925c0268..d77c31a7 100644
--- a/docs/img/linear.png
+++ b/docs/img/linear.png
Binary files differ
diff --git a/docs/img/llil-hierarchy.png b/docs/img/llil-hierarchy.png
index 2f1264a4..79b891f2 100644
--- a/docs/img/llil-hierarchy.png
+++ b/docs/img/llil-hierarchy.png
Binary files differ
diff --git a/docs/img/llil-option.png b/docs/img/llil-option.png
new file mode 100644
index 00000000..84017309
--- /dev/null
+++ b/docs/img/llil-option.png
Binary files differ
diff --git a/docs/img/llil_option.png b/docs/img/llil_option.png
deleted file mode 100644
index ee42c3b9..00000000
--- a/docs/img/llil_option.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/logo.png b/docs/img/logo.png
index c1e1ecb1..d117edcf 100644
--- a/docs/img/logo.png
+++ b/docs/img/logo.png
Binary files differ
diff --git a/docs/img/logs.png b/docs/img/logs.png
new file mode 100644
index 00000000..be89c384
--- /dev/null
+++ b/docs/img/logs.png
Binary files differ
diff --git a/docs/img/main.png b/docs/img/main.png
index 688cedc3..c3fa79f0 100644
--- a/docs/img/main.png
+++ b/docs/img/main.png
Binary files differ
diff --git a/docs/img/memory-map-icon.png b/docs/img/memory-map-icon.png
new file mode 100644
index 00000000..116e4a00
--- /dev/null
+++ b/docs/img/memory-map-icon.png
Binary files differ
diff --git a/docs/img/memory-map.png b/docs/img/memory-map.png
index b3f4e825..115da036 100644
--- a/docs/img/memory-map.png
+++ b/docs/img/memory-map.png
Binary files differ
diff --git a/docs/img/merge-variables.png b/docs/img/merge-variables.png
index 8f564f6c..9de2f1af 100644
--- a/docs/img/merge-variables.png
+++ b/docs/img/merge-variables.png
Binary files differ
diff --git a/docs/img/merge-vars-dialog.png b/docs/img/merge-vars-dialog.png
deleted file mode 100644
index 722503c9..00000000
--- a/docs/img/merge-vars-dialog.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/merge-vars.png b/docs/img/merge-vars.png
deleted file mode 100644
index 3038b1db..00000000
--- a/docs/img/merge-vars.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/mini-graph.png b/docs/img/mini-graph.png
new file mode 100644
index 00000000..a723875a
--- /dev/null
+++ b/docs/img/mini-graph.png
Binary files differ
diff --git a/docs/img/mystring.png b/docs/img/mystring.png
deleted file mode 100644
index a14805a3..00000000
--- a/docs/img/mystring.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/navigation.png b/docs/img/navigation.png
index 1210d15f..141aa148 100644
--- a/docs/img/navigation.png
+++ b/docs/img/navigation.png
Binary files differ
diff --git a/docs/img/newtab-compact.png b/docs/img/newtab-compact.png
new file mode 100644
index 00000000..9222a0e4
--- /dev/null
+++ b/docs/img/newtab-compact.png
Binary files differ
diff --git a/docs/img/newtab-personal.png b/docs/img/newtab-personal.png
new file mode 100644
index 00000000..1fdcc22b
--- /dev/null
+++ b/docs/img/newtab-personal.png
Binary files differ
diff --git a/docs/img/newtab-projects.png b/docs/img/newtab-projects.png
new file mode 100644
index 00000000..46e0cc90
--- /dev/null
+++ b/docs/img/newtab-projects.png
Binary files differ
diff --git a/docs/img/objc-analyze-action.png b/docs/img/objc-analyze-action.png
new file mode 100644
index 00000000..0f600bce
--- /dev/null
+++ b/docs/img/objc-analyze-action.png
Binary files differ
diff --git a/docs/img/objc-workflow-selected.png b/docs/img/objc-workflow-selected.png
new file mode 100644
index 00000000..14d4c4ac
--- /dev/null
+++ b/docs/img/objc-workflow-selected.png
Binary files differ
diff --git a/docs/img/objc_analyze_action.png b/docs/img/objc_analyze_action.png
deleted file mode 100644
index 2e486778..00000000
--- a/docs/img/objc_analyze_action.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/objc_workflow_selected.png b/docs/img/objc_workflow_selected.png
deleted file mode 100644
index 51ecef4f..00000000
--- a/docs/img/objc_workflow_selected.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/open-with-options.png b/docs/img/open-with-options.png
index c7f85e10..c90f2905 100644
--- a/docs/img/open-with-options.png
+++ b/docs/img/open-with-options.png
Binary files differ
diff --git a/docs/img/options-setting-uidf.png b/docs/img/options-setting-uidf.png
deleted file mode 100644
index 1205cd5d..00000000
--- a/docs/img/options-setting-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/options.png b/docs/img/options.png
index 86386da3..ecd6e3ba 100644
--- a/docs/img/options.png
+++ b/docs/img/options.png
Binary files differ
diff --git a/docs/img/overview.png b/docs/img/overview.png
index 0029ade0..2c731a2a 100644
--- a/docs/img/overview.png
+++ b/docs/img/overview.png
Binary files differ
diff --git a/docs/img/plugin-manager.png b/docs/img/plugin-manager.png
index 4fa534e5..f376be89 100644
--- a/docs/img/plugin-manager.png
+++ b/docs/img/plugin-manager.png
Binary files differ
diff --git a/docs/img/preferences.png b/docs/img/preferences.png
deleted file mode 100644
index 29b3033e..00000000
--- a/docs/img/preferences.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/projects.png b/docs/img/projects.png
new file mode 100644
index 00000000..9ec04afa
--- /dev/null
+++ b/docs/img/projects.png
Binary files differ
diff --git a/docs/img/pseudo-c.png b/docs/img/pseudo-c.png
index 80113b3e..3152727b 100644
--- a/docs/img/pseudo-c.png
+++ b/docs/img/pseudo-c.png
Binary files differ
diff --git a/docs/img/rename.png b/docs/img/rename.png
index 37aec6fa..f50e297d 100644
--- a/docs/img/rename.png
+++ b/docs/img/rename.png
Binary files differ
diff --git a/docs/img/right-click-uidf.png b/docs/img/right-click-uidf.png
deleted file mode 100644
index 0d9f0266..00000000
--- a/docs/img/right-click-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/save-choices.png b/docs/img/save-choices.png
index b4304b83..729ecfb1 100644
--- a/docs/img/save-choices.png
+++ b/docs/img/save-choices.png
Binary files differ
diff --git a/docs/img/save-with-options.png b/docs/img/save-with-options.png
index 103ada1c..5db0f06a 100644
--- a/docs/img/save-with-options.png
+++ b/docs/img/save-with-options.png
Binary files differ
diff --git a/docs/img/select-enum-member.png b/docs/img/select-enum-member.png
new file mode 100644
index 00000000..3174ea74
--- /dev/null
+++ b/docs/img/select-enum-member.png
Binary files differ
diff --git a/docs/img/select_enum_member.png b/docs/img/select_enum_member.png
deleted file mode 100644
index fe062f5c..00000000
--- a/docs/img/select_enum_member.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/settings.png b/docs/img/settings.png
index 0518786d..f85f245e 100644
--- a/docs/img/settings.png
+++ b/docs/img/settings.png
Binary files differ
diff --git a/docs/img/sidebar.png b/docs/img/sidebar.png
deleted file mode 100644
index 1e67b263..00000000
--- a/docs/img/sidebar.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/sidebaricons.png b/docs/img/sidebaricons.png
new file mode 100644
index 00000000..d95dc208
--- /dev/null
+++ b/docs/img/sidebaricons.png
Binary files differ
diff --git a/docs/img/sidebars.png b/docs/img/sidebars.png
new file mode 100644
index 00000000..0f69e6ae
--- /dev/null
+++ b/docs/img/sidebars.png
Binary files differ
diff --git a/docs/img/split-var.png b/docs/img/split-var.png
index 72f45e85..94849a5d 100644
--- a/docs/img/split-var.png
+++ b/docs/img/split-var.png
Binary files differ
diff --git a/docs/img/stack.png b/docs/img/stack.png
new file mode 100644
index 00000000..0efad194
--- /dev/null
+++ b/docs/img/stack.png
Binary files differ
diff --git a/docs/img/status-bar.png b/docs/img/status-bar.png
index f4f42870..af8d090d 100644
--- a/docs/img/status-bar.png
+++ b/docs/img/status-bar.png
Binary files differ
diff --git a/docs/img/stringapplied.png b/docs/img/stringapplied.png
deleted file mode 100644
index 994d5179..00000000
--- a/docs/img/stringapplied.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/strings.png b/docs/img/strings.png
new file mode 100644
index 00000000..5f94c6d1
--- /dev/null
+++ b/docs/img/strings.png
Binary files differ
diff --git a/docs/img/symbols-header-menu.png b/docs/img/symbols-header-menu.png
new file mode 100644
index 00000000..712a7b9a
--- /dev/null
+++ b/docs/img/symbols-header-menu.png
Binary files differ
diff --git a/docs/img/symbols-right-click.png b/docs/img/symbols-right-click.png
new file mode 100644
index 00000000..c199b980
--- /dev/null
+++ b/docs/img/symbols-right-click.png
Binary files differ
diff --git a/docs/img/symbols_dragtocreate.png b/docs/img/symbols_dragtocreate.png
deleted file mode 100644
index fa327b0b..00000000
--- a/docs/img/symbols_dragtocreate.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_header_drag.png b/docs/img/symbols_header_drag.png
deleted file mode 100644
index 5863aa4e..00000000
--- a/docs/img/symbols_header_drag.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_header_menu.png b/docs/img/symbols_header_menu.png
deleted file mode 100644
index cb2caf43..00000000
--- a/docs/img/symbols_header_menu.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_overview1.png b/docs/img/symbols_overview1.png
deleted file mode 100644
index 055c0742..00000000
--- a/docs/img/symbols_overview1.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_right_click_NFwS.png b/docs/img/symbols_right_click_NFwS.png
deleted file mode 100644
index b459f4b0..00000000
--- a/docs/img/symbols_right_click_NFwS.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_truncation.png b/docs/img/symbols_truncation.png
deleted file mode 100644
index fa2de480..00000000
--- a/docs/img/symbols_truncation.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/tags.png b/docs/img/tags.png
new file mode 100644
index 00000000..e257fada
--- /dev/null
+++ b/docs/img/tags.png
Binary files differ
diff --git a/docs/img/taped/1.png b/docs/img/taped/1.png
index 291481c8..3aadee6f 100644
--- a/docs/img/taped/1.png
+++ b/docs/img/taped/1.png
Binary files differ
diff --git a/docs/img/taped/2.png b/docs/img/taped/2.png
index a0c18289..ad597518 100644
--- a/docs/img/taped/2.png
+++ b/docs/img/taped/2.png
Binary files differ
diff --git a/docs/img/taped/3.png b/docs/img/taped/3.png
index b1a5cb96..4a619d7a 100644
--- a/docs/img/taped/3.png
+++ b/docs/img/taped/3.png
Binary files differ
diff --git a/docs/img/taped/4.png b/docs/img/taped/4.png
index 329f6f1f..d56c6f48 100644
--- a/docs/img/taped/4.png
+++ b/docs/img/taped/4.png
Binary files differ
diff --git a/docs/img/taped/5.png b/docs/img/taped/5.png
index 3c45bf51..c67fea43 100644
--- a/docs/img/taped/5.png
+++ b/docs/img/taped/5.png
Binary files differ
diff --git a/docs/img/taped/6.png b/docs/img/taped/6.png
index 60562078..f68ba984 100644
--- a/docs/img/taped/6.png
+++ b/docs/img/taped/6.png
Binary files differ
diff --git a/docs/img/themedocs-console.png b/docs/img/themedocs-console.png
deleted file mode 100644
index a3872270..00000000
--- a/docs/img/themedocs-console.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-graphview.png b/docs/img/themedocs-graphview.png
deleted file mode 100644
index 46fc7282..00000000
--- a/docs/img/themedocs-graphview.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-hexview.png b/docs/img/themedocs-hexview.png
deleted file mode 100644
index f68fe127..00000000
--- a/docs/img/themedocs-hexview.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-highlighting.png b/docs/img/themedocs-highlighting.png
deleted file mode 100644
index c4a08e7e..00000000
--- a/docs/img/themedocs-highlighting.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-linearview.png b/docs/img/themedocs-linearview.png
deleted file mode 100644
index 6fa91b83..00000000
--- a/docs/img/themedocs-linearview.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-tokens.png b/docs/img/themedocs-tokens.png
deleted file mode 100644
index d36314ca..00000000
--- a/docs/img/themedocs-tokens.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themes-console.png b/docs/img/themes-console.png
new file mode 100644
index 00000000..7a410034
--- /dev/null
+++ b/docs/img/themes-console.png
Binary files differ
diff --git a/docs/img/themes-graph.png b/docs/img/themes-graph.png
new file mode 100644
index 00000000..df74c012
--- /dev/null
+++ b/docs/img/themes-graph.png
Binary files differ
diff --git a/docs/img/themes-hex.png b/docs/img/themes-hex.png
new file mode 100644
index 00000000..cad30b42
--- /dev/null
+++ b/docs/img/themes-hex.png
Binary files differ
diff --git a/docs/img/themes-hexview.png b/docs/img/themes-hexview.png
new file mode 100644
index 00000000..495eb935
--- /dev/null
+++ b/docs/img/themes-hexview.png
Binary files differ
diff --git a/docs/img/themes-highlighting.png b/docs/img/themes-highlighting.png
new file mode 100644
index 00000000..097bfb28
--- /dev/null
+++ b/docs/img/themes-highlighting.png
Binary files differ
diff --git a/docs/img/themes-linear.png b/docs/img/themes-linear.png
new file mode 100644
index 00000000..392bab47
--- /dev/null
+++ b/docs/img/themes-linear.png
Binary files differ
diff --git a/docs/img/themes-minigraph.png b/docs/img/themes-minigraph.png
new file mode 100644
index 00000000..b3dc1318
--- /dev/null
+++ b/docs/img/themes-minigraph.png
Binary files differ
diff --git a/docs/img/themes-panes.png b/docs/img/themes-panes.png
new file mode 100644
index 00000000..0f88c8be
--- /dev/null
+++ b/docs/img/themes-panes.png
Binary files differ
diff --git a/docs/img/themes-statusbar.png b/docs/img/themes-statusbar.png
new file mode 100644
index 00000000..f35970f8
--- /dev/null
+++ b/docs/img/themes-statusbar.png
Binary files differ
diff --git a/docs/img/themes-tokens.png b/docs/img/themes-tokens.png
new file mode 100644
index 00000000..ed6cc1e2
--- /dev/null
+++ b/docs/img/themes-tokens.png
Binary files differ
diff --git a/docs/img/tiling-panes.png b/docs/img/tiling-panes.png
index 1f0860dd..9503e39a 100644
--- a/docs/img/tiling-panes.png
+++ b/docs/img/tiling-panes.png
Binary files differ
diff --git a/docs/img/type-archives-status.png b/docs/img/type-archives-status.png
new file mode 100644
index 00000000..783703e1
--- /dev/null
+++ b/docs/img/type-archives-status.png
Binary files differ
diff --git a/docs/img/type-archives.png b/docs/img/type-archives.png
new file mode 100644
index 00000000..c202e3b1
--- /dev/null
+++ b/docs/img/type-archives.png
Binary files differ
diff --git a/docs/img/type-view-accesses.png b/docs/img/type-view-accesses.png
deleted file mode 100644
index d34410a9..00000000
--- a/docs/img/type-view-accesses.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/types-containers.png b/docs/img/types-containers.png
new file mode 100644
index 00000000..8fde5275
--- /dev/null
+++ b/docs/img/types-containers.png
Binary files differ
diff --git a/docs/img/types-list.png b/docs/img/types-list.png
new file mode 100644
index 00000000..45bd6c2d
--- /dev/null
+++ b/docs/img/types-list.png
Binary files differ
diff --git a/docs/img/types-right-click-menu-bottom.png b/docs/img/types-right-click-menu-bottom.png
new file mode 100644
index 00000000..b11fbe82
--- /dev/null
+++ b/docs/img/types-right-click-menu-bottom.png
Binary files differ
diff --git a/docs/img/types-right-click-menu-top.png b/docs/img/types-right-click-menu-top.png
new file mode 100644
index 00000000..0b468a14
--- /dev/null
+++ b/docs/img/types-right-click-menu-top.png
Binary files differ
diff --git a/docs/img/types-right-click-menu.png b/docs/img/types-right-click-menu.png
deleted file mode 100644
index c7cb427f..00000000
--- a/docs/img/types-right-click-menu.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/types-view.png b/docs/img/types-view.png
index ed70c3f7..1808216c 100644
--- a/docs/img/types-view.png
+++ b/docs/img/types-view.png
Binary files differ
diff --git a/docs/img/uidf-correct-switch-after.png b/docs/img/uidf-correct-switch-after.png
new file mode 100644
index 00000000..1a8f4299
--- /dev/null
+++ b/docs/img/uidf-correct-switch-after.png
Binary files differ
diff --git a/docs/img/uidf-hlil-after.png b/docs/img/uidf-hlil-after.png
new file mode 100644
index 00000000..1c722c73
--- /dev/null
+++ b/docs/img/uidf-hlil-after.png
Binary files differ
diff --git a/docs/img/uidf-hlil-before.png b/docs/img/uidf-hlil-before.png
new file mode 100644
index 00000000..977104ca
--- /dev/null
+++ b/docs/img/uidf-hlil-before.png
Binary files differ
diff --git a/docs/img/uidf-hover.png b/docs/img/uidf-hover.png
new file mode 100644
index 00000000..fe154352
--- /dev/null
+++ b/docs/img/uidf-hover.png
Binary files differ
diff --git a/docs/img/uidf-jump-table.png b/docs/img/uidf-jump-table.png
new file mode 100644
index 00000000..af179480
--- /dev/null
+++ b/docs/img/uidf-jump-table.png
Binary files differ
diff --git a/docs/img/uidf-options-setting.png b/docs/img/uidf-options-setting.png
new file mode 100644
index 00000000..dfa063aa
--- /dev/null
+++ b/docs/img/uidf-options-setting.png
Binary files differ
diff --git a/docs/img/uidf-right-click.png b/docs/img/uidf-right-click.png
new file mode 100644
index 00000000..fa690f09
--- /dev/null
+++ b/docs/img/uidf-right-click.png
Binary files differ
diff --git a/docs/img/uidf-sidebar.png b/docs/img/uidf-sidebar.png
new file mode 100644
index 00000000..8f5e2a84
--- /dev/null
+++ b/docs/img/uidf-sidebar.png
Binary files differ
diff --git a/docs/img/unicode-settings.png b/docs/img/unicode-settings.png
new file mode 100644
index 00000000..7a223414
--- /dev/null
+++ b/docs/img/unicode-settings.png
Binary files differ
diff --git a/docs/img/variables.png b/docs/img/variables.png
new file mode 100644
index 00000000..441de572
--- /dev/null
+++ b/docs/img/variables.png
Binary files differ
diff --git a/docs/img/view-choices.png b/docs/img/view-choices.png
index 1d379cbb..98aed16e 100644
--- a/docs/img/view-choices.png
+++ b/docs/img/view-choices.png
Binary files differ
diff --git a/docs/img/vtable-cross-refs-context.png b/docs/img/vtable-cross-refs-context.png
new file mode 100644
index 00000000..31dda234
--- /dev/null
+++ b/docs/img/vtable-cross-refs-context.png
Binary files differ
diff --git a/docs/img/vtable-cross-refs.png b/docs/img/vtable-cross-refs.png
new file mode 100644
index 00000000..e900fad1
--- /dev/null
+++ b/docs/img/vtable-cross-refs.png
Binary files differ
diff --git a/docs/img/vtable_cross_refs.png b/docs/img/vtable_cross_refs.png
deleted file mode 100644
index 18b715fe..00000000
--- a/docs/img/vtable_cross_refs.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/vtable_cross_refs_context.png b/docs/img/vtable_cross_refs_context.png
deleted file mode 100644
index 4bd1a242..00000000
--- a/docs/img/vtable_cross_refs_context.png
+++ /dev/null
Binary files differ
diff --git a/docs/index.md b/docs/index.md
index 1e6f5daf..e9e463f4 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,13 +1,10 @@
# Binary Ninja
-A new kind of reverse engineering platform
+[Binary Ninja](https://binary.ninja/) is a reverse engineering platform and decompiler. It focuses on a clean and easy to use interface with a powerful multithreaded analysis built on top of a stack of custom ILs. It can quickly adapt to a variety of architectures, platforms, and compilers.
----
+- To quickly get started as a new user, check out our [Getting Started Guide](getting-started.md).
+- To learn about the user interface, check out the more extensive [User Guide](./guide/index.md).
+- To learn about the API and plugin design, check out the [Developer Guide](./dev/index.md).
+- To get a complete reference for the API, check out the documentation for [Python](https://api.binary.ninja/), [C++](https://api.binary.ninja/cpp/), and [Rust](https://rust.binary.ninja/binaryninja/).
-[Binary Ninja](https://binary.ninja/) is a reverse engineering platform. It focuses on a clean and easy to use interface with a powerful multithreaded analysis built on a custom IL to quickly adapt to a variety of architectures, platforms, and compilers.
-
-- To quickly get started as a new user, check out our [getting started guide](getting-started.md).
-- More in-depth user questions are probably answered in our [user manual](./guide/index.md).
-- Anyone wanting to get started with our powerful API should check out the [developer section](./dev/index.md). Note that this section is different from our API reference for [Python](https://api.binary.ninja/), [CPP](https://api.binary.ninja/cpp/), and [Rust](https://rust.binary.ninja/binaryninja/).
-
-Of course, if you just have some questions, you might find our [discussions](https://github.com/Vector35/binaryninja-api/discussions) forum helpful, search [search our public issue tracker](https://github.com/Vector35/binaryninja-api/issues) or join the more interactive [slack channel](https://slack.binary.ninja/).
+Of course, if you just have some questions, you might find our [discussions](https://github.com/Vector35/binaryninja-api/discussions) forum helpful, search [our public issue tracker](https://github.com/Vector35/binaryninja-api/issues), or join the more interactive [slack channel](https://slack.binary.ninja/).
diff --git a/mkdocs-verify.yml b/mkdocs-verify.yml
deleted file mode 100644
index df98dcb3..00000000
--- a/mkdocs-verify.yml
+++ /dev/null
@@ -1,87 +0,0 @@
-site_name: 'Binary Ninja User Documentation'
-site_url: 'https://docs.binary.ninja/'
-repo_url: 'https://binary.ninja/'
-repo_name: 'binary.ninja'
-site_description: 'Documentation for the Binary Ninja reverse engineering platform'
-site_author: 'Vector 35 Inc'
-use_directory_urls: false
-extra_css: ['docs.css', 'github.min.css', 'juxtapose.min.css']
-extra_javascript: ['highlight.min.js', 'cpp.min.js', 'python.min.js', 'juxtapose.min.js']
-theme:
- name: material
- custom_dir: overrides
- favicon: 'img/favicon.ico'
- font: false
- highlightjs: false
- palette:
- scheme: binja
- accent: red
- features:
- - navigation.tracking
- - navigation.tabs
- - navigation.sections
- - navigation.expand
- - navigation.prune
- - navigation.indexes
- - navigation.top
- shortcuts:
- help: 191 # ?
- next: 78 # n
- previous: 80 # p
- search: 191 # ? / /
-
- copyright: '(<a href="https://creativecommons.org/licenses/by/3.0/">cc</a>) <a href="https://vector35.com/">Vector 35 Inc</a>'
-
-plugins:
- - search
- - offline
- - htmlproofer:
- enabled: True
-
-markdown_extensions:
- - codehilite
- - admonition
- - pymdownx.details
- - pymdownx.superfences
- - toc:
- permalink: True
-
-nav:
- - Home: 'index.md'
- - Getting Started: 'getting-started.md'
- #
- #- User Manual: 'guide/'
- #- Developer Guide: 'dev/'
- #- About: 'about/'
- - User Manual:
- - 'guide/index.md'
- - Plugins: 'guide/plugins.md'
- - Settings: 'guide/settings.md'
- - Types: 'guide/type.md'
- - C++ Types: 'guide/cpp.md'
- - Debug Info: 'guide/debuginfo.md'
- - Debugger: 'guide/debugger.md'
- - Objective-C (Experimental): 'guide/objectivec.md'
- - Troubleshooting: 'guide/troubleshooting.md'
- - Developer Guide:
- - 'dev/index.md'
- - Important Concepts: 'dev/concepts.md'
- - Applying Annotations: 'dev/annotation.md'
- - Cookbook: 'dev/cookbook.md'
- - Writing Plugins: 'dev/plugins.md'
- - Automation: 'dev/batch.md'
- - BNIL Guide&#58; Overview: 'dev/bnil-overview.md'
- - BNIL Guide&#58; LLIL: 'dev/bnil-llil.md'
- - BNIL Guide&#58; MLIL: 'dev/bnil-mlil.md'
- - Flag Guide: 'dev/flags.md'
- - Workflows: 'dev/workflows.md'
- - Creating Themes: 'dev/themes.md'
- - Contributing Documentation: 'dev/documentation.md'
- - About:
- - 'about/index.md'
- - License: 'about/license.md'
- - Open Source: 'about/open-source.md'
-
-extra:
- disablesearch: True
- logo: 'images/logo.png'
diff --git a/mkdocs.yml b/mkdocs.yml
index 09ebe86d..b714b75f 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -14,8 +14,24 @@ theme:
font: false
highlightjs: false
palette:
- scheme: binja
- accent: red
+
+ # Palette toggle for light mode
+ - media: "(prefers-color-scheme: light)"
+ scheme: binja
+ accent: red
+ primary: red
+ toggle:
+ icon: material/brightness-7
+ name: Switch to dark mode
+
+ # Palette toggle for dark mode
+ - media: "(prefers-color-scheme: dark)"
+ scheme: slate
+ primary: red
+ accent: red
+ toggle:
+ icon: material/brightness-4
+ name: Switch to light mode
features:
- navigation.tracking
- navigation.tabs
@@ -36,8 +52,15 @@ theme:
plugins:
- search
- offline
+ - glightbox:
+ background: none
+ shadow: false
+ - htmlproofer:
+ enabled: !ENV [VALIDATE, False]
markdown_extensions:
+ - attr_list
+ - md_in_html
- codehilite
- admonition
- pymdownx.details
@@ -48,35 +71,51 @@ markdown_extensions:
nav:
- Home: 'index.md'
- Getting Started: 'getting-started.md'
- #
- #- User Manual: 'guide/'
- #- Developer Guide: 'dev/'
- #- About: 'about/'
- - User Manual:
+ # When updating here make sure to update guide/index.md as well
+ - User Guide:
- 'guide/index.md'
- Plugins: 'guide/plugins.md'
- Settings: 'guide/settings.md'
- - Types: 'guide/type.md'
- - C++ Types: 'guide/cpp.md'
- - Debug Info: 'guide/debuginfo.md'
- - Debugger: 'guide/debugger.md'
- - Objective-C (Experimental): 'guide/objectivec.md'
+ - Projects: 'guide/projects.md'
- Troubleshooting: 'guide/troubleshooting.md'
+ - Objective-C (Experimental): 'guide/objectivec.md'
+ - Debugger:
+ - Overview: 'guide/debugger/index.md'
+ - Remote Debugging: 'guide/debugger/remote-debugging.md'
+ - Time Travel Debugging (Windows): 'guide/debugger/dbgeng-ttd.md'
+ - Kernel Debugging (Windows): 'guide/debugger/windows-kd.md'
+ - Migration Guide:
+ - 'guide/migration/index.md'
+ - Migrating from IDA: 'guide/migration/migrationguideida.md'
+ - Migrating from Ghidra: 'guide/migration/migrationguideghidra.md'
+ - Types:
+ - 'guide/types/index.md'
+ - Basic Types: 'guide/types/basictypes.md'
+ - Working With Types: 'guide/types/type.md'
+ - Importing/Exporting Types: 'guide/types/typeimportexport.md'
+ - Type Archives: 'guide/types/typearchives.md'
+ - Type Libraries: 'guide/types/typelibraries.md'
+ - Debug Info: 'guide/types/debuginfo.md'
+ - Platform Types: 'guide/types/platformtypes.md'
+ - C++ Types: 'guide/types/cpp.md'
- Developer Guide:
- 'dev/index.md'
- Cookbook: 'dev/cookbook.md'
- Writing Plugins: 'dev/plugins.md'
- Automation: 'dev/batch.md'
- BNIL / Architectures:
- - BNIL Guide&#58; Overview: 'dev/bnil-overview.md'
- - BNIL Guide&#58; LLIL: 'dev/bnil-llil.md'
- - BNIL Guide&#58; MLIL: 'dev/bnil-mlil.md'
- - Flag Guide: 'dev/flags.md'
+ - BNIL Guide&#58; Overview: 'dev/bnil-overview.md'
+ - BNIL Guide&#58; LLIL: 'dev/bnil-llil.md'
+ - BNIL Guide&#58; MLIL: 'dev/bnil-mlil.md'
+ - BNIL Guide&#58; HLIL: 'dev/bnil-hlil.md'
+ - Flag Guide: 'dev/flags.md'
+ - Types:
+ - Applying Annotations: 'dev/annotation.md'
+ - Type Libraries: 'dev/typelibraries.md'
- Important Concepts:
- - 'dev/concepts.md'
- - Applying Annotations: 'dev/annotation.md'
- - User Informed Data Flow: 'dev/uidf.md'
- - Workflows: 'dev/workflows.md'
+ - 'dev/concepts.md'
+ - User Informed Data Flow: 'dev/uidf.md'
+ - Workflows: 'dev/workflows.md'
- Creating Themes: 'dev/themes.md'
- Contributing Documentation: 'dev/documentation.md'
- About:
diff --git a/python/__init__.py b/python/__init__.py
index 144d022a..9e31f906 100644
--- a/python/__init__.py
+++ b/python/__init__.py
@@ -94,6 +94,8 @@ if core.BNGetProduct() == "Binary Ninja Enterprise Client":
def shutdown():
"""
``shutdown`` cleanly shuts down the core, stopping all workers and closing all log files.
+
+ .. note:: This will be called automatically on script exit if you import the binaryninja module.
"""
core.BNShutdown()
@@ -103,13 +105,30 @@ atexit.register(shutdown)
@dataclass
class CoreVersionInfo:
+ """
+ Structure representing the Binary Ninja Version.
+
+ Use :py:func:`core_version_info` to look up the current version of Binary Ninja loaded.
+ """
+
major: int
+ """Major version number, e.g. 4.0.5000-dev would be 4"""
+
minor: int
+ """Minor version number, e.g. 4.0.5000-dev would be 0"""
+
build: int
+ """Build version number, e.g. 4.0.5000-dev would be 5000"""
+
channel: str
+ """Release channel name, e.g. "dev" or "Stable" """
def get_unique_identifier():
+ """
+ Generate a GUID
+ :return: A GUID string
+ """
return core.BNGetUniqueIdentifierString()
@@ -299,6 +318,10 @@ def core_set_license(licenseData: str) -> None:
def get_memory_usage_info() -> Mapping[str, int]:
+ """
+ Get counts of various Binary Ninja objects in memory.
+ :return: Dictionary of {class name: count} for objects in memory
+ """
count = ctypes.c_ulonglong()
info = core.BNGetMemoryUsageInfo(count)
assert info is not None, "core.BNGetMemoryUsageInfo returned None"
@@ -341,7 +364,7 @@ def load(*args, **kwargs) -> BinaryView:
return bv
-@deprecation.deprecated(deprecated_in="3.5.4378", details='Use :py:func:`BinaryView.load` instead')
+@deprecation.deprecated(deprecated_in="3.5.4378", details='Use :py:func:`load` instead')
def open_view(*args, **kwargs) -> BinaryView:
return load(*args, **kwargs)
@@ -383,6 +406,9 @@ def connect_vscode_debugger(port=5678):
class UIPluginInHeadlessError(Exception):
+ """
+ Error thrown when trying to load a UI plugin in a headless Binary Ninja installation.
+ """
def __init__(self, *args, **kwargs):
Exception.__init__(self, *args, **kwargs)
diff --git a/python/basicblock.py b/python/basicblock.py
index a22b540f..6c03fe32 100644
--- a/python/basicblock.py
+++ b/python/basicblock.py
@@ -33,6 +33,18 @@ from . import function as _function
@dataclass(frozen=True)
class BasicBlockEdge:
+ """
+ ``class BasicBlockEdge`` represents the edges that connect basic blocks in graph view.
+
+ :cvar type: The :py:meth:`enums.BranchType` of the edge; Whether the edge is a true branch, false branch, unconditional, etc.
+ :cvar source: The basic block that the edge originates from.
+ :cvar target: The basic block that the edge is going to.
+ :cvar backedge: Whether this edge targets to a node whose control flow can eventually flow back through the source node of this edge.
+ :Example:
+
+ >>> current_basic_block.outgoing_edges
+ [<TrueBranch: x86_64@0x6>, <FalseBranch: x86_64@0x1f>]
+ """
type: BranchType
source: 'BasicBlock'
target: 'BasicBlock'
@@ -50,7 +62,18 @@ class BasicBlockEdge:
class BasicBlock:
"""
- The ``BasicBlock`` object is returned during analysis and should not be directly instantiated.
+ The ``class BasicBlock`` object is returned during analysis and should not be directly instantiated.
+
+ Basic blocks contain a sequence of instructions that must execute in-order with no branches.
+ We include calls in basic blocks, which technically violates that assumption, but you can mark
+ functions as `func.can_return = False` if a given function should terminate basic blocks.
+ :Example:
+
+ >>> for func in bv.functions:
+ >>> for bb in func:
+ >>> # Any block-based analysis could start here
+ >>> for inst in bb:
+ >>> pass # Optionally do something here with instructions
"""
def __init__(self, handle: core.BNBasicBlockHandle, view: Optional['binaryview.BinaryView'] = None):
self._view = view
diff --git a/python/binaryview.py b/python/binaryview.py
index ec8475c8..aaad9b0f 100644
--- a/python/binaryview.py
+++ b/python/binaryview.py
@@ -455,7 +455,7 @@ class AnalysisCompletionEvent:
"""
The ``AnalysisCompletionEvent`` object provides an asynchronous mechanism for receiving
callbacks when analysis is complete. The callback runs once. A completion event must be added
- for each new analysis in order to be notified of each analysis completion. The
+ for each new analysis in order to be notified of each analysis completion. The
AnalysisCompletionEvent class takes responsibility for keeping track of the object's lifetime.
:Example:
@@ -2019,7 +2019,7 @@ class BinaryView:
either and are used explicitly for subclassing a BinaryView.
.. note:: An important note on the ``*_user_*()`` methods. Binary Ninja makes a distinction between edits \
- performed by the user and actions performed by auto analysis. Auto analysis actions that can quickly be recalculated \
+ performed by the user and actions performed by auto analysis. Auto analysis actions that can quickly be recalculated \
are not saved to the database. Auto analysis actions that take a long time and all user edits are stored in the \
database (e.g. :py:func:`remove_user_function` rather than :py:func:`remove_function`). Thus use ``_user_`` methods if saving \
to the database is desired.
@@ -3752,7 +3752,7 @@ class BinaryView:
"""
``read`` returns the data reads at most ``length`` bytes from virtual address ``addr``.
- .. note:: Python2 returns a str, but Python3 returns a bytes object. str(DataBufferObject) will \
+ .. note:: Python2 returns a str, but Python3 returns a bytes object. str(DataBufferObject) will \
still get you a str in either case.
:param int addr: virtual address to read from.
@@ -4184,10 +4184,9 @@ class BinaryView:
def update_analysis(self) -> None:
"""
- ``update_analysis`` asynchronously starts the analysis running and returns immediately. Analysis of BinaryViews
- does not occur automatically, the user must start analysis by calling either :py:func:`update_analysis` or
- :py:func:`update_analysis_and_wait`. An analysis update **must** be run after changes are made which could change
- analysis results such as adding functions.
+ ``update_analysis`` asynchronously starts the analysis running and returns immediately.
+ An analysis update **must** be run after changes are made which could change analysis
+ results such as adding functions.
:rtype: None
"""
@@ -4196,9 +4195,7 @@ class BinaryView:
def update_analysis_and_wait(self) -> None:
"""
``update_analysis_and_wait`` blocking call to update the analysis, this call returns when the analysis is
- complete. Analysis of BinaryViews does not occur automatically, the user must start analysis by calling either
- :py:func:`update_analysis` or :py:func:`update_analysis_and_wait`. An analysis update **must** be run after changes are
- made which could change analysis results such as adding functions.
+ complete. An analysis update **must** be run after changes are made which could change analysis results such as adding functions.
:rtype: None
"""
@@ -6202,7 +6199,7 @@ class BinaryView:
) -> bool:
"""
``is_skip_and_return_zero_patch_available`` queries the architecture plugin to determine if the
- instruction at ``addr`` is similar to an x86 "call" instruction which can be made to return zero. The actual
+ instruction at ``addr`` is similar to an x86 "call" instruction which can be made to return zero. The actual
logic of which is implemented in the ``perform_is_skip_and_return_zero_patch_available`` in the corresponding
architecture.
diff --git a/python/bncompleter.py b/python/bncompleter.py
index 9a33659b..3b632aab 100644
--- a/python/bncompleter.py
+++ b/python/bncompleter.py
@@ -25,14 +25,14 @@ Tip: to use the tab key as the completion key, call
Notes:
- Exceptions raised by the completer function are *ignored* (and generally cause
- the completion to fail). This is a feature -- since readline sets the tty
+ the completion to fail). This is a feature -- since readline sets the tty
device in raw (or cbreak) mode, printing a traceback wouldn't work well
without some complicated hoopla to save, reset and restore the tty state.
- The evaluation of the NAME.NAME... form may cause arbitrary application
defined code to be executed if an object with a __getattr__ hook is found.
Since it is the responsibility of the application (or the user) to enable this
- feature, I consider this an acceptable risk. More complicated expressions
+ feature, I consider this an acceptable risk. More complicated expressions
(e.g. function calls or indexing operations) are *not* evaluated.
- When the original stdin is not a tty device, GNU readline is never
@@ -89,7 +89,7 @@ class Completer:
"""Return the next possible completion for 'text'.
This is called successively with state == 0, 1, 2, ... until it
- returns None. The completion should begin with 'text'.
+ returns None. The completion should begin with 'text'.
"""
if self.use_main_ns:
@@ -152,7 +152,7 @@ class Completer:
Assuming the text is of the form NAME.NAME....[NAME], and is
evaluable in self.namespace, it will be evaluated and its attributes
- (as revealed by dir()) are used as possible completions. (For class
+ (as revealed by dir()) are used as possible completions. (For class
instances, class members are also considered.)
WARNING: this can still invoke arbitrary C code, if an object
diff --git a/python/demangle.py b/python/demangle.py
index 89532f78..874b13cf 100644
--- a/python/demangle.py
+++ b/python/demangle.py
@@ -158,7 +158,7 @@ def simplify_name_to_string(input_name):
def simplify_name_to_qualified_name(input_name, simplify=True):
"""
- ``simplify_name_to_qualified_name`` simplifies a templated C++ name with default arguments and returns a qualified name. This can also tokenize a string to a qualified name with/without simplifying it
+ ``simplify_name_to_qualified_name`` simplifies a templated C++ name with default arguments and returns a qualified name. This can also tokenize a string to a qualified name with/without simplifying it
:param input_name: String or qualified name to be simplified
:type input_name: Union[str, QualifiedName]
diff --git a/python/filemetadata.py b/python/filemetadata.py
index e51436b1..4dbde1a7 100644
--- a/python/filemetadata.py
+++ b/python/filemetadata.py
@@ -519,7 +519,7 @@ class FileMetadata:
"""
``navigate`` navigates the UI to the specified virtual address
- .. note:: Despite the confusing name, ``view`` in this context is not a BinaryView but rather a string describing the different UI Views. Check :py:attr:`view` while in different views to see examples such as ``Linear:ELF``, ``Graph:PE``.
+ .. note:: Despite the confusing name, ``view`` in this context is not a BinaryView but rather a string describing the different UI Views. Check :py:attr:`view` while in different views to see examples such as ``Linear:ELF``, ``Graph:PE``.
:param str view: view name
:param int offset: address to navigate to
diff --git a/python/highlevelil.py b/python/highlevelil.py
index da1d9346..ff35c018 100644
--- a/python/highlevelil.py
+++ b/python/highlevelil.py
@@ -2888,7 +2888,7 @@ class HighLevelILFunction:
@property
def aliased_vars(self) -> List["variable.Variable"]:
- """This returns a list of Variables that are taken reference to and used elsewhere. You may also wish to consider `HighLevelIlFunction.vars` and `HighLevelIlFunction.source_function.parameter_vars`"""
+ """This returns a list of Variables that are taken reference to and used elsewhere. You may also wish to consider `HighLevelIlFunction.vars` and `HighLevelIlFunction.source_function.parameter_vars`"""
if self.source_function is None:
return []
diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py
index e8e020ea..db5da1a1 100644
--- a/python/mediumlevelil.py
+++ b/python/mediumlevelil.py
@@ -3710,7 +3710,7 @@ class MediumLevelILFunction:
@property
def aliased_vars(self) -> List["variable.Variable"]:
- """This returns a list of Variables that are taken reference to and used elsewhere. You may also wish to consider `MediumLevelIlFunction.vars` and `MediumLevelIlFunction.source_function.parameter_vars`"""
+ """This returns a list of Variables that are taken reference to and used elsewhere. You may also wish to consider `MediumLevelIlFunction.vars` and `MediumLevelIlFunction.source_function.parameter_vars`"""
if self.source_function is None:
return []
diff --git a/python/plugin.py b/python/plugin.py
index 4d65db0b..455d511e 100644
--- a/python/plugin.py
+++ b/python/plugin.py
@@ -103,6 +103,13 @@ class _PluginCommandMetaClass(type):
class PluginCommand(metaclass=_PluginCommandMetaClass):
+ """
+ The ``class PluginCommand` contains all the plugin registration methods as class methods.
+
+ You shouldn't need to create an instance of this class, instead see `register`,
+ `register_for_address`, `register_for_function`, and similar class methods for examples
+ on how to register your plugin.
+ """
_registered_commands = []
def __init__(self, cmd):
@@ -369,6 +376,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` as an argument
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView):
+ >>> log_info(f"My plugin was called on bv: `{bv}`")
+ >>> PluginCommand.register("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView) -> bool:
+ >>> return False
+ >>> PluginCommand.register("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -395,6 +412,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` and address as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` and address to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, address: int):
+ >>> log_info(f"My plugin was called on bv: `{bv}` at address {hex(address)}")
+ >>> PluginCommand.register_for_address("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, address: int) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_address("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_address`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -421,6 +448,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView`, start address, and length as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView`, start address, and length to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, start: int, length: int):
+ >>> log_info(f"My plugin was called on bv: `{bv}` at {hex(start)} of length {hex(length)}")
+ >>> PluginCommand.register_for_range("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, start: int, length: int) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_range("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_range`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -447,6 +484,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` and a :class:`~function.Function` as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` and :class:`~function.Function` to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, func: Function):
+ >>> log_info(f"My plugin was called on func {func} in bv `{bv}`")
+ >>> PluginCommand.register_for_function("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, func: Function) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_function("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_function`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -474,6 +521,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` and a :class:`~lowlevelil.LowLevelILFunction` as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` and :class:`~lowlevelil.LowLevelILFunction` to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, func: LowLevelILFunction):
+ >>> log_info(f"My plugin was called on func {func} in bv `{bv}`")
+ >>> PluginCommand.register_for_low_level_il_function("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, func: LowLevelILFunction) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_low_level_il_function("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_low_level_il_function`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -502,6 +559,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` and a :class:`~lowlevelil.LowLevelILInstruction` as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` and :class:`~lowlevelil.LowLevelILInstruction` to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, inst: LowLevelILInstruction):
+ >>> log_info(f"My plugin was called on inst {inst} in bv `{bv}`")
+ >>> PluginCommand.register_for_low_level_il_instruction("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, inst: LowLevelILInstruction) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_low_level_il_instruction("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_low_level_il_instruction`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -531,6 +598,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` and a :class:`~mediumlevelil.MediumLevelILFunction` as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` and :class:`~mediumlevelil.MediumLevelILFunction` to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, func: MediumLevelILFunction):
+ >>> log_info(f"My plugin was called on func {func} in bv `{bv}`")
+ >>> PluginCommand.register_for_low_level_il_function("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, func: MediumLevelILFunction) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_low_level_il_function("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_medium_level_il_function`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -559,6 +636,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` and a :class:`~mediumlevelil.MediumLevelILInstruction` as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` and :class:`~mediumlevelil.MediumLevelILInstruction` to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, inst: MediumLevelILInstruction):
+ >>> log_info(f"My plugin was called on inst {inst} in bv `{bv}`")
+ >>> PluginCommand.register_for_low_level_il_instruction("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, inst: MediumLevelILInstruction) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_low_level_il_instruction("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_medium_level_il_instruction`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -588,6 +675,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` and a :class:`~highlevelil.HighLevelILFunction` as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` and :class:`~highlevelil.HighLevelILFunction` to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, func: HighLevelILFunction):
+ >>> log_info(f"My plugin was called on func {func} in bv `{bv}`")
+ >>> PluginCommand.register_for_low_level_il_function("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, func: HighLevelILFunction) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_low_level_il_function("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_high_level_il_function`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
@@ -616,6 +713,16 @@ class PluginCommand(metaclass=_PluginCommandMetaClass):
:param callback action: function to call with the :class:`~binaryview.BinaryView` and a :class:`~highlevelil.HighLevelILInstruction` as arguments
:param callback is_valid: optional argument of a function passed a :class:`~binaryview.BinaryView` and :class:`~highlevelil.HighLevelILInstruction` to determine whether the plugin should be enabled for that view
:rtype: None
+ :Example:
+
+ >>> def my_plugin(bv: BinaryView, inst: HighLevelILInstruction):
+ >>> log_info(f"My plugin was called on inst {inst} in bv `{bv}`")
+ >>> PluginCommand.register_for_low_level_il_instruction("My Plugin", "My plugin description (not used)", my_plugin)
+ True
+ >>> def is_valid(bv: BinaryView, inst: HighLevelILInstruction) -> bool:
+ >>> return False
+ >>> PluginCommand.register_for_low_level_il_instruction("My Plugin (With Valid Function)", "My plugin description (not used)", my_plugin, is_valid)
+ True
.. warning:: Calling ``register_for_high_level_il_instruction`` with the same function name will replace the existing function but will leak the memory of the original plugin.
"""
diff --git a/python/project.py b/python/project.py
index d9b9880d..a080123a 100644
--- a/python/project.py
+++ b/python/project.py
@@ -664,7 +664,7 @@ class Project:
and the project on disk vs in memory may not agree on state
if an exception occurs while a bulk operation is happening.
- :example:
+ :Example:
>>> from pathlib import Path
>>> with project.bulk_operation():
... for i in Path('/bin/').iterdir():
diff --git a/python/variable.py b/python/variable.py
index 0a86b850..75e95712 100644
--- a/python/variable.py
+++ b/python/variable.py
@@ -644,16 +644,28 @@ class StackVariableReference:
@dataclass(frozen=True, order=True)
class CoreVariable:
+ """
+ ``class CoreVariable`` is the base class for other variable types,
+ such as :py:meth:`VariableNameAndType` and :py:meth:`Variable`
+
+ :cvar index: Internal identifier
+ :cvar storage: If this variable is a stack variable
+ (`source_type == VariableSourceType.StackVariableSourceType`),
+ then the storage location is the offset onto the stack that contains
+ the first byte of this variable. Otherwise it's used as an internal identifier.
+ """
_source_type: int
index: int
storage: int
@property
def identifier(self) -> int:
+ """A UID for a variable within a function."""
return core.BNToVariableIdentifier(self.to_BNVariable())
@property
def source_type(self) -> VariableSourceType:
+ """Whether this variable was created based off of an underlying register, stack location, or flag."""
return VariableSourceType(self._source_type)
def to_BNVariable(self):
@@ -675,6 +687,16 @@ class CoreVariable:
@dataclass(frozen=True, order=True)
class VariableNameAndType(CoreVariable):
+ """
+ ``class VariableNameAndType`` is a lightweight wrapper around a
+ variable and its name, useful for shuttling between APIs that require
+ them both. While :py:meth:`Variable` has :py:meth:`Variable.name` and
+ :py:meth:`Variable.type` fields, those require additional core calls
+ each time you fetch them.
+
+ :cvar name: The variable's name
+ :cvar type: The variable's type
+ """
name: str
type: 'binaryninja.types.Type'
@@ -689,6 +711,10 @@ class VariableNameAndType(CoreVariable):
class Variable(CoreVariable):
+ """
+ ``class Variable`` represents variables in Binary Ninja. Variables are resolved
+ in medium level IL, so variables objects are only valid for MLIL and above.
+ """
def __init__(self, func: FunctionOrILFunction, source_type: VariableSourceType, index: int, storage: int):
super(Variable, self).__init__(int(source_type), index, storage)
if isinstance(func, binaryninja.function.Function):
@@ -759,10 +785,12 @@ class Variable(CoreVariable):
@property
def core_variable(self) -> CoreVariable:
+ """Retrieve the underlying :py:meth:`CoreVariable` class"""
return CoreVariable(self._source_type, self.index, self.storage)
@property
def var_name_and_type(self) -> VariableNameAndType:
+ """Convert to :py:meth:`VariableNameAndType` """
return VariableNameAndType.from_core_variable(self, self.name, self.type)
@property
@@ -794,7 +822,7 @@ class Variable(CoreVariable):
@property
def ssa_versions(self) -> Generator[int, None, None]:
- """Returns the SSA versions associated with this variable. Doesn't return anything for aliased variables."""
+ """Returns the SSA versions associated with this variable. Doesn't return anything for aliased variables."""
if self._il_function is None:
raise NotImplementedError("No IL function associated with variable")
@@ -825,6 +853,7 @@ class Variable(CoreVariable):
@property
def dead_store_elimination(self) -> DeadStoreElimination:
+ """returns the dead store elimination setting for this variable"""
return DeadStoreElimination(
core.BNGetFunctionVariableDeadStoreElimination(self._function.handle, self.to_BNVariable())
)