summaryrefslogtreecommitdiff
path: root/docs/dev
diff options
context:
space:
mode:
authorJordan Wiens <github@psifertex.com>2025-12-11 17:09:46 -0500
committerJordan Wiens <github@psifertex.com>2025-12-11 17:15:25 -0500
commit4ef9ad58360b8244185a09c4dabe74c81f9c3c63 (patch)
treed831fa2267d0fdde0700ddb381e55021271cf3ef /docs/dev
parent5d7877b807e45c6b58e6beb73ea11d7fe7f4467f (diff)
add script for validating white space in mkdocs, and many whitespace fixes
Diffstat (limited to 'docs/dev')
-rw-r--r--docs/dev/bnil-hlil.md1
-rw-r--r--docs/dev/bnil-llil.md8
-rw-r--r--docs/dev/outlining.md7
3 files changed, 13 insertions, 3 deletions
diff --git a/docs/dev/bnil-hlil.md b/docs/dev/bnil-hlil.md
index b66081dc..db8377fc 100644
--- a/docs/dev/bnil-hlil.md
+++ b/docs/dev/bnil-hlil.md
@@ -49,7 +49,6 @@ There are a number of properties that can be queried on the [`HighLevelILInstruc
* `HLIL_IF` - Branch to the `true`/`false` HLIL instruction identifier depending on the result of the `condition` expression
* `HLIL_GOTO` - Branch to the `dest` expression id
* `HLIL_TAILCALL` - This instruction calls the expression `dest` using `params` as input and `output` for return values
-not exist
* `HLIL_SYSCALL` - Make a system/service call with parameters `params` and output `output`
* `HLIL_WHILE` -
* `HLIL_DO_WHILE` -
diff --git a/docs/dev/bnil-llil.md b/docs/dev/bnil-llil.md
index 2eafe5cb..2ac1e77f 100644
--- a/docs/dev/bnil-llil.md
+++ b/docs/dev/bnil-llil.md
@@ -15,8 +15,7 @@ Since doing is the easiest way to learn let's start with a simple example binary
![Low Level IL Option >](../img/llil-option.png)
- Download [chal1](../files/chal1) and open it with Binary Ninja
- - Next, bring up the `Low Level IL` view by clicking in the view drop down at the top of the pane
- (or alternatively, use the `i` key to cycle view levels)
+ - Next, bring up the `Low Level IL` view by clicking in the view drop down at the top of the pane (or alternatively, use the `i` key to cycle view levels)
- Navigate to main (`g`, then "main", or double-click it in the function list)
- Finally, bring up the python console using: `~`
@@ -97,30 +96,35 @@ For the above instruction, we have a few operations we can perform:
>>> instr.function
<binaryninja.lowlevelil.LowLevelILFunction object at 0x111c79810>
```
+
* **instr_index** - returns the LLIL index
```
>>> instr.instr_index
2
```
+
* **operands** - returns a list of all operands.
```
>>> instr.operands
['rsp', <il: rsp - 0x110>]
```
+
* **operation** - returns the enumeration value of the current operation
```
>>> instr.operation
<LowLevelILOperation.LLIL_SET_REG: 1>
```
+
* **src** - returns the source operand
```
>>> instr.src
<il: rsp - 0x110>
```
+
* **dest** - returns the destination operand
```
diff --git a/docs/dev/outlining.md b/docs/dev/outlining.md
index fa826b2f..78d2bbe0 100644
--- a/docs/dev/outlining.md
+++ b/docs/dev/outlining.md
@@ -109,6 +109,7 @@ The outliner then recognizes the intrinsic name and transforms it into the appro
#### Recognized Intrinsic Names
**Memory Copy Intrinsics**:
+
- `__memcpy` → `memcpy`, `strcpy`, or `strncpy` (based on data classification)
- `__memcpy_u8` → `memcpy` (byte-wise, count unchanged)
- `__memcpy_u16` → `memcpy` (16-bit elements, count × 2)
@@ -116,6 +117,7 @@ The outliner then recognizes the intrinsic name and transforms it into the appro
- `__memcpy_u64` → `memcpy` (64-bit elements, count × 8)
**Memory Fill Intrinsics**:
+
- `__memfill` → `memset`
- `__memfill_u8` → `memset` (byte-wise, count unchanged)
- `__memfill_u16` → `memset` (16-bit elements, count × 2)
@@ -235,11 +237,13 @@ Outlining is valuable across many analysis domains including reverse engineering
### Common Issues
**Patterns not being outlined**:
+
- Check if `analysis.outlining.builtins` is enabled
- Verify type information supports the expected operation
- Ensure patterns meet minimum size thresholds (see below)
**Incorrect function selection**:
+
- Provide more precise type information
- Check data stream classification
- Verify pattern clarity and confidence
@@ -249,17 +253,20 @@ Outlining is valuable across many analysis domains including reverse engineering
Binary Ninja applies size-based filtering to avoid outlining trivial operations. Understanding these thresholds can help explain why certain patterns aren't outlined:
**Without Type Information** (no user-provided types with full confidence):
+
- General memory operations: Must be >16 bytes
- String operations: Must be ≥4 bytes
- ASCII patterns: Must be ≥4 bytes
- Fill patterns (memset): Must be ≥16 bytes
**With Type Information** (user-provided types with full confidence):
+
- Size thresholds are relaxed
- Type compatibility checks take priority
- Operations matching type boundaries are more likely to be outlined
**String-Specific Requirements**:
+
- String must have at least 4 printable characters before null terminator
- Very short strings (1-3 bytes) are often demoted to general memory operations