diff options
| author | Jordan Wiens <github@psifertex.com> | 2025-12-11 17:09:46 -0500 |
|---|---|---|
| committer | Jordan Wiens <github@psifertex.com> | 2025-12-11 17:15:25 -0500 |
| commit | 4ef9ad58360b8244185a09c4dabe74c81f9c3c63 (patch) | |
| tree | d831fa2267d0fdde0700ddb381e55021271cf3ef /docs/dev | |
| parent | 5d7877b807e45c6b58e6beb73ea11d7fe7f4467f (diff) | |
add script for validating white space in mkdocs, and many whitespace fixes
Diffstat (limited to 'docs/dev')
| -rw-r--r-- | docs/dev/bnil-hlil.md | 1 | ||||
| -rw-r--r-- | docs/dev/bnil-llil.md | 8 | ||||
| -rw-r--r-- | docs/dev/outlining.md | 7 |
3 files changed, 13 insertions, 3 deletions
diff --git a/docs/dev/bnil-hlil.md b/docs/dev/bnil-hlil.md index b66081dc..db8377fc 100644 --- a/docs/dev/bnil-hlil.md +++ b/docs/dev/bnil-hlil.md @@ -49,7 +49,6 @@ There are a number of properties that can be queried on the [`HighLevelILInstruc * `HLIL_IF` - Branch to the `true`/`false` HLIL instruction identifier depending on the result of the `condition` expression * `HLIL_GOTO` - Branch to the `dest` expression id * `HLIL_TAILCALL` - This instruction calls the expression `dest` using `params` as input and `output` for return values -not exist * `HLIL_SYSCALL` - Make a system/service call with parameters `params` and output `output` * `HLIL_WHILE` - * `HLIL_DO_WHILE` - diff --git a/docs/dev/bnil-llil.md b/docs/dev/bnil-llil.md index 2eafe5cb..2ac1e77f 100644 --- a/docs/dev/bnil-llil.md +++ b/docs/dev/bnil-llil.md @@ -15,8 +15,7 @@ Since doing is the easiest way to learn let's start with a simple example binary  - Download [chal1](../files/chal1) and open it with Binary Ninja - - Next, bring up the `Low Level IL` view by clicking in the view drop down at the top of the pane - (or alternatively, use the `i` key to cycle view levels) + - Next, bring up the `Low Level IL` view by clicking in the view drop down at the top of the pane (or alternatively, use the `i` key to cycle view levels) - Navigate to main (`g`, then "main", or double-click it in the function list) - Finally, bring up the python console using: `~` @@ -97,30 +96,35 @@ For the above instruction, we have a few operations we can perform: >>> instr.function <binaryninja.lowlevelil.LowLevelILFunction object at 0x111c79810> ``` + * **instr_index** - returns the LLIL index ``` >>> instr.instr_index 2 ``` + * **operands** - returns a list of all operands. ``` >>> instr.operands ['rsp', <il: rsp - 0x110>] ``` + * **operation** - returns the enumeration value of the current operation ``` >>> instr.operation <LowLevelILOperation.LLIL_SET_REG: 1> ``` + * **src** - returns the source operand ``` >>> instr.src <il: rsp - 0x110> ``` + * **dest** - returns the destination operand ``` diff --git a/docs/dev/outlining.md b/docs/dev/outlining.md index fa826b2f..78d2bbe0 100644 --- a/docs/dev/outlining.md +++ b/docs/dev/outlining.md @@ -109,6 +109,7 @@ The outliner then recognizes the intrinsic name and transforms it into the appro #### Recognized Intrinsic Names **Memory Copy Intrinsics**: + - `__memcpy` → `memcpy`, `strcpy`, or `strncpy` (based on data classification) - `__memcpy_u8` → `memcpy` (byte-wise, count unchanged) - `__memcpy_u16` → `memcpy` (16-bit elements, count × 2) @@ -116,6 +117,7 @@ The outliner then recognizes the intrinsic name and transforms it into the appro - `__memcpy_u64` → `memcpy` (64-bit elements, count × 8) **Memory Fill Intrinsics**: + - `__memfill` → `memset` - `__memfill_u8` → `memset` (byte-wise, count unchanged) - `__memfill_u16` → `memset` (16-bit elements, count × 2) @@ -235,11 +237,13 @@ Outlining is valuable across many analysis domains including reverse engineering ### Common Issues **Patterns not being outlined**: + - Check if `analysis.outlining.builtins` is enabled - Verify type information supports the expected operation - Ensure patterns meet minimum size thresholds (see below) **Incorrect function selection**: + - Provide more precise type information - Check data stream classification - Verify pattern clarity and confidence @@ -249,17 +253,20 @@ Outlining is valuable across many analysis domains including reverse engineering Binary Ninja applies size-based filtering to avoid outlining trivial operations. Understanding these thresholds can help explain why certain patterns aren't outlined: **Without Type Information** (no user-provided types with full confidence): + - General memory operations: Must be >16 bytes - String operations: Must be ≥4 bytes - ASCII patterns: Must be ≥4 bytes - Fill patterns (memset): Must be ≥16 bytes **With Type Information** (user-provided types with full confidence): + - Size thresholds are relaxed - Type compatibility checks take priority - Operations matching type boundaries are more likely to be outlined **String-Specific Requirements**: + - String must have at least 4 printable characters before null terminator - Very short strings (1-3 bytes) are often demoted to general memory operations |
