summaryrefslogtreecommitdiff
path: root/docs/guide
diff options
context:
space:
mode:
authorJordan Wiens <jordan@psifertex.com>2024-07-09 00:52:13 -0400
committerJordan Wiens <jordan@psifertex.com>2024-07-09 00:52:13 -0400
commit19b19eb425574f89f9f42c5c47f27bf5f54f5f0e (patch)
tree1612cc27ca5848f36ddc2f8a30cb1adfa46efd27 /docs/guide
parent89e8e4daa4fb32d942ae96df5805a11c69d65bcb (diff)
split triage features into separate subheadings for better searching
Diffstat (limited to 'docs/guide')
-rw-r--r--docs/guide/index.md88
1 files changed, 50 insertions, 38 deletions
diff --git a/docs/guide/index.md b/docs/guide/index.md
index 58599011..e3715710 100644
--- a/docs/guide/index.md
+++ b/docs/guide/index.md
@@ -586,59 +586,71 @@ however the python plugin contains a feature that the C++ one does not: the abil
use this version, copy the folder linked above into your [plugins folder](#user-folder) and disable the built-in C++ UI
using the [`corePlugins.triage`](settings.md#corePlugins.triage) setting.
-1. Entropy: This image shows the overall entropy of the file. Brighter areas indicate regions of higher entropy
- (encrypted, compressed, etc), while darker regions indicate places of lower entropy. You can click anywhere in the
- entropy map to navigate to that location in your default view.
+### 1. Entropy
-1. File Info: The file info section contains some summary information for the file, each result can be clicked to copy
- it into your clipboard.
+This image shows the overall entropy of the file. Brighter areas indicate regions of higher entropy
+(encrypted, compressed, etc), while darker regions indicate places of lower entropy. You can click anywhere in the
+entropy map to navigate to that location in your default view.
-1. Base Address Detection (BASE):
+### 2. File Info
- ![BASE](../img/base.png "BASE Address Detection"){ width="800" }
+File Info: The file info section contains some summary information for the file, each result can be clicked to copy
+it into your clipboard.
- The Base Address Scan Engine (or BASE) is used to automatically identify load addresses for embedded files or
- other formats where the load address isn't known and the file isn't relocatable. BASE is only visible in the triage
- summary when the file doesn't specify a load address such as a raw or mapped file. For BinaryViews like PE or MachO,
- switching the view in the upper-left from the BinaryView name to `raw` will force the BASE UI to show up in the
- Triage Summary.
+### 3. Base Address Detection (BASE)
- See our recent [blog
- post](https://binary.ninja/2024/05/21/automatically-identifying-base-addresses.html) for more information on how
- BASE works. The following settings describe the advanced settings and how they influence the process.
+![BASE](../img/base.png "BASE Address Detection"){ width="800" }
- Note that you can cancel the analysis at any time and the current results will be displayed which may be useful for
- large files or files with many pointers being analyzed.
+The Base Address Scan Engine (or BASE) is used to automatically identify load addresses for embedded files or
+other formats where the load address isn't known and the file isn't relocatable. BASE is only visible in the triage
+summary when the file doesn't specify a load address such as a raw or mapped file. For BinaryViews like PE or MachO,
+switching the view in the upper-left from the BinaryView name to `raw` will force the BASE UI to show up in the
+Triage Summary.
- If the file format has a header that can be identified before analysis that may help BASE identify the proper load
- address, otherwise the alignment would need to account for the header.
+See our recent [blog
+post](https://binary.ninja/2024/05/21/automatically-identifying-base-addresses.html) for more information on how
+BASE works. The following settings describe the advanced settings and how they influence the process.
- |Setting|Description|Default|
- |--- |--- |--- |
- |Min. String Length|Minimum length of string to be considered a point-of-interest|0n10|
- |Alignment|Byte boundary to align the base address while scanning|0n1024|
- |Lower Boundary|Lowest address to begin search for candidate base address|0x0|
- |Upper Boundary|Highest address to end search for candidate base address|0xffffffffffffffff|
- |Points of Interest|Specifies types of points-of-interest to use for analysis (all, strings only, functions only)|All|
- |Max Pointers|Maximum amount of pointers to allow in each pointer cluster|0n128|
+Note that you can cancel the analysis at any time and the current results will be displayed which may be useful for
+large files or files with many pointers being analyzed.
+If the file format has a header that can be identified before analysis that may help BASE identify the proper load
+address, otherwise the alignment would need to account for the header.
-1. Headers: This section appears only in BinaryViews and the exact information depends on the view itself. PE headers
- are the most detailed and include such items as checksums, characterstics, and compiler strings. Addresses that
- existing in the virtual memory space of the file can be clicked to navigate to that location.
+|Setting|Description|Default|
+|--- |--- |--- |
+|Min. String Length|Minimum length of string to be considered a point-of-interest|0n10|
+|Alignment|Byte boundary to align the base address while scanning|0n1024|
+|Lower Boundary|Lowest address to begin search for candidate base address|0x0|
+|Upper Boundary|Highest address to end search for candidate base address|0xffffffffffffffff|
+|Points of Interest|Specifies types of points-of-interest to use for analysis (all, strings only, functions only)|All|
+|Max Pointers|Maximum amount of pointers to allow in each pointer cluster|0n128|
-1. Libraries: For file formats that include explicit linking information to a particular library (like PE), the
- libraries linked will be listed in this section and are available in the [API as well](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.libraries).
+### 4. Headers
-1. Imports / Exports: The Imports and Exports sections show any imports and exports. The lists are sortable by clicking
- the table headers.
+This section appears only in BinaryViews and the exact information depends on the view itself. PE headers
+are the most detailed and include such items as checksums, characterstics, and compiler strings. Addresses that
+existing in the virtual memory space of the file can be clicked to navigate to that location.
-1. Sections: If the file format contains section information, they will be listed here. All mapped addresses are
- clickable to navigate to the virtual address.
+### 5. Libraries
-1. Strings: Strings can be double clicked to navigate to them, and the table can be sorted or the list filtered by
- typing in the search box.
+For file formats that include explicit linking information to a particular library (like PE), the
+libraries linked will be listed in this section and are available in the [API as well](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.libraries).
+### 6. Imports / Exports
+
+The Imports and Exports sections show any imports and exports. The lists are sortable by clicking
+the table headers.
+
+### 7. Sections
+
+If the file format contains section information, they will be listed here. All mapped addresses are
+clickable to navigate to the virtual address.
+
+### 8. Strings
+
+Strings can be double clicked to navigate to them, and the table can be sorted or the list filtered by
+typing in the search box.
## Byte Overview