diff options
| author | Jordan Wiens <jordan@psifertex.com> | 2024-07-09 00:52:13 -0400 |
|---|---|---|
| committer | Jordan Wiens <jordan@psifertex.com> | 2024-07-09 00:52:13 -0400 |
| commit | 19b19eb425574f89f9f42c5c47f27bf5f54f5f0e (patch) | |
| tree | 1612cc27ca5848f36ddc2f8a30cb1adfa46efd27 /docs | |
| parent | 89e8e4daa4fb32d942ae96df5805a11c69d65bcb (diff) | |
split triage features into separate subheadings for better searching
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/guide/index.md | 88 |
1 files changed, 50 insertions, 38 deletions
diff --git a/docs/guide/index.md b/docs/guide/index.md index 58599011..e3715710 100644 --- a/docs/guide/index.md +++ b/docs/guide/index.md @@ -586,59 +586,71 @@ however the python plugin contains a feature that the C++ one does not: the abil use this version, copy the folder linked above into your [plugins folder](#user-folder) and disable the built-in C++ UI using the [`corePlugins.triage`](settings.md#corePlugins.triage) setting. -1. Entropy: This image shows the overall entropy of the file. Brighter areas indicate regions of higher entropy - (encrypted, compressed, etc), while darker regions indicate places of lower entropy. You can click anywhere in the - entropy map to navigate to that location in your default view. +### 1. Entropy -1. File Info: The file info section contains some summary information for the file, each result can be clicked to copy - it into your clipboard. +This image shows the overall entropy of the file. Brighter areas indicate regions of higher entropy +(encrypted, compressed, etc), while darker regions indicate places of lower entropy. You can click anywhere in the +entropy map to navigate to that location in your default view. -1. Base Address Detection (BASE): +### 2. File Info - { width="800" } +File Info: The file info section contains some summary information for the file, each result can be clicked to copy +it into your clipboard. - The Base Address Scan Engine (or BASE) is used to automatically identify load addresses for embedded files or - other formats where the load address isn't known and the file isn't relocatable. BASE is only visible in the triage - summary when the file doesn't specify a load address such as a raw or mapped file. For BinaryViews like PE or MachO, - switching the view in the upper-left from the BinaryView name to `raw` will force the BASE UI to show up in the - Triage Summary. +### 3. Base Address Detection (BASE) - See our recent [blog - post](https://binary.ninja/2024/05/21/automatically-identifying-base-addresses.html) for more information on how - BASE works. The following settings describe the advanced settings and how they influence the process. +{ width="800" } - Note that you can cancel the analysis at any time and the current results will be displayed which may be useful for - large files or files with many pointers being analyzed. +The Base Address Scan Engine (or BASE) is used to automatically identify load addresses for embedded files or +other formats where the load address isn't known and the file isn't relocatable. BASE is only visible in the triage +summary when the file doesn't specify a load address such as a raw or mapped file. For BinaryViews like PE or MachO, +switching the view in the upper-left from the BinaryView name to `raw` will force the BASE UI to show up in the +Triage Summary. - If the file format has a header that can be identified before analysis that may help BASE identify the proper load - address, otherwise the alignment would need to account for the header. +See our recent [blog +post](https://binary.ninja/2024/05/21/automatically-identifying-base-addresses.html) for more information on how +BASE works. The following settings describe the advanced settings and how they influence the process. - |Setting|Description|Default| - |--- |--- |--- | - |Min. String Length|Minimum length of string to be considered a point-of-interest|0n10| - |Alignment|Byte boundary to align the base address while scanning|0n1024| - |Lower Boundary|Lowest address to begin search for candidate base address|0x0| - |Upper Boundary|Highest address to end search for candidate base address|0xffffffffffffffff| - |Points of Interest|Specifies types of points-of-interest to use for analysis (all, strings only, functions only)|All| - |Max Pointers|Maximum amount of pointers to allow in each pointer cluster|0n128| +Note that you can cancel the analysis at any time and the current results will be displayed which may be useful for +large files or files with many pointers being analyzed. +If the file format has a header that can be identified before analysis that may help BASE identify the proper load +address, otherwise the alignment would need to account for the header. -1. Headers: This section appears only in BinaryViews and the exact information depends on the view itself. PE headers - are the most detailed and include such items as checksums, characterstics, and compiler strings. Addresses that - existing in the virtual memory space of the file can be clicked to navigate to that location. +|Setting|Description|Default| +|--- |--- |--- | +|Min. String Length|Minimum length of string to be considered a point-of-interest|0n10| +|Alignment|Byte boundary to align the base address while scanning|0n1024| +|Lower Boundary|Lowest address to begin search for candidate base address|0x0| +|Upper Boundary|Highest address to end search for candidate base address|0xffffffffffffffff| +|Points of Interest|Specifies types of points-of-interest to use for analysis (all, strings only, functions only)|All| +|Max Pointers|Maximum amount of pointers to allow in each pointer cluster|0n128| -1. Libraries: For file formats that include explicit linking information to a particular library (like PE), the - libraries linked will be listed in this section and are available in the [API as well](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.libraries). +### 4. Headers -1. Imports / Exports: The Imports and Exports sections show any imports and exports. The lists are sortable by clicking - the table headers. +This section appears only in BinaryViews and the exact information depends on the view itself. PE headers +are the most detailed and include such items as checksums, characterstics, and compiler strings. Addresses that +existing in the virtual memory space of the file can be clicked to navigate to that location. -1. Sections: If the file format contains section information, they will be listed here. All mapped addresses are - clickable to navigate to the virtual address. +### 5. Libraries -1. Strings: Strings can be double clicked to navigate to them, and the table can be sorted or the list filtered by - typing in the search box. +For file formats that include explicit linking information to a particular library (like PE), the +libraries linked will be listed in this section and are available in the [API as well](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.libraries). +### 6. Imports / Exports + +The Imports and Exports sections show any imports and exports. The lists are sortable by clicking +the table headers. + +### 7. Sections + +If the file format contains section information, they will be listed here. All mapped addresses are +clickable to navigate to the virtual address. + +### 8. Strings + +Strings can be double clicked to navigate to them, and the table can be sorted or the list filtered by +typing in the search box. ## Byte Overview |
