diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/dev/concepts.md | 43 | ||||
| -rw-r--r-- | docs/guide/index.md | 11 | ||||
| -rw-r--r-- | docs/img/find.png | bin | 227006 -> 149526 bytes | |||
| -rw-r--r-- | docs/img/getcompletion.png | bin | 0 -> 164464 bytes | |||
| -rw-r--r-- | docs/img/hlil-braces.png | bin | 297481 -> 231388 bytes | |||
| -rw-r--r-- | docs/img/logs.png | bin | 264406 -> 153934 bytes | |||
| -rw-r--r-- | docs/img/sidebaricons.png | bin | 17417 -> 10355 bytes | |||
| -rw-r--r-- | docs/img/stack.png | bin | 85071 -> 43236 bytes | |||
| -rw-r--r-- | docs/img/strings.png | bin | 160654 -> 92217 bytes | |||
| -rw-r--r-- | docs/img/themes-console.png | bin | 80034 -> 54159 bytes | |||
| -rw-r--r-- | docs/img/themes-graph.png | bin | 95413 -> 67462 bytes | |||
| -rw-r--r-- | docs/img/themes-hex.png | bin | 26790 -> 20371 bytes | |||
| -rw-r--r-- | docs/img/themes-hexview.png | bin | 26222 -> 20036 bytes | |||
| -rw-r--r-- | docs/img/themes-highlighting.png | bin | 76592 -> 54322 bytes | |||
| -rw-r--r-- | docs/img/themes-linear.png | bin | 110410 -> 77359 bytes | |||
| -rw-r--r-- | docs/img/themes-minigraph.png | bin | 9962 -> 7933 bytes | |||
| -rw-r--r-- | docs/img/themes-panes.png | bin | 31145 -> 22290 bytes | |||
| -rw-r--r-- | docs/img/themes-statusbar.png | bin | 13490 -> 10906 bytes | |||
| -rw-r--r-- | docs/img/themes-tokens.png | bin | 235554 -> 165127 bytes | |||
| -rw-r--r-- | docs/img/variables.png | bin | 137636 -> 73321 bytes |
20 files changed, 48 insertions, 6 deletions
diff --git a/docs/dev/concepts.md b/docs/dev/concepts.md index 25dd5af0..454f0fbf 100644 --- a/docs/dev/concepts.md +++ b/docs/dev/concepts.md @@ -1,5 +1,26 @@ # Important Concepts +## Binary Views + +The highest level analysis object in Binary Ninja is a [BinaryView](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView) (or `bv` for short). You can think of a `bv` as the Binary Ninja equivalent of what an operating system does when loading an executable binary. These `bv`'s are the top-level analysis object representing how a file is loaded into memory as well as debug information, tables of function pointers, and many other structures. + +When you are interacting in the UI with an executable file, you can access `bv` in the python scripting console to see the representation of the current file's BinaryView: + +```python +>>> bv +<BinaryView: '/bin/ls', start 0x100000000, len 0x182f8> +>>> len(bv.functions) +140 +``` + +???+ Info "Tip" + Note the use of `bv` here as a shortcut to the currently open BinaryView. For other "magic" variables, see the [user guide](../guide/index.md#magic-console-variables) + +If you want to start writing a plugin, most top-level methods will exist off of the BinaryView. Conceptually, you can think about the organization as a hierarchy starting with a BinaryView, then functions, then basic blocks, then instructions. There are of course lots of other ways to access parts of the binary but this is the most common organization. Check out the tab completion in the scripting console for `bv.get<TAB>` for example (a common prefix for many APIs): + + + +Some BinaryViews have parent views. The view used for decompilation includes memory mappings through segments and sections for example, but the "parent_view" property is a view of the original file on-disk. ## REPL versus Scripts @@ -46,7 +67,13 @@ t = [ bv.get_symbol_by_raw_name('__builtin_strncpy').address ] -list(current_hlil.traverse(find_strcpy, t)) +# Find the first call to a builtin: +for result in current_hlil.traverse(find_strcpy, t): + # Any logic should live here, not inside the callable which is just for + # matching. Because this is a generator, it can fail fast when used for + # search! + print(result) + break def get_memcpy_data(i, t) -> bytes: @@ -56,7 +83,8 @@ def get_memcpy_data(i, t) -> bytes: # Iterate through all instructions in the HLIL t = bv.get_symbol_by_raw_name('__builtin_memcpy').address -list(current_hlil.traverse(get_memcpy_data, t)) +for i in current_hlil.traverse(get_memcpy_data, t): + print(f"Found some memcpy data: {repr(i)}") # find all the calls to __builtin_strcpy and get their values @@ -69,13 +97,20 @@ t = [ bv.get_symbol_by_raw_name('__builtin_strcpy').address, bv.get_symbol_by_raw_name('__builtin_strncpy').address ] -list(current_hlil.traverse(find_strcpy, t)) + +for i in current_hlil.traverse(find_strcpy, t): + print(i) # collect the number of parameters for each function call def param_counter(i) -> int: match i: case HighLevelILCall(): return len(i.params) + +# Note that the results are a generator and usually anything that is found +# should have processing done outside the callback, but you can always +# convert it to a list like this: + list(current_hlil.traverse(param_counter)) @@ -84,6 +119,7 @@ def collect_call_target(i) -> None: match i: case HighLevelILCall(dest=HighLevelILConstPtr(constant=c)): return c + set([hex(a) for a in current_hlil.traverse(collect_call_target)]) @@ -92,6 +128,7 @@ def collect_this_vars(i) -> Variable: match i: case HighLevelILVar(var=v) if v.name == 'this': return v + list(v for v in current_hlil.traverse(collect_this_vars)) ``` diff --git a/docs/guide/index.md b/docs/guide/index.md index db20be62..e4cff8e9 100644 --- a/docs/guide/index.md +++ b/docs/guide/index.md @@ -132,7 +132,7 @@ When you create a new file, you're given the [hex view](index.md#hex-view) of an To paste, right click anywhere in the view, select "Paste From," and choose whichever option matches the data you copied. For example, the string `\x01\x02\x03\x04` can be pasted as an Escape String, while `01020304` is Raw Hex. -From here, you can save the contents of your new binary to disk and reopen it for auto-analysis. Of course, you could also switch out of hex view and start creating functions yourself. +From here, you can save the contents of your new binary to disk and reopen it for auto-analysis. Of course, you could also switch out of hex view into linear view and start creating functions directly. ## New Tab @@ -210,6 +210,9 @@ There's also [many](#using-the-keyboard) keyboard-based navigation options. Switching views happens multiple ways. In some instances, it is automatic, such as clicking a data reference from graph view. This will navigate to linear view as data is not shown in the graph view. While navigating, you can use the [view hotkeys](#default-hotkeys) to switch to a specific view at the same location as the current selection. Next you can use the [command palette](#command-palette). Additionally, the view menu in the header at the top of each pane can be used to change views without navigating to any given location. Finally, you can also use the `View` application menu. +???+ Tip "Tip" + Any loaded BinaryView will show up in the upper-left of the main pane. You can switch between (for example), `ELF` and `Raw` to switch between multiple loaded [BinaryViews](../dev/concepts.md#Binary-Views). + ## The Sidebar { width = "800" } @@ -410,6 +413,7 @@ The normal find dialog also exists as a sidebar panel that allows persistent, ta The search types are available from a drop-down next to the text input field and include: + - Advanced Binary Search: A new search type using the [bv.search](https://dev-api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.search) syntax (supporting regular expressions and wildcard hex strings) - Escaped: Escaped strings such as `OneString\x09\Tabsx09Another` - Hex: All values much be valid hex characters such as `ebfffc390` and the bytes will only be searched for in this particular order - Raw: A simple string search that matches the exact string as specified @@ -573,9 +577,10 @@ The hexadecimal view is useful for viewing raw binary files that may or may not The hex view is particularly good for transforming data in various ways via the `Copy as`, `Transform`, and `Paste from` menus. Note that like any other edits, `Transform` menu options will transform the data in-place, but unlike other means of editing the binary, the transformation dialog will work even when the lock button is toggled on (🔒). -???+ Tip "Tip" - Any changes made in the Hex view will take effect immediately in any other views open into the same file (new views can be created via the `Split to new tab`, or `Split to new window` options under `View`, or via [splitting panes](#tiling-panes)). This can, however, cause large amounts of re-analysis so be warned before making large edits or transformations in a large binary file. +If you're using the hex view for a Binary View like ELF, Mach-O or PE, you probably want to make sure you're also in the `Raw` view if you want to see the file as it exists on disk in hex view. +### Live Preview + Any changes made in the Hex view will take effect immediately in any other views open into the same file (new views can be created via the `Split to new tab`, or `Split to new window` options under `View`, or via [splitting panes](#tiling-panes)). This can, however, cause large amounts of re-analysis so be warned before making large edits or transformations in a large binary file. ## Linear View diff --git a/docs/img/find.png b/docs/img/find.png Binary files differindex ab081ee7..6a10a014 100644 --- a/docs/img/find.png +++ b/docs/img/find.png diff --git a/docs/img/getcompletion.png b/docs/img/getcompletion.png Binary files differnew file mode 100644 index 00000000..15aaf6a8 --- /dev/null +++ b/docs/img/getcompletion.png diff --git a/docs/img/hlil-braces.png b/docs/img/hlil-braces.png Binary files differindex 551c4e97..26d9404e 100644 --- a/docs/img/hlil-braces.png +++ b/docs/img/hlil-braces.png diff --git a/docs/img/logs.png b/docs/img/logs.png Binary files differindex be89c384..bfcf9389 100644 --- a/docs/img/logs.png +++ b/docs/img/logs.png diff --git a/docs/img/sidebaricons.png b/docs/img/sidebaricons.png Binary files differindex d95dc208..05de75dd 100644 --- a/docs/img/sidebaricons.png +++ b/docs/img/sidebaricons.png diff --git a/docs/img/stack.png b/docs/img/stack.png Binary files differindex 0efad194..06db97c8 100644 --- a/docs/img/stack.png +++ b/docs/img/stack.png diff --git a/docs/img/strings.png b/docs/img/strings.png Binary files differindex 5f94c6d1..2ad7a459 100644 --- a/docs/img/strings.png +++ b/docs/img/strings.png diff --git a/docs/img/themes-console.png b/docs/img/themes-console.png Binary files differindex 7a410034..a8de28f2 100644 --- a/docs/img/themes-console.png +++ b/docs/img/themes-console.png diff --git a/docs/img/themes-graph.png b/docs/img/themes-graph.png Binary files differindex df74c012..b118f516 100644 --- a/docs/img/themes-graph.png +++ b/docs/img/themes-graph.png diff --git a/docs/img/themes-hex.png b/docs/img/themes-hex.png Binary files differindex cad30b42..01551b9a 100644 --- a/docs/img/themes-hex.png +++ b/docs/img/themes-hex.png diff --git a/docs/img/themes-hexview.png b/docs/img/themes-hexview.png Binary files differindex 495eb935..8c33a1c3 100644 --- a/docs/img/themes-hexview.png +++ b/docs/img/themes-hexview.png diff --git a/docs/img/themes-highlighting.png b/docs/img/themes-highlighting.png Binary files differindex 097bfb28..5e665366 100644 --- a/docs/img/themes-highlighting.png +++ b/docs/img/themes-highlighting.png diff --git a/docs/img/themes-linear.png b/docs/img/themes-linear.png Binary files differindex 392bab47..1ecfd3fd 100644 --- a/docs/img/themes-linear.png +++ b/docs/img/themes-linear.png diff --git a/docs/img/themes-minigraph.png b/docs/img/themes-minigraph.png Binary files differindex b3dc1318..f58c911b 100644 --- a/docs/img/themes-minigraph.png +++ b/docs/img/themes-minigraph.png diff --git a/docs/img/themes-panes.png b/docs/img/themes-panes.png Binary files differindex 0f88c8be..3c617056 100644 --- a/docs/img/themes-panes.png +++ b/docs/img/themes-panes.png diff --git a/docs/img/themes-statusbar.png b/docs/img/themes-statusbar.png Binary files differindex f35970f8..71ec911f 100644 --- a/docs/img/themes-statusbar.png +++ b/docs/img/themes-statusbar.png diff --git a/docs/img/themes-tokens.png b/docs/img/themes-tokens.png Binary files differindex ed6cc1e2..96b8926b 100644 --- a/docs/img/themes-tokens.png +++ b/docs/img/themes-tokens.png diff --git a/docs/img/variables.png b/docs/img/variables.png Binary files differindex 441de572..99fc2d50 100644 --- a/docs/img/variables.png +++ b/docs/img/variables.png |
