summaryrefslogtreecommitdiff
path: root/docs
diff options
context:
space:
mode:
Diffstat (limited to 'docs')
-rw-r--r--docs/about/open-source.md4
-rw-r--r--docs/dev/annotation.md297
-rw-r--r--docs/dev/bnil-hlil.md158
-rw-r--r--docs/dev/bnil-llil.md10
-rw-r--r--docs/dev/bnil-mlil.md16
-rw-r--r--docs/dev/bnil-overview.md8
-rw-r--r--docs/dev/concepts.md64
-rw-r--r--docs/dev/cookbook.md163
-rw-r--r--docs/dev/flags.md6
-rw-r--r--docs/dev/index.md4
-rw-r--r--docs/dev/plugins.md2
-rw-r--r--docs/dev/themes.md138
-rw-r--r--docs/dev/typelibraries.md288
-rw-r--r--docs/dev/uidf.md39
-rw-r--r--docs/dev/workflows.md1
-rw-r--r--docs/docs.css141
-rw-r--r--docs/getting-started.md44
-rw-r--r--docs/guide/index.md590
-rw-r--r--docs/guide/migration/index.md21
-rw-r--r--docs/guide/migration/migrationguideghidra.md119
-rw-r--r--docs/guide/migration/migrationguideida.md66
-rw-r--r--docs/guide/objectivec.md4
-rw-r--r--docs/guide/plugins.md2
-rw-r--r--docs/guide/projects.md122
-rw-r--r--docs/guide/settings.md98
-rw-r--r--docs/guide/troubleshooting.md2
-rw-r--r--docs/guide/type.md363
-rw-r--r--docs/guide/types/basictypes.md173
-rw-r--r--docs/guide/types/cpp.md (renamed from docs/guide/cpp.md)18
-rw-r--r--docs/guide/types/debuginfo.md (renamed from docs/guide/debuginfo.md)2
-rw-r--r--docs/guide/types/index.md18
-rw-r--r--docs/guide/types/platformtypes.md42
-rw-r--r--docs/guide/types/type.md88
-rw-r--r--docs/guide/types/typearchives.md47
-rw-r--r--docs/guide/types/typeimportexport.md184
-rw-r--r--docs/guide/types/typelibraries.md37
-rw-r--r--docs/img/BNIL-hlil.pngbin40400 -> 36969 bytes
-rw-r--r--docs/img/BNIL-llil.pngbin40254 -> 36803 bytes
-rw-r--r--docs/img/BNIL-mlil.pngbin40390 -> 36907 bytes
-rw-r--r--docs/img/BNIL-overview.pngbin79401 -> 46721 bytes
-rw-r--r--docs/img/BNIL.pngbin39769 -> 26955 bytes
-rw-r--r--docs/img/address-indicator.pngbin58102 -> 50375 bytes
-rw-r--r--[-rwxr-xr-x]docs/img/after-template-simplification.pngbin87740 -> 137998 bytes
-rw-r--r--docs/img/apply_enum.pngbin91006 -> 0 bytes
-rw-r--r--docs/img/auto-create-members.pngbin28429 -> 57427 bytes
-rw-r--r--docs/img/auto-create-one-member.pngbin22854 -> 0 bytes
-rw-r--r--[-rwxr-xr-x]docs/img/before-template-simplification.pngbin106157 -> 150555 bytes
-rw-r--r--docs/img/change-type.pngbin46488 -> 77785 bytes
-rw-r--r--docs/img/clear-var-value.pngbin152231 -> 64450 bytes
-rw-r--r--docs/img/command-palette.pngbin96334 -> 87296 bytes
-rw-r--r--docs/img/console-split.pngbin108715 -> 92967 bytes
-rw-r--r--docs/img/console.pngbin59637 -> 92327 bytes
-rw-r--r--docs/img/controls.pngbin2241 -> 0 bytes
-rw-r--r--docs/img/correct-switch-after-uidf.pngbin40405 -> 0 bytes
-rw-r--r--docs/img/create-array.pngbin0 -> 81453 bytes
-rw-r--r--docs/img/create-derived-struct-1.pngbin0 -> 50174 bytes
-rw-r--r--docs/img/create-derived-struct-2.pngbin0 -> 50742 bytes
-rw-r--r--docs/img/create-multi-derived-struct.pngbin0 -> 48873 bytes
-rw-r--r--docs/img/create-struct-menu.pngbin0 -> 85030 bytes
-rw-r--r--docs/img/create_array.pngbin47957 -> 0 bytes
-rw-r--r--docs/img/create_derived_struct_1.pngbin66815 -> 0 bytes
-rw-r--r--docs/img/create_derived_struct_2.pngbin67254 -> 0 bytes
-rw-r--r--docs/img/create_multi_derived_struct.pngbin75288 -> 0 bytes
-rw-r--r--docs/img/create_struct_menu.pngbin56056 -> 0 bytes
-rw-r--r--docs/img/cross-reference-filter.pngbin24431 -> 47078 bytes
-rw-r--r--docs/img/cross-reference-panel-pin.pngbin25763 -> 21072 bytes
-rw-r--r--docs/img/cross-reference-table.pngbin43800 -> 34487 bytes
-rw-r--r--docs/img/cross-reference-tree.pngbin88717 -> 62627 bytes
-rw-r--r--docs/img/dead-store-after.pngbin27977 -> 24818 bytes
-rw-r--r--docs/img/dead-store-example.pngbin35415 -> 24055 bytes
-rw-r--r--docs/img/dead-store-menu.pngbin166633 -> 199137 bytes
-rw-r--r--docs/img/efp-dialog-diagram.pngbin0 -> 187848 bytes
-rw-r--r--docs/img/efp_dialog_diagram.pngbin115580 -> 0 bytes
-rw-r--r--docs/img/external-links-edit-external-library.pngbin0 -> 232678 bytes
-rw-r--r--docs/img/external-links-edit-external-location.pngbin0 -> 93060 bytes
-rw-r--r--docs/img/external-links-right-click-library.pngbin0 -> 46086 bytes
-rw-r--r--docs/img/external-links.pngbin0 -> 42146 bytes
-rw-r--r--docs/img/featuremap.pngbin6684 -> 4029 bytes
-rw-r--r--docs/img/find.pngbin0 -> 227006 bytes
-rw-r--r--docs/img/functionlist.pngbin66676 -> 0 bytes
-rw-r--r--docs/img/graphview.pngbin190457 -> 52381 bytes
-rw-r--r--docs/img/hanyu-no-codepage.pngbin0 -> 17977 bytes
-rw-r--r--docs/img/hanyu-with-codepage.pngbin0 -> 17444 bytes
-rw-r--r--docs/img/hex.pngbin319944 -> 214354 bytes
-rw-r--r--docs/img/hlil-after-uidf.pngbin91085 -> 0 bytes
-rw-r--r--docs/img/hlil-before-uidf.pngbin74449 -> 0 bytes
-rw-r--r--docs/img/hlil-braces.pngbin303084 -> 297481 bytes
-rw-r--r--docs/img/hlil-hierarchy-call.pngbin39238 -> 25428 bytes
-rw-r--r--docs/img/hlil-scope.pngbin25489 -> 30777 bytes
-rw-r--r--docs/img/hover-uidf.pngbin43901 -> 0 bytes
-rw-r--r--docs/img/ilmapping.pngbin116999 -> 175295 bytes
-rw-r--r--docs/img/import-bndb.pngbin296661 -> 133730 bytes
-rw-r--r--docs/img/import-header.pngbin509733 -> 248135 bytes
-rw-r--r--docs/img/jump-table-uidf.pngbin77602 -> 0 bytes
-rw-r--r--docs/img/keybindings.pngbin80351 -> 60116 bytes
-rw-r--r--docs/img/license-popup.pngbin69296 -> 115823 bytes
-rw-r--r--docs/img/linear.pngbin309443 -> 342383 bytes
-rw-r--r--docs/img/llil-hierarchy.pngbin241251 -> 129772 bytes
-rw-r--r--docs/img/llil-option.pngbin0 -> 50569 bytes
-rw-r--r--docs/img/llil_option.pngbin29139 -> 0 bytes
-rw-r--r--docs/img/logo.pngbin15720 -> 9652 bytes
-rw-r--r--docs/img/logs.pngbin0 -> 264406 bytes
-rw-r--r--docs/img/main.pngbin285874 -> 478007 bytes
-rw-r--r--docs/img/memory-map-icon.pngbin0 -> 2859 bytes
-rw-r--r--docs/img/memory-map.pngbin73128 -> 317898 bytes
-rw-r--r--docs/img/merge-variables.pngbin150397 -> 101221 bytes
-rw-r--r--docs/img/merge-vars-dialog.pngbin58976 -> 0 bytes
-rw-r--r--docs/img/merge-vars.pngbin63066 -> 0 bytes
-rw-r--r--docs/img/mini-graph.pngbin0 -> 18100 bytes
-rw-r--r--docs/img/mystring.pngbin17069 -> 0 bytes
-rw-r--r--docs/img/navigation.pngbin50125 -> 64492 bytes
-rw-r--r--docs/img/newtab-compact.pngbin0 -> 164348 bytes
-rw-r--r--docs/img/newtab-personal.pngbin0 -> 1033053 bytes
-rw-r--r--docs/img/newtab-projects.pngbin0 -> 529169 bytes
-rw-r--r--docs/img/objc-analyze-action.pngbin0 -> 127684 bytes
-rw-r--r--docs/img/objc-workflow-selected.pngbin0 -> 71140 bytes
-rw-r--r--docs/img/objc_analyze_action.pngbin107944 -> 0 bytes
-rw-r--r--docs/img/objc_workflow_selected.pngbin37469 -> 0 bytes
-rw-r--r--docs/img/open-with-options.pngbin121934 -> 424007 bytes
-rw-r--r--docs/img/options-setting-uidf.pngbin46958 -> 0 bytes
-rw-r--r--docs/img/options.pngbin79025 -> 63295 bytes
-rw-r--r--docs/img/overview.pngbin381544 -> 504705 bytes
-rw-r--r--docs/img/plugin-manager.pngbin151411 -> 529518 bytes
-rw-r--r--docs/img/preferences.pngbin72367 -> 0 bytes
-rw-r--r--docs/img/projects.pngbin0 -> 424810 bytes
-rw-r--r--docs/img/pseudo-c.pngbin134160 -> 102908 bytes
-rw-r--r--docs/img/rename.pngbin17634 -> 71322 bytes
-rw-r--r--docs/img/right-click-uidf.pngbin175393 -> 0 bytes
-rw-r--r--docs/img/save-choices.pngbin24272 -> 28511 bytes
-rw-r--r--docs/img/save-with-options.pngbin41830 -> 82454 bytes
-rw-r--r--docs/img/select-enum-member.pngbin0 -> 164197 bytes
-rw-r--r--docs/img/select_enum_member.pngbin101703 -> 0 bytes
-rw-r--r--docs/img/settings.pngbin332687 -> 238566 bytes
-rw-r--r--docs/img/sidebar.pngbin345978 -> 0 bytes
-rw-r--r--docs/img/sidebaricons.pngbin0 -> 17417 bytes
-rw-r--r--docs/img/sidebars.pngbin0 -> 552152 bytes
-rw-r--r--docs/img/split-var.pngbin54707 -> 92559 bytes
-rw-r--r--docs/img/stack.pngbin0 -> 85071 bytes
-rw-r--r--docs/img/status-bar.pngbin16608 -> 12324 bytes
-rw-r--r--docs/img/stringapplied.pngbin16193 -> 0 bytes
-rw-r--r--docs/img/strings.pngbin0 -> 160654 bytes
-rw-r--r--docs/img/symbols-header-menu.pngbin0 -> 75558 bytes
-rw-r--r--docs/img/symbols-right-click.pngbin0 -> 80996 bytes
-rw-r--r--docs/img/symbols_dragtocreate.pngbin117537 -> 0 bytes
-rw-r--r--docs/img/symbols_header_drag.pngbin178695 -> 0 bytes
-rw-r--r--docs/img/symbols_header_menu.pngbin117775 -> 0 bytes
-rw-r--r--docs/img/symbols_overview1.pngbin392638 -> 0 bytes
-rw-r--r--docs/img/symbols_right_click_NFwS.pngbin154256 -> 0 bytes
-rw-r--r--docs/img/symbols_truncation.pngbin23655 -> 0 bytes
-rw-r--r--docs/img/tags.pngbin0 -> 85901 bytes
-rw-r--r--docs/img/taped/1.pngbin27905 -> 23879 bytes
-rw-r--r--docs/img/taped/2.pngbin33085 -> 32969 bytes
-rw-r--r--docs/img/taped/3.pngbin29260 -> 31573 bytes
-rw-r--r--docs/img/taped/4.pngbin28660 -> 28580 bytes
-rw-r--r--docs/img/taped/5.pngbin65863 -> 40997 bytes
-rw-r--r--docs/img/taped/6.pngbin276452 -> 196049 bytes
-rw-r--r--docs/img/themedocs-console.pngbin34610 -> 0 bytes
-rw-r--r--docs/img/themedocs-graphview.pngbin34406 -> 0 bytes
-rw-r--r--docs/img/themedocs-hexview.pngbin28782 -> 0 bytes
-rw-r--r--docs/img/themedocs-highlighting.pngbin59619 -> 0 bytes
-rw-r--r--docs/img/themedocs-linearview.pngbin62882 -> 0 bytes
-rw-r--r--docs/img/themedocs-tokens.pngbin135432 -> 0 bytes
-rw-r--r--docs/img/themes-console.pngbin0 -> 80034 bytes
-rw-r--r--docs/img/themes-graph.pngbin0 -> 95413 bytes
-rw-r--r--docs/img/themes-hex.pngbin0 -> 26790 bytes
-rw-r--r--docs/img/themes-hexview.pngbin0 -> 26222 bytes
-rw-r--r--docs/img/themes-highlighting.pngbin0 -> 76592 bytes
-rw-r--r--docs/img/themes-linear.pngbin0 -> 110410 bytes
-rw-r--r--docs/img/themes-minigraph.pngbin0 -> 9962 bytes
-rw-r--r--docs/img/themes-panes.pngbin0 -> 31145 bytes
-rw-r--r--docs/img/themes-statusbar.pngbin0 -> 13490 bytes
-rw-r--r--docs/img/themes-tokens.pngbin0 -> 235554 bytes
-rw-r--r--docs/img/tiling-panes.pngbin282560 -> 591934 bytes
-rw-r--r--docs/img/type-archives-status.pngbin0 -> 81319 bytes
-rw-r--r--docs/img/type-archives.pngbin0 -> 61102 bytes
-rw-r--r--docs/img/type-view-accesses.pngbin17547 -> 0 bytes
-rw-r--r--docs/img/types-containers.pngbin0 -> 32689 bytes
-rw-r--r--docs/img/types-list.pngbin0 -> 31999 bytes
-rw-r--r--docs/img/types-right-click-menu-bottom.pngbin0 -> 86147 bytes
-rw-r--r--docs/img/types-right-click-menu-top.pngbin0 -> 66646 bytes
-rw-r--r--docs/img/types-right-click-menu.pngbin21040 -> 0 bytes
-rw-r--r--docs/img/types-view.pngbin248754 -> 357042 bytes
-rw-r--r--docs/img/uidf-correct-switch-after.pngbin0 -> 31723 bytes
-rw-r--r--docs/img/uidf-hlil-after.pngbin0 -> 35351 bytes
-rw-r--r--docs/img/uidf-hlil-before.pngbin0 -> 83679 bytes
-rw-r--r--docs/img/uidf-hover.pngbin0 -> 24938 bytes
-rw-r--r--docs/img/uidf-jump-table.pngbin0 -> 59090 bytes
-rw-r--r--docs/img/uidf-options-setting.pngbin0 -> 126457 bytes
-rw-r--r--docs/img/uidf-right-click.pngbin0 -> 111094 bytes
-rw-r--r--docs/img/uidf-sidebar.pngbin0 -> 146005 bytes
-rw-r--r--docs/img/unicode-settings.pngbin0 -> 48085 bytes
-rw-r--r--docs/img/variables.pngbin0 -> 137636 bytes
-rw-r--r--docs/img/view-choices.pngbin45913 -> 29523 bytes
-rw-r--r--docs/img/vtable-cross-refs-context.pngbin0 -> 54577 bytes
-rw-r--r--docs/img/vtable-cross-refs.pngbin0 -> 38743 bytes
-rw-r--r--docs/img/vtable_cross_refs.pngbin48986 -> 0 bytes
-rw-r--r--docs/img/vtable_cross_refs_context.pngbin68328 -> 0 bytes
-rw-r--r--docs/index.md15
198 files changed, 2188 insertions, 1206 deletions
diff --git a/docs/about/open-source.md b/docs/about/open-source.md
index 96b7d7f3..b71813bd 100644
--- a/docs/about/open-source.md
+++ b/docs/about/open-source.md
@@ -297,7 +297,7 @@ Please note that we offer no support for running Binary Ninja with modified Qt l
[sourcecodepro]: https://github.com/adobe-fonts/source-code-pro
[NotoColorEmoji license]: https://github.com/googlefonts/noto-emoji/blob/main/fonts/LICENSE
[NotoColorEmoji]: https://github.com/googlefonts/noto-emoji
-[sphinx license]: https://github.com/sphinx-doc/sphinx/blob/master/LICENSE
+[sphinx license]: https://github.com/sphinx-doc/sphinx/blob/master/LICENSE.rst
[sphinx]: http://www.sphinx-doc.org/en/stable/index.html
[sqlite license]: https://www.sqlite.org/copyright.html
[sqlite]: https://www.sqlite.org/index.html
@@ -701,7 +701,7 @@ Please note that we offer no support for running Binary Ninja with modified Qt l
[webpki]: https://github.com/briansmith/webpki
[webpki license]: https://github.com/briansmith/webpki/blob/main/LICENSE
[webpki-roots]: https://github.com/rustls/webpki-roots
-[webpki-roots license]: https://github.com/rustls/webpki-roots/blob/main/LICENSE
+[webpki-roots license]: https://github.com/rustls/webpki-roots/blob/main/webpki-roots/LICENSE
[which]: https://github.com/harryfei/which-rs.git
[which license]: https://github.com/harryfei/which-rs/blob/master/LICENSE.txt
[x509-signature]: https://github.com/paritytech/x509-signature
diff --git a/docs/dev/annotation.md b/docs/dev/annotation.md
index d952baa6..60cb9681 100644
--- a/docs/dev/annotation.md
+++ b/docs/dev/annotation.md
@@ -1,11 +1,11 @@
# Applying Annotations
-This document is organized into five sections describing how to work with various types of annotations in Binary Ninja using the API. Note that its [companion documentation](../guide/type.md) describes how to interact with many of the same elements via the UI.
+This document is organized into five sections describing how to work with various types of annotations in Binary Ninja using the API. Note that its [companion documentation](../guide/types/index.md) describes how to interact with many of the same elements via the UI.
1. [Symbols](#symbols) covers how to work with Symbols in a binary
1. [Types](#types) documents creating and interacting with types through the API
1. [Tags](#tags) describes how to create tags and bookmarks
-1. [Type Libraries](#type-libraries) explains how to work with Type Libraries, including multiple sources of information from which Binary Ninja can automatically source for type information from and how you can add to them
+1. [Type Libraries](typelibraries.md) explains how to work with Type Libraries, including multiple sources of information from which Binary Ninja can automatically source for type information from and how you can add to them
1. [Signature Libraries](#signature-library) explains how to work with the signature library which match statically compiled functions which are then matched with type libraries
## Symbols
@@ -20,7 +20,7 @@ From an API perspective there are several helper functions available for working
'newName'
```
-Other objects or variables may need a [symbol](https://api.binary.ninja/binaryninja.types.Symbol.html) created and applied (this can also be done even if not using a helper function on objects such as functions):
+Other objects or variables may need a [symbol](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol) created and applied (this can also be done even if not using a helper function on objects such as functions):
```py
>>> mysym = Symbol(SymbolType.FunctionSymbol, here, "myVariableName")
@@ -31,7 +31,7 @@ Other objects or variables may need a [symbol](https://api.binary.ninja/binaryni
Note that `here` and `bv` are used in many of the previous examples. These shortcuts and [several others](../guide/index.md#script-python-console) are only available when running in the Binary Ninja python console and are used here for convenience.
-Valid symbol types [include](https://api.binary.ninja/binaryninja.enums.SymbolType.html):
+Valid symbol types [include](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.SymbolType):
| SymbolType | Description |
| ---------- | ----------- |
@@ -439,7 +439,7 @@ Note that most of the APIs that take a Type object also take a C-style type stri
### Headers
-Importing a header goes through the same code path as parsing source directly. You will just have to read the file and specify the appropriate command-line arguments as an array. See [user type guide](../guide/type.md#import-header-file) for directions for choosing arguments.
+Importing a header goes through the same code path as parsing source directly. You will just have to read the file and specify the appropriate command-line arguments as an array. See [user type guide](../guide/types/typeimportexport.md#import-header-file) for directions for choosing arguments.
```python
>>> with open('C:\projects\stdafx.h', 'r') as f:
@@ -473,292 +473,7 @@ Exporting a header uses the `TypePrinter.print_all_types` api, and outputs a str
## Type Libraries
-Type Libraries are collections of type information (structs, enums, function types, etc.) stored in a file with the extension `.bntl`.
-
-Relative to the binaryninja executable, the default type library location is `../Resources/typelib` on macOS and `./typelib` on Linux and Windows. Individual .bntl files are organized in subdirectories named for the supported architecture. Users may include their own type libraries
-
-The information in a type library is contained in two key-value stores:
-
-1. named types: key is the type name, value is the type
-1. named objects: key is external symbol name, value is the type
-
-### How Binary Ninja Loads Type Libraries
-
-When a binary is opened, its platform is determined, all .bntl's are processed, and those matching the platform of the loaded binary are registered. A debug log will show:
-
-```
-Registered library 'libc.so.6' with platform 'linux-x86_64'
-```
-
-Then, those with either a filename or an alternative name matching the exact text of the binary's import command are imported, much like the native linker/loader. For example, in ELF, the .dynstr entry is used.
-
-```
-elf: searching for 'libc.so.6' in type libraries
-Type library 'libc.so.6' imported
-```
-
-Type libraries for linux are ideally named after their realname, preserving the library minor version from which they were generated, and the soname in the alternatives list. In practice, naming them after their soname suffices. Using the linkname with no alternatives will prevent your library from loading.
-
-This requested name should be a soname, like "libfoo.so.1" but could be a linkname like "libfoo.so". (The ldconfig tool is responsible for creating symlinks from soname to realnames, like `/usr/lib/libfoo.so.1` -> `/usr/lib/libfoo.so.1.0`. See [tldp.org](https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html) for more information.).
-
-Binary Ninja's logic for determining a match is straightforward:
-
-```
-typelibname.removesuffix('.bntl') == requestedname or requestedname in alternativenames
-```
-
-Therefore, without any alternative names, `libc.so.bntl` will not be loaded by Binary Ninja if an ELF requests libc.so.6.
-
-We recommend and use the following convention:
-
-Type libraries should be named for the filename from which they were generated with the phrase ".bntl" added. When the source library contains additional minor and release number, like `libfoo.so.1.2.3` Binary Ninja would not load the resulting type library `libfoo.so.1.2.3.bntl` for an ELF requesting soname `libfoo.so.1`. Therefore the alternative names list should include the most specific version numbers, incrementally stripped down to the soname, and finally a linkname for good measure.
-
-Example:
-
-`libfoo.so.1.2.3` is used to generated `libfoo.so.1.2.3.bntl`
-
-The alternative names list should have:
-
-```
-libfoo.so.1.2.3 <-- includes version, minor, release (most specific)
-libfoo.so.1.2 <-- includes version, minor (less specific)
-libfoo.so.1 <-- includes version (soname)
-libfoo.so <-- linkname
-```
-
-### Acquiring a Handle
-
-The platform class exposes handles to these imported type libraries with its `type_libraries` list and its `get_type_libraries_by_name()` function:
-
-```python
->>> bv.platform.type_libraries
-[<typelib 'libm.so.6':x86_64':x86_64>, <typelib 'SYSCALLS':x86_64]
->>> bv.platform.get_type_libraries_by_name('libm.so.6')
-[<typelib 'libm.so.6':x86_64>]
-```
-
-That requires the type library having been loaded. A more direct way is to load from a file path with the `load_from_file()` from `Typelibrary` class from `typelibrary` module:
-
-```python
->>> typelibrary.TypeLibrary.load_from_file('/path/to/libm_x86_64.so.6.bntl')
-<typelib 'libm_x86_64.so.6':x86_64>
-```
-
-### Contents of Libraries
-
-The following demonstrates attributes of interest on a loaded type library in variable `tl`:
-
-```python
- print(' name: %s' % tl.name)
- print(' arch: %s' % tl.arch)
- print(' guid: %s' % tl.guid)
- print('dependency_name: %s' % tl.dependency_name)
- print('alternate_names: %s' % tl.alternate_names)
- print(' platform_names: %s' % tl.platform_names)
-
- print(' named_objects: %d' % len(tl.named_objects))
- for (key, val) in tl.named_objects.items():
- print('\t"%s" %s' % (str(key), str(val)))
-
- print(' named_types: %d' % len(tl.named_types))
- for (key,val) in tl.named_types.items():
- print('\t"%s" %s' % (str(key), str(val)))
-```
-
-Named objects (via dictionary `.named_objects` are functions signatures and a module's exported variables. Named types (via dictionary `.named_types`) are the textual named you might use to declare a variable. For example,
-
-For example, `.named_objects['fegetexceptionflag']` looks up its function prototype: `int32_t (fexcept_t* flagp)` and `.named_types['fexcept_t']` looks up `uint16_t`, its typedef.
-
-### Creating
-
-You may also wish to use the [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py) example script included both online and offline in your installation path.
-
-Types entered by manual entry can be exported from the binary view using `export_type_to_library()`.
-
-Manual creation is achieved by creating a new type library, associating the correct platform and architecture, adding types, finalizing, and writing to a file. Example:
-
-```python
-arch = binaryninja.Architecture['x86_64']
-
-struct = Structure()
-struct.append(Type.pointer(arch, Type.char()), 'name')
-struct.append(Type.int(4), 'age')
-struct.append(Type.int(4), 'height')
-struct.append(Type.int(4), 'weight')
-
-typelib = binaryninja.typelibrary.TypeLibrary.new(arch, 'test.so.1.4')
-typelib.add_named_type('human', binaryninja.types.Type.structure_type(struct))
-typelib.add_alternate_name('test.so.1') #don't forget this step!
-typelib.add_alternate_name('test.so')
-typelib.finalize()
-typelib.write_to_file('test.so.1.bntl')
-```
-
-### Other Type Library Questions
-
-_What's a named type vs. just a type?_
-
-Some variable definitions have type information, but don't produce a type name useful for future definitions, examples:
-
-- `enum {A=1,B=2} foo;` : foo has type with no type name (it does have a variable name)
-- `struct {int A; int B;} bar;` : bar has type with no type name
-
-In C, enum and struct definitions can create a new type name as a byproduct of a definition by using a "tag name":
-
-- `enum MyEnum {A=1,B=2} foo;` : foo has the type named `MyEnum`
-- `struct MyStruct {int A; int B;} bar;` : bar has the type named `MyStruct`
-
-In the second set of examples, the types are named, and that name could be used to declare other variables, like `enum MyEnum bar2;` and `struct MyStruct bar2`.
-
-Functions' types are not named. The function name is considered the name of a function object, and the function's type is anonymous.
-
-In summary:
-
-```c
-typedef int foo; // type:int, name:foo
-
-// structs, without and with a "tag name"
-struct {int A; int B;} foo; // type:struct{int A, intB;}, name:<anonymous>
-struct MyStruct {int A; int B;} foo; // type:struct{int A, intB;}, name:MyStruct
-
-// enumerations, without and with a "tag name"
-enum {A=1,B=2} foo; // type:enum{A=1,B=2}, name:<anonymous>
-enum MyEnum {A=1,B=2} foo; // type:enum{A=1,B=2}, name:MyEnum
-
-// functions
-int main(int ac, char **av); // type int ()(int, char **), name:<anonymous>
-typedef int (MyFunc)(int ac, char **av); // type int ()(int, char **), name:MyFunc
-
-```
-
-_How does Binary Ninja decide when to use a typelibrary (.bntl) file?_
-
-Type Libraries are loaded when the corresponding library is imported by a BinaryView. (i.e. if an exe imports `ntdll.dll`, binja will look in the bv's platform for type libraries named ntdll.bntl and load the first one it finds)
-
-_What's the difference between a named type and a named object?_
-
-A named type is a type with a name that can identify it. For example, `color` is the name of type `enum {RED=0, ORANGE=1, YELLOW=2, ...}`.
-
-A named object is the name of an external/imported symbol for which the type library has type information. For example, `MessageBoxA` is the name of a function whose type is `int ()(HWND, LPCSTR, LPCSTR, UINT)`.
-
-_How do I find what type of type a type object is? How many are there?_
-
-I've seen "types of types", "sorts of types", "kinds of types", "classes of types" used to differentiate the varieties of possible types, and there are probably more. Binary Ninja uses "class", example:
-
-```
->>> type_obj.type_class
-<TypeClass.FunctionTypeClass: 8>
-```
-
-In [enums.py](https://api.binary.ninja/_modules/binaryninja/enums.html#TypeClass) we can see Binary Ninja currently thinks of types falling into 13 classes: `Void`, `Bool`, `Integer`, `Float`, `Structure`, `Enumeration`, `Pointer`, `Array`, `Function`, `VarArgs`, `Value`, `NamedTypeReference`, `WideCharType`.
-
-Compare this to LLDB, which also uses the term "class", and currently has 19 of them: `Array`, `BlockPointer`, `Builtin`, `Class`, `ComplexFloat`, `ComplexInteger`, `Enumeration`, `Function`, `MemberPointer`, `ObjCObject`, `ObjCInterface`, `ObjCObjectPointer`, `Pointer`, `Reference`, `Struct`, `Typedef`, `Union`, `Vector`, `Other`.
-
-Compare this to GDB, which uses the term "type code" and has 25 of them.
-
-_Where are function parameter names stored?_
-
-While technically not part of the type, having names of function parameters is very useful and can thus be optionally stored in a type.
-
-Function types (types with `.type_class == FunctionTypeClass`) have a `.parameters` attribute, a list of [`FunctionParameter`](https://api.binary.ninja/binaryninja.types.FunctionParameter.html) objects. When those objects have `.name==''` you get the bare bones function types like `int ()(int, char **)`. When those objects have their `.name` populated you get the more meaningful `int ()(int argc, char **argv)`.
-
-_How do I manually load a type library?_
-
-```
->>> bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))
-```
-
-_How can I manually load a type object?_
-
-```
->>> bv.import_library_object('_MySuperComputation')
-<type: int32_t (int32_t, int32_t, char*)>
-```
-
-_Why doesn't the types view show the types imported from type libraries?_
-
-Because the type libraries added to a binary view only makes their type information _available_ for use. The types view will show a type from a type library only after it is used (on demand).
-
-Try this experiment:
-
-- note `bv.type_libraries`, `bv.types`
-- add a type library with `bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))`
-- note that `bv.type_libraries` is extended, but `bv.types` is unchanged!
-- note `bv.get_type_by_name('Rectangle')` returns nothing
-- set the type of some data to `struct Rectangle` (using `y` in linear view or via any other method described above)
-- `bv.types` is extended, and the types view shows `struct Rectangle` in the auto types
-
-_What's a named type reference?_
-
-Named Type References are a way to refer to a type by name without having its declaration immediately available.
-
-For example, examine this struct from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
-
-```
-struct Rectangle2 {
- int width;
- int height;
- struct Point center;
-}
-```
-
-We don't know at this moment what a `struct Point is`. Maybe we've already added it. Maybe we'll add it later. Maybe it's in another type library. But we want to add a Rectangle now. So we leave the center field as a reference to the named type `struct Point`.
-
-Load the resulting `test.bntl` in your binary and try to set some data to type `struct Rectangle2` and you'll be met with this message:
-
-```
-TypeLibrary: failed to import type 'Point'; referenced but not present in library 'libtest.so.1`
-```
-
-This makes sense! Now go to types view and `define struct Point { int x; int y; }` and try again, success!
-
-```
-100001000 struct rectangle_unresolved data_100001000 =
-100001000 {
-100001000 int32_t width = 0x5f0100
-100001004 int32_t height = 0x5f030005
-100001008 struct Point center =
-100001008 {
-100001008 int32_t x = 0x655f686d
-10000100c int32_t y = 0x75636578
-100001010 }
-100001008 }
-```
-
-You should repeat the experiment using `struct Rectangle` and see that you're allowed to create variables with type containing _pointers_ to unresolved type references.
-
-_How are types represented?_
-
-By a hierarchy of objects from [api/python/types.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/types.py) referencing one another. The "glue" object is [`binaryninja.types.Type`](https://api.binary.ninja/binaryninja.types.Type.html#binaryninja.types.Type) and depending on the complexity of the type it represents (stored in its `.type_class` attribute), it could have an attribute with more information. For instance, if the `binaryninja.types.Type` has `.type_class == FunctionTypeClass` then its `.parameters` attribute is a list of [`binaryninja.types.FunctionParameter`](https://api.binary.ninja/binaryninja.types.FunctionParameter.html). See [typelib_dump.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_dump.py) for how this can work.
-
-As an example, here is the hierarchical representation of `type struct Rectangle` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py)
-
-```
-typelib.named_types["Rectangle"] =
-----------------------------------
-Type class=Structure
- Structure
- StructureMember "width"
- Type class=Integer width=4
- StructureMember "height"
- Type class=Integer width=4
- StructureMember "center"
- Type class=Pointer
- Type class=NamedTypeReference
- NamedTypeReference <named type: struct Point>
-```
-
-Here is the representation of `type int ()(int, int)` named `MyFunctionType` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
-
-_When do named objects get used?_
-
-When a binary is loaded and its external symbols is processed, the symbol names are searched against the named objects from type libraries. If there is a match, it obeys the type from the type library. Upon success, you'll see a message like:
-
-```
-type library test.bntl found hit for _DoSuperComputation
-```
-
-At this moment, there is no built in functionality to apply named objects to an existing Binary Ninja database.
+Type Libraries have outgrown this section and now live [in their own file](typelibraries.md)
## Signature Library
diff --git a/docs/dev/bnil-hlil.md b/docs/dev/bnil-hlil.md
new file mode 100644
index 00000000..157b6a59
--- /dev/null
+++ b/docs/dev/bnil-hlil.md
@@ -0,0 +1,158 @@
+# Binary Ninja Intermediate Language Series, Part 3: High Level IL
+# Binary Ninja Intermediate Language: High Level IL
+
+The High Level Intermediate Language (HLIL) is Binary Ninja's decompiler output. Much like [LLIL](./bnil-llil.md) and [MLIL](./bnil-mlil.md), this representation is tree based and has many of the same instructions. This representation is distinct in a few key ways.
+
+![BNIL-HLIL Selected](../img/BNIL-hlil.png)
+
+1. High level language concepts are recovered.
+1. Expressions are folded
+
+## Purposes of HLIL
+
+* Simplified representation
+* Small discrete operations
+* Enables source-level forms of queries and analysis
+
+In the rest of this article we will explore the instruction set.
+
+## The Instruction Set
+
+The instruction set is made up of [`HighLevelILInstruction`](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an HLIL instruction:+
+
+```
+>>> current_il_instruction
+<HighLevelILVarInit: uint64_t rax_2 = zx.q(rax_1 - 0x6c)>
+>>> type(current_il_instruction)
+<class 'binaryninja.highlevelil.HighLevelILVarInit'>
+```
+
+`current_il_instruction` is mapped to whatever il instruction is currently selected viewed and is not generally available to those writing plugins or scripts. You can see a full list of our [magic variables here](../guide/index.md#magic-console-variables).
+
+There are a number of properties that can be queried on the [`HighLevelILInstruction`](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction) object, and the validity of these properties changes depending on what the current operation is. The properties in HLIL are extremely similar to those in MLIL, with one notable exception being that `HLIL_CALL` instruction objects do not have a `.output` property, but instead `HLIL_CALL`s that have return values will be the `inst.right` of a `HighLevelILVarInit`, `HighLevelILVarAssign`, or similar.
+
+
+### Control Flow
+
+* `HLIL_JUMP` - Branch to the `dest` expression's address
+* `HLIL_CALL` - Branch to the `dest` expression function, saving the return address, with the list of parameters `params`
+* `HLIL_RET` - Return to the calling function.
+* `HLIL_NORET` - This instruction will never be executed, the instruction before it is a call that doesn't return
+* `HLIL_IF` - Branch to the `true`/`false` HLIL instruction identifier depending on the result of the `condition` expression
+* `HLIL_GOTO` - Branch to the `dest` expression id
+* `HLIL_TAILCALL` - This instruction calls the expression `dest` using `params` as input and `output` for return values
+not exist
+* `HLIL_SYSCALL` - Make a system/service call with parameters `params` and output `output`
+* `HLIL_WHILE` -
+* `HLIL_DO_WHILE` -
+* `HLIL_FOR` -
+* `HLIL_SWITCH` -
+* `HLIL_CASE` -
+* `HLIL_BREAK` -
+* `HLIL_CONTINUE` -
+
+### Variable Reads and Writes
+
+* `HLIL_VAR_DECLARE` - A declaration of `var`
+* `HLIL_VAR_INIT` - Initializes `dest` to the result of an expression `src`
+* `HLIL_ASSIGN` - Sets a variable `dest` to the result of an expression `src`
+* `HLIL_ASSIGN_UNPACK` -
+* `HLIL_VAR` - A variable expression `src`
+* `HLIL_VAR_PHI` - A `PHI` represents the combination of several prior versions of a variable when differnet basic blocks coalesce into a single destination and it's unknown which path was taken.
+* `HLIL_MEM_PHI` - A memory `PHI` represents memory modifications that could have occured down different source basic blocks similar to a `VAR_PHI`.
+* `HLIL_ADDRESS_OF` - The address of variable `src`
+* `HLIL_CONST` - A constant integral value `constant`
+* `HLIL_CONST_DATA` - A constant data reference `constant data reference`
+* `HLIL_CONST_PTR` - A constant integral value which is used as a pointer `constant`
+* `HLIL_EXTERN_PTR` - A symbolic pointer `constant` + `offset` to a symbol that exists outside the binary
+* `HLIL_FLOAT_CONST` - A floating point constant `constant`
+* `HLIL_IMPORT` - A `constant` integral value representing an imported address
+* `HLIL_LOW_PART` - `size` bytes from the low end of `src` expression
+* `HLIL_STRUCT_FIELD` -
+* `HLIL_ARRAY_INDEX` -
+* `HLIL_SPLIT` - A split pair of variables `high`:`low` which can be used a single expression
+* `HLIL_DEREF` - Dereferences `src`
+* `HLIL_DEREF_FIELD` -
+
+### Arithmetic Operations
+
+* `HLIL_ADD` - Adds `left` expression to `right` expression
+* `HLIL_ADC` - Adds with carry the `left` expression to the `right` expression with carry from the `carry` expression
+* `HLIL_SUB` - Subtracts the `right` expression from the `left` expression
+* `HLIL_SBB` - Subtraction with borrow the `right` expression from the `left` expression with carry from the `carry` expression
+* `HLIL_AND` - Bitwise AND `left` expression with the `right` expression
+* `HLIL_OR` - Bitwise OR `left` expression with the `right` expression
+* `HLIL_XOR` - Bitwise XOR `left` expression with the `right` expression
+* `HLIL_LSL` - Logical shift left the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_LSR` - Logical shift right the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_ASR` - Arithmetic shift right the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_ROL` - Rotate left the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_RLC` - Rotate left with carry the `left` expression and the `carry` expression by the number of bits stored in the `right` expression
+* `HLIL_ROR` - Rotate right the `left` expression by the number of bits stored in the `right` expression
+* `HLIL_RRC` - Rotate right with carry the `left` expression and the `carry` expression by the number of bits stored in the `right` expression
+* `HLIL_MUL` - Single-precision multiply the `left` expression with the `right` expression
+* `HLIL_MULU_DP` - Double-precision unsigned multiply the `left` expression with the `right` expression, result expression is twice the size of the input expressions
+* `HLIL_MULS_DP` - Double-precision signed multiply the `left` expression with the `right` expression, result expression is twice the size of the input expressions
+* `HLIL_DIVU` - Unsigned single-precision divide `left` expression by the `right` expression
+* `HLIL_DIVU_DP` - Unsigned double-precision divide `left` expression by the `right` expression
+* `HLIL_DIVS` - Signed single-precision divide `left` expression by the `right` expression
+* `HLIL_DIVS_DP` - Signed double-precision divide `left` expression by the `right` expression
+* `HLIL_MODU` - Unsigned single-precision modulus of `left` expression by the `right` expression
+* `HLIL_MODU_DP` - Unsigned double-precision modulus of `left` expression by the `right` expression
+* `HLIL_MODS` - Signed single-precision modulus of `left` expression by the `right` expression
+* `HLIL_MODS_DP` - Signed double-precision modulus of `left` expression by the `right` expression
+* `HLIL_NEG` - Sign inversion of `src` expression
+* `HLIL_NOT` - Bitwise inversion of `src` expression
+* `HLIL_FADD` - IEEE754 floating point addition of `left` expression with `right` expression
+* `HLIL_FSUB` - IEEE754 floating point subtraction of `left` expression with `right` expression
+* `HLIL_FMUL` - IEEE754 floating point multiplication of `left` expression with `right` expression
+* `HLIL_FDIV` - IEEE754 floating point division of `left` expression with `right` expression
+* `HLIL_FSQRT` - IEEE754 floating point square root of `left` expression with `right` expression
+* `HLIL_FNEG` - IEEE754 floating point sign negation of `src` expression
+* `HLIL_FABS` - IEEE754 floating point absolute value of `src` expression
+* `HLIL_FLOAT_TO_INT` - IEEE754 floating point to integer conversion of `src` expression
+* `HLIL_INT_TO_FLOAT` - Integer to IEEE754 floating point conversion of `src` expression
+* `HLIL_FLOAT_CONV` - Convert bytes in `src` expression to IEEE754 floating point
+* `HLIL_ROUND_TO_INT` - Rounds the IEEE754 floating point number `src` expression
+* `HLIL_FLOOR` - Computes the floating point floor of the IEEE754 number in `src`
+* `HLIL_CEIL` - Computes the floating point floor of the IEEE754 number in `src`
+* `HLIL_FTRUNC` - Computes the floating point truncation of the IEEE754 number in `src`
+* `HLIL_SX` - Sign extends the `src` expression
+* `HLIL_ZX` - Zero extends the `src` expression
+* `HLIL_ADD_OVERFLOW` - Calculates overflow of the addition of `left` expression with `right` expression
+* `HLIL_BOOL_TO_INT` - Converts a bool `src` to an integer
+
+### Comparison Instructions
+
+* `HLIL_CMP_E` - Compare expression evaluates to true if `left` expression is equal to `right`
+* `HLIL_CMP_NE` - Compare expression evaluates to true if `left` expression is not equal to `right`
+* `HLIL_CMP_SLT` - Compare expression evaluates to true if `left` expression is signed less than `right`
+* `HLIL_CMP_ULT` - Compare expression evaluates to true if `left` expression is unsigned less than `right`
+* `HLIL_CMP_SLE` - Compare expression evaluates to true if `left` expression is signed less than or equal to `right`
+* `HLIL_CMP_ULE` - Compare expression evaluates to true if `left` expression is unsigned less than or equal to `right`
+* `HLIL_CMP_SGE` - Compare expression evaluates to true if `left` expression is signed greater than or equal to `right`
+* `HLIL_CMP_UGE` - Compare expression evaluates to true if `left` expression is unsigned greater than or equal to `right`
+* `HLIL_CMP_SGT` - Compare expression evaluates to true if `left` expression is signed greater than `right`
+* `HLIL_CMP_UGT` - Compare expression evaluates to true if `left` expression is unsigned greater than `right`
+* `HLIL_TEST_BIT` - Test if bit `right` in expression `left` is set
+* `HLIL_FCMP_E` - Floating point compare expressions - evaluates to true if `left` expression is equal to `right`
+* `HLIL_FCMP_NE` - Floating point compare expressions - evaluates to true if `left` expression is not equal to `right`
+* `HLIL_FCMP_LT` - Floating point compare expressions - evaluates to true if `left` expression is less than `right`
+* `HLIL_FCMP_LE` - Floating point compare expressions - evaluates to true if `left` expression is less than or equal to `right`
+* `HLIL_FCMP_GE` - Floating point compare expressions - evaluates to true if `left` expression is greater than or equal to `right`
+* `HLIL_FCMP_GT` - Floating point compare expressions - evaluates to true if `left` expression is greater than `right`
+* `HLIL_FCMP_O` - Floating point compare expressions - evaluates to true if both `left` and `right` expressions are ordered (not NaN)
+* `HLIL_FCMP_UO` - Floating point compare expressions - evaluates to true if either `left` or `right` expression is unordered (NaN)
+
+### Miscellaneous Instructions
+
+* `HLIL_NOP` - No operation
+* `HLIL_BP` - Breakpoint instruction
+* `HLIL_TRAP` - Interrupt/trap instruction with `vector` expression
+* `HLIL_INTRINSIC` - Intrinsic instruction defined by the architecture
+* `HLIL_UNDEF` - The expression performs undefined behavior
+* `HLIL_UNIMPL` - The expression is not implemented
+* `HLIL_UNIMPL_MEM` - The expression is not implemented but does access `src` memory
+* `HLIL_BLOCK` -
+* `HLIL_LABEL` -
+* `HLIL_UNREACHABLE` - \ No newline at end of file
diff --git a/docs/dev/bnil-llil.md b/docs/dev/bnil-llil.md
index df520e4e..97ce11bc 100644
--- a/docs/dev/bnil-llil.md
+++ b/docs/dev/bnil-llil.md
@@ -1,6 +1,6 @@
# Binary Ninja Intermediate Language: Low Level IL
-Make sure to checkout the [BNIL overview](bnil-overview.md) first if you haven't already. Or feel free to skip to [part 2](bnil-mlil.md) which covers MLIL. This developer guide is intended to cover some of the mechanics of the LLIL to distinguish it from the other ILs in the BNIL family.
+Make sure to checkout the [BNIL overview](bnil-overview.md) first if you haven't already. Or feel free to skip to [part 2](bnil-mlil.md) which covers MLIL, or [part 3](bnil-hlil.md) which covers HLIL. This developer guide is intended to cover some of the mechanics of the LLIL to distinguish it from the other ILs in the BNIL family.
If you've already read the introduction, let's get right into the details of LLIL!
@@ -12,11 +12,11 @@ The Lifted IL is very similar to the LLIL and is primarily of interest for Archi
Since doing is the easiest way to learn let's start with a simple example binary and step through analyzing it using the python console.
-![Low Level IL Option >](../img/llil_option.png)
+![Low Level IL Option >](../img/llil-option.png)
- Download [chal1](../files/chal1) and open it with Binary Ninja
- - Next, bring up the `Low Level IL` view by clicking in the options pane at the bottom of the screen
- (or alternatively, use the `i` key)
+ - Next, bring up the `Low Level IL` view by clicking in the view drop down at the top of the pane
+ (or alternatively, use the `i` key to cycle view levels)
- Navigate to main (`g`, then "main", or double-click it in the function list)
- Finally, bring up the python console using: `~`
@@ -38,7 +38,7 @@ This will print out all the LLIL instructions in the current function. How does
First we use the global magic variable `current_function` which gives us the python object [`function.Function`](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function) for whatever function is currently selected in the UI. The variable is only usable from the python console, and shouldn't be used for headless plugins. In a script you can either use the function that was passed in if you [registered your plugin](https://api.binary.ninja/binaryninja.plugin-module.html#binaryninja.plugin.PluginCommand.register_for_function) to handle functions, or you can compute the function based on [a specific address](https://api.binary.ninja/binaryninja.binaryview-module.html?highlight=get_functions_at#binaryninja.binaryview.BinaryView.get_functions_at), or maybe even just iterate over all the functions in a BinaryView (`for func in bv.functions:`).
-Next we get the [`lowlevelil.LowLevelILFunction`](http://api.binary.ninja/binaryninja.lowlevelil.LowLevelILFunction.html) from the `Function` class: `current_function.low_level_il`. Iterating over the `LowLevelILFunction` class provides access to the [`lowlevelil.LowLevelILBasicBlock`](http://api.binary.ninja/binaryninja.lowlevelil.LowLevelILBasicBlock.html) classes for this function. Inside the loop we can now iterate over the `LowLevelILBasicBlock` class which provides access to the individual [`lowlevelil.LowLevelILInstruction`](http://api.binary.ninja/binaryninja.lowlevelil.LowLevelILInstruction.html) classes.
+Next we get the [`lowlevelil.LowLevelILFunction`](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILFunction) from the `Function` class: `current_function.low_level_il`. Iterating over the `LowLevelILFunction` class provides access to the [`lowlevelil.LowLevelILBasicBlock`](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILBasicBlock) classes for this function. Inside the loop we can now iterate over the `LowLevelILBasicBlock` class which provides access to the individual [`lowlevelil.LowLevelILInstruction`](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILInstruction) classes.
Finally, we can print out the attributes of the instruction. We first print out `address` which is the address of the corresponding assembly language instruction. Next, we print the `instr_index`, this you can think of as the address of the IL instruction. Since translating assembly language is a many-to-many relationship, we may see multiple IL instructions needed to represent a single assembly language instruction, and thus each IL instruction needs to have its own index separate from its address. Finally, we print out the instruction text.
diff --git a/docs/dev/bnil-mlil.md b/docs/dev/bnil-mlil.md
index ee7c1d91..bdade82c 100644
--- a/docs/dev/bnil-mlil.md
+++ b/docs/dev/bnil-mlil.md
@@ -24,7 +24,7 @@ In the rest of this article we will explore the variable object, the type object
## The Variable Object
-First, it's important to understand what we mean when we talk about a MLIL variable. Continuing from our example above we can get a [`Variable`](https://api.binary.ninja/binaryninja.function.Variable.html) object.
+First, it's important to understand what we mean when we talk about a MLIL variable. Continuing from our example above we can get a [`Variable`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.Variable) object.
```
>>> inst.output
@@ -36,7 +36,7 @@ First, it's important to understand what we mean when we talk about a MLIL varia
Variables in MLIL have a very specific meaning, that is not completely obvious at first. They represent a single storage location within the scope of a single function. To those not well versed in program analysis, a storage location is where a value is located at a given point in time. In the process of compilation a compiler conducts a step called _Register Allocation_; this is the process of figuring out how to map the potentially infinite number of variables specified in the original source code to a finite set of registers. When there are more variables and intermediate values than registers available, the compiler _spills_ them on to the stack. Thus a single high-level-language variable can be mapped across a number of storage locations. A variable can simultaneously be in multiple registers and on the stack at the same time. However, unlike high-level-language variables, MLIL variables represent one and only one storage location. Binary Ninja's High Level IL (HLIL) will be responsible for storing this mapping.
-So let's look at the properties available on a [`Variable`](https://api.binary.ninja/binaryninja.function.Variable.html) object.
+So let's look at the properties available on a [`Variable`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.Variable) object.
### `source_type`
@@ -59,7 +59,7 @@ enum VariableSourceType
### `storage`
-The `storage` property changes meaning depending on the [`VariableSourceType`](https://api.binary.ninja/binaryninja.enums.VariableSourceType.html). When a variable is of type `RegisterVariableSourceType`, its `storage` property represents the index into the register list for the given architecture. If the `source_type` is `StackVariableSourceType`, its `storage` property represents the stack offset of the variable.
+The `storage` property changes meaning depending on the [`VariableSourceType`](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.VariableSourceType). When a variable is of type `RegisterVariableSourceType`, its `storage` property represents the index into the register list for the given architecture. If the `source_type` is `StackVariableSourceType`, its `storage` property represents the stack offset of the variable.
```
>>> var
@@ -95,7 +95,7 @@ Type objects are described in detail in the next section.
## The Type Object
-Type objects are very similar to standard C types. A Type object's type can be determined through the object’s `type_class` property. Valid types are in the [`TypeClass`](https://api.binary.ninja/binaryninja.enums.TypeClass.html) enumeration:
+Type objects are very similar to standard C types. A Type object's type can be determined through the object’s `type_class` property. Valid types are in the [`TypeClass`](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.TypeClass) enumeration:
```
enum TypeClass
@@ -168,7 +168,7 @@ A value type is simply a constant value. It is used mainly in demangling for typ
### FunctionTypeClass
-The function type describes the return type, parameter list, and calling convention of a [function](https://api.binary.ninja/binaryninja.function.Function.html), among many other properties.
+The function type describes the return type, parameter list, and calling convention of a [function](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function), among many other properties.
* `can_return` - boolean value indicating if the function can return
* `calling_convention` - the calling convention this function uses
@@ -193,7 +193,7 @@ Array types function similarly to pointer types however the array type knows how
### EnumerationTypeClass
-`Enumeration` types function much the same way they do in C, providing a mapping between a name and corresponding constant. The object itself contains a `members` property and a list of [`EnumerationMember`](https://api.binary.ninja/binaryninja.types.EnumerationMember.html) objects each containing a name and value.
+`Enumeration` types function much the same way they do in C, providing a mapping between a name and corresponding constant. The object itself contains a `members` property and a list of [`EnumerationMember`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.EnumerationMember) objects each containing a name and value.
### StructureTypeClass
@@ -219,7 +219,7 @@ Most of the above should be self-explanatory except for the `UnknownNamedTypeCla
## The Instruction Set
-The instruction set is made up of [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil.MediumLevelILInstruction.html) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an MLIL instruction:
+The instruction set is made up of [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an MLIL instruction:
```
>>> inst = current_mlil[8]
@@ -230,7 +230,7 @@ The instruction set is made up of [`MediumLevelILInstruction`](https://api.binar
`current_mlil` is mapped to whatever function is currently being viewed and is not generally available to those writing plugins, as your plugin could be headless. The bracket operators tell the API to get the MLIL instruction at index 8 for the current function.
-There are a number of properties that can be queried on the [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil.MediumLevelILInstruction.html) object, and the validity of these properties changes depending on what the current operation is. If we look at the `operation` of `inst` we can see it is a `MLIL_CALL` instruction.
+There are a number of properties that can be queried on the [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction) object, and the validity of these properties changes depending on what the current operation is. If we look at the `operation` of `inst` we can see it is a `MLIL_CALL` instruction.
```
>>> inst.operation
diff --git a/docs/dev/bnil-overview.md b/docs/dev/bnil-overview.md
index 480b9873..b0ffefe2 100644
--- a/docs/dev/bnil-overview.md
+++ b/docs/dev/bnil-overview.md
@@ -12,7 +12,7 @@ Except that overview isn't telling the whole story! The real stack of BNIL _actu
![BNIL-Stack](../img/BNIL.png)
-This short introduction is a very brief guide to BNIL with much more details in [Part 1: LLIL](bnil-llil.md) and [Part 2: MLIL](bnil-mlil.md).
+This short introduction is a very brief guide to BNIL with much more details in [Part 1: LLIL](bnil-llil.md), [Part 2: MLIL](bnil-mlil.md), and [Part 3: HLIL](bnil-hlil.md).
## Summary
@@ -20,10 +20,10 @@ While the image above shows a bit of the logical relationships between each IL i
- Lifted IL is intended to be a straight-forward translation from native instruction semantics to LLIL instructions. Note that Lifted IL and LLIL share the same instructions and are substantively similar with a few small differences.
- Low Level IL (LLIL) is converted from Lifted IL, LLIL removes NOP instructions and folds flags into conditional instructions but otherwise contains the same operations as Lifted IL.
-- Low Level IL SSA Form is an [SSA](conceps.md#static-single-assignment-basics) form of LLIL.
+- Low Level IL SSA Form is an [SSA](concepts.md#static-single-assignment-basics) form of LLIL.
- Mapped Medium Level IL is a translation layer between LLIL that is rarely needed for analysis but is useful for the translation process.
- Medium Level IL (MLIL) translates registers and memory accesses into variables, types are associated with variables, platform information is used to generate call sites with types (both inferred and explicit) and parameters, data flow is calculated and constants are propagated.
-- Medium Level IL SSA Form is an [SSA](conceps.md#static-single-assignment-basics) form of MLIL.
+- Medium Level IL SSA Form is an [SSA](concepts.md#static-single-assignment-basics) form of MLIL.
- High Level IL (HLIL) [builds on](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function.request_debug_report) (use the `high_level_il` report type) MLIL by adding higher level control flow instructions, a number of dead-code and variable passes as well as other simplification/folding. It also includes an [AST](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction.ast).
@@ -117,7 +117,7 @@ Here's what that instruction might look like when selected with the IL Hierarchy
Be warned though! HLIL in particular is very tree-based. LLIL and MLIL are much safer to use the above paradigm of simply iterating through top-level instructions.
-Make sure to also check out the specifics of each IL level for more details: [LLIL](https://docs.binary.ninja/dev/bnil-llil.html), [MLIL](https://docs.binary.ninja/dev/bnil-mlil.html) (HLIL not yet complete)
+Make sure to also check out the specifics of each IL level for more details: [LLIL](bnil-llil.md), [MLIL](bnil-mlil.md), [HLIL](bnil-hlil.md)
## Visitors
diff --git a/docs/dev/concepts.md b/docs/dev/concepts.md
index 5dcf0a3a..daf120b1 100644
--- a/docs/dev/concepts.md
+++ b/docs/dev/concepts.md
@@ -1,12 +1,5 @@
# Important Concepts
-## Mapping between ILs
-
-ILs in general are critical to how Binary Ninja analyzes binaries and we have much more [in-depth](bnil-overview.md) documentation for BNIL (or Binary Ninja Intermediate Language -- the name given to the family of ILs that Binary Ninja uses). However, one important concept to summarize here is that the translation between each layer of IL is many-to-many. Going from disassembly to LLIL to MLIL can result in more or less instructions at each step. Additionally, at higher levels, data can be copied, moved around, etc. You can see this in action in the UI when you select a line of HLIL and many LLIL or disassembly instructions are highlighted.
-
-APIs that query these mappings are plural. So for example, while `current_hlil.llil` will give a single mapping, `current_hlil.llils` will return a list that may contain multiple mappings.
-
-![Mapping between ILs ><](../img/ilmapping.png "Mapping between ILs")
## REPL versus Scripts
@@ -24,15 +17,29 @@ Another difference in the REPL / scripting console is that the scripting console
![Scriping Console ><](../img/console.png "Python Scripting Console")
-## Operating on IL versus Native
+## Auto vs User
+
+In the Binary Ninja API, there are often two parallel sets of functions with `_auto_` and `_user_` in their names. For example: [add_user_segment](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.add_user_segment) and [add_auto_segment](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.add_auto_segment). So what's the difference? Auto functions are those that are expected to be run _automatically_, every time the file is loaded. So for example, if you're writing a [custom file loader](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/nsf.py) that will parse a particular binary format, you would use `_auto_` functions because each time the file is opened your loader will be used. The results of auto functions are **not** saved in a `.bndb` database because it's expected that whatever produced them originally will again when the file is re-opened or analyzed. This means that even if you're writing a plugin to make changes on a file during analysis, you likely want to use the `_user_` set of APIs so that the changes your plugin causes will separately be saved to the database as if they were done by a user.
+
+## Concepts for ILs
+
+### Mapping between ILs
+
+ILs in general are critical to how Binary Ninja analyzes binaries and we have much more [in-depth](bnil-overview.md) documentation for BNIL (or Binary Ninja Intermediate Language -- the name given to the family of ILs that Binary Ninja uses). However, one important concept to summarize here is that the translation between each layer of IL is many-to-many. Going from disassembly to LLIL to MLIL can result in more or less instructions at each step. Additionally, at higher levels, data can be copied, moved around, etc. You can see this in action in the UI when you select a line of HLIL and many LLIL or disassembly instructions are highlighted.
+
+APIs that query these mappings are plural. So for example, while `current_hlil.llil` will give a single mapping, `current_hlil.llils` will return a list that may contain multiple mappings.
+
+![Mapping between ILs ><](../img/ilmapping.png "Mapping between ILs")
+
+### Operating on IL versus Native
Generally speaking, scripts should operate on ILs. The available information far surpasses the native addresses and querying properties and using APIs almost always beats directly manipulating bytes. However, when it comes time to change the binary, there are some operations that can only be done at a simple virtual address. So for example, the [comment](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.set_comment_at) or [tag](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.add_tag) APIs (among others) work off of native addressing irrespective of IL level.
-## Instruction Index vs Expression Index
+### Instruction Index vs Expression Index
It is easy to confuse ExpressionIndex and InstructionIndex properties in the API. While they [are both integers](https://github.com/Vector35/binaryninja-api/blob/dev/python/highlevelil.py#L49-L50) they mean different things and it's important to keep them straight. The Instruction Index is a unique index for that given IL level for that given function. However, because BNIL is [tree-based](bnil-overview.md), when there are nested expresses the expression index may be needed. These indexes are also unique per-function and per-IL level, but they are _distinct_ from instruction indexes even though they may occasionally be similar since they each start at 0 for a given function!
-## Static Single Assignment Basics
+### Static Single Assignment Basics
Our [BNIL Overview](bnil-overview.md) mentions Static Single Assignment (SSA) without explaining what it is. You can of course always check out [Wikipedia](https://en.wikipedia.org/wiki/Static_single-assignment_form), but here's a quick summary of what it is, why we expose multiple SSA forms of our ILs and how you can use it to improve your plugin writing with BNIL.
@@ -86,4 +93,39 @@ One reason that having an "end" might be useful in a function (as opposed to the
So how do you tell Binary Ninja how big a function is? The answer is you don't directly, but you can instead direct its analysis. For example, if a function is improperly not marked as a noreturn function, edit the function properties via the right-click menu and set the property and all calls to it will end analysis at that point in any callees.
-Likewise, you can do things like change memory permissions, patch in invalid instructions, [change an indirect branch's targets](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/jump_table.py), or use [UIDF](https://binary.ninja/2020/09/10/user-informed-dataflow.html) to influence analysis such that it ends where desired. \ No newline at end of file
+Likewise, you can do things like change memory permissions, patch in invalid instructions, [change an indirect branch's targets](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/jump_table.py), or use [UIDF](https://binary.ninja/2020/09/10/user-informed-dataflow.html) to influence analysis such that it ends where desired.
+
+## Working with Strings
+
+### Unicode Support
+
+If you're opening a file with non-ascii string encodings, make sure to use one of the "open with options" [methods](../guide/index.md#loading-files) and choose the appropriate code pages. These settings are under the `analysis` / `unicode` section of the settings dialog. If you're not sure which code page you should be enabling, consider using a library like [chardet](https://chardet.readthedocs.io/en/latest/usage.html). For example, here's a file both with and without the "CJK Unified Ideographs" block being enabled:
+
+![Sample Binary Without CJK Unified Ideographs](../img/hanyu-no-codepage.png "Sample Binary Without CJK Unified Ideographs")
+
+![Sample Binary With CJK Unified Ideographs](../img/hanyu-with-codepage.png "Sample Binary With CJK Unified Ideographs")
+
+???+ Warning "Tip"
+ Note that there is a small bug and some string length calculations will be off with certain characters as shown above.
+
+### Wide Strings in the UI
+
+Many Windows applications use wide (UTF-16 or UTF-32) strings. By default these should be identified during initial string analysis as long as the default settings are still enabled.
+
+![Unicode settings](../img/unicode-settings.png "Unicode Settings")
+
+However, you can always change a variable to a `wchar_t` with `[SHIFT] a` and to a `wchar32_t` with `[CTRL-SHIFT] a` in the UI.
+
+### "Strings" versus Strings
+
+The strings view in Binary Ninja are based on all identified strings found in a manner similar to the command-line "strings" tool (with `-a` if you're using a GPL Binutils version). However, this is not the same as a string having a string type in Binary Ninja!
+
+Several settings under analysis limits are relevant to identifying these strings:
+
+ - Maximum String Length: The maximum string length that will be copied (defaults to 16384)
+ - Minimum String Length: The minimum string length for strings created during auto-analysis (defaults to 4)
+ - Maximum String Search: Maximum number of strings before string identification halts (defaults to 1048576)
+
+### Custom String Formats
+
+There is currently no support for custom types with different encoding mechanisms. Follow [#1334](https://github.com/Vector35/binaryninja-api/issues/1334) for more updates on when that feature is added. That said, it is possible to use a custom [DataRenderer](https://api.binary.ninja/binaryninja.datarender-module.html#binaryninja.datarender.DataRenderer) to improve the rendering using a custom type, but those strings will still not show up in the strings list or when included as variables in decompilation, only in linear view. \ No newline at end of file
diff --git a/docs/dev/cookbook.md b/docs/dev/cookbook.md
index 61cd6386..abd1a089 100644
--- a/docs/dev/cookbook.md
+++ b/docs/dev/cookbook.md
@@ -7,31 +7,110 @@ One of the best ways to learn a complicated API is to simply find the right exam
- [Gist Collection](https://gist.github.com/psifertex/6fbc7532f536775194edd26290892ef7): Jordan's collection of python examples usually created for (or contributed by) customers
- [Offline examples](https://github.com/Vector35/binaryninja-api/tree/dev/python/examples): These examples are especially useful because they're included in your offline install as well, just look in the examples/python subfolder wherever Binary Ninja installed
- That said, most of those examples tend to be more complex and so the following recipes are meant to be simple but useful building-blocks with which to learn useful techniques:
+ That said, most of those examples tend to be more complex and so the following recipes are meant to be simple but useful building-blocks with which to learn useful techniques. Many of them also make use of the built-in Python console's [magic variables](../guide/index.md#magic-console-variables):
## Recipes
-### Accessing cross references
+#### Getting all functions in a binary
-This recipe is useful for iterating over all of the HLIL cross-references of a given interesting function:
+```python
+for func in bv.functions:
+ print(func.name)
+ print(func.start)
+ print(func.parameter_vars)
+ print(func.function_type)
+```
+
+#### Getting a specific function
```python
-for ref in current_function.caller_sites:
- print(ref.hlil)
+func = bv.get_functions_by_name(here)[0] # Multiple functions can share the same name!
+func = bv.get_function_at(here) # Shortcut for the next one
+func = bv.get_functions_at(here)[0] # Binary Ninja support functions that overlap!
+func = bv.get_function_containing(here) # Functions that contain the given address
+# Just a note that using address to work with functions is fine
+# But when working with ILs, addresses are approximate and can change for any given instruction
```
-But what if you don't have that function yet?
+#### All forms of a function:
+
+```python
+for func in bv.functions:
+ low_level_il = func.llil
+ low_level_il_ssa = func.llil.ssa_form
-### Getting a function by name
+ medium_level_il = func.mlil
+ medium_level_il_ssa = func.mlil.ssa_form
+
+ # Decompilation:
+ high_level_il = func.hlil
+ high_level_il_ssa = func.hlil.ssa_form
+
+ base_function = <any>_level_il.source_function # Some helpers are only on the base function object!
+```
+
+#### All decompiled instructions in a binary
```python
-bv.get_functions_by_name('_start')
+for func in bv.functions:
+ for inst in func.hlil.instructions:
+ print(f"{inst.address} : {inst}")
```
-### Finding the function with the most bytes
+or
```python
-max(bv.functions, key=lambda x: x.total_bytes)
+for func in bv.functions:
+ for bb in func.hlil:
+ for inst in bb:
+ print(f"{inst.address} : {inst}")
+```
+
+or
+
+```python
+for inst in bv.hlil_instructions:
+ print(f"{inst.address} : {inst}")
+```
+
+#### Getting the decompiled instruction at an address
+
+```python
+func = bv.get_functions_containing(here)[0] # You should probably be more robust than this
+llil_inst = func.get_llil_at(here) # LLIL have the "closest" mapping to actual addresses, but you should still consider this volatile/fuzzy
+hlil_inst = llil_inst.hlil # This is also very approximate
+
+# What's "more correct" walking down instead:
+hlil_inst.mlil # Approximate "direct" mapping down
+hlil_inst.mlils # All mlil instructions that contributed to this hlil instruction - most correct!
+hlil_inst.llil # Approximate "direct" mapping down
+hlil_inst.llils # All llil instructions that contributed to this hlil instruction - most correct!
+# Be careful when working with address and mappings! We try to make them work as well as possible
+# (and in most cases using the direct mapping is _fine_)
+# But you should always be aware that they are approximate and can change!
+```
+
+
+#### All callers of a function
+
+```python
+current_function.callers
+```
+
+#### All locations where a function is called
+
+```python
+for site in current_function.caller_sites:
+ addr = site.address
+ inst = site.hlil
+```
+
+#### All calls and call instructions in a function:
+
+```python
+for site in current_function.call_sites:
+ addr = site.address
+ inst = site.hlil
```
### Finding the most "connected" function
@@ -42,6 +121,12 @@ As defined by having the highest sum of incoming and outgoing calls. Adjust acco
max(bv.functions, key=lambda x: len(x.callers + x.callees))
```
+### Finding the largest function (by most bytes)
+
+```python
+max(bv.functions, key=lambda x: x.total_bytes)
+```
+
### Querying possible values of a function parameter
Is that memcpy length a bit too big?
@@ -67,6 +152,64 @@ Make sure to check out the much more in-depth [applying annotations](annotation.
current_function.type = Type.function(Type.void(), [])
```
+### Accessing cross references
+
+This recipe is useful for iterating over all of the HLIL cross-references of a given interesting function:
+
+```python
+for ref in current_function.caller_sites:
+ print(ref.hlil)
+```
+
+#### Common variable APIs
+
+```python
+for func in bv.functions:
+ all_vars = func.vars # This isn't the most meaningful thing to do, because....
+ hlil_vars = func.hlil.vars # ...you probably only want the variables used in the IL you're looking at
+ hlil_aliased_vars = func.hlil.aliased_vars # ...but don't forget about aliased variables!
+ parameter_vars = func.parameter_vars # ...or parameter variables!
+
+ var = hlil_vars[0]
+ if var.source_type == StackVariableSourceType:
+ print(var.storage) # var.storage is the variables stack offset, but ONLY IF the source type is `StackVariableSourceType`
+
+ # There are many ways to *estimate* the size of a variable on the stack
+ print(var.offset_to_next_variable) # Distance to the next variable that Binary Ninja has identified on the stack
+ print(abs(var.storage)) # Absolute maximum size the variable can be until it overwrites the saved return pointer!
+ print(abs(var.type.width)) # If Binary Ninja gave the variable a type, or you manually applied a type, then you can get the size from that type
+
+ # SSA
+ hlil_ssa_vars = func.hlil.ssa_vars # You can also get ssa variables
+ def_inst = func.hlil.ssa_form.get_ssa_variable_definition(ssa_vars[0]) # But if you want definitions, you need to use the ssa form
+ use_insts = func.hlil.ssa_form.get_ssa_variable_uses(ssa_vars[0]) # There's only ever one ssa definition, but potentially many uses
+```
+
+#### Working with Tags
+
+```python
+# Data tags
+bv.add_tag(here, "Crashes", "Description")
+
+# Function tags
+current_function.add_tag("Important", "Look at this later!")
+
+# Function address tags
+current_function.add_tag("Bug", "I think there's an overflow here?", here)
+```
+
+#### Logging
+
+```python
+log.log_debug("Debug logs are hidden by default")
+log.log_info("Info logs are displayed in the console")
+log.log_warn("Warning logs will print in yellow text")
+log.log_error("Errors are red!")
+log.log_alert("This pops up a dialogue box!")
+
+log.log_error("You can add your own filter group easily to any of these APIs", "My Log Group")
+```
+
### Find a variable's definition and all uses using SSA
```python
diff --git a/docs/dev/flags.md b/docs/dev/flags.md
index 2aabd244..e87c6a2d 100644
--- a/docs/dev/flags.md
+++ b/docs/dev/flags.md
@@ -182,9 +182,9 @@ This also means that you can mark instructions as producers of a group of many f
You, the architecture author:
* inform Binja of your architecture's flags by defining:
- * flag names
- * flag "roles" which are just their textbook behavior, if they qualify
- * flag "write types" which groups of flags often set together
+ * flag names
+ * flag "roles" which are just their textbook behavior, if they qualify
+ * flag "write types" which groups of flags often set together
* assign instructions as flag **producers** by passing `flag=` keyword parameter during lifting
* assign instructions as flag **consumers** by passing IL flag expressions as operands during lifting
diff --git a/docs/dev/index.md b/docs/dev/index.md
index d9abcde6..7407d7bb 100644
--- a/docs/dev/index.md
+++ b/docs/dev/index.md
@@ -1,6 +1,6 @@
# Using the Binary Ninja API
-Welcome to the Binary Ninja API documentation. Much like the [User Manual](../guide/index.md), some larger sections have been split off into their own sections on the left, while the table of contents for this documentation is on the right.
+Welcome to the Binary Ninja API documentation. Much like the [User Guide](../guide/index.md), some larger sections have been split off into their own sections on the left, while the table of contents for this documentation is on the right.
## Language Specific Bindings
@@ -34,5 +34,5 @@ The C++ API is what the Binary Ninja UI itself is built using so it's a robust a
The Rust API is still experimental and lacks complete coverage for all core APIs. Documentation is available at:
- - [Rust API](https://github.com/Vector35/binaryninja-api/tree/dev/rust)
+ - [Rust API](https://dev-rust.binary.ninja/)
diff --git a/docs/dev/plugins.md b/docs/dev/plugins.md
index 79a39982..f489f94b 100644
--- a/docs/dev/plugins.md
+++ b/docs/dev/plugins.md
@@ -206,7 +206,7 @@ class, and you should only ever handle Refs or bare pointers. When in doubt, fee
Managing build infrastructure to build cross-platform native plugins can be a headache even for stables, let alone
trying to track all dev releases. To help with that, we've published an [example plugin](https://github.com/CouleeApps/binja-ci-tests) that includes GitHub
-actions to build on MacOS, Linux, and Windows. Combining this with something like a [plugin loader](https://github.com/rikodot/binja_native_plugin_loader) can simplify
+actions to build on MacOS, Linux, and Windows. Combining this with something like a [plugin loader](https://github.com/rikodot/binja_native_sigscan_loader) can simplify
both publishing and using native plugins.
### UI Plugins
diff --git a/docs/dev/themes.md b/docs/dev/themes.md
index 1c2931ed..0f2b7caf 100644
--- a/docs/dev/themes.md
+++ b/docs/dev/themes.md
@@ -1,4 +1,4 @@
-User themes are loaded from JSON files (with the `.bntheme` extension) found in the `themes` or `community-themes` subdirectories of your [user folder](../guide/index.md#user-folder). The default, full path to these folders is the following on each supported platform:
+User themes are loaded from JSON files (with the `.bntheme` extension) found in the `themes` or `community-themes` (consider cloning the [community themes repo](https://github.com/Vector35/community-themes)) subdirectories of your [user folder](../guide/index.md#user-folder). The default, full path to these folders is the following on each supported platform:
- macOS: `~/Library/Application Support/Binary Ninja/{themes,community-themes}`
- Windows: `%APPDATA%\Binary Ninja\{themes,community-themes}`
@@ -110,37 +110,33 @@ Colors marked "*required*" must be specified. Unmarked colors will hold default
#### Tokens
-![Tokens Diagram](../img/themedocs-tokens.png)
+![Tokens Theme Diagram](../img/themes-tokens.png)
-1. `addressColor` (*required*) - Used to color memory addresses, e.g. `0x100003c5b`
-2. `modifiedColor` (*required*)
-3. `insertedColor` (*required*)
-4. `notPresentColor` (*required*)
-5. `selectionColor` (*required*)
-6. `outlineColor` (*required*)
-7. `registerColor` (*required*) - Used to color register names in code views, e.g. `rax`
-8. `numberColor` (*required*) - Used to color number literals in code view, e.g. `0xf0`
-9. `codeSymbolColor` (*required*) - Used to color local function names in code views, e.g. `sub_100003c50`
-10. `dataSymbolColor` (*required*) - Used to color data symbols in code views, e.g. `data_100003e2c`
-11. `stackVariableColor` (*required*) - Used to color stack variables in code views, e.g `var_8`
-12. `importColor` (*required*) - Used to color imported function names in code views, e.g. `printf`
-13. `instructionHighlightColor` (*required*)
-14. `relatedInstructionHighlightColor`
-15. `tokenHighlightColor` (*required*)
-16. `annotationColor` (*required*) - Used to color annotations, such as hints
-17. `commentColor` - Used to color comments
-18. `opcodeColor` (*required*) - Used to color instruction opcodes in code views
-19. `stringColor` (*required*) - Used to color string literals in code views, e.g. `"Hello, world!"`
-20. `typeNameColor` (*required*) - Used to color user-defined type names in code views, e.g. `my_struct`
-21. `fieldNameColor` (*required*) - Used to color structure member names in code views
-22. `keywordColor` (*required*) - Used to color keywords in code views, e.g. `for` in HLIL
-23. `uncertainColor` (*required*) - Used to color uncertain data in code views, such as variable types with low confidence
-24. `exportColor`
-25. `nameSpaceColor`
-26. `nameSpaceSeparatorColor`
-27. `operationColor`
-28. `gotoLabelColor`
-29. `tokenSelectionColor`
+1. `addressColor` (*required*) - Used to color memory address tokens (e.g. `0x100003c5b`)
+2. `registerColor` (*required*) - Used to color register names (e.g. `rax`)
+3. `numberColor` (*required*) - Used to color number literals (e.g. `0xf0`)
+4. `codeSymbolColor` (*required*) - Used to color local function names (e.g. `sub_100003c50`)
+5. `dataSymbolColor` (*required*) - Used to color data symbols (e.g. `data_100003e2c`)
+6. `stackVariableColor` (*required*) - Used to color stack variables (e.g `var_8`)
+7. `importColor` (*required*) - Used to color imported function names (e.g. `printf`)
+8. `annotationColor` (*required*) - Used to color annotations (e.g. hints), not shown in picture above
+9. `commentColor` - Used to color code comments
+10. `opcodeColor` (*required*) - Used to color instruction opcodes (e.g. `ebfe`)
+11. `stringColor` (*required*) - Used to color string literals (e.g. `"Hello, world!"`)
+12. `typeNameColor` (*required*) - Used to color user-defined type names (e.g. `my_struct`)
+13. `fieldNameColor` (*required*) - Used to color structure member names
+14. `keywordColor` (*required*) - Used to color keywords (e.g. `for` in HLIL)
+15. `uncertainColor` (*required*) - Used to color uncertain data (e.g. variable types with low confidence)
+16. `exportColor` - Used to color exported symbols, not shown in picture above
+17. `nameSpaceColor` - Used to color a namespace, not shown in picture above
+18. `nameSpaceSeparatorColor` - Used to color the separator between a namespace and the rest of the symbol, not shown in picture above
+19. `operationColor` - *Currently unused*
+20. `gotoLabelColor` - Used to color a `goto`'s label, not shown in picture above
+21. `tokenSelectionColor` - Used to draw the background of tokens selected with click-and-drag
+22. `outlineColor` (*required*) - Used to draw a box around tokens selected with click-and-drag
+23. `tokenHighlightColor` (*required*) - Used to color the background of a token that has been selected with a single click or an arrow key
+24. `instructionHighlightColor` (*required*) - Used to color the background of an instruction that has been selected with a single click or an arrow key
+25. `relatedInstructionHighlightColor` - Used to color the background of instructions related to an instruction that has been selected with a single click or an arrow key
The following colors are used for the Rainbow Braces setting (`ui.rainbowBraces`):
@@ -153,20 +149,24 @@ The following colors are used for the Rainbow Braces setting (`ui.rainbowBraces`
#### Hex View
-![Hex View Diagram](../img/themedocs-hexview.png)
+![Hex View Theme Diagram](../img/themes-hex.png)
Each byte in hex view is given a background color based on its value. Values between `0x00` and `0xFF` will use a color interpolated between the `Dark` and `Light` colors specified below.
-1. `backgroundHighlightDarkColor` - Used as the background color for bytes of value `0x00`
-2. `backgroundHighlightLightColor` - Used as the background color for bytes of value `0xFF`
-3. `boldBackgroundHighlightDarkColor` (*required*)
-4. `boldBackgroundHighlightLightColor` (*required*)
-5. `alphanumericHighlightColor` (*required*) - Used to color alphanumeric characters in hex views, takes precedence over printableHighlightColor
-6. `printableHighlightColor` (*required*) - Used to color printable characters in hex views
+1. `alphanumericHighlightColor` (*required*) - Used to color bytes that are alphanumeric characters if Color Highlight/ASCII and Printable is enabled in view options (default)
+2. `printableHighlightColor` (*required*) - Used to color bytes that are non-alphanumeric printable characters if Color Highlight/ASCII and Printable is enabled in view options (default)
+3. `modifiedColor` (*required*) - Used to color bytes that have been modified if Color Highlight/Modification is enabled in view options
+4. `insertedColor` (*required*) - Used to color bytes that have been inserted if Color Highlight/Modification is enabled in view options
+5. `notPresentColor` (*required*) - Used to color bytes that do not have a value
+5. `backgroundHighlightDarkColor` (*required*) - Used as the background color for bytes of value `0x00` if Contrast/Normal is enabled in view options (default)
+6. `backgroundHighlightLightColor` (*required*) - Used as the background color for bytes of value `0xFF` if Contrast/Normal is enabled in view options (default)
+7. `boldBackgroundHighlightDarkColor` (*required*) - Used as the background color for bytes of value `0x00` if Contrast/High is enabled in view options
+8. `boldBackgroundHighlightLightColor` (*required*) - Used as the background color for bytes of value `0xFF` if Contrast/High is enabled in view options
+9. `selectionColor` (*required*) - Used as the background color on any bytes that have been selected via click-and-drag
#### Linear View
-![Linear View Diagram](../img/themedocs-linearview.png)
+![Linear View Theme Diagram](../img/themes-linear.png)
1. `linearDisassemblyFunctionHeaderColor` (*required*) - Used as the background for function
headers in linear view
@@ -179,7 +179,7 @@ Each byte in hex view is given a background color based on its value. Values bet
#### Graph View
-![Graph View Diagram](../img/themedocs-graphview.png)
+![Graph View Theme Diagram](../img/themes-graph.png)
Both the graph background and individual graph nodes are actually painted as a gradient. To get a flat background instead, set the `Dark` and `Light` colors to the same color value.
@@ -201,7 +201,7 @@ Both the graph background and individual graph nodes are actually painted as a g
#### Highlighting
-![Highlighting Diagram](../img/themedocs-highlighting.png)
+![Highlighting Theme Diagram](../img/themes-highlighting.png)
1. `blackStandardHighlightColor` (*required*)
2. `blueStandardHighlightColor` (*required*)
@@ -215,24 +215,24 @@ Both the graph background and individual graph nodes are actually painted as a g
#### Tab Bar
-1. `tabBarTabActiveColor`
-2. `tabBarTabHoverColor`
-3. `tabBarTabInactiveColor`
-4. `tabBarTabBorderColor`
-5. `tabBarTabGlowColor`
+1. `tabBarTabActiveColor` - Used to color the background of the currently active tab
+2. `tabBarTabHoverColor` - Used to color the background of any tab the mouse is currently hovering over
+3. `tabBarTabInactiveColor` - Used to color the background of any inactive tab
+4. `tabBarTabBorderColor` - Used to draw the border around the currently active tab
+5. `tabBarTabGlowColor` - Used to draw a glow or shadow around the border of the currently active tab
#### Feature Map
-1. `featureMapBaseColor`
-2. `featureMapNavLineColor`
-3. `featureMapNavHighlightColor`
-4. `featureMapDataVariableColor`
-5. `featureMapAsciiStringColor`
-6. `featureMapUnicodeStringColor`
-7. `featureMapFunctionColor`
-8. `featureMapImportColor`
-9. `featureMapExternColor`
-10. `featureMapLibraryColor`
+1. `featureMapBaseColor` - Used to color the background
+2. `featureMapNavLineColor` - Used to color the line(s) that represent where you are in the binary
+3. `featureMapNavHighlightColor` - Used as a highlight outside of the navigation line(s)
+4. `featureMapDataVariableColor` - Used to highlight any area containing data variables
+5. `featureMapAsciiStringColor` - Used to highlight any area containing ASCII strings
+6. `featureMapUnicodeStringColor` - Used to highlight any area containing Unicode strings
+7. `featureMapFunctionColor` - Used to highlight any area containing functions
+8. `featureMapImportColor` - Used to highlight any area containing imported functions that are not from a library (see below)
+9. `featureMapExternColor` - Used to highlight any area containing symbols that are externs
+10. `featureMapLibraryColor` - Used to highlight any area containing symbolic functions or functions that are imported from a library
#### Side Bar
@@ -245,11 +245,13 @@ Both the graph background and individual graph nodes are actually painted as a g
#### Mini-Graph
-1. `miniGraphOverlayColor`
+![Mini-Graph Theme Diagram](../img/themes-minigraph.png)
+
+1. `miniGraphOverlayColor` - Used to color the area of the mini graph that is currently being displayed in graph view
#### Script Console
-![Hex View Diagram](../img/themedocs-console.png)
+![Console Theme Diagram](../img/themes-console.png)
1. `scriptConsoleOutputColor` - Used to color normal output in the console
2. `scriptConsoleWarningColor` - Used to color warnings in the console
@@ -258,12 +260,20 @@ Both the graph background and individual graph nodes are actually painted as a g
#### Panes
-1. `activePaneBackgroundColor`
-2. `inactivePaneBackgroundColor`
+![Panes Theme Diagram](../img/themes-panes.png)
+
+The image above shows an active pane on the left and an inactive pane on the right.
+
+1. `activePaneBackgroundColor` - Used to color the background of a pane that is active
+2. `inactivePaneBackgroundColor` - Used to color the background of a pane that is inactive
#### Status Bar
-1. `statusBarServerConnectedColor`
-2. `statusBarServerDisconnectedColor`
-3. `statusBarServerWarningColor`
-4. `statusBarProjectColor`
+![Status Bar Theme Diagram](../img/themes-statusbar.png)
+
+The image above shows the Enterprise button in the "connected" state (connected to a server named "dev") with an open project (named "Alex's Stuff").
+
+1. `statusBarServerConnectedColor` - Used for the Enterprise button while connected to a server
+2. `statusBarServerDisconnectedColor` - Used for the Enterprise button while disconnected from a server
+3. `statusBarServerWarningColor` - Used for the Enterprise button when there is an issue with the server connection
+4. `statusBarProjectColor` - Used for the Project button
diff --git a/docs/dev/typelibraries.md b/docs/dev/typelibraries.md
new file mode 100644
index 00000000..dccb9102
--- /dev/null
+++ b/docs/dev/typelibraries.md
@@ -0,0 +1,288 @@
+## Type Libraries
+
+Type Libraries are collections of type information (structs, enums, function types, etc.) stored in a file with the extension `.bntl`.
+
+Relative to the binaryninja executable, the default type library location is `../Resources/typelib` on macOS and `./typelib` on Linux and Windows. Individual .bntl files are organized in subdirectories named for the supported architecture. Users may include their own type libraries in the `typelib` folder in their [user folder](../guide/index.md#user-folder).
+
+The information in a type library is contained in two key-value stores:
+
+1. named types: key is the type name, value is the type
+1. named objects: key is external symbol name, value is the type
+
+## How Binary Ninja Loads Type Libraries
+
+When a binary is opened, its platform is determined, all .bntl's are processed, and those matching the platform of the loaded binary are registered. A debug log will show:
+
+```
+Registered library 'libc.so.6' with platform 'linux-x86_64'
+```
+
+Then, those with either a filename or an alternative name matching the exact text of the binary's import command are imported, much like the native linker/loader. For example, in ELF, the .dynstr entry is used.
+
+```
+elf: searching for 'libc.so.6' in type libraries
+Type library 'libc.so.6' imported
+```
+
+Type libraries for linux are ideally named after their realname, preserving the library minor version from which they were generated, and the soname in the alternatives list. In practice, naming them after their soname suffices. Using the linkname with no alternatives will prevent your library from loading.
+
+This requested name should be a soname, like "libfoo.so.1" but could be a linkname like "libfoo.so". (The ldconfig tool is responsible for creating symlinks from soname to realnames, like `/usr/lib/libfoo.so.1` -> `/usr/lib/libfoo.so.1.0`. See [tldp.org](https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html) for more information.).
+
+Binary Ninja's logic for determining a match is straightforward:
+
+```
+typelibname.removesuffix('.bntl') == requestedname or requestedname in alternativenames
+```
+
+Therefore, without any alternative names, `libc.so.bntl` will not be loaded by Binary Ninja if an ELF requests libc.so.6.
+
+We recommend and use the following convention:
+
+Type libraries should be named for the filename from which they were generated with the phrase ".bntl" added. When the source library contains additional minor and release number, like `libfoo.so.1.2.3` Binary Ninja would not load the resulting type library `libfoo.so.1.2.3.bntl` for an ELF requesting soname `libfoo.so.1`. Therefore the alternative names list should include the most specific version numbers, incrementally stripped down to the soname, and finally a linkname for good measure.
+
+Example:
+
+`libfoo.so.1.2.3` is used to generated `libfoo.so.1.2.3.bntl`
+
+The alternative names list should have:
+
+```
+libfoo.so.1.2.3 <-- includes version, minor, release (most specific)
+libfoo.so.1.2 <-- includes version, minor (less specific)
+libfoo.so.1 <-- includes version (soname)
+libfoo.so <-- linkname
+```
+
+## Acquiring a Handle
+
+The platform class exposes handles to these imported type libraries with its `type_libraries` list and its `get_type_libraries_by_name()` function:
+
+```python
+>>> bv.platform.type_libraries
+[<typelib 'libm.so.6':x86_64':x86_64>, <typelib 'SYSCALLS':x86_64]
+>>> bv.platform.get_type_libraries_by_name('libm.so.6')
+[<typelib 'libm.so.6':x86_64>]
+```
+
+That requires the type library having been loaded. A more direct way is to load from a file path with the `load_from_file()` from `Typelibrary` class from `typelibrary` module:
+
+```python
+>>> typelibrary.TypeLibrary.load_from_file('/path/to/libm_x86_64.so.6.bntl')
+<typelib 'libm_x86_64.so.6':x86_64>
+```
+
+## Contents of Libraries
+
+The following demonstrates attributes of interest on a loaded type library in variable `tl`:
+
+```python
+ print(' name: %s' % tl.name)
+ print(' arch: %s' % tl.arch)
+ print(' guid: %s' % tl.guid)
+ print('dependency_name: %s' % tl.dependency_name)
+ print('alternate_names: %s' % tl.alternate_names)
+ print(' platform_names: %s' % tl.platform_names)
+
+ print(' named_objects: %d' % len(tl.named_objects))
+ for (key, val) in tl.named_objects.items():
+ print('\t"%s" %s' % (str(key), str(val)))
+
+ print(' named_types: %d' % len(tl.named_types))
+ for (key,val) in tl.named_types.items():
+ print('\t"%s" %s' % (str(key), str(val)))
+```
+
+Named objects (via dictionary `.named_objects` are functions signatures and a module's exported variables. Named types (via dictionary `.named_types`) are the textual named you might use to declare a variable. For example,
+
+For example, `.named_objects['fegetexceptionflag']` looks up its function prototype: `int32_t (fexcept_t* flagp)` and `.named_types['fexcept_t']` looks up `uint16_t`, its typedef.
+
+## Creating
+
+You may also wish to use the [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py) example script included both online and offline in your installation path.
+
+Types entered by manual entry can be exported from the binary view using `export_type_to_library()`.
+
+Manual creation is achieved by creating a new type library, associating the correct platform and architecture, adding types, finalizing, and writing to a file. Example:
+
+```python
+arch = binaryninja.Architecture['x86_64']
+
+struct = Structure()
+struct.append(Type.pointer(arch, Type.char()), 'name')
+struct.append(Type.int(4), 'age')
+struct.append(Type.int(4), 'height')
+struct.append(Type.int(4), 'weight')
+
+typelib = binaryninja.typelibrary.TypeLibrary.new(arch, 'test.so.1.4')
+typelib.add_named_type('human', binaryninja.types.Type.structure_type(struct))
+typelib.add_alternate_name('test.so.1') #don't forget this step!
+typelib.add_alternate_name('test.so')
+typelib.finalize()
+typelib.write_to_file('test.so.1.bntl')
+```
+
+## Other Type Library Questions
+
+_What's a named type vs. just a type?_
+
+Some variable definitions have type information, but don't produce a type name useful for future definitions, examples:
+
+- `enum {A=1,B=2} foo;` : foo has type with no type name (it does have a variable name)
+- `struct {int A; int B;} bar;` : bar has type with no type name
+
+In C, enum and struct definitions can create a new type name as a byproduct of a definition by using a "tag name":
+
+- `enum MyEnum {A=1,B=2} foo;` : foo has the type named `MyEnum`
+- `struct MyStruct {int A; int B;} bar;` : bar has the type named `MyStruct`
+
+In the second set of examples, the types are named, and that name could be used to declare other variables, like `enum MyEnum bar2;` and `struct MyStruct bar2`.
+
+Functions' types are not named. The function name is considered the name of a function object, and the function's type is anonymous.
+
+In summary:
+
+```c
+typedef int foo; // type:int, name:foo
+
+// structs, without and with a "tag name"
+struct {int A; int B;} foo; // type:struct{int A, intB;}, name:<anonymous>
+struct MyStruct {int A; int B;} foo; // type:struct{int A, intB;}, name:MyStruct
+
+// enumerations, without and with a "tag name"
+enum {A=1,B=2} foo; // type:enum{A=1,B=2}, name:<anonymous>
+enum MyEnum {A=1,B=2} foo; // type:enum{A=1,B=2}, name:MyEnum
+
+// functions
+int main(int ac, char **av); // type int ()(int, char **), name:<anonymous>
+typedef int (MyFunc)(int ac, char **av); // type int ()(int, char **), name:MyFunc
+
+```
+
+_How does Binary Ninja decide when to use a typelibrary (.bntl) file?_
+
+Type Libraries are loaded when the corresponding library is imported by a BinaryView. (i.e. if an exe imports `ntdll.dll`, binja will look in the bv's platform for type libraries named ntdll.bntl and load the first one it finds)
+
+_What's the difference between a named type and a named object?_
+
+A named type is a type with a name that can identify it. For example, `color` is the name of type `enum {RED=0, ORANGE=1, YELLOW=2, ...}`.
+
+A named object is the name of an external/imported symbol for which the type library has type information. For example, `MessageBoxA` is the name of a function whose type is `int ()(HWND, LPCSTR, LPCSTR, UINT)`.
+
+_How do I find what type of type a type object is? How many are there?_
+
+I've seen "types of types", "sorts of types", "kinds of types", "classes of types" used to differentiate the varieties of possible types, and there are probably more. Binary Ninja uses "class", example:
+
+```
+>>> type_obj.type_class
+<TypeClass.FunctionTypeClass: 8>
+```
+
+In [enums.py](https://api.binary.ninja/_modules/binaryninja/enums.html#TypeClass) we can see Binary Ninja currently thinks of types falling into 13 classes: `Void`, `Bool`, `Integer`, `Float`, `Structure`, `Enumeration`, `Pointer`, `Array`, `Function`, `VarArgs`, `Value`, `NamedTypeReference`, `WideCharType`.
+
+Compare this to LLDB, which also uses the term "class", and currently has 19 of them: `Array`, `BlockPointer`, `Builtin`, `Class`, `ComplexFloat`, `ComplexInteger`, `Enumeration`, `Function`, `MemberPointer`, `ObjCObject`, `ObjCInterface`, `ObjCObjectPointer`, `Pointer`, `Reference`, `Struct`, `Typedef`, `Union`, `Vector`, `Other`.
+
+Compare this to GDB, which uses the term "type code" and has 25 of them.
+
+_Where are function parameter names stored?_
+
+While technically not part of the type, having names of function parameters is very useful and can thus be optionally stored in a type.
+
+Function types (types with `.type_class == FunctionTypeClass`) have a `.parameters` attribute, a list of [`FunctionParameter`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.FunctionParameter) objects. When those objects have `.name==''` you get the bare bones function types like `int ()(int, char **)`. When those objects have their `.name` populated you get the more meaningful `int ()(int argc, char **argv)`.
+
+_How do I manually load a type library?_
+
+```
+>>> bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))
+```
+
+_How can I manually load a type object?_
+
+```
+>>> bv.import_library_object('_MySuperComputation')
+<type: int32_t (int32_t, int32_t, char*)>
+```
+
+_Why doesn't the types view show the types imported from type libraries?_
+
+Because the type libraries added to a binary view only makes their type information _available_ for use. The types view will show a type from a type library only after it is used (on demand).
+
+Try this experiment:
+
+- note `bv.type_libraries`, `bv.types`
+- add a type library with `bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))`
+- note that `bv.type_libraries` is extended, but `bv.types` is unchanged!
+- note `bv.get_type_by_name('Rectangle')` returns nothing
+- set the type of some data to `struct Rectangle` (using `y` in linear view or via any other method described above)
+- `bv.types` is extended, and the types view shows `struct Rectangle` in the auto types
+
+_What's a named type reference?_
+
+Named Type References are a way to refer to a type by name without having its declaration immediately available.
+
+For example, examine this struct from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
+
+```
+struct Rectangle2 {
+ int width;
+ int height;
+ struct Point center;
+}
+```
+
+We don't know at this moment what a `struct Point is`. Maybe we've already added it. Maybe we'll add it later. Maybe it's in another type library. But we want to add a Rectangle now. So we leave the center field as a reference to the named type `struct Point`.
+
+Load the resulting `test.bntl` in your binary and try to set some data to type `struct Rectangle2` and you'll be met with this message:
+
+```
+TypeLibrary: failed to import type 'Point'; referenced but not present in library 'libtest.so.1`
+```
+
+This makes sense! Now go to types view and `define struct Point { int x; int y; }` and try again, success!
+
+```
+100001000 struct rectangle_unresolved data_100001000 =
+100001000 {
+100001000 int32_t width = 0x5f0100
+100001004 int32_t height = 0x5f030005
+100001008 struct Point center =
+100001008 {
+100001008 int32_t x = 0x655f686d
+10000100c int32_t y = 0x75636578
+100001010 }
+100001008 }
+```
+
+You should repeat the experiment using `struct Rectangle` and see that you're allowed to create variables with type containing _pointers_ to unresolved type references.
+
+_How are types represented?_
+
+By a hierarchy of objects from [api/python/types.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/types.py) referencing one another. The "glue" object is [`binaryninja.types.Type`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Type) and depending on the complexity of the type it represents (stored in its `.type_class` attribute), it could have an attribute with more information. For instance, if the `binaryninja.types.Type` has `.type_class == FunctionTypeClass` then its `.parameters` attribute is a list of [`binaryninja.types.FunctionParameter`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.FunctionParameter). See [typelib_dump.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_dump.py) for how this can work.
+
+As an example, here is the hierarchical representation of `type struct Rectangle` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py)
+
+```
+typelib.named_types["Rectangle"] =
+----------------------------------
+Type class=Structure
+ Structure
+ StructureMember "width"
+ Type class=Integer width=4
+ StructureMember "height"
+ Type class=Integer width=4
+ StructureMember "center"
+ Type class=Pointer
+ Type class=NamedTypeReference
+ NamedTypeReference <named type: struct Point>
+```
+
+Here is the representation of `type int ()(int, int)` named `MyFunctionType` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
+
+_When do named objects get used?_
+
+When a binary is loaded and its external symbols is processed, the symbol names are searched against the named objects from type libraries. If there is a match, it obeys the type from the type library. Upon success, you'll see a message like:
+
+```
+type library test.bntl found hit for _DoSuperComputation
+```
+
+At this moment, there is no built in functionality to apply named objects to an existing Binary Ninja database.
diff --git a/docs/dev/uidf.md b/docs/dev/uidf.md
index a6422246..8a421dfa 100644
--- a/docs/dev/uidf.md
+++ b/docs/dev/uidf.md
@@ -1,8 +1,8 @@
## User Informed Data Flow
-Binary Ninja now implements User-Informed DataFlow (UIDF) to improve the static reverse engineering experience of our users. This feature allows users to set the value of a variable at the Medium-level IL layer and have the internal dataflow engine propagate it through the control-flow graph of the function. Besides constant values, Binary Ninja supports various `PossibleValueSet` states as containers to help inform complex variable values.
+Binary Ninja now implements User-Informed DataFlow (UIDF) to improve the static reverse engineering experience of our users. This feature allows users to set the value of a variable and have the internal dataflow engine propagate it through the control-flow graph of the function. Besides constant values, Binary Ninja supports various `PossibleValueSet` states as containers to help inform complex variable values.
-## Usage
+## Sample Usage
For the purpose of demonstration, we are going to use a simple [crackme](https://github.com/Vector35/uidf-example).
@@ -14,18 +14,18 @@ Let's first look at `rax_2`. We see that the conditional at Medium Level IL (MLI
First, note the definition site of `rax_2` is instruction 7 and then right click there to see "Set User Variable Value...". Users can also bind the action to a hotkey or access it via the command palette.
-![Right click options](../img/right-click-uidf.png)
+![Right click options](../img/uidf-right-click.png)
The dialog box to set the variable value contains two fields:
* `PossibleValueSet` type: `PossibleValueSet` is used to represent the values that a variable can take during analysis. This can also be representative of the values that the variable would take during concrete execution of the program. For instance if the variable value is `<const 0x0>`, it implies that the mapped register would always contain the value `0x0` during the lifetime of the variable. `UndeterminedValue` on the other hand suggests that the analysis could not figure out an appropriate value and representation in the available `PossibleValueSet`s. For the program analysis folks, this is analogous to the top of the dataflow lattice. An `EntryValue` represents the bottom. `PossibleValueSet`s provide complex container types such as `InSetOfValues`, `SignedRangeValue`, `UnsignedRangeValue`, etc.
* Value: Represents the concrete value which is to be informed to the analysis. Please refer to the parse_possiblevalueset [documentation](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.parse_possiblevalueset) for a detailed description of the parser rules for the various `PossibleValueSet`s.
-![Options when setting PossibleValueSet](../img/options-setting-uidf.png)
+![Options when setting PossibleValueSet](../img/uidf-options-setting.png)
-The parser checks if the string can be parsed into a [`PossibleValueSet`](https://api.binary.ninja/binaryninja.function.PossibleValueSet.html). The behavior of this parser is similar to the `Goto Address` dialog box or the [`parse_expression` API](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.parse_expression). This enables the use of keywords such as `$here`, `$start/$end`, etc.
+The parser checks if the string can be parsed into a [`PossibleValueSet`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.PossibleValueSethtml). The behavior of this parser is similar to the `Goto Address` dialog box or the [`parse_expression` API](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView.parse_expression). This enables the use of keywords such as `$here`, `$start/$end`, etc.
-And of course, like everything else in Binary Ninja you can accomplish this using the API. `PossibleValueSet`s can be created through instantiation of the [`PossibleValueSet`](https://api.binary.ninja/binaryninja.function.PossibleValueSet.html) class or through parsing a value string:
+And of course, like everything else in Binary Ninja, you can accomplish this using the API. `PossibleValueSet`s can be created through instantiation of the [`PossibleValueSet`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.PossibleValueSet) class or through parsing a value string:
```python
>>> # Creating a PossibleValueSet object through instance creation
@@ -62,7 +62,7 @@ Let's set the value of the variable `rax_2` to `ConstantValue <0x0>`. Here's how
Looking at the binary this input should lead to "Incorrect" output. Setting the variable value automatically triggers a re-analysis of the function. This leads to a dataflow analysis pass over the function seeded with the user-informed value for that specific variable. On hovering over the variable token, we see the value that it takes is the one we informed.
-![Hover over value](../img/hover-uidf.png)
+![Hover over value](../img/uidf-hover.png)
The API makes it easy to query for the value of the conditional to check if it has been statically evaluated. We can also get a list of all the currently informed variable values through the API:
@@ -74,13 +74,24 @@ The API makes it easy to query for the value of the conditional to check if it h
>>>
```
+## Variable View Sidebar
+
+The variable sidebar also supports both setting and seeing the values of UIDF variables. Note that because the UIDF values are location-sensitive you'll want to make sure you've clicked into an appropriate location in the MLIL or HLIL to see the appropriate values annotated in the variable view.
+
+![UIDF in Variable Sidebar](../img/uidf-hlil-before.png)
+
+## Jump Table Example
+
+???+ Warning "Tip"
+ Since these docs were originally written, this jump table no longer behaves the same way and is automatically solved during Binary Ninja's normal analysis. The documentation is being left in for illustrative purposes as it's still a valuable consideration even if this exact example no longer applies.
+
Let us see the High Level IL (HLIL) representation of `main` before UIDF:
-![HLIL before UIDF](../img/hlil-before-uidf.png)
+![HLIL before UIDF](../img/uidf-hlil-before.png)
Below is the HLIL of `main` after UIDF. If constant propagation leads to conditionals which can be evaluated at analysis time, its value is set to `if (true) or if (false)` at the MLIL layer. More so, the branch of the conditional where the control flow is guaranteed to not reach is eliminated from HLIL. The sub-graph of the CFG which results in the "Correct" output is eliminated. Here, HLIL benefits from dataflow calculations made at MLIL and the updated CFG is indicative of that.
-![HLIL after UIDF](../img/hlil-after-uidf.png)
+![HLIL after UIDF](../img/uidf-hlil-after.png)
We believe that UIDF is great for experimenting around with during the initial phase of the RE life cycle. If the value for a variable at a location is already informed, right-clicking on the variable at any usage site where the variable has the same SSA version will show an option to "Clear User Variable Value". This clears the informed value and triggers reanalysis. And as always, you can just use undo if setting the user variable value was the last action (using CMD/CTRL+Z).
@@ -100,7 +111,7 @@ Another example of using UIDF would be to construct jump-tables with known bound
Now, with the introduction of UIDF, there's another easy way to help inform the jump-table analysis. Consider the MLIL representation for an indirect jump as shown below:
-![Indirect jump](../img/jump-table-uidf.png)
+![Indirect jump](../img/uidf-jump-table.png)
Let us inform value for the variable `eax` to be in the range `1` to `0x13`.
@@ -113,12 +124,12 @@ Let us inform value for the variable `eax` to be in the range `1` to `0x13`.
A jump table will be created with a base of `0x804891c` with 14 possible targets for the jump at 0x804855b. Below is a cropped screenshot of the resulting HLIL which consists of a switch construct which depends on the variable value. This [binary](http://pages.cs.wisc.edu/~xmeng/Testsuite.tar.gz) is available on [BN Cloud](https://cloud.binary.ninja/bn/fb2131dd-e726-4009-8428-80f9f0b5e8ae) and is originally written by [Xiaozhu Meng](http://pages.cs.wisc.edu/~xmeng).
-![Correct switch after UIDF](../img/correct-switch-after-uidf.png)
+![Correct switch after UIDF](../img/uidf-correct-switch-after.png)
## Design notes
-Static-only reverse engineering limits the ability to test hypothesis formulated during the initial analysis phase. To that end, analysts usually turn to emulation/debugging to experiment with a binary. This can often be time-consuming if the focus is on checking dependencies between program variables or for verifying the dataflow, or worse, may be impossible for some platforms that are difficult to dynamically analyze. With UIDF, we aim to provide our users with the ability to interact with the dataflow engine more richly and partly achieve the same results without leaving the flow graph or linear analysis window. UIDF could also aid in better understanding targets of indirect jumps or fixing jump tables. Research [[1](#ref1),[2](#ref2)] shows that it is imperative that binary analysis tools adopt a more user-guided approach to solve RE/VR tasks and UIDF tries to be a step up that slope. We aim to continue work in this direction!
+Static-only reverse engineering limits the ability to test hypotheses formulated during the initial analysis phase. To that end, analysts usually turn to emulation/debugging to experiment with a binary. This can often be time-consuming if the focus is on checking dependencies between program variables or for verifying the dataflow, or worse, may be impossible for some platforms that are difficult to dynamically analyze. With UIDF, we aim to provide our users with the ability to interact with the dataflow engine more richly and partly achieve the same results without leaving the flow graph or linear analysis window. UIDF could also aid in better understanding targets of indirect jumps or fixing jump tables. Research [[1](https://acmccs.github.io/papers/p347-shoshitaishviliA.pdf),[2](https://dl.acm.org/doi/fullHtml/10.1145/3290607.3313040)] shows that it is imperative that binary analysis tools adopt a more user-guided approach to solve RE/VR tasks and UIDF tries to be a step up that slope. We aim to continue work in this direction!
-UIDF primarily operates on the MLIL layer. Binary Ninja performs constant propagation, resolves call parameters and lifts stack load/stores into a variables. This combined with the SSA form enables an effective dataflow analysis pipeline. MLIL also provides control over dead-code elimination and allows us to prevent removal of redundant instructions (eg. variable definitions for informed variables) and basic blocks (removed due to the resulting dataflow). Binary Ninja's tiered IL representation allows the higher layers to benefit from simplifying transformations at the lower layers. Through fixing jump tables or branch elimination, UIDF influences HLIL output as a user would expect without having drastic changes to the MLIL representation.
+UIDF primarily operates on the MLIL layer. Binary Ninja performs constant propagation, resolves call parameters and lifts stack load/stores into a variables. However, the UI can apply a UIDF constraint on an HLIL variable or MLIL variable and apply it appropriately. This combined with the SSA form enables an effective dataflow analysis pipeline. MLIL also provides control over dead-code elimination and allows us to prevent removal of redundant instructions (eg. variable definitions for informed variables) and basic blocks (removed due to the resulting dataflow). Binary Ninja's tiered IL representation allows the higher layers to benefit from simplifying transformations at the lower layers. Through fixing jump tables or branch elimination, UIDF influences HLIL output as a user would expect without having drastic changes to the MLIL representation.
-Looking towards the future, improvements to the dataflow solver engine would inherently increase the efficacy of UIDF. This could include support for more operations on the complex [`PossibleValueSet`](https://api.binary.ninja/binaryninja.function.PossibleValueSet.html) containers or the ability to play well with program structure such as loops.
+Looking towards the future, improvements to the dataflow solver engine would inherently increase the efficacy of UIDF. This could include support for more operations on the complex [`PossibleValueSet`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.PossibleValueSet) containers or the ability to play well with program structure such as loops.
diff --git a/docs/dev/workflows.md b/docs/dev/workflows.md
index 678f6510..7ff91503 100644
--- a/docs/dev/workflows.md
+++ b/docs/dev/workflows.md
@@ -13,7 +13,6 @@ This capability is experimental with no guarantees of API stability or future co
- [What is Workflows](#what-is-workflows)
- [Getting Started](#getting-started)
- - [Availability](#availability)
- [Enable](#enable)
- [Explore](#explore)
- [Examples](#examples)
diff --git a/docs/docs.css b/docs/docs.css
index 8ca8e887..6b61a79f 100644
--- a/docs/docs.css
+++ b/docs/docs.css
@@ -131,31 +131,16 @@
}
:root {
- --md-text-font: "Roboto";
- --md-code-font: "Roboto Mono";
+ --md-text-font: "Roboto";
+ --md-code-font: "Roboto Mono";
}
.juxtapose {
margin-bottom: 1rem;
}
-code,
-.codehilite {
- background-color: #eee;
-}
-
-.admonition.warning .admonition-title,
-.admonition.warning {
- background-color: #d73726 !important;
- border-color: #d73726;
- color: #fff !important;
-}
-
-.md-typeset.admonition.tip .admonition-title,
-.md-typeset.admonition.tip {
- background-color: #6e6e6e !important;
- border-color: #6e6e6e !important;
- color: #fff !important;
+.jx-knightlab {
+ display: none !important;
}
img[alt$=">"] {
@@ -179,63 +164,6 @@ img[alt$="><"] {
}
-/*
-@media only screen and (min-width: 76.25em) {
- .md-main__inner {
- max-width: none;
- }
- .md-sidebar--primary {
- left: 0;
- }
- .md-sidebar--secondary {
- right: 0;
- margin-left: 0;
- -webkit-transform: none;
- transform: none;
- }
- .wy-nav-content {
- max-width: 100%;
- }
-}
-*/
-
-pre {
- overflow-x: auto;
-}
-
-.wy-side-nav-search {
- background-color: #d73726;
- color: #fff;
-}
-
-.wy-menu-vertical p.caption {
- color: #9b9b9b;
-}
-
-.toctree-l1 a:visited,
-.toctree-l1 a:hover,
-.toctree-l1 a {
- color: #ccc;
-}
-
-.wy-nav-top {
- background-color: #d73726 !important;
- color: #fff !important;
-}
-
-.wy-nav-top a:visited,
-.wy-nav-top a:hover,
-.wy-nav-top a,
-.wy-side-nav-search a:visited,
-.wy-side-nav-search a:hover,
-.wy-side-nav-search a {
- color: #fff;
-}
-
-#image-slider {
- background-color: #000;
-}
-
.lslide {
margin: 0px !important;
text-align: center;
@@ -248,10 +176,8 @@ pre {
overflow: hidden;
}
-ol#inline-slides-text li#currentline {
- background-color: #6e6e6e;
- color: #fff;
- font-weight: bold;
+pre {
+ overflow-x: auto;
}
ol#inline-slides-text li {
@@ -303,51 +229,21 @@ h3#all-settings+p+div table tbody tr>td:nth-child(6) {
white-space: break-spaces;
}
-.md-header {
- background-color: #d73726;
-}
-
-.md-tabs {
- background-color: #d73726;
- color: #ffffff;
-}
-
-.headerlink,
-.md-typeset a,
-.md-nav__link,
-.md-nav__item {
- color: #d73726;
-}
-
-a.md-tabs__link,
-a.md_tabs__link:visited {
- color: #ffffff;
-}
-
-.md_tabs__link:hover {
- color: #cccccc;
-}
-
-.headerlink:hover,
-.md-typeset a:hover,
-.md-nav__link:hover,
-.md-nav__item:hover {
- color: #000000;
-}
-
-.md-source,
-.md-source:visited,
-.md-header__button,
-.md-header__button:visited {
- color: #ffffff;
-}
-
-
.md-grid {
max-width: 95%;
}
-/* TODO: Cleanup above hacks and replace with fully theme-aware code like below. */
+[data-md-color-scheme="slate"] {
+ --md-primary-fg-color: #d73726;
+ --md-primary-fg-color--light: #ECB7B7;
+ --md-primary-fg-color--dark: #990000;
+ --md-code-fg-color: #ecb7b7;
+ /* To use a red hue instead
+ * --md-hue: 15;
+ */
+ --md-typeset-a-color: rgb(215, 55, 38);
+ --md-nav-primary: rgb(215, 55, 38);
+}
[data-md-color-scheme="binja"] {
--md-primary-fg-color: #d73726;
@@ -356,7 +252,8 @@ a.md_tabs__link:visited {
--md-primary-fg-color--dark: #990000;
--md-code-fg-color: rgb(215, 55, 38);
--md-code-bg-color: hsla(0, 0%, 96%, 1);
- --md-typeset-a-color: #000000;
+ --md-typeset-a-color: rgb(215, 55, 38);
+ --md-nav-primary: rgb(215, 55, 38);
}
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 2d446cee..adb41b0e 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -1,22 +1,24 @@
# Getting Started
-Welcome to Binary Ninja. This introduction document is meant to quickly guide you over some of the most common uses of Binary Ninja. If you're interested in more detailed information, check out the [User Manual](./guide/index.md).
+Welcome to Binary Ninja! This introduction document is meant to quickly guide you over some of the most common uses of Binary Ninja. If you're interested in more detailed information, check out the [User Guide](./guide/index.md).
+
+![main ><](./img/main.png "Main"){ width="800" }
-![main](./img/main.png "Main")
## Installing Binary Ninja
-The download links you receive after purchasing expire after 72 hours but as long as you have [active support](https://binary.ninja/faq/#updates) you can [request download links](https://binary.ninja/recover/) any time!
+The download links you receive after purchasing expire after 72 hours but as long as you have [active support](https://binary.ninja/faq/#updates) you can [request download links](https://binary.ninja/recover/) any time.
+
### Linux
-Because Linux install locations can vary widely, we do not assume that Binary Ninja has been installed in any particular folder on Linux. Instead, first unzip the installation zip wherever you wish to install BN. Next, for paid versions, run `./binaryninja/scripts/linux-setup.sh`. This sets up file associations, icons, and adds BN's Python library to your python path. Adding the library to your path is most helpful for headless functionality in commercial licenses, but even on non-commercial plugins it can help IDE's find the type information to make plugin development easier. Run the script with `-h` to see customization options.
+Because Linux install locations can vary widely, we do not assume that Binary Ninja has been installed in any particular folder on Linux. Instead, first unzip the installation zip wherever you wish to install Binary Ninja. Next, for paid versions, run `./binaryninja/scripts/linux-setup.sh`. This sets up file associations, icons, and adds Binary Ninja's Python library to your Python path. Adding the library to your path is most helpful for headless functionality in the commercial editions, but even on the Non-Commercial edition it can help your IDE find the api sources to make plugin development easier. Run the script with `-h` to see customization options.
-### MacOS
+### macOS
-To install on MacOS, simply drag-and-drop the app bundle from the DMG to the desired location.
+To install on macOS, simply drag-and-drop the app bundle from the DMG to the desired location.
### Windows
-To install on Windows, use the installer linked from the email you received after purchase. You'll need to choose whether to install globally or to your local user path during the install process.
+To install on Windows, use the installer linked from the email you received after purchase. During the install process, you'll need to choose whether to install globally or to your local user path.
## License
@@ -30,47 +32,47 @@ While there are [more ways than shown here](./guide/index.md#loading-files), the
- File Open
- Run via CLI
-But you can also change how analysis happens using [open with options](./guide/index.md#loading-files).
+You can change analysis settings by using [Open with Options](./guide/index.md#loading-files).
## UI Basics
-![Overview](./img/overview.png "Overview")
+![Overview ><](./img/overview.png "Overview"){ width="800" }
By default, you'll see four main areas in Binary Ninja:
1. Symbol List (one of many [sidebar panels](./guide/index.md#the-sidebar))
-1. [Cross References](./guide/index.md#cross-references-pane)
+1. [Cross References](./guide/index.md#cross-references)
1. Main View (defaults to High Level IL and can have many [panes](./guide/index.md#tiling-panes))
1. [Feature Map](./guide/index.md#feature-map)
-Not enabled by default but can be made visible is the global area which includes the [scripting console](./guide/index.md#script-python-console) and log window.
+Not enabled by default but can be made visible is the bottom bar which includes the [scripting console](./guide/index.md#script-python-console) and log window.
-Make sure to check out the many view options available in the various ☰ ("hamburger") menus. However, most configuration settings are available in the [settings](./guide/settings.md) menu. (`[CMD/CTRL] ,` is the hotkey for settings) in the top right of each pane allows for additional customization, including locking the pane to a single function.
+Make sure to check out the many view options available in the various ☰ ("hamburger") menus. Many configuration settings are also available in the [Settings](./guide/settings.md) menu (hotkey: `[CMD/CTRL] ,`).
### Interacting
-![command palette](./img/command-palette.png "Command Palette")
+![command palette ><](./img/command-palette.png "Command Palette"){ width="800" }
-One of the most useful features of Binary Ninja is that everything can be quickly and easily accessed through a [command-palette](./guide/index.md#command-palette) (`[CMD/CTRL] p`). You'll be surprised how often it saves you from looking through menus to find out just what you need. Also, any action in the command-palette can be assigned to a [custom hotkey](./guide/index.md#custom-hotkeys). That said, here are a few of the more useful default hotkeys:
+One of the most useful features of Binary Ninja is that everything can be quickly and easily accessed through the [command palette](./guide/index.md#command-palette) (`[CMD/CTRL] p`). You'll be surprised how often it saves you from looking through menus to find out just what you need. Any action in the command palette can be assigned to a [custom hotkey](./guide/index.md#custom-hotkeys). Here are a few of the more useful ones:
- `[ESC]` : Navigate backward
- - `[SPACE]` : Toggle between linear view and [graph view](./guide/index.md#graph-view)
- - `[F5]`, `[TAB]` : Toggle between Pseudo C and disassembly view
+ - `[SPACE]` : Toggle between Linear View and [Graph View](./guide/index.md#graph-view)
+ - `[F5]`, `[TAB]` : Toggle between Pseudo C and Disassembly in the current view
- `g` : Go to an address or symbol
- `n` : Name a symbol
- `;` : Add a comment
- `i` : Cycle between disassembly, LLIL, MLIL and HLIL
- `y` : Change type of the currently selected element
+ - `a` : Create a C String at the currently selected address
- `1`, `2`, `4`, `8` : Change type of a data variable to the indicated width in bytes (creates a variable if none exists)
- `d` : Switch between data variables of various widths
- `r` : Change the data type to single ASCII character
- - `o` : Create a pointer data type
-For more hotkeys, see the [User Manual](./guide/index.md).
+For more hotkeys, see the [User Guide](./guide/index.md).
## Intermediate Languages
-Binary Ninja is one of the most advanced binary analysis platforms, and it has a unique stack of related intermediate languages. If that gets you excited, you'll surely want to check out the [developer guide](./dev/bnil-overview.md) for more information. If it doesn't mean anything to you, no worries, here's a few tips to make your life easier. The default view is "High Level IL". It looks and reads almost like pseudo code. There's a few extra notations (usually just around comparisons for whether they are signed or not, or between moves of data indicating the size of the operation) but it should otherwise be very understandable.
+Binary Ninja is one of the most advanced binary analysis platforms, and it has a unique stack of related intermediate languages. If that gets you excited, you'll surely want to check out the [developer guide](./dev/bnil-overview.md) for more information. If it doesn't mean anything to you, no worries, here's a few tips to make your life easier. The default view is "High Level IL". It looks and reads almost like pseudo code. There are a few extra annotations that make it more expressive, like how comparisons show whether they are signed or not, and when data is moved the size of the operation is indicated.
Many of the IL behaviors and views are customizable via settings. If you prefer disassembly or even [Pseudo C](./guide/index.md#pseudo-c) as your default view, no worries, just check out the `UI`/`view.graph` and `view.linear` settings. Likewise, there are several settings available under the "hlil" heading.
@@ -82,7 +84,7 @@ Plugins can be installed by one of two methods, either automatically by using th
Binary Ninja includes a debugger that can debug executables on Windows, Linux, and macOS.
-For more detailed information, see the [debugger guide](./guide/debugger.md).
+For more detailed information, see the [debugger guide](./guide/debugger/index.md).
## Updates
@@ -94,4 +96,4 @@ By default, Binary Ninja is configured to automatically update itself to any new
- Watch our [Binary Ninja Basics](https://www.youtube.com/watch?v=xKBQatwshs0&list=PLCVV6Y9LmwOgqqT5obf0OmN9fp5495bLr) videos (or any other [videos on our channel](https://www.youtube.com/watch?v=xKBQatwshs0&list=PLCVV6Y9LmwOgqqT5obf0OmN9fp5495bLr&index=1))
- Join one of our [live streams](https://www.youtube.com/@vector35/live)
- Attend one of our [trainings](https://binary.ninja/training/)
-- Read the rest of the more detailed [User Manual](./guide/index.md)
+- Read the rest of the more detailed [User Guide](./guide/index.md)
diff --git a/docs/guide/index.md b/docs/guide/index.md
index 476e214d..58717818 100644
--- a/docs/guide/index.md
+++ b/docs/guide/index.md
@@ -1,15 +1,16 @@
-# User Manual
+# User Guide
-Welcome to the Binary Ninja User Manual. You'll notice two menus here. On the right is the table of contents for this main page of the user manual. On the left are links to larger topics that have their own pages, including:
+Welcome to the Binary Ninja User Guide. You'll notice two menus here. On the right is the table of contents for this main page of the user manual. On the left are links to larger topics that have their own pages, including:
- [Plugins](plugins.md)
- [Settings](settings.md)
-- [Types](type.md)
-- [C++ Types](cpp.md)
-- [Debug Info](debuginfo.md)
-- [Debugger](debugger.md)
-- [Objective C](objectivec.md)
+- [Projects](projects.md)
- [Troubleshooting](troubleshooting.md)
+- [Objective-C](objectivec.md)
+- [Debugger](debugger/index.md)
+- [Migration Guide](migration/index.md)
+- [Types](types/index.md)
+[comment]: <> (When changing this list, make sure to update mkdocs.yml as well)
## Directories
@@ -25,7 +26,7 @@ Binaries are installed in the following locations by default:
- Windows (user install): `%LOCALAPPDATA%\Vector35\BinaryNinja`
???+ Warning "Tip"
- If you want a silent install on windows, because we use the [NSIS](https://nsis.sourceforge.io/Docs/) installer, simply use: `BinaryNinjaInstaller.exe /S`
+ If you want a silent install on Windows, because we use the [NSIS](https://nsis.sourceforge.io/Docs/) installer, simply use: `BinaryNinjaInstaller.exe /S`
???+ Danger "Warning"
Do not put any user content in the install-path of Binary Ninja. The auto-update process of Binary Ninja WILL remove any files included in these locations.
@@ -40,7 +41,7 @@ While the default user folders are listed below, you can override these paths on
The contents of the user folder includes:
-- `lastrun`: A text file containing the directory of the last BinaryNinja binary path -- very useful for plugins to resolve the install locations in non-default settings or on Linux
+- `lastrun`: A text file containing the directory of the last Binary Ninja binary path -- very useful for plugins to resolve the install locations in non-default settings or on Linux
- `license.dat`: License file
- `plugins/`: Folder containing all manually installed user plugins
- `repositories/`: Folder containing files and plugins managed by the [Plugin Manager API](https://api.binary.ninja/binaryninja.pluginmanager-module.html)
@@ -55,19 +56,20 @@ The following files and folders may be created in the user folder but are not cr
- `symbols/`: Used to store automatically downloaded PDBs
- `update/`: Used to store update caches for pending updates
- `snippets/`: Used to store snippets created using the official Snippet plugin
-- `themes/`: For user themes or user-modified versions of official themes
-- `types/platform`: This folder can contain additional user [platform types](type.md#platform-types)
-- `community-themes/`: Can also be used to store themes, useful to clone the [plugin theme collection](https://github.com/vector35/community-themes) directly into your user folder
+- `themes/`: For user themes or user-modified versions of official themes (see [Creating Themes](../dev/themes.md))
+- `types/platform`: This folder can contain additional user [platform types](types/platformtypes.md)
+- `typelib`: This folder can contain additional user [Type Libraries](../dev/annotation.md#type-libraries)
+- `community-themes/`: Can also be used to store themes, particularly so you can clone the [community theme collection](https://github.com/vector35/community-themes) directly into your user folder
### QSettings Locations
-Some settings such as window locations, saved checkboxes, recent file lists, disassembly settings, dialog histories are stored in QSettings.
+Some settings such as window locations, saved checkboxes, recent file lists, disassembly settings, dialog histories are stored in `QSettings`.
If you ever have the need to flush these, you can find the install locations as described in the [QT documentation](https://doc.qt.io/qt-6/qsettings.html#platform-specific-notes).
## License
-![license pop-up >](../img/license-popup.png "License Popup")
+![license pop-up >](../img/license-popup.png "License Popup"){ width="400" }
When you first run Binary Ninja, it will prompt you for your license key. You should have received your license key via email after your purchase. If not, please contact [support](https://binary.ninja/support).
@@ -79,9 +81,9 @@ Because Linux install locations can vary widely, we do not assume that Binary Ni
## Loading Files
-You can load files in many ways:
+![open with options ><](../img/open-with-options.png "Open with Options"){ width="600" }
-![open with options](../img/open-with-options.png "Open with Options")
+You can load files in many ways:
1. Drag-and-drop a file onto the Binary Ninja window (hold `[CMD/CTRL-SHIFT]` while dropping to use the `Open with Options` workflow)
2. Use the `File/Open` menu or `Open` button on the start screen (`[CMD/CTRL] o`)
@@ -101,7 +103,7 @@ You can load files in many ways:
## Saving Files
-![save choies >](../img/save-choices.png "Save Menu Choices")
+![save choices >](../img/save-choices.png "Save Menu Choices"){ width="400" }
There are five menu items that can be used to save some combination of a raw file or a file's analysis information. Analysis information is saved into files that end in `.bndb` and have the same prefix as the original file. The default behavior for each of the "save" menu choices is described below:
@@ -116,17 +118,54 @@ There are five menu items that can be used to save some combination of a raw fil
- If you choose to save the analysis database, it behaves similarly to "Save" above, except for the cases that save without prompt. In those cases, you will _always_ be prompted for a filename.
- If you choose to save the file contents only, you will be prompted for a filename to which to save the current contents of the binary view, including any modifications.
-3. "Save All" - Used to save multiple tabs worth of analysis data only. Does not save file contents.
+3. "Save All" - Used to save multiple tabs worth of analysis data only. Does not save file contents.
4. "Save Analysis Database" - Will prompt to select a database to save analysis information if none is currently selected and in use, and will save without a prompt if one has already been selected.
- ![save with options >](../img/save-with-options.png "Save With Options")
-
5. "Save Analysis Database With Options" - Allows for saving a `.bndb` without additional undo information, or by cleaning up some internal snapshot information to decrease the file size.
+![save with options](../img/save-with-options.png "Save With Options"){ width="600" }
+
+## New Files
+
+When you create a new file, you're given the [hex view](index.md#hex-view) of an empty file. From here you can manually type in hexadecimal or ascii values, or paste in data in a variety of ways. To type in hex, make sure the left-side is focused, to type in ascii, just focus the right-side using the mouse or the "tab" key. The only way to enter a tab character into the ascii section is to enter "09" in the hex side.
+
+To paste, right click anywhere in the view, select "Paste From," and choose whichever option matches the data you copied. For example, the string `\x01\x02\x03\x04` can be pasted as an Escape String, while `01020304` is Raw Hex.
+
+From here, you can save the contents of your new binary to disk and reopen it for auto-analysis. Of course, you could also switch out of hex view and start creating functions yourself.
+
+## New Tab
+
+![new tab ><](../img/newtab-personal.png "New Tab"){ width="800" }
+
+The New Tab is the first view shown when starting the application. It contains a set of buttons with common actions for loading and creating files,
+and a list of recent files you've opened.
+
+![new tab ><](../img/newtab-compact.png "New Tab Compact Mode"){ width="700" }
+
+A "Compact Mode" exists which presents only file paths. This can be enabled and disabled from the right-click menu. Additionally, within Binary Ninja settings, `CompactBase` mode can be enabled, which only shows the filenames.
+
+### Recent Files
+
+Recent files can be opened on double click. They can also be navigated using the arrow keys, and opened via pressing enter. Opening a recent file using `[SHIFT+ENTER]` will open that file with the Open With Options dialog.
+
+The Recent files list can be cleared via using the Command Palette (`[CTRL] + P`) action `Clear Recently Opened`.
+
+Hotkeys (macOS: `[CMD] + 0` - `[CMD] + 9`, Windows/Linux: `[CTRL] + 0` - `[CTRL + 9]`) can also be used to quickly open a file. The hotkey for a given entry will be shown on the right.
+
+### Commercial/Enterprise Features
+
+![new tab](../img/newtab-projects.png "New Tab Projects Version"){ width="700" }
+
+On Commercial and Enterprise, the New Tab file list also contains a separate tab for Recent Projects. These tabs can be docked, rearranged, split, or unified, and their split is adjustable. Layout changes will be saved.
+
+While Projects themselves are presented in their own tab, files opened in Projects will be located in the usual Recent Files list.
+
+Project names are formatted as `[Project] Project Name Here` while project files are formatted as `[Project Name Here] File Name Here`.
+
## Status Bar
-![status bar >](../img/status-bar.png "Status Bar") <!-- this image needs updating to reflect new status bar -->
+![status bar](../img/status-bar.png "Status Bar"){ width="800" }
The status bar provides current information about the open file as well as some interactive controls. Summary features are listed below:
@@ -135,7 +174,7 @@ The status bar provides current information about the open file as well as some
* Cursor offset or selection - interactive control that can be clicked to change its display format, or also to copy the current address or selection in a number of different formats (see the below screenshot)
* File Contents Lock - interactive control to prevent accidental changes to the underlying file
-![address indicator](../img/address-indicator.png "Status Bar") <!-- this image needs updating to reflect new status bar -->
+![address indicator](../img/address-indicator.png "Status Bar")
## Analysis
@@ -159,49 +198,238 @@ Additionally, using the [open with options](#loading-files) feature allows for c
## Navigating
-![navigation >](../img/navigation.png "Navigation")
-Navigating code in Binary Ninja is usually a case of just double-clicking where you want to go. Addresses, references, functions, jump edges etc, can all be double-clicked to navigate. Additionally, the `g` hotkey can navigate to a specific address in the current view. Syntax for this field is very flexible. Full expressions can be entered including basic arithmetic, dereferencing, and name resolution (function names, data variable names, segment names, etc). Numerics default to hexadecimal but that can be controlled as well if you wish to use octal decimal or other base/radix. Full documentation on the syntax of this field can be found [here](https://api.binary.ninja/binaryninja.binaryview-module.html?highlight=parse_expression#binaryninja.binaryview.BinaryView.parse_expression).
+![navigation >](../img/navigation.png "Navigation"){ width="600" }
+Navigating code in Binary Ninja is usually a case of just double-clicking where you want to go. Addresses, references, functions, jump edges etc., can all be double-clicked to navigate. Additionally, the `g` hotkey can navigate to a specific address in the current view. Syntax for this field is very flexible. Full expressions can be entered including basic arithmetic, dereferencing, and name resolution (function names, data variable names, segment names, etc.). Numerics default to hexadecimal, but that can be controlled as well if you wish to use octal decimal or other base/radix. Full documentation on the syntax of this field can be found [here](https://api.binary.ninja/binaryninja.binaryview-module.html?highlight=parse_expression#binaryninja.binaryview.BinaryView.parse_expression).
-Additionally, middle-clicking (scroll-wheel clicking) items that can be double-clicked can be used to navigate to that location in a new Split Pane. Shift + middle-click can also be used to navigate to that location in a new Tab. These bindings can be configured in the Settings ([ui.middleClickNavigationAction](settings.md#ui.middleClickNavigationAction), [ui.middleClickShiftNavigationAction](settings.md#ui.middleClickShiftNavigationAction)). These "Split and Navigate" actions can also be accessed in the Context (right-click) menu, and can be separately bound to keys in the Keybindings view.
+Additionally, middle-clicking (scroll-wheel clicking) items that can be double-clicked can be used to navigate to that location in a new Split Pane. Shift + middle-click can also be used to navigate to that location in a new Tab. These bindings can be configured in the Settings ([`ui.middleClickNavigationAction`](settings.md#ui.middleClickNavigationAction), [`ui.middleClickShiftNavigationAction`](settings.md#ui.middleClickShiftNavigationAction)). These "Split and Navigate" actions can also be accessed in the Context (right-click) menu, and can be separately bound to keys in the Keybindings view.
There's also [many](#using-the-keyboard) keyboard-based navigation options.
### Switching Views
-![graph view >](../img/view-choices.png "Different Views")
+![graph view](../img/view-choices.png "Different Views")
-Switching views happens multiple ways. In some instances, it is automatic (clicking a data reference from graph view will navigate to linear view as data is not shown in the graph view), and there are multiple ways to manually change views as well. While navigating, you can use the view hotkeys (see below) to switch to a specific view at the same location as the current selection. Alternatively, the view menu in the header at the top of each pane can be used to change views without navigating to any given location.
+Switching views happens multiple ways. In some instances, it is automatic, such as clicking a data reference from graph view. This will navigate to linear view as data is not shown in the graph view. While navigating, you can use the [view hotkeys](#default-hotkeys) to switch to a specific view at the same location as the current selection. Next you can use the [command palette](#command-palette). Additionally, the view menu in the header at the top of each pane can be used to change views without navigating to any given location. Finally, you can also use the `View` application menu.
## The Sidebar
-![the sidebar >](../img/sidebar.png "The Sidebar")
+![the sidebar ><](../img/sidebars.png "The Sidebar"){ width = "800" }
+
+Once you have a file open, the sidebar lets you quickly access the most common features as sidebar panels and keeps them available while you work. These panels can be moved both upper left (1) and upper right (2) as well as to the bottom left (3), bottom right (4), and along the bottom left (5) and bottom right (5) in the middle.
+
+ - 1-2: This section is where the majority of the primarily vertical panels reside. You can only have on larger item here at a time visible. The default behavior is for a click on another panel icon to hide the previous panel. However, this default can be overridden by using `[SHIFT]` click. If overridden, both the old panel and the new panel will be visible.
+ - 3-4: This section is primarily for smaller panels where you may wish to toggle multiple on or off. Clicking a panel here will toggle its visibility without impacting other panels. Note that despite 4 not having any items in it by default, when you drag a panel icon to this region, you'll see the separator that separates 1/2 from 3/4 appear.
+ - 5-6: Primarily for horizontal content, the bottom-most panel icon regions behave much like sections 1-2 except they are applied to two regions in the bottom of the window. Clicking a different icon in this region will switch to that panel, or hide that panel entirely if it is already selected.
+
+Here's a more detailed look into each of those panels:
+
+### Symbols
+
+The Symbols List is a powerful symbol organization and navigation tool. It allows sorting symbols by a variety of attributes, organizing them into folders (both manually, and automatically via the [API](https://api.binary.ninja/binaryninja.component-module.html#binaryninja.component.Component)), and much more.
+
+???+ Warning "Tip"
+ Searching in the symbol list doesn't require focusing the search box. That the filter list here (and in the string panel) is a "fuzzy" search. Each space-separated keyword is used as a substring match and order matters. So: "M C N" for example would match `MyClassName`.
+
+#### Columns
+
+![symbols list >](../img/symbols-header-menu.png "Symbols List Header Menu"){ width="600" }
+
+The Symbol List shows the following columns by default:
+
+- `Name`: the [short name](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.CoreSymbol) of the symbol (can be changed to the [raw name](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.CoreSymbol) in the menu icon for the Symbol List)
+- `Address`: the virtual address for the symbol
+- `Kind`: may be one of "Folder", Function", "Data", and "Bare Symbol"
+- `Section`: the section of the binary the symbol appears in
+
+Additionally, the following columns are hidden by default and can be enabled by right-clicking the header:
+
+- `Total Bytes`: tn the case of functions, the sum of size of basic blocks
+
+These columns can be re-arranged, hidden, and used for sorting.
+
+Sort by a given column simply by clicking it. Click it again to toggle between ascending and descending sort order.
+
+Columns can be re-arranged via dragging.
+
+#### New Folder with Selection
+"New Folder with Selection" will create a new folder containing the selected items.
+When this is done within a folder, the folder will be created within the shared parent.
+
+![symbols list >](../img/symbols-right-click.png "Symbols List: Right clicking with several symbols selected, and then clicking 'New Folder with Selection'"){ width="600" }
+
+#### Via Dragging
+
+Dragging several items onto another non-folder item will create a folder containing the dragged items and the item they were dropped on.
+
+#### Moving Items into Folders
+
+Dragging several items onto or into a folder will move the items into that folder.
+
+#### "Remove from Folder"
+
+The "Remove from Folder" context menu option will move a given item or items to the root of the tree.
+
+### Types
+
+The Types View can be used as a sidebar panel or as a pane in the main view. The UI is exactly the same except for the default vertical versus horizontal. For more details, see the [Types View](types/basictypes.md#types-view) documentation.
+
+### Tags/Bookmarks
+
+![tags ><](../img/tags.png "Tags"){ width="600" }
+
+The tags panel allows you to both change existing tag categories, add your own categories, and also review any existing tags or bookmarks. Bookmarks are just tags with default hotkeys bound to them for both setting them and navigating them. The default keybinding to set a bookmark is `[CTRL-ALT] 1` through `[CTRL-ALT] 0` representing Bookmarks 1-10. The default hotkeys for navigating them are `[CTRL] 1` through `[CTRL] 0`. See the [keybindings](#custom-hotkeys) section for information on changing the default keybindings.
+
+### Memory Map
+
+![memory map ><](../img/memory-map.png "Memory Map"){ width="600" }
+
+The "Memory Map" pane and sidebar widget show segments and sections currently present in the binary, allows some modification of automatically added sections, and allows adding, modifying, and deleting user segments and sections.
+
+![memory map icon <](../img/memory-map-icon.png "Memory Map Icon")
+
+To access it, use either the icon in the sidebar to open the panel, or use the view drop-down in the main pane, or use the command-palette!
+
+When a segment is selected (highlighted in blue) related sections will be outlined (white border).
+
+Likewise, when a section is selected, related segments will be outlined.
+
+The sorting order of segments and sections can be changed by clicking on any column header.
+
+### External Links
+
+![External Links](../img/external-links.png "External Links"){ width="400" }
+
+External Links allow files in projects to connect to one another, so you could, for example, have an analysis database of an executable as well as multiple libraries it imports and follow references between the two. See the [projects documentation](projects.md#external-links) for more information.
+
+### Mini-Graph
+
+![mini graph](../img/mini-graph.png "Mini-Graph"){ width="400" }
+
+The Mini Graph only shows content when the currently selected main pane contains a [Graph view](#graph-view). The preview region is shown as a gray box that can be dragged to navigate the larger graph.
+
+### Cross References
+
+The Cross References view in the lower-left section of the sidebar shows all cross-references to the currently selected address, address range, variable or type. This pane will change depending on whether an entire line is selected (all cross-references to that address/type/variable are shown), or whether a specific token within the line is selected. For instance if you click on the symbol `memmove` in `call memmove` it will display all known cross-references to `memmove`, whereas if you click on the line the `call` instruction is on, you will only get cross-references to the address of the call instruction. Cross-references can be either incoming or outgoing, and they can be either data, code, type, or variable.
+
+![Cross References](../img/cross-reference-tree.png "xrefs"){ width="600" }
+
+#### Code References
+
+Code references are references to or from code, but not necessarily _to_ code. Code References can reference, code, data, or structure types. Code References are inter-procedural, and unfortunately due to speed considerations we currently only show disassembly (rather than an IL) when displaying these types of references. In a future version we hope to address this limitation.
+
+#### Data References
+
+Data References are references created _by_ data (i.e. pointers), not necessarily _to_ data. Outgoing Data References are what is pointed to by the currently selected data. Incoming Data References are the set of data pointers which point to this address.
+
+#### Variable References
+
+Variable References are all the set of uses of a given variable. As these references are intraprocedural we're able to show the currently viewed IL in the preview.
+
+#### Type References
+
+Type References are references to types and type members made by other types, perhaps more accurately called Type-to-Type-References.
+
+#### Tree-based Layout
+The cross-references pane comes in two different layouts: tree-based (default and shown above) and table-based (this can be toggled through the context menu or the command palette). The tree-based layout provides the most condensed view, allowing users to quickly see (for instance) how many references are present to the current selection overall and by function. It also allows collapsing to quickly hide uninteresting results.
+
+#### Table-based Layout
+
+![xrefs](../img/cross-reference-table.png "xrefs table"){ width="600" }
+
+The table-based layout provides field-based sorting and multi-select. Clicking the `Filter` text expands the filter pane, showing options for filtering the current results.
+
+#### Cross-Reference Filtering
+
+![xrefs](../img/cross-reference-filter.png "xrefs filter"){ width="500" }
+
+The first of the two drop down boxes allows the selection of incoming, outgoing, or both incoming and outgoing (default). The second allows selection of code, data, type, or variable or any combination thereof. The text box allows regular expression matching of results. When a filter is selected the `Filter` display changes from `Filter (<total-count>)` to `Filter (<total-filtered>/<total-count>)`
+
+#### Cross-Reference Pinning
+
+![xrefs](../img/cross-reference-panel-pin.png "xrefs panel pin"){ width="600" }
+
+By default, Binary Ninja's cross-reference pane is dynamic, allowing quick navigation to relevant references. Sometimes you might rather have the current references stick around, so they can be used as a sort of work-list. This workflow is supported in four different ways. First is the `Pin` checkbox (which is only visible if the `Filter` drop-down is open). This prevents the list of cross-references from being updated even after the current selection is changed.
+
+Alternatively clicking the `Pin Cross References to New Pane` button at the top right of the cross references pane in the sidebar, selecting `Pin Cross References` in the context menu or command palette, or using the `SHIFT+X` shortcut pops up a `Pinned Cross References` pane. This pane has a static address range which can only be updated through the `Pin Cross References` action. The third way would be to select (or multi-select in table view) a set of cross-references then right-click `Tag Selected Rows`. The tag pane can then be used to navigate those references. Tags allow for persistent lists to be saved to an analysis database whereas the other options only last for the current session.
+
+#### Cross-Reference Hotkeys
+
+* `x` - Focus the cross-references pane
+* `[SHIFT] x` Create a new pinned cross-references pane
+* `[OPTION/ALT] x` - Navigate to the next cross-reference
+* `[OPTION/ALT-SHIFT] x` - Navigate to the previous cross-reference
+
+The following are only available when the cross-references pane is in focus:
+
+* `[CMD/CTRL] f` - Open the filter dialog
+* `[ESC]` - Clear the search dialog
+* `[CMD/CTRL] a` - Select all cross-references
+* `[ARROW UP/DOWN]` - Select (but don't navigate) next/previous cross-reference
+* `[ENTER]` - Navigate to the selected reference
+
+### Console
+
+![console](../img/console.png "Console"){ width="800" }
+
+The Console panel by default only contains a single Python scripting console, however it is possible to create additional consoles using the `Create Python Console` command palette item.
+
+For many more details about using the python console, see below in the [Python console documentation](#script-python-console).
+
+### Variables
+
+![Variables](../img/variables.png "Variables"){ width="400" }
+
+The Variables sidebar panel will show local variables from the currently selected function. Possible variable values include:
+
+ - Register Variables (R)
+ - Stack Variables (S)
+ - Flag Variables (F)
+ - Data Variables (D)
+
+ Note that this sidebar is sensitive to function. Possible value set values will be shown for variables based on the currently selected offset in the function.
+
+### Stack
+
+![Stack](../img/stack.png "Stack"){ width="400" }
+
+The Stack sidebar panel shows the currently selected function's stack layout. You can create variables using the [usual](types/type.md#direct-ui-manipulation) hotkeys as well as using the right-click menu (which also shows the hotkeys).
+
+### Strings
-Once you have a file open, the sidebar lets you quickly access the most common features and keeps them available while you work, including:
+![Strings](../img/strings.png "Strings"){ width="700" }
-- symbols
-- types
-- function-specific local variables
-- context-sensitive stack state
-- strings
-- tags/bookmarks
-- a mini-graph of the current function
-- cross-references to the current selection
+The Strings sidebar panel shows all identified strings in the binary. See [working with strings](../dev/concepts.md#working-with-strings) for more information on how these strings are identified.
+
+### Find
+
+![Find](../img/find.png "Find"){ width="700" }
+
+The normal find dialog also exists as a sidebar panel that allows persistent, tabbed results. The `Filter` drop-down allows further filtering of identified results and supports regular expressions (though the main find search types do not).
+
+The search types are available from a drop-down next to the text input field and include:
+
+ - Escaped: Escaped strings such as `OneString\x09\Tabsx09Another`
+ - Hex: All values much be valid hex characters such as `ebfffc390` and the bytes will only be searched for in this particular order
+ - Raw: A simple string search that matches the exact string as specified
+ - Text: Searches the decompilation or whatever view is currently selected for disassembly, BNIL, or Pseudo C
+ - Constant: Useful for searching for a constant where the byte ordering is handled for you, such as `0x01020304`
+
+### Logs
+
+![Logs](../img/logs.png "Logs"){ width="700" }
+
+The log window lets you search and filter through logs. You can search by text or filter by loggers to identify messages of interest. By default, only the logs for a specific BinaryView that's open as well as any Global logs will show up but this setting can either be changed through the right-click menu or the drop down menu in the upper-right of the log window.
## Tiling Panes
-![tiling panes >](../img/tiling-panes.png "Tiling Panes")
+![tiling panes ](../img/tiling-panes.png "Tiling Panes"){ width="1000" }
Binary Ninja displays binaries in panes, whether shown as disassembly, hex, IL, or decompiler output. Tiling these panes allows for a wide variety of information to be displayed at the same time.
Each pane has display options at the top and can be split and synchronized with other panes (or groups of panes). The ☰ ("hamburger") menu in the top right of each pane allows for additional customization, including locking the pane to a single function.
-<!--
-TODO: Document pane synchronization, splitting, etc in more detail.
-### Synchronizing Panes
--->
-
## Feature Map
-![tiling panes <](../img/featuremap.png "Feature Map")
+![tiling panes >](../img/featuremap.png "Feature Map"){ width="100" }
The Feature Map is also displayed on the right of the main pane area. It provides a visual summary of the entire binary with different colors representing data variables, code, strings, functions/code, imports, externs, and libraries. It can be moved or hidden via the right-click menu. Note that these colors are theme-aware and will change if your theme does, but on the default Ninja Edit theme:
@@ -216,15 +444,15 @@ The Feature Map is also displayed on the right of the main pane area. It provide
### Command Palette
-![command palette](../img/command-palette.png "Command Palette")
+![command palette](../img/command-palette.png "Command Palette"){ width="800" }
One great feature for quickly navigating through a variety of options and actions is the `command palette`. Inspired by similar features in [Sublime](https://sublime-text-unofficial-documentation.readthedocs.io/en/sublime-text-2/extensibility/command_palette.html) and [VS Code](https://code.visualstudio.com/docs/getstarted/userinterface#_command-palette), the command-palette is a front end into an application-wide, context-sensitive action system that all actions, plugins, and hotkeys in the system are routed through.
-To trigger it, simply use the `[CMD/CTRL] p` hotkey. Note that the command-palette is context-sensitive and therefore some actions (for example, `Display as - Binary`) may only be available depending on your current view or selection. This is also available to plugins. For example, a plugin may use [PluginCommand.register](https://api.binary.ninja/binaryninja.plugin-module.html#binaryninja.plugin.PluginCommand.register) with the optional `is_valid` callback to determine when the action should be available.
+To trigger it, simply use the `[CMD/CTRL] p` hotkey. Note that the command-palette is context-sensitive and therefore some actions (for example, `Display as - Binary`) may only be available depending on your current view or selection. This is also available to plugins. For example, a plugin may use [`PluginCommand.register`](https://api.binary.ninja/binaryninja.plugin-module.html#binaryninja.plugin.PluginCommand.register) with the optional `is_valid` callback to determine when the action should be available.
### Custom Hotkeys
-![keybindings](../img/keybindings.png "Keybindings")
+![keybindings](../img/keybindings.png "Keybindings"){ width="800" }
Any action in the [action system](#command-palette) can have a custom hotkey mapped to it. To access the keybindings menu, use the `[CMD/CTRL-SHIFT] b` hotkey, via the `Edit / Keybindings...` (`Binary Ninja / Preferences / Keybindings...` on macOS) menu, or the `Keybindings` [command palette](#command-palette) entry. Any overlapping keybindings will be highlighted. Click the `Keybinding` column header to sort by keybindings in order to see what bindings are overlapping.
@@ -256,10 +484,11 @@ To search in the keybindings list, just click to make sure it's focused and star
- `t` : Switch to type view
- `y` : Change type of currently selected element
- `a` : Change the data type to an ASCII string
- - `[SHIFT] a` : Change the data type to a wchar_t string
- - `[CTRL-SHIFT] a` : Change the data type to a wchar32_t string
+ - `[SHIFT] a` : Change the data type to a `wchar_t` string
+ - `[OPT-SHIFT] a` (macOS) : Change the data type to a `wchar32_t` string
+ - `[CTRL-SHIFT] a` (Windows/Linux) : Change the data type to a `wchar32_t` string
- `1`, `2`, `4`, `8` : Change type directly to a data variable of the indicated widths
- - `f` : Switch data variable between floating point types of various precisions
+ - `f` : Switch data variable between floating point types of varying precision
- `d` : Switch between data variables of various widths
- `r` : Change the data type to single ASCII character
- `o` : Create a pointer data type
@@ -269,17 +498,17 @@ To search in the keybindings list, just click to make sure it's focused and star
- `[CMD-SHIFT] -` (macOS) : Graph view zoom out
- `[CTRL-SHIFT] +` (Windows/Linux) : Graph view zoom in
- `[CTRL-SHIFT] -` (Windows/Linux) : Graph view zoom out
- - Other hotkeys specifically for working with types are listed in the [type guide](type.md#direct-ui-manipulation)
+ - Other hotkeys specifically for working with types are listed in the [type guide](types/type.md#direct-ui-manipulation)
## Graph View
-![graph view](../img/graphview.png "Graph View")
+![graph view](../img/graphview.png "Graph View"){ width="800" }
Binary Ninja offers a graph view that groups the basic blocks of disassembly into visually distinct blocks with edges showing control flow between them.
Features of the graph view include:
-- Ability to double click edges to quickly jump between locations
+- Ability to double-click edges to quickly jump between locations
- Zoom (CTRL-mouse wheel)
- Zoom to Fit - Zooms out until the whole graph is visible (`w`)
- Zoom to Cursor - Zooms to 100% at the position of the cursor (`z`)
@@ -287,15 +516,15 @@ Features of the graph view include:
- Horizontal Scrolling (Bottom scroll bar as well as SHIFT-mouse wheel)
- Individual highlighting of arguments, addresses, immediate values, types, etc.
- Full type signature of current function shown in an interactive header:
- - Selecting elements in the header highlights them in the graph view
- - Change type (`y`) and Rename (`n`) shortcuts work on elements in the header
- - Reanalyze function button on left edge of the header
+ - Selecting elements in the header highlights them in the graph view
+ - Change type (`y`) and Rename (`n`) shortcuts work on elements in the header
+ - Reanalyze function button on left edge of the header
- Edge colors indicate whether the path is the true (green) or false (red) case of a conditional jump (a color-blind option in the preferences is useful for those with red-green color blindness) and blue for unconditional branches
- Context menu that can trigger some function-wide actions as well as some specific to the highlighted instruction (such as inverting branch logic or replacing a specific function with a NOP)
## View Options
-![options ><](../img/options.png "View options")
+![options >](../img/options.png "View options"){ width="400" }
Each of the views (Hex, Graph, Linear) have a variety of options configurable from the ☰ menu on the top right of the view pane.
@@ -335,7 +564,7 @@ Current options include:
## Hex View
-![hex >](../img/hex.png "hex view")
+![hex](../img/hex.png "hex view"){ width="800" }
The hexadecimal view is useful for viewing raw binary files that may or may not even be executable binaries and allows direct editing of the binary contents in place, regardless of the type of the binary. Any changes made in hex view will be reflected in all other [open views](#tiling-panes) of the same binary. The lock button on the right edge of the bottom status bar must be toggled off (🔓) to perform any direct editing in hex view -- this is to prevent unintended modification of the binary by accidental pasting or typing.
@@ -344,142 +573,18 @@ The hex view is particularly good for transforming data in various ways via the
???+ Warning "Tip"
Any changes made in the Hex view will take effect immediately in any other views open into the same file (new views can be created via the `Split to new tab`, or `Split to new window` options under `View`, or via [splitting panes](#tiling-panes)). This can, however, cause large amounts of re-analysis so be warned before making large edits or transformations in a large binary file.
-## Cross References Pane
-
-The Cross References view in the lower-left section of the sidebar shows all cross-references to the currently selected address, address range, variable or type. This pane will change depending on whether an entire line is selected (all cross-references to that address/type/variable are shown), or whether a specific token within the line is selected. For instance if you click on the symbol `memmove` in `call memmove` it will display all known cross-references to `memmove`, whereas if you click on the line the `call` instruction is on, you will only get cross-references to the address of the call instruction. Cross-references can be either incoming or outgoing, and they can be either data, code, type, or variable.
-
-![Cross References](../img/cross-reference-tree.png "xrefs")
-
-### Code References
-
-Code references are references to or from code, but not necessarily _to_ code. Code References can reference, code, data, or structure types. Code References are inter-procedural, and unfortunately due to speed considerations we currently only show disassembly (rather than an IL) when displaying these types of references. In a future version we hope to address this limitation.
-
-### Data References
-
-Data References are references created _by_ data (i.e. pointers), not necessarily _to_ data. Outgoing Data References are what is pointed to by the currently selected data. Incoming Data References are the set of data pointers which point to this address.
-
-### Variable References
-
-Variable References are all the set of uses of a given variable. As these references are intra-procedural we're able to show the currently viewed IL in the preview.
-
-### Type References
-
-Type References are references to types and type members made by other types, perhaps more accurately called Type-to-Type-References.
-
-### Tree-based Layout
-The cross-references pane comes in two different layouts: tree-based (default and shown above) and table-based (this can be toggled through the context menu or the command palette). The tree-based layout provides the most condensed view, allowing users to quickly see (for instance) how many references are present to the current selection overall and by function. It also allows collapsing to quickly hide uninteresting results.
-
-### Table-based Layout
-
-![xrefs](../img/cross-reference-table.png "xrefs table")
-
-The table-based layout provides field-based sorting and multi-select. Clicking the `Filter` text expands the filter pane, showing options for filtering the current results.
-
-### Cross-Reference Filtering
-
-![xrefs >](../img/cross-reference-filter.png "xrefs filter")
-
-The first of the two drop down boxes allows the selection of incoming, outgoing, or both incoming and outgoing (default). The second allows selection of code, data, type, or variable or any combination thereof. The text box allows regular expression matching of results. When a filter is selected the `Filter` display changes from `Filter (<total-count>)` to `Filter (<total-filtered>/<total-count>)`
-
-### Cross-Reference Pinning
-
-![xrefs >](../img/cross-reference-panel-pin.png "xrefs panel pin")
-
-By default Binary Ninja's cross-reference pane is dynamic, allowing quick navigation to relevant references. Sometimes you might rather have the current references stick around so they can be used as a sort of work-list. This workflow is supported in four different ways. First is the `Pin` checkbox (which is only visible if the `Filter` drop-down is open). This prevents the list of cross-references from being updated even after the current selection is changed.
-
-Alternatively clicking the `Pin Cross References to New Pane` button at the top right of the cross references pane in the sidebar, selecting `Pin Cross References` in the context menu or command palette, or using the `SHIFT+X` shortcut pops up a `Pinned Cross References` pane. This pane has a static address range which can only be updated through the `Pin Cross References` action. The third way would be to select (or multi-select in table view) a set of cross-references then right-click `Tag Selected Rows`. The tag pane can then be used to navigate those references. Tags allow for persistent lists to be saved to an analysis database whereas the other options only last for the current session.
-
-
-### Cross-Reference Hotkeys
-
-* `x` - Focus the cross-references pane
-* `[SHIFT] x` Create a new pinned cross-references pane
-* `[OPTION/ALT] x` - Navigate to the next cross-reference
-* `[OPTION/ALT-SHIFT] x` - Navigate to the previous cross-reference
-
-The following are only available when the cross-references pane is in focus:
-
-* `[CMD/CTRL] f` - Open the filter dialog
-* `[ESC]` - Clear the search dialog
-* `[CMD/CTRL] a` - Select all cross-references
-* `[ARROW UP/DOWN]` - Select (but don't navigate) next/previous cross-reference
-* `[ENTER]` - Navigate to the selected reference
-
## Linear View
-![linear](../img/linear.png "Linear View")
+![linear](../img/linear.png "Linear View"){ width="1000" }
Linear view is a hybrid view between a graph-based disassembly window and the raw hex view. It lists the entire binary's memory in a linear fashion and is especially useful when trying to find sections of a binary that were not properly identified as code or even just examining data.
Linear view is commonly used for identifying and adding type information for unknown data. To this end, as you scroll, you'll see data and code interspersed. Much like the graph view, you can turn on and off addresses via the command palette `Show Address` or the ☰ menu on the top right of the linear view pane. Many other [options](#view-options) are also available.
-## Symbols List
-
-The Symbols List is a powerful symbol organization and navigation tool. It allows sorting symbols by a variety of attributes,
-organizing them into folders (both manually, and automatically via the [API](https://api.binary.ninja/binaryninja.component-module.html#binaryninja.component.Component)), and much more.
-
-???+ Warning "Tip"
- Searching in the symbol list doesn't require focusing the search box. That the filter list here (and in the string panel) is a "fuzzy" search. Each space-separated keyword is used as a substring match and order matters. So: "M C N" for example would match "MyClassName".
-
-### Columns
-
-The Symbol List shows the following columns by default:
-
-- `Name`: the [short name](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.CoreSymbol) of the symbol (can be changed to the [raw name](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.CoreSymbol) in the menu icon for the Symbol List)
-- `Address`: the virtual address for the symbol
-- `Kind`: may be one of "Folder", Function", "Data", and "Bare Symbol"
-- `Section`: the section of the binary the symbol appears in
-
-Additionally, the following columns are hidden by default and can be enabled by right-clicking the header:
-
-![symbols list >](../img/symbols_header_menu.png "Symbols List Header Menu")
-
-- `Total Bytes`: tn the case of functions, the sum of size of basic blocks
-
-These columns can be re-arranged, hidden, and used for sorting.
-
-Sort by a given column simply by clicking it. Click it again to toggle between ascending and descending sort order.
-
-Rearrange columns by dragging them into the order you'd prefer:
-
-![symbols list >](../img/symbols_header_drag.png "Symbols List: Dragging a column")
-
-### New Folder with Selection
-"New Folder with Selection" will create a new folder containing the selected items.
-When this is done within a folder, the folder will be created within the shared parent.
-
-![symbols list >](../img/symbols_right_click_NFwS.png "Symbols List: Right clicking with several symbols selected, and then clicking 'New Folder with Selection'")
-
-### Via Dragging
-
-Dragging several items onto another non-folder item will create a folder containing the dragged items and the item they were dropped on.
-
-### Moving Items into Folders
-
-Dragging several items onto or into a folder will move the items into that folder.
-
-![symbols list >](../img/symbols_dragtocreate.png "Symbols List: Dragging several functions onto another function")
-
-### "Remove from Folder"
-
-The "Remove from Folder" context menu option will move a given item or items to the root of the tree.
-
-## Memory Map
-
-![memory map >](../img/memory-map.png "Memory Map")
-
-The "Memory Map" sidebar widget shows segments and sections currently present in the binary, allows some modification of automatically added sections, and allows adding, modifying, and deleting user segments and sections.
-
-When a segment is selected (highlighted in blue) related sections will be outlined (white border).
-
-Likewise, when a section is selected, related segments will be outlined.
-
-The sorting order of segments and sections can be changed by clicking on any column header.
-
## Edit Function Properties Dialog
-![Edit Function Properties Dialog ><](../img/efp_dialog_diagram.png "Edit Function Properties Dialog")
+![Edit Function Properties Dialog >](../img/efp-dialog-diagram.png "Edit Function Properties Dialog"){ width="600" }
The “Edit Function Properties” dialog provides the ability to easily configure some of a function’s more advanced properties. It can be opened via the context menu when a function is focused in the graph or linear views, or via the command palette. An overview of the UI is as follows:
@@ -497,6 +602,8 @@ The “Edit Function Properties” dialog provides the ability to easily configu
1. **Calling convention.** The calling convention this function uses. All calling conventions for the function’s architecture are available as choices.
1. **Stack adjustment.** How many _extra_ bytes does this function remove from the stack upon return?
1. **Has variable arguments.** Does this function accept a variable number of arguments?
+1. **Can return.** Functions that cannot return will halt disassembly on branches where they are called
+1. **Pure.** Functions that are pure are assumed to have no side effects and may be inlined if their return value is trivial
1. **Inline during analysis.** Causes the function to be [inlined](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function.inline_during_analysis) during analysis.
1. **Clobbered registers.** The list of registers that this function clobbers; individual registers can be checked or unchecked.
1. **Return registers.** The list of registers that this function returns data in; individual registers can be checked or unchecked.
@@ -504,7 +611,7 @@ The “Edit Function Properties” dialog provides the ability to easily configu
## High Level IL
-![HLIL Scoping Options >](../img/hlil-scope.png "HLIL Scoping Options")
+![HLIL Scoping Options >](../img/hlil-scope.png "HLIL Scoping Options"){ width="400" }
Binary Ninja features a decompiler that produces High Level IL (HLIL) as output. HLIL is not intended to be a representation of the code in C, but some users prefer to have a more C-like scoping style.
@@ -512,31 +619,31 @@ You can control the way HLIL appears in the settings.
The different options are shown below:
-![HLIL Scoping Display](../img/hlil-braces.png "HLIL Scoping Display")
+![HLIL Scoping Display](../img/hlil-braces.png "HLIL Scoping Display"){ width="500" }
## Pseudo C
-![Pseudo C >](../img/pseudo-c.png "Pseudo C View")
+![Pseudo C](../img/pseudo-c.png "Pseudo C View"){ width="800" }
-Binary Ninja offers an option to render the HLIL as a decompilation to "Pseudo C". This decompilation is intended to be more familiar to the user than the HLIL. It is not necessarily intended to be "compliant" C or even recompilable. In some cases, it may be possible to edit it into a form that a C compiler will accept, but the amount of effort required will vary widely and no guarantee is made that it will be possible in all cases.
+Binary Ninja offers an option to render the HLIL as a decompilation to "Pseudo C". This decompilation is intended to be more familiar to the user than the HLIL. It is not necessarily intended to be "compliant" C or even recompilable. In some cases, it may be possible to edit it into a form that a C compiler will accept, but the amount of effort required will vary widely, and no guarantee is made that it will be possible in all cases.
## Dead Store Elimination
Binary Ninja tries to be conservative with eliminating unused variables on the stack. When the analysis finds a variable that cannot be eliminated but does not appear to be used, the assignment will appear grayed out in the decompiler output. The first two lines of the function below show this:
-![Dead Stores](../img/dead-store-example.png "Dead Stores")
+![Dead Stores](../img/dead-store-example.png "Dead Stores"){ width="500" }
-In this case, these variables are actually unused and can be eliminated. You can tell Binary Ninja to do this by right clicking on the variable and choosing "Allow" from the "Dead Store Elimination" submenu.
+In this case, these variables are actually unused and can be eliminated. You can tell Binary Ninja to do this by right-clicking on the variable and choosing "Allow" from the "Dead Store Elimination" submenu.
-![Dead Store Elimination Menu](../img/dead-store-menu.png "Dead Store Elimination Menu")
+![Dead Store Elimination Menu](../img/dead-store-menu.png "Dead Store Elimination Menu"){ width="500" }
Performing this action on both variables in the example results in the following output:
-![Dead Store Elimination Results](../img/dead-store-after.png "Dead Store Elimination Results")
+![Dead Store Elimination Results](../img/dead-store-after.png "Dead Store Elimination Results"){ width="500" }
## Merging and Splitting Variables
-Binary Ninja can not always determine when two variables are simple copies of one another. When this condition occurs these variables can be merged in one of two ways.
+Binary Ninja automatically splits all variables that the analysis determines to be safely splittable. This allows the user to assign different types to different uses of the same register or memory location. Sometimes, however, the code is more clear if two or more of these variables are merged together into a single variable.
### Merge Variable Here
@@ -544,9 +651,9 @@ The `Merge Variable Here` action is bound to the hotkey `+` (i.e. `Shift + =` )
### Merge Variables
-For more complicated situations you can select the variable in question and use the "Merge Variables" dialog. By default this dialog is bound to the `=` hotkey. The dialog provides you with a searchable list of variables that can be merged or unmerged.
+For more complicated situations you can select the variable in question and use the "Merge Variables" dialog. By default, this dialog is bound to the `=` hotkey. The dialog provides you with a searchable list of variables that can be merged or unmerged.
-![Merge Variables](../img/merge-variables.png)
+![Merge Variables](../img/merge-variables.png){ width="400" }
There are 3 categories of variables that you can select from.
@@ -556,9 +663,32 @@ There are 3 categories of variables that you can select from.
Any of these merges can be undone if you determine them to be done in error by either using "Undo" or by bringing up this dialog again and unchecking the variables in question.
+### Removing Merges
+
+To unmerge a variable, either select "Split Merged Variable" from the context menu, or reenter the "Merge Variables..."
+dialog and deselect the variables that should no longer be merged.
+
+### Split Variables
+
+![Split Variable >](../img/split-var.png "Split Variable"){ width="200" }
+
+Variables that have multiple definitions can be manually split into multiple variables by clicking on the
+variable at a definition site and selecting "Split Variable at Definition" from the context menu.
+
+!!! Warning "Warning"
+ Splitting a variable manually can cause IL and decompilation to be incorrect. There are some
+ patterns where variables can be safely split semantically but analysis cannot determine that
+ it is safe, and this feature is provided to allow variable splitting to be performed in these
+ cases.
+
+Manually split variables will initially provide the selected definition as a separate variable, and all other
+definitions will be automatically resolved into one or more other variables. If some of the definitions should
+have been included as part of the same variable, use "Merge Variables..." from the context menu after splitting
+to select which of the other definitions should be merged.
+
## Script (Python) Console
-![console >](../img/console.png "Console")
+![console](../img/console.png "Console"){ width="800" }
The integrated script console is useful for small scripts that aren't worth writing as full plugins.
@@ -567,7 +697,7 @@ To trigger the console, either use `<BACKTICK>`, or use the `View`/`Python Conso
???+ Warning "Tip"
Note that `<BACKTICK>` will work in most contexts to open the console and focus its command line, unless the UI focus is in an editor widget.
-![console >](../img/console-split.png "Console Split")
+![console](../img/console-split.png "Console Split"){ width="800" }
When both the Script Console and the Log view are open, the title of both acts as a tab that can be dragged to either a tabbed view showing only one at a time (the default) or a split view showing both. Currently, the console and log views are part of a "Global Area", meaning they are always visible in the same position when switching between open binary tabs in the same window. This means they can only dock with each other, and not with the sidebar or the main pane view area. It is possible to open additional scripting consoles via the `Create Python Console` action in the [command palette](#command-palette), and these new consoles will appear as additional tabs in the topmost, leftmost tab in the global area. Note that `<BACKTICK>` will always focus the original main scripting console, and while any of the other created consoles can be closed (using the button that will appear when hovering over the right edge of its tab), the original one cannot be closed.
@@ -581,37 +711,37 @@ The scripting console is not a full IDE, but it has several convenience features
### Magic Console Variables
-The interactive python prompt also has several built-in "magic" functions and variables. Some are read-only, and some are writable to provide convenient interacitivty between the UI and console:
+The interactive python prompt also has several built-in "magic" functions and variables. Some are read-only, and some are writable to provide convenient interactivity between the UI and console:
- `here` / `current_address`: address of the current selection. It's settable too and will navigate the UI if changed
- `current_selection`: a tuple of the start and end addresses of the current selection. It's settable and will change the current selection
- `current_raw_offset`: the file offset that corresponds the current address. It's settable and will navigate to the corresponding file offset
-- `bv` / `current_view` / : the current [BinaryView](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView)
-- `current_function`: the current [Function](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function)
-- `current_basic_block`: the current [BasicBlock](https://api.binary.ninja/binaryninja.basicblock-module.html#binaryninja.basicblock.BasicBlock)
-- `current_llil`: the current [LowLevelILFunction](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILFunction)
-- `current_mlil`: the current [MediumLevelILFunction](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILFunction)
-- `current_hlil`: the current [HighLevelILFunction](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILFunction)
+- `bv` / `current_view` / : the current [`BinaryView`](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView)
+- `current_function`: the current [`Function`](https://api.binary.ninja/binaryninja.function-module.html#binaryninja.function.Function)
+- `current_basic_block`: the current [`BasicBlock`](https://api.binary.ninja/binaryninja.basicblock-module.html#binaryninja.basicblock.BasicBlock)
+- `current_llil`: the current [`LowLevelILFunction`](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILFunction)
+- `current_mlil`: the current [`MediumLevelILFunction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILFunction)
+- `current_hlil`: the current [`HighLevelILFunction`](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILFunction)
- `write_at_cursor(data)`: function that writes data to the start of the current selection
- `get_selected_data()`: function that returns the data in the current selection
-- `current_il_index`: the current index of the IL instruction. It can be LLIL/MLIL/HLIL depending which one is shown in the UI
-- `current_il_instruction`: the current IL instruction. It can be LLIL/MLIL/HLIL depending which one is shown in the UI
-- `current_il_function`: the current IL function. It can be LLIL/MLIL/HLIL depending which one is shown in the UI
-- `current_il_basic_block`: the current IL basic block. It can be LLIL/MLIL/HLIL depending which one is shown in the UI
-- `current_token`: the current selected [InstructionTextToken](https://api.binary.ninja/binaryninja.architecture-module.html#binaryninja.architecture.InstructionTextToken). None if no token is selected
-- `current_data_var`: the current selected [DataVariable](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.DataVariable). None if no data variable is selected
-- `current_sections`: the list of [Section](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.Section)s that the current address is in. This the list can be empty
-- `current_segment`: the [Segment](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.Segment) that the current address is in.
+- `current_il_index`: the current index of the IL instruction. It can be LLIL/MLIL/HLIL depending on which one is shown in the UI
+- `current_il_instruction`: the current IL instruction. It can be LLIL/MLIL/HLIL depending on which one is shown in the UI
+- `current_il_function`: the current IL function. It can be LLIL/MLIL/HLIL depending on which one is shown in the UI
+- `current_il_basic_block`: the current IL basic block. It can be LLIL/MLIL/HLIL depending on which one is shown in the UI
+- `current_token`: the current selected [`InstructionTextToken`](https://api.binary.ninja/binaryninja.architecture-module.html#binaryninja.architecture.InstructionTextToken). None if no token is selected
+- `current_data_var`: the current selected [`DataVariable`](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.DataVariable). None if no data variable is selected
+- `current_sections`: the list of [`Section`](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.Section)s that the current address is in. This the list can be empty
+- `current_segment`: the [`Segment`](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.Segment) that the current address is in.
- `current_comment`: the comment at the current address. Writing to it sets comment at the current address
-- `current_symbol`: the [Symbol](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol) at the current address. None if there is no symbol
-- `current_symbols`: the list of [Symbol](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol)s at the current address
-- `current_var`: the current selected [Variable](https://api.binary.ninja/binaryninja.variable-module.html?highlight=variable#binaryninja.variable.Variable) in a function. Not to be confused with `current_data_var`
-- `current_ui_context`: the current [UIContext](https://api.binary.ninja/cpp/class_u_i_context.html)
-- `current_ui_view_frame`: the current [ViewFrame](https://api.binary.ninja/cpp/class_view_frame.html)
-- `current_ui_view`: the current [View](https://api.binary.ninja/cpp/class_view.html)
-- `current_ui_action_handler`: the current [UIActionHandler](https://api.binary.ninja/cpp/class_u_i_action_handler.html)
-- `current_ui_view_location`: the current [ViewLocation](https://api.binary.ninja/cpp/class_view_location.html)
-- `current_ui_action_context`: the current [UIActionContext](https://api.binary.ninja/cpp/struct_u_i_action_context.html)
+- `current_symbol`: the [`Symbol`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol) at the current address. None if there is no symbol
+- `current_symbols`: the list of [`Symbol`](https://api.binary.ninja/binaryninja.types-module.html#binaryninja.types.Symbol)s at the current address
+- `current_var`: the current selected [`Variable`](https://api.binary.ninja/binaryninja.variable-module.html?highlight=variable#binaryninja.variable.Variable) in a function. Not to be confused with `current_data_var`
+- `current_ui_context`: the current [`UIContext`](https://api.binary.ninja/cpp/class_u_i_context.html)
+- `current_ui_view_frame`: the current [`ViewFrame`](https://api.binary.ninja/cpp/class_view_frame.html)
+- `current_ui_view`: the current [`View`](https://api.binary.ninja/cpp/class_view.html)
+- `current_ui_action_handler`: the current [`UIActionHandler`](https://api.binary.ninja/cpp/class_u_i_action_handler.html)
+- `current_ui_view_location`: the current [`ViewLocation`](https://api.binary.ninja/cpp/class_view_location.html)
+- `current_ui_action_context`: the current [`UIActionContext`](https://api.binary.ninja/cpp/struct_u_i_action_context.html)
### startup.py
@@ -631,7 +761,7 @@ The "Run Script..." option in the File Menu allows loading a python script from
within the console. It can also be run via the Command Palette or bound to a key.
The script will have access to the same variables the Python console does, including the built-in special functions and
-variables defined by BinaryNinja, and any variables you have already defined within the console. It may be helpful to
+variables defined by Binary Ninja, and any variables you have already defined within the console. It may be helpful to
think of it as an equivalent to pasting the contents of the script within the console.
While `__name__` in the console is set to `'__console__'`, within a script it will be set to `'__main__'`. `__file__` is not
@@ -650,7 +780,7 @@ Note
Plugins can be installed by one of two methods. First, they can be installed via the Plugin Manager accessed via the `Plugins` / `Manage Plugins` menu or `[CMD/CTRL] m` hotkey.
-![plugin manager >](../img/plugin-manager.png "Plugin Manager")
+![plugin manager](../img/plugin-manager.png "Plugin Manager"){ width="1000" }
Second, they can be manually installed by adding the plugin (either a `.py` file or a folder implementing a python module with a `__init__.py` file) to the appropriate path:
@@ -662,10 +792,10 @@ For more detailed information on using plugins, see the [plugin guide](plugins.m
## Loading PDBs
-Binary Ninja supports loading PDB files through a built in PDB loader. It will automatically search for a corresponding PDB file whenever you load a Windows executable or library that was compiled with a PDB. The PDB loader will search a variety of places for PDBs, in the following order, if the files exist and match the guid in the analyzed file:
+Binary Ninja supports loading PDB files through a built-in PDB loader. It will automatically search for a corresponding PDB file whenever you load a Windows executable or library that was compiled with a PDB. The PDB loader will search a variety of places for PDBs, in the following order, if the files exist and match the GUID in the analyzed file:
-1. Look in symbol servers defined in the `_NT_SYMBOL_PATH` environment variable, as defined by [Microsoft's documentation](https://learn.microsoft.com/en-us/windows/win32/debug/using-symsrv).
-2. Look for the file at the path specified in the loaded binary. E.g. when `C:\Users\foo\foo.exe` was compiled, it stored `C:\Users\foo\foo.pdb` as metadata inside `foo.exe`, so `C:\Users\foo\foo.pdb` will be loaded if it exists (and matches the guid).
+1. Look in symbol servers defined in the `_NT_SYMBOL_PATH` environment variable, as defined by [Microsoft's documentation](https://learn.microsoft.com/en-us/windows/win32/debug/using-symsrv).
+2. Look for the file at the path specified in the loaded binary. E.g. when `C:\Users\foo\foo.exe` was compiled, it stored `C:\Users\foo\foo.pdb` as metadata inside `foo.exe`, so `C:\Users\foo\foo.pdb` will be loaded if it exists (and matches the guid).
3. Look in the same directory as the opened file/bndb (e.g. If you have opened `C:\foo.exe` or `C:\foo.bndb`, the PDB plugin looks for `C:\foo.pdb`)
4. Look in the local symbol store. This is the directory specified by `pdb.files.localStoreAbsolute` in the settings, if it exists. Otherwise, this is a folder relative to the Binary Ninja user directory, specified by the `pdb.files.localStoreRelative` setting (and possibly the `BN_USER_DIRECTORY` environment variable). This directory has the structure `<symbol store>\foo.pdb\<guid>\foo.pdb`, equivalent to a regular symbol server.
5. Attempt to connect and download the PDB from the list of symbol servers specified in setting `pdb.files.symbolServerList`, in order.
@@ -688,15 +818,15 @@ The PDB loader comes with a couple configuration options which enable and disabl
Binary Ninja now comes with a debugger plugin that can debug executables on Windows, Linux, and macOS.
-For more detailed information on plugins, see the [debugger guide](debugger.md).
+For more detailed information on plugins, see the [debugger guide](debugger/index.md).
## Updates
Binary Ninja automatically updates itself by default. This functionality can be disabled in the `Update Channel` dialog (`[CMD/CTRL] p`, `Update Channel`, or under the `Preferences` sub menu available under `Edit` on Linux and Windows, and the Application menu on macOS) preferences by turning off the `Update to latest version automatically` option. Regardless of whether automatic updates are enabled, it is always possible to check for updates by selecting `Check for Updates...` from either the command palette or under `Help` menu on Linux and Windows, and the Application menu on macOS.
-Updates are silently downloaded in the background and when complete an option to restart is displayed in the status bar. When an update is available but has not been applied, a blue up arrow will appear in the status bar. Clicking this arrow will apply the update once it ensures it has the lastest update, downloading it if necessary. Once the update is complete, a green arrow will appear in its place with the message "Restart to Apply Update". Even if the arrow is not clicked, once the arrow is green, Binary Ninja will replace itself with the new version as it launches whenever it is restarted.
+Updates are silently downloaded in the background and when complete an option to restart is displayed in the status bar. When an update is available but has not been applied, a blue up arrow will appear in the status bar. Clicking this arrow will apply the update once it ensures it has the latest update, downloading it if necessary. Once the update is complete, a green arrow will appear in its place with the message "Restart to Apply Update". Even if the arrow is not clicked, once the arrow is green, Binary Ninja will replace itself with the new version as it launches whenever it is restarted.
-On windows, this is achieved through a separate launcher that loads first and replaces the installation before launching the new version which you'll notice as a separate window. On macOS and Linux, the original installation is overwritten after the update occurs as these operating systems allow files to be replaced while running. The update on restart is thus immediate.
+On Windows, this is achieved through a separate launcher that loads first and replaces the installation before launching the new version which you'll notice as a separate window. On macOS and Linux, the original installation is overwritten after the update occurs as these operating systems allow files to be replaced while running. The update on restart is thus immediate.
Note
???+ Warning "Tip"
@@ -704,7 +834,7 @@ Note
### Development Branch
-Binary Ninja [stable builds](https://binary.ninja/changelog) releases happen on semi-regular intervals throughout the year. However, we also make development builds available to customers with active support. Simply use the update dialog, and select one of the "Development" channels in the `Update Channel` field.
+Binary Ninja [stable builds](https://binary.ninja/changelog) releases happen on semiregular intervals throughout the year. However, we also make development builds available to customers with active support. Simply use the update dialog, and select one of the "Development" channels in the `Update Channel` field.
## Support
diff --git a/docs/guide/migration/index.md b/docs/guide/migration/index.md
new file mode 100644
index 00000000..83309c50
--- /dev/null
+++ b/docs/guide/migration/index.md
@@ -0,0 +1,21 @@
+# Migrating from Other Tools
+
+Thank you for trying Binary Ninja! We know that it can be a bit different from what you're used to, so this page dedicated to getting you oriented in your new favorite decompiler!
+
+If you haven't already installed Binary Ninja, you can follow our [installation guide](../../getting-started.md#installing-binary-ninja).
+
+And be sure to check out some of our additional resource below before you click away!
+
+We have quick start guides for the following:
+
+- [New Users](../../getting-started.md)
+- [IDA Pro Users](migrationguideida.md)
+- [Ghidra Users](migrationguideghidra.md)
+
+## Additional Resources
+
+We love our community! Feel free to hang with us and chat in our [Public Slack Server](https://slack.binary.ninja). Our community is great about answering questions for each other, but one of our engineers will often get to your question first as well. We have a lot of different channels for different levels of engineers, different interests, topics, and so on.
+
+Our community has also generated a tremendous number of [community plugins](https://github.com/Vector35/community-plugins) that provide support for new architectures, automate different types of analysis, and even some that provide new and advanced visualizations for your programs. That repo also contains instructions for how to get your own plugin into our [plugin manager](../plugins.md#plugin-manager).
+
+If you think you've found a bug or have a suggestion for us, tell us over on [GitHub](https://github.com/Vector35/binaryninja-api). There are [discussions](https://github.com/Vector35/binaryninja-api/discussions) over there if you'd prefer to ask us something on GitHub instead of Slack. GitHub also hosts the vast majority of our [API and scripting examples](../../dev/cookbook.md) to help you start automating tasks! If you're really passionate about getting something fixed, we have [a _ton_ of open source repos](https://github.com/Vector35/binaryninja-api?tab=readme-ov-file#related-repositories) to contribute to, including every single one of our core architecture plugins.
diff --git a/docs/guide/migration/migrationguideghidra.md b/docs/guide/migration/migrationguideghidra.md
new file mode 100644
index 00000000..88f32675
--- /dev/null
+++ b/docs/guide/migration/migrationguideghidra.md
@@ -0,0 +1,119 @@
+# Migrating from Ghidra
+
+## Starting Binary Ninja
+
+Binary Ninja starts with the [New Tab Page](../index.md#new-tab) open. From here, you can optionally [start a project](../projects.md#creating-a-project) to work with multiple files, navigate your offline docs from the help menu, or just [open existing files](../index.md#loading-files) (including drag-and-drop!).
+
+## Decompiler Settings
+
+Binary Ninja likes to stay out of your way as much as possible, but sometimes you need to dig into the settings and change how a file is analyzed. If you have a file that can be opened with default settings, you won't get prompted for any additional input. Binary Ninja will automatically analyze the entire file — including running [linear sweep](https://binary.ninja/2017/11/06/architecture-agnostic-function-detection-in-binaries.html) — and provide you with linear decompilation for the whole file (like Ghidra's linear disassembly, but as decomp by default).
+
+If you're opening a [Universal Mach-O](https://en.wikipedia.org/wiki/Universal_binary), the Open with Options dialogue will appear so that you can choose which architecture to open (in the top right). If you have a default architecture you want to open whenever you open a universal binary, you can set your preference in a setting called [Universal Mach-O Architecture Preference](../settings.md#all-settings). You'll also see the Open with Options dialogue when Binary Ninja is unable to recognize the file type or otherwise needs user input to analyze the file (can't find the entry point, needs you to provide some memory mappings, etc).
+
+It's worth digging into Binary Ninja's [settings](../settings.md) and seeing what's available to tune, but if you ever want to change a setting for a single binary, you can Open (it) with Options. Go to File -> Open with Options, and any settings you change will apply to only that file.
+
+<!-- TODO : Can you analyze a file while Ghidra is running its analysis?
+## Analyzing While Analyzing -->
+
+## Keybindings
+
+Binary Ninja's keybindings are very different from Ghidra. Thankfully, [Binary Ninja's action system](https://binary.ninja/2024/02/15/command-palette.html) allows you to easily find actions and view the keybindings extremely easily. It'll also save you from digging through unfamiliar right-click menus while helping you learn any new keybindings. All actions can have their keybinding set, changed, or removed in the [keybindings menu](../index.md#default-hotkeys).
+
+Some of the most useful default keybindings are as follows:
+
+Analysis Keybindings:
+
+| Action | Keybinding |
+|----------------------|--------------------|
+| Rename | `N` |
+| Set Type | `Y` |
+| Go to | `G` |
+| Toggle Disasm/Decomp | `[TAB]` |
+| Toggle Graph/Linear | `[SPACE]` |
+| Toggle Hex View | `H` |
+| Insert Comment | `;` |
+| Manage Plugins | `[CTRL/⌘-SHIFT-B]` |
+| Open Command Palette | `[CTRL/⌘-P]` |
+| Open Python Console | `\`` |
+
+Types Keybindings:
+
+| Action | Keybinding |
+|----------------------|------------|
+| Set Type | Y |
+| Make C String | A |
+| Make Magic Struct | S |
+| Open Types Menu | T |
+| Make 1-byte elements | 1 |
+| Make 2-byte elements | 2 |
+| Make 4-byte elements | 4 |
+| Make 8-byte elements | 8 |
+| Make array | * |
+
+Common System Keybindings:
+
+| Action | Keybinding |
+|-------------------|--------------------|
+| Open File | `[CTRL/⌘-O]` |
+| Open with Options | `[CTRL/⌘-SHIFT-O]` |
+| Save | `[CTRL/⌘-S]` |
+| Undo | `[CTRL/⌘-Z]` |
+| Redo | `[CTRL/⌘-SHIFT-Z]` |
+| Find | `[CTRL/⌘-F]` |
+| Open Settings | `[CTRL/⌘-,]` |
+| Open Keybindings | `[CTRL/⌘-SHIFT-B]` |
+
+## Layout
+
+Binary Ninja's layout is also a bit different from what you're used to in Ghidra, but thankfully Binary Ninja's UI is flexible enough to allow us to build something that will feel familiar.
+
+### Theme
+
+This doesn't exactly have to do with your layout, but it go a long way towards making the interface feel a bit more familiar. We have an expansive list of [community themes](https://github.com/Vector35/community-themes), and [a guide](../../dev/themes.md) and a [blog post](https://binary.ninja/2021/07/08/creating-great-themes.html) on how to make your own. The built-in "Classic" theme should feel nostalgic, but if you're looking for a light theme that's slightly easier on the eyes, try out Summer or Solarized Light.
+
+### Feature Map
+
+Binary Ninja's [feature map](../index.md#feature-map) lives on the right side of your main view area. If you'd rather not see it, you can right-click it and select "Hide Feature Map."
+
+### Sidebars
+
+Our sidebars have a whole host of customization options, so make sure to check out [their dedicated docs](../index.md#the-sidebar) to maximize your workflow.
+
+That said, I'll walk you through how to set up your sidebars to get it looking very similar to what you're used to in Ghidra.
+
+#### Program Tree
+
+But first, there are a couple caveats. Binary Ninja does not have an exact 1-to-1 widget for everything in Ghidra. The Program Tree is one of those elements; it's a little bit like our memory map, but it's also kinda not. Our new Binary Ninja layout assumes you've closed the program tree in Ghidra. Now Binary Ninja and Ghidra's sidebars are starting to match by having the symbols view on the top (which we start as a flat listing for you to organize into file yourself), and a different sidebar panel below it. Be sure to check out the options in the Symbols list's hamburger menu (the three lines in the top right).
+
+#### Cross References and Types Manager
+
+We show cross references by default, but you can toggle that just by clicking it off on the left side under the divider line. If you want to match how Ghidra has it's types showing on the bottom, you can simply drag the types widget to beneath the divider line on the left side. Whenever you open your sidebar, both areas will open together. The Types sidebar also shows you the full type definition when you select a type.
+
+#### Main Area
+
+Time for the main event!
+
+Ghidra shows you a linear view on the left, and single-function-at-a-time decompilation on the right. We already gave you linear decompilation of the whole Binary here by default, so there are three last things to do:
+
+1. Create a new pane by pressing the icon in the top right that looks like a rectangle with a line through it. The two panes are now synced by address, as you’d expect.
+2. In the left pane, find the drop down that says "High Level IL", and switch down to disassembly. You should now have linear disassembly on the left, and linear decompilation on the right.
+3. The final touch is to go back to the decompilation pane on the right and find the hamburger menu for that pane in the top right, and then select “Single Function View.”
+
+Now the UI should be looking extremely familiar. Read our last couple of tips below, don't forget to use the command palette to find what you want to do, and you'll be off analyzing binaries in no time!
+
+#### Saving Layouts
+
+Now that you've done all this hard work to make the perfect layout, it would be a shame to lose it! Thankfully, we make it easy. Go to the `Window` → `Layout` → `Save Current Layout...` and give it a name, or select `Save Current Layout as Default`. Named layouts let you quickly swap between different kinds of work.
+
+## What You'll Love
+
+...about switching to Binary Ninja! We know leaving your old tool behind can be hard, and there will be things you miss, but we think there are a lot of features packed into Binary Ninja that you'll love. Here are a couple we think you'll appreciate:
+
+ - [Updates every day](../index.md#updates) on the dev branch (nearly) - accepted PRs can be in everyone's hands within hours.
+ - [Our awesome native Python API](../../dev/cookbook.md) (and [C++](https://api.binary.ninja/cpp/), and [Rust](https://dev-rust.binary.ninja/))
+ - [The speed](https://binary.ninja/2022/05/31/3.1-the-performance-release.html)
+ - ...not needing to manage Java installations
+
+---
+
+Don't forget to check out our [additional resources](index.md#additional-resources)!
diff --git a/docs/guide/migration/migrationguideida.md b/docs/guide/migration/migrationguideida.md
new file mode 100644
index 00000000..88914439
--- /dev/null
+++ b/docs/guide/migration/migrationguideida.md
@@ -0,0 +1,66 @@
+# Migrating from IDA
+
+## Starting Binary Ninja
+
+Binary Ninja starts with the [New Tab Page](../index.md#new-tab) open. From here, you can optionally [start a project](../projects.md#creating-a-project) to work with multiple files, [create new files](../index.md#new-files) to paste in data, or just [open existing files](../index.md#loading-files) (including drag-and-drop!).
+
+## Decompiler Settings
+
+Binary Ninja likes to stay out of your way as much as possible, but sometimes you need to dig into the settings and change how a file is analyzed. If you have a file that can be opened with default settings, you won't get prompted for any additional input. Binary Ninja will automatically analyze the entire file — including running [linear sweep](https://binary.ninja/2017/11/06/architecture-agnostic-function-detection-in-binaries.html) — and provide you with linear decompilation for the whole file (like IDA's linear disassembly, but as decomp by default).
+
+If you're opening a [Universal Mach-O](https://en.wikipedia.org/wiki/Universal_binary), the Open with Options dialogue will appear so that you can choose which architecture to open (in the top right). If you have a default architecture you want to open whenever you open a universal binary, you can set your preference in a setting called [Universal Mach-O Architecture Preference](../settings.md#all-settings). You'll also see the Open with Options dialogue when Binary Ninja is unable to recognize the file type or otherwise needs user input to analyze the file (can't find the entry point, needs you to provide some memory mappings, etc).
+
+It's worth digging into Binary Ninja's [settings](../settings.md) and seeing what's available to tune, but if you ever want to change a setting for a single binary, you can Open (it) with Options. Go to File -> Open with Options, and any settings you change will apply to only that file.
+
+<!-- TODO : Can you analyze a file while IDA is running its analysis?
+## Analyzing While Analyzing -->
+
+## Keybindings
+
+Most of the keybindings you're used to are the same. Any "actions" (renaming, setting types, opening cross-references, etc) you might want to perform can be found in the [command palette](../index.md#command-palette), which will save you from digging through unfamiliar right-click menus and help you learn any new keybindings. You can even [add your own actions](https://binary.ninja/2024/02/15/command-palette.html#how-do-i-register-actions-with-the-command-palette-myself) with ease. All actions can have their keybinding set, changed, or removed in the [keybindings menu](../index.md#default-hotkeys).
+
+Some major exceptions are:
+
+- Save is `[CTRL/⌘-S]`.
+- All our find options are under `[CTRL/⌘-F]`.
+- The "subviews" keybindings are:
+ - `T` for Types
+ - `H` to toggle to/from Hex View
+ - `[TAB]` to toggle to/from disassembly
+
+## Theme
+
+We like our dark themes, but understand they're not for everyone. We have an expansive list of [community themes](https://github.com/Vector35/community-themes), and [a guide](../../dev/themes.md) and a [blog post](https://binary.ninja/2021/07/08/creating-great-themes.html) on how to make your own. The built-in "Classic" theme should feel nostalgic, but if you're looking for a light theme that's slightly easier on the eyes, try out Summer or Solarized Light.
+
+## Layout
+
+Binary Ninja's layout is very similar to what you're used to in IDA, but there's one setting you might want to change and a handful of improvements to look out for as well.
+
+### Feature Map
+
+If you want the [feature map](../index.md#feature-map) back to where you're used to, right-click it, find "Feature Map Location" and change it to the top. That said, take notice that Binary Ninja's feature map is 2d: both directions you move your cursor changes the address in Binary Ninja. The exact number of bytes that fit across the width of the feature map scales to the size of the binary. You can disable this in the right-click menu by selecting "Linear Feature Map."
+
+We also have an entropy map, if you need it, but it's tucked away in [triage view](https://binary.ninja/2019/04/01/hackathon-2019-summary.html#triage-mode-rusty).
+
+### Sidebars
+
+Our sidebars have a whole host of customization options, so make sure to check out [their dedicated docs](../index.md#the-sidebar) to maximize your workflow.
+
+#### Main Area
+
+Binary Ninja shows you linear decompilation by default for the whole binary. However, some people strongly prefer the "single function at a time" workflow, so we made an option for that too. Find the small hamburger menu (the three line pop-out menu) in the top right of your view and select “Single Function View.”
+
+Check out the [tiling panes](../index.md#tiling-panes) docs for more information.
+
+## What You'll Love
+
+...about switching to Binary Ninja! We know leaving your old tool behind can be hard, and there will be things you miss, but we think there are a lot of features packed into Binary Ninja that you'll love. Here are a couple we think you'll appreciate:
+
+ - Decompilation for every architecture, including [ones you bring yourself](https://binary.ninja/2020/01/08/guide-to-architecture-plugins-part1.html)
+ - [Updates every day](../index.md#updates) on the dev branch (nearly)
+ - [Our awesome native Python API](../../dev/cookbook.md) (and [C++](https://api.binary.ninja/cpp/), and [Rust](https://dev-rust.binary.ninja/))
+ - [**So** much open source](https://github.com/Vector35/binaryninja-api?tab=readme-ov-file#related-repositories) (that includes our architecture modules!)
+
+---
+
+Don't forget to check out our [additional resources](index.md#additional-resources)!
diff --git a/docs/guide/objectivec.md b/docs/guide/objectivec.md
index f101d7a5..4178fc0e 100644
--- a/docs/guide/objectivec.md
+++ b/docs/guide/objectivec.md
@@ -31,14 +31,14 @@ analysis. _If you have already marked up Objective-C structures or modified
function types yourself, be aware that they may be overwritten when this action
is run._
-![](../img/objc_analyze_action.png)
+![](../img/objc-analyze-action.png)
### Workflow
To utilize function call cleanup, the workflows feature must be enabled, and the
Objective-C workflow must be chosen when loading a binary for analysis.
-![](../img/objc_workflow_selected.png)
+![](../img/objc-workflow-selected.png)
This will automatically apply structure analysis as the binary is analyzed and
also translate `objc_msgSend` calls to direct method calls, where possible.
diff --git a/docs/guide/plugins.md b/docs/guide/plugins.md
index e7e8ec48..0807f069 100644
--- a/docs/guide/plugins.md
+++ b/docs/guide/plugins.md
@@ -12,7 +12,7 @@ Note that plugins installed via the [PluginManager API](https://api.binary.ninja
## Plugin Manager
-![Plugin Manager >](../img/plugin-manager.png "Plugin Manager")
+![Plugin Manager](../img/plugin-manager.png "Plugin Manager"){ width="1000" }
Plugins can be installed directly via the GUI from Binary Ninja. You can launch the plugin manager via any of the following methods:
diff --git a/docs/guide/projects.md b/docs/guide/projects.md
new file mode 100644
index 00000000..8f4366c1
--- /dev/null
+++ b/docs/guide/projects.md
@@ -0,0 +1,122 @@
+# Projects
+
+Projects provide a way to keep and organize related binaries, databases, and resources in a managed format.
+
+???+ Important "Supported Editions"
+ Projects are only available in the Commercial and Enterprise editions of Binary Ninja
+
+## Creating a Project
+
+A new project can be created by either selecting `New Project` from the new tab page or `File > New Project` from the application toolbar. After creation, the new project will be opened automatically.
+
+## Opening a Project
+
+Existing projects can be opened by:
+
+- Opening the `.bnpm` (or `.bnpr` on macOS) like any other file in Binary Ninja
+- Double-clicking the project from the "Recent Projects" list in a new tab
+
+When a project is first opened, a new window will be created for it. This window is permanently tied to this project, meaning that it will only contain files associated with this project.
+
+## Structure on Disk
+
+A project has a few components stored on disk:
+
+- A top-level `.bnpr` directory that contains everything
+- A `project.bnpm` project metadata file
+- Optionally a `settings.json` file if project settings have been modified
+- A `data` directory that contains the data for files in the project
+
+## Project Browser
+
+The primary method of interaction with a project is through the "Project Browser" UI.
+
+![Project View](../img/projects.png "Projects")
+
+1. The name of the project
+2. Edit project details
+3. Description of project
+4. Import files to the project
+5. Import a folder to the project
+6. View and modify project-level settings
+7. Tab for project file tree
+8. Tab for Recent project file list
+9. Refresh project
+10. Filter the current view for files and folders
+11. Project contents tree
+12. Info widget showing details about the currently selected items
+13. Description of currently selected item
+
+### Adding Files to a Project
+
+There are a handful of ways to add files to a project:
+
+- Drag and drop files and folders directly into the project browser
+- Using the `Import Files` button, select files to add to the currently selected folder
+- Using the `Import Folder` button, select a folder to recursively import under the selected folder
+
+### Exporting Files from a Project
+
+To export files/folders from a project, select any number of files and folders in the project browser and choose `Export Selected` from the context menu or `Project Browser - Export Selected` from the command palette.
+
+### Batch Analysis
+
+Files in a project can be batch-analyzed easily from the project browser. Simply select the files to analyze and choose `Analyze Selected` from the context menu or `Project Browser - Analyze Selected` from the command palette. This will create a BNDB for each selected file, unless it is a BNDB itself.
+
+## Project Settings
+
+Project level settings let you set project-wide settings that apply to every file in the project. See the [settings documentation](settings.md) for more information.
+
+## External Links
+
+![External Links](../img/external-links.png "External Links"){ width="400" }
+
+In the `External Links` sidebar widget, there is a top level entry for each defined `External Library`. Additionally, there is a special top-level entry: `<No Library>`, that contains all `External Locations` that are yet to be assigned to an `External Library`.
+
+
+
+### External Libraries
+
+An External Library represents a full library, optionally backed by a project file (e.g. `libc.so` which is backed by `libc.bndb`).
+
+
+#### Creating an External Library
+
+![Creating External Library](../img/external-links-edit-external-library.png "Creating External Library"){ width="800" }
+
+Creating an `External Library` can be done via context menu or command palette action `Create External Library...` with the `External Links` sidebar widget focused. This will open a dialog that lets you specify the name and (optionally) the file backing the new library. `External Libraries` are identified by a unique name that is immutable after creation.
+
+
+#### Editing an External Library
+
+Editing an existing `External Library` can be done via context menu or command palette action `Edit External Library...` with a library entry selected. This uses the same dialog as creation, but the "name" field is not editable.
+
+
+#### Removing an External Library
+
+Removing an `External Library` can be done via context menu or command palette action `Remove External Library...` with a library entry selected. This will delete the `External Library`, and all associated `External Locations` will have their library unassigned.
+
+
+### External Locations
+
+An External Location represents a symbol in a `Binary View` that points to an external target address and/or symbol in an `External Library` (e.g. `strcpy` points to `strcpy` in `libc.so`). When attempting to navigate to the symbol that is the source of an `External Location` with an `External Library` assigned, you will instead navigate to the destination address or symbol in the `External Library`, if it is backed by a file.
+
+
+#### Creating an External Location
+
+![Creating External Location](../img/external-links-edit-external-location.png "Creating External Location"){ width="600" }
+
+
+Creating an `External Location` can be done via context menu or command palette action `Create External Location...` with the `External Links` sidebar widget focused. This will open a dialog that lets you specify the internal symbol that is the source of the link, (optionally) the library that the `External Location` points to, and the external symbol and/or address. `External Locations` must always have at least one of the external symbol or address populated.
+
+
+#### Editing an External Location
+
+Editing an `External Location` can be done via context menu or command palette action `Edit External Location...` with a location entry selected. This uses the same dialog as creation, but the "internal symbol" field is not editable.
+
+To easily change the assigned library for one or more `External Locations`, you can select and drag them to the desired `External Library` top-level entry.
+
+
+#### Removing an External Location
+
+Removing an `External Location` can be done via context menu or command palette action `Remove External Location...` with a location entry selected.
diff --git a/docs/guide/settings.md b/docs/guide/settings.md
index 7a8714fe..02284f73 100644
--- a/docs/guide/settings.md
+++ b/docs/guide/settings.md
@@ -2,7 +2,7 @@
## UI
-![settings >](../img/settings.png "Settings")
+![settings](../img/settings.png "Settings"){ width="800" }
Binary Ninja provides various settings which are available via the `[CMD/CTRL] ,` hotkey for *User* settings and the `[CMD/CTRL] .` hotkey for *Resource* settings which apply to the current BinaryView. These settings allow a wide variety of customization of the user interface and functional aspects of the analysis environment.
@@ -30,29 +30,30 @@ All settings are uniquely identified with an identifier string. Identifiers are
## All Settings
|Category|Setting|Description|Type|Default|Scope|Key|
|---|---|---|---|---|---|---|
+|analysis|Alternate Type Propagation|Enable an alternate approach for function type propagation. This setting is experimental and may be useful for some binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.alternateTypePropagation'>analysis.alternateTypePropagation</a>|
+|analysis|Automatic Name Variables|Automatically name variables according to their usage.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.autoNameVariables'>analysis.autoNameVariables</a>|
|analysis|Disallow Branch to String|Enable the ability to halt analysis of branch targets that fall within a string reference. This setting may be useful for malformed binaries.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.conservative.disallowBranchToString'>analysis.conservative.disallowBranchToString</a>|
+|analysis|Correlated Memory Value Propagation|Attempt to propagate the value of an expression from a memory definition to a usage. Currently this feature is simplistic and the scope is a single basic block. This setting is experimental and may be useful for some binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.correlatedMemoryValuePropagation'>analysis.correlatedMemoryValuePropagation</a>|
|analysis|Purge Original Filename Path|When saving a database, remove all path information from the Original Filename field|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='analysis.database.purgeOriginalFilenamePath'>analysis.database.purgeOriginalFilenamePath</a>|
|analysis|Purge Snapshots|When saving a database, purge old snapshots keeping only the current snapshot.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='analysis.database.purgeSnapshots'>analysis.database.purgeSnapshots</a>|
|analysis|Purge Undo History|When saving a database, purge current and existing undo history.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='analysis.database.purgeUndoHistory'>analysis.database.purgeUndoHistory</a>|
|analysis|Suppress Reanalysis|Disable function reanalysis on database load when the product version or analysis settings change.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.database.suppressReanalysis'>analysis.database.suppressReanalysis</a>|
|analysis|External Debug Info File|Separate file to attempt to parse and import debug information from.|`string`| |[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.debugInfo.external'>analysis.debugInfo.external</a>|
|analysis|Import Debug Information|Attempt to parse and apply debug information from each file opened.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.debugInfo.internal'>analysis.debugInfo.internal</a>|
-|analysis|Alternate Type Propagation|Enable an alternate approach for function type propagation. This setting is experimental and may be useful for some binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.alternateTypePropagation'>analysis.experimental.alternateTypePropagation</a>|
-|analysis|Correlated Memory Value Propagation|Attempt to propagate the value of an expression from a memory definition to a usage. Currently this feature is simplistic and the scope is a single basic block. This setting is experimental and may be useful for some binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.correlatedMemoryValuePropagation'>analysis.experimental.correlatedMemoryValuePropagation</a>|
|analysis|Early Stack Constant Propagation|Propagate constants stored on the stack during Low Level IL analysis. This allows stack offsets to be resolved when stack pointer updates use constants placed on the stack.|`string`|`inlined`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.earlyStackConstantPropagation'>analysis.experimental.earlyStackConstantPropagation</a>|
| | | enum: Do not perform early constant propagation for stack variables|`enum`|`off`| | |
| | | enum: Only perform early constant propagation when one or more functions have been inlined into the function|`enum`|`inlined`| | |
| | | enum: Always perform early constant propagation for stack variables|`enum`|`on`| | |
|analysis|Gratuitous Function Update|Force the function update cycle to always end with an IncrementalAutoFunctionUpdate type.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.gratuitousFunctionUpdate'>analysis.experimental.gratuitousFunctionUpdate</a>|
-|analysis|Heuristic Value Range Clamping|Use DataVariable state inferencing to help determine the possible size of a lookup table.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.heuristicRangeClamp'>analysis.experimental.heuristicRangeClamp</a>|
|analysis|Keep Dead Code Branches|Keep unreachable code branches and associated basic blocks in HLIL.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.keepDeadCodeBranches'>analysis.experimental.keepDeadCodeBranches</a>|
-|analysis|Return Value Propagation|Propagate and use constant return values from functions in the caller in order to simplify downstream expressions.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.returnValuePropagation'>analysis.experimental.returnValuePropagation</a>|
-|analysis|Translate Windows CFG Calls|Attempt to identify and translate calls to `_guard_dispatch_icall_nop` to improve analysis of control flow guard binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.experimental.translateWindowsCfgCalls'>analysis.experimental.translateWindowsCfgCalls</a>|
|analysis|Extract Types From Mangled Names|Attempt to extract types from mangled names using the demangler. This can lead to recovering inaccurate parameters.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.extractTypesFromMangledNames'>analysis.extractTypesFromMangledNames</a>|
|analysis|Always Analyze Indirect Branches|When using faster analysis modes, perform full analysis of functions containing indirect branches.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.forceIndirectBranches'>analysis.forceIndirectBranches</a>|
+|analysis|Heuristic Value Range Clamping|Use DataVariable state inferencing to help determine the possible size of a lookup table.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.heuristicRangeClamp'>analysis.heuristicRangeClamp</a>|
|analysis|Aggressive Condition Complexity Removal Threshold|High Level IL tuning parameter.|`number`|`64`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.aggressiveConditionComplexityRemovalThreshold'>analysis.hlil.aggressiveConditionComplexityRemovalThreshold</a>|
+|analysis|Graph Optimizer Limit|High Level IL tuning parameter.|`number`|`64`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.graphOptimizerLimit'>analysis.hlil.graphOptimizerLimit</a>|
|analysis|Max Condition Complexity|High Level IL tuning parameter.|`number`|`1024`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.maxConditionComplexity'>analysis.hlil.maxConditionComplexity</a>|
|analysis|Max Condition Reduce Iterations|High Level IL tuning parameter.|`number`|`1024`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.maxConditionReduceIterations'>analysis.hlil.maxConditionReduceIterations</a>|
+|analysis|Maximum Expression Count|High Level IL tuning parameter.|`number`|`1048576`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.maxExpressionCount'>analysis.hlil.maxExpressionCount</a>|
|analysis|Max Intermediate Condition Complexity|High Level IL tuning parameter.|`number`|`1048576`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.maxIntermediateConditionComplexity'>analysis.hlil.maxIntermediateConditionComplexity</a>|
|analysis|Eliminate Pure Calls during HLIL Optimization|Whether or not pure calls (calls to functions with no side-effects) are removed during HLIL optimizations.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.pureCallElimination'>analysis.hlil.pureCallElimination</a>|
|analysis|Strict Memory Ordering|Prevents reordering of memory reads during HLIL optimization.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.hlil.strictMemoryOrdering'>analysis.hlil.strictMemoryOrdering</a>|
@@ -77,6 +78,8 @@ All settings are uniquely identified with an identifier string. Identifiers are
|analysis|Low Entropy Threshold for Linear Sweep|Regions in the binary at or below this threshold are not included in the search space for linear sweep.|`number`|`0.025`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.linearSweep.entropyThresholdLow'>analysis.linearSweep.entropyThresholdLow</a>|
|analysis|Max Linear Sweep Work Queues|The number of binary regions under concurrent analysis.|`number`|`64`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.linearSweep.maxWorkQueues'>analysis.linearSweep.maxWorkQueues</a>|
|analysis|Permissive Linear Sweep|Permissive linear sweep searches all executable segments regardless of read/write permissions. By default, linear sweep searches sections that are ReadOnlyCodeSectionSemantics, or if no sections are defined, segments that are read/execute.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.linearSweep.permissive'>analysis.linearSweep.permissive</a>|
+|analysis|Program's Exit Symbol List|A list of common 'exit' symbols to search for when 'Navigate to Program's Main' is enabled.|`array`|[`_cexit`, `_exit`, `_o__cexit`, `_o_exit`, `common_exit`, `doexit`, `exit`]|[`SettingsUserScope`]|<a id='analysis.mainFunctionDetection.exitSymbols'>analysis.mainFunctionDetection.exitSymbols</a>|
+|analysis|Program's Main Symbol List|A list of common 'main' symbols to search for when 'Navigate to Program's Main' is enabled.|`array`|[`WinMain`, `_main`, `main`, `wWinMain`]|[`SettingsUserScope`]|<a id='analysis.mainFunctionDetection.mainSymbols'>analysis.mainFunctionDetection.mainSymbols</a>|
|analysis|Load/Store Splitting|Controls splitting of oversized variable field accesses into appropriately sized accesses|`string`|`validFieldsOnly`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.mlil.loadStoreSplitting'>analysis.mlil.loadStoreSplitting</a>|
| | | enum: Do not split oversized accesses to fields|`enum`|`off`| | |
| | | enum: Split oversized accesses to valid fields and hide accessed gaps/alignment/padding bytes|`enum`|`validFieldsOnly`| | |
@@ -88,10 +91,12 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | enum: Perform full analysis of the binary.|`enum`|`full`| | |
|analysis|Builtin Outlining of Constant Expressions|Enable outlining of constant expression compiler emitted builtins.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.outlining.builtins'>analysis.outlining.builtins</a>|
|analysis|Autorun Pointer Sweep|Automatically run pointer sweep when opening a binary for analysis.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.pointerSweep.autorun'>analysis.pointerSweep.autorun</a>|
+|analysis|Return Value Propagation|Propagate and use constant return values from functions in the caller in order to simplify downstream expressions.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.returnValuePropagation'>analysis.returnValuePropagation</a>|
|analysis|Autorun Function Signature Matcher|Automatically run the function signature matcher when opening a binary for analysis.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.signatureMatcher.autorun'>analysis.signatureMatcher.autorun</a>|
|analysis|Auto Function Analysis Suppression|Enable suppressing analysis of automatically discovered functions.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.suppressNewAutoFunctionAnalysis'>analysis.suppressNewAutoFunctionAnalysis</a>|
|analysis|Tail Call Heuristics|Attempts to recover function starts that may be obscured by tail call optimization (TCO). Specifically, branch targets within a function are analyzed as potential function starts.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.tailCallHeuristics'>analysis.tailCallHeuristics</a>|
|analysis|Tail Call Translation|Performs tail call translation for jump instructions where the target is an existing function start.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.tailCallTranslation'>analysis.tailCallTranslation</a>|
+|analysis|Translate Windows CFG Calls|Attempt to identify and translate calls to `_guard_dispatch_icall_nop` to improve analysis of control flow guard binaries.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.translateWindowsCfgCalls'>analysis.translateWindowsCfgCalls</a>|
|analysis|Padding Threshold|Specify the minimum number of undefined bytes in a structure type before __padding notation is used when rendering the type to text. This setting does not affect exporting types to a file, where the __padding notation will always be used.|`number`|`1024`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.types.paddingThreshold'>analysis.types.paddingThreshold</a>|
|analysis|Type Parser|Specify the implementation used for parsing types from text.|`string`|`ClangTypeParser`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.types.parserName'>analysis.types.parserName</a>|
| | | |`enum`|`ClangTypeParser`| | |
@@ -102,7 +107,8 @@ All settings are uniquely identified with an identifier string. Identifiers are
|analysis|UTF-16 Encoding|Whether or not to consider UTF-16 code points when searching for strings.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.unicode.utf16'>analysis.unicode.utf16</a>|
|analysis|UTF-32 Encoding|Whether or not to consider UTF-32 code points when searching for strings.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.unicode.utf32'>analysis.unicode.utf32</a>|
|analysis|UTF-8 Encoding|Whether or not to consider UTF-8 code points when searching for strings.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='analysis.unicode.utf8'>analysis.unicode.utf8</a>|
-|arch|MIPS Disassembly Pseudo-Op|Enable use of pseudo-op instructions in MIPS disassembly.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='arch.mips.disassembly.pseudo_ops'>arch.mips.disassembly.pseudo_ops</a>|
+|arch|AARCH64 Alignment Requirement|Require instructions be on 4-byte aligned addresses to be disassembled.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='arch.aarch64.disassembly.alignRequired'>arch.aarch64.disassembly.alignRequired</a>|
+|arch|MIPS Disassembly Pseudo-Op|Enable use of pseudo-op instructions in MIPS disassembly.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='arch.mips.disassembly.pseudoOps'>arch.mips.disassembly.pseudoOps</a>|
|arch|x86 Disassembly Case|Specify the case for opcodes, operands, and registers.|`boolean`|`True`|[`SettingsUserScope`]|<a id='arch.x86.disassembly.lowercase'>arch.x86.disassembly.lowercase</a>|
|arch|x86 Disassembly Separator|Specify the token separator between operands.|`string`|`, `|[`SettingsUserScope`]|<a id='arch.x86.disassembly.separator'>arch.x86.disassembly.separator</a>|
|arch|x86 Disassembly Syntax|Specify disassembly syntax for the x86/x86_64 architectures.|`string`|`BN_INTEL`|[`SettingsUserScope`]|<a id='arch.x86.disassembly.syntax'>arch.x86.disassembly.syntax</a>|
@@ -113,12 +119,13 @@ All settings are uniquely identified with an identifier string. Identifiers are
|corePlugins|ARMv7 Architecture|Enable the built-in ARMv7 architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.armv7'>corePlugins.architectures.armv7</a>|
|corePlugins|MIPS Architecture|Enable the built-in MIPS architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.mips'>corePlugins.architectures.mips</a>|
|corePlugins|PowerPC Architecture|Enable the built-in PowerPC architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.powerpc'>corePlugins.architectures.powerpc</a>|
+|corePlugins|RISC-V Architecture|Enable the built-in RISC-V architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.riscv'>corePlugins.architectures.riscv</a>|
|corePlugins|x86/x86_64 Architecture|Enable the built-in x86/x86_64 architecture module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.architectures.x86'>corePlugins.architectures.x86</a>|
|corePlugins|Crypto Plugin|Enable the built-in crypto plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.crypto'>corePlugins.crypto</a>|
|corePlugins|Database Viewer (Debug)|Enable the built-in Database Viewer plugin. Be aware this is a debug feature and may not be well-behaved.|`boolean`|`False`|[`SettingsUserScope`]|<a id='corePlugins.databaseViewer'>corePlugins.databaseViewer</a>|
|corePlugins|Debugger|Enable the built-in debugger plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.debugger'>corePlugins.debugger</a>|
-|corePlugins|DWARF Export Plugin|Enable the experimental DWARF export plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.dwarfExport'>corePlugins.dwarfExport</a>|
-|corePlugins|DWARF Import Plugin|Enable the experimental DWARF import plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.dwarfImport'>corePlugins.dwarfImport</a>|
+|corePlugins|DWARF Export Plugin|Enable the DWARF export plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.dwarfExport'>corePlugins.dwarfExport</a>|
+|corePlugins|DWARF Import Plugin|Enable the DWARF import plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.dwarfImport'>corePlugins.dwarfImport</a>|
|corePlugins|PDB Import Plugin|Enable the built-in PDB import plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.pdbImport'>corePlugins.pdbImport</a>|
|corePlugins|DECREE Platform|Enable the built-in DECREE platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.decree'>corePlugins.platforms.decree</a>|
|corePlugins|EFI Platform|Enable the built-in EFI platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.efi'>corePlugins.platforms.efi</a>|
@@ -126,7 +133,9 @@ All settings are uniquely identified with an identifier string. Identifiers are
|corePlugins|Linux Platform|Enable the built-in Linux platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.linux'>corePlugins.platforms.linux</a>|
|corePlugins|macOS Platform|Enable the built-in macOS platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.mac'>corePlugins.platforms.mac</a>|
|corePlugins|Windows Platform|Enable the built-in Windows platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.windows'>corePlugins.platforms.windows</a>|
+|corePlugins|Windows Kernel Platform|Enable the built-in Window Kernel platform module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.platforms.windows_kernel'>corePlugins.platforms.windows_kernel</a>|
|corePlugins|Triage Plugin|Enable the built-in triage plugin.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.triage'>corePlugins.triage</a>|
+|corePlugins|Type Archive Inspector (Debug)|Enable the built-in Type Archive Inspector plugin. Be aware this is a debug feature and may not be well-behaved.|`boolean`|`False`|[`SettingsUserScope`]|<a id='corePlugins.typeArchiveViewer'>corePlugins.typeArchiveViewer</a>|
|corePlugins|ELF View|Enable the built-in ELF view module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.view.elf'>corePlugins.view.elf</a>|
|corePlugins|Mach-O View|Enable the built-in Mach-O view module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.view.macho'>corePlugins.view.macho</a>|
|corePlugins|PE/COFF View|Enable the built-in PE/COFF view module.|`boolean`|`True`|[`SettingsUserScope`]|<a id='corePlugins.view.pe'>corePlugins.view.pe</a>|
@@ -190,6 +199,7 @@ All settings are uniquely identified with an identifier string. Identifiers are
|python|Python Virtual Environment Site-Packages|The 'site-packages' directory for your python virtual environment.|`string`| |[`SettingsUserScope`]|<a id='python.virtualenv'>python.virtualenv</a>|
|rendering|Show variable and integer annotations|Show variable and integer annotations in disassembly i.e. {var_8}|`boolean`|`True`|[`SettingsUserScope`]|<a id='rendering.annotations'>rendering.annotations</a>|
|rendering|Show All Expression Types in Debug Reports|Enables the "Show All Expression Types" option in debug reports.|`boolean`|`False`|[`SettingsUserScope`]|<a id='rendering.debug.types'>rendering.debug.types</a>|
+|rendering|Add New Lines Around Scopes|Add extra newlines in HLIL between closing scopes and the following instructions.|`number`|`0`|[`SettingsUserScope`]|<a id='rendering.hlil.newLinesAroundScopes'>rendering.hlil.newLinesAroundScopes</a>|
|rendering|HLIL Scoping Style|Controls the display of new scopes in HLIL.|`string`|`default`|[`SettingsUserScope`]|<a id='rendering.hlil.scopingStyle'>rendering.hlil.scopingStyle</a>|
| | | enum: Default BNIL scoping style.|`enum`|`default`| | |
| | | enum: Braces around scopes, same line.|`enum`|`braces`| | |
@@ -212,10 +222,11 @@ All settings are uniquely identified with an identifier string. Identifiers are
|triage|Always Prefer Triage Summary View|Always prefer opening binaries in Triage Summary view, even when performing full analysis.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='triage.preferSummaryView'>triage.preferSummaryView</a>|
|triage|Prefer Triage Summary View for Raw Files|Prefer opening raw files in Triage Summary view.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='triage.preferSummaryViewForRaw'>triage.preferSummaryViewForRaw</a>|
|ui|Allow Welcome Popup|By default, the welcome window will only show up when it has changed and this install has not seen it. However, disabling this setting will prevent even that.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.allowWelcome'>ui.allowWelcome</a>|
-|ui|Enable the new Symbols UI (Experimental)|Enables the new Symbols UI. The upgraded UI supports Folders, displaying addresses, and much more. Be aware that this is a feature preview and may still have issues.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.components.enabled'>ui.components.enabled</a>|
|ui|Dock Window Title Bars|Enable to display title bars for dockable windows attached to a main window.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.docks.titleBars'>ui.docks.titleBars</a>|
+|ui|Developer Tools|Enables Qt UI development tooling. Requires a restart and creates a new sidebar icon that can be enabled.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.experimental.uiDeveloperTools'>ui.experimental.uiDeveloperTools</a>|
|ui|Feature Map|Enable the feature map which displays a visual overview of the BinaryView.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.featureMap.enable'>ui.featureMap.enable</a>|
|ui|Feature Map File-Backed Only Mode|Exclude mapped regions that are not backed by a load file.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.featureMap.fileBackedOnly'>ui.featureMap.fileBackedOnly</a>|
+|ui|Linear Feature Map|Show feature map in one dimension instead of two.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.featureMap.linear'>ui.featureMap.linear</a>|
|ui|Feature Map Location|Location of the feature map.|`string`|`right`|[`SettingsUserScope`]|<a id='ui.featureMap.location'>ui.featureMap.location</a>|
| | | enum: Feature map appears on the right side of the window.|`enum`|`right`| | |
| | | enum: Feature map appears at the top of the window.|`enum`|`top`| | |
@@ -235,13 +246,13 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | |`enum`|`Universal`| | |
| | | |`enum`|`PE`| | |
| | | |`enum`|`COFF`| | |
-|ui|Programmer's Main Symbol List|A list of common 'main' symbols to search for when 'Navigate to Programmer's Main' is enabled.|`array`|[`main`, `_main`, `WinMain`]|[`SettingsUserScope`]|<a id='ui.files.navigation.mainSymbols'>ui.files.navigation.mainSymbols</a>|
|ui|Navigate to Programmer's Main|Detect and navigate to the 'main' function, rather than the entry point, after opening a binary.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.files.navigation.preferMain'>ui.files.navigation.preferMain</a>|
|ui|Restore Recent Open with Options|Restores previously modified settings in the 'Open with Options' dialog when opening or reopening files (databases excluded). Load options are only included when reopening the same file.|`string`|`disable`|[`SettingsUserScope`]|<a id='ui.files.restore.viewOptions'>ui.files.restore.viewOptions</a>|
| | | enum: Only restore settings for files with existing history.|`enum`|`strict`| | |
| | | enum: Restore settings for files with existing history and propagate most recently used settings for new files.|`enum`|`flexible`| | |
| | | enum: Disable the settings history for 'Open with Options'.|`enum`|`disable`| | |
|ui|Restore View State for File|Restores the last view state when reopening a file. The view state includes the layout and location.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.files.restore.viewState'>ui.files.restore.viewState</a>|
+|ui|'Save All' for Databases Only|Only save existing databases when using 'Save All'|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.files.saveAllOnlyDatabases'>ui.files.saveAllOnlyDatabases</a>|
|ui|Font Antialiasing Style|Which antialiasing style should be used when drawing fonts.|`string`|`subpixel`|[`SettingsUserScope`]|<a id='ui.font.antialiasing'>ui.font.antialiasing</a>|
| | | enum: Perform subpixel antialiasing on fonts.|`enum`|`subpixel`| | |
| | | enum: Avoid subpixel antialiasing on fonts if possible.|`enum`|`grayscale`| | |
@@ -249,11 +260,11 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | enum: No font antialiasing.|`enum`|`none`| | |
|ui|Application Font Name|The font to be used in UI elements, e.g. buttons, text fields, etc.|`string`|`Inter`|[`SettingsUserScope`]|<a id='ui.font.app.name'>ui.font.app.name</a>|
|ui|Application Font Size|The desired font size (in points) for interface elements.|`number`|`12`|[`SettingsUserScope`]|<a id='ui.font.app.size'>ui.font.app.size</a>|
-|ui|Emoji Font Name|The font to be used in for rendering emoji.|`string`|`Segoe UI Emoji` (Windows), `Apple Color Emoji` (macOS), `Noto Color Emoji` (Linux)|[`SettingsUserScope`]|<a id='ui.font.emoji.name'>ui.font.emoji.name</a>|
+|ui|Emoji Font Name|The font to be used in for rendering emoji.|`string`|`Apple Color Emoji`|[`SettingsUserScope`]|<a id='ui.font.emoji.name'>ui.font.emoji.name</a>|
|ui|Emoji Font Style|The subfamily of the emoji font that should be used.|`string`| |[`SettingsUserScope`]|<a id='ui.font.emoji.style'>ui.font.emoji.style</a>|
|ui|Allow Bold View Fonts|Should bold view fonts be allowed?|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.font.view.bold'>ui.font.view.bold</a>|
|ui|View Font Name|The font to be used in disassembly views, the hex editor, and anywhere a monospaced font is appropriate.|`string`|`Roboto Mono`|[`SettingsUserScope`]|<a id='ui.font.view.name'>ui.font.view.name</a>|
-|ui|View Font Size|The desired font size (in points) for the view font.|`number`|`12` (macOS), `10` (Windows), `11` (Linux)|[`SettingsUserScope`]|<a id='ui.font.view.size'>ui.font.view.size</a>|
+|ui|View Font Size|The desired font size (in points) for the view font.|`number`|`12`|[`SettingsUserScope`]|<a id='ui.font.view.size'>ui.font.view.size</a>|
|ui|View Line Spacing|How much additional spacing should be inserted between baselines in views.|`number`|`1`|[`SettingsUserScope`]|<a id='ui.font.view.spacing'>ui.font.view.spacing</a>|
|ui|View Font Style|The subfamily (e.g. Regular, Medium) of the view font that should be used.|`string`| |[`SettingsUserScope`]|<a id='ui.font.view.style'>ui.font.view.style</a>|
|ui|Input Field History Limit|Controls the number of history entries to store for input dialogs.|`number`|`50`|[`SettingsUserScope`]|<a id='ui.inputHistoryCount'>ui.inputHistoryCount</a>|
@@ -274,6 +285,10 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | enum: Split to new pane and navigate|`enum`|`NewPane`| | |
| | | enum: Split to new tab and navigate|`enum`|`NewTab`| | |
| | | enum: Split to new window and navigate|`enum`|`NewWindow`| | |
+|ui|New Tab Compact Mode|Display mode for files in Recent File list|`string`|`Normal`|[`SettingsUserScope`]|<a id='ui.newtab.compactMode'>ui.newtab.compactMode</a>|
+| | | enum: Show both basename and full path.|`enum`|`Normal`| | |
+| | | enum: Show only the basename|`enum`|`CompactBase`| | |
+| | | enum: Show only the filepath|`enum`|`CompactFile`| | |
|ui|Desired Maximum Columns for Split Panes|Number of horizontal splits (columns) before defaulting to a vertical split.|`number`|`2`|[`SettingsUserScope`]|<a id='ui.panes.columnCount'>ui.panes.columnCount</a>|
|ui|Show Pane Headers|Enable to display headers containing the current view and options at the top of every pane. When headers are disabled, use the Command Palette or keyboard shortcuts to manage panes.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.panes.headers'>ui.panes.headers</a>|
|ui|Preferred Location for New Panes|Default corner for placement of new panes. Split will occur horizontally up to the maximum column setting, then vertically in the corner specified by this setting.|`string`|`bottomRight`|[`SettingsUserScope`]|<a id='ui.panes.newPaneLocation'>ui.panes.newPaneLocation</a>|
@@ -296,39 +311,49 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | |`enum`|`Target`| | |
|ui|Scripting Provider History Size|Specify the maximum number of lines contained in the scripting history.|`number`|`1000`|[`SettingsUserScope`]|<a id='ui.scripting.historySize'>ui.scripting.historySize</a>|
|ui|Display Settings Identifiers|Display setting identifiers in the UI settings view.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.settings.displayIdentifiers'>ui.settings.displayIdentifiers</a>|
-|ui|Default Sidebar Content on Open|Specify a sidebar widget to automatically activate in the content area when opening a file.|`string`|`Symbols`|[`SettingsUserScope`]|<a id='ui.sidebar.defaultContentWidget'>ui.sidebar.defaultContentWidget</a>|
+|ui|Default Sidebar Content on Open|Specify the sidebar widgets to automatically activate when opening a file.|`array`|[`Cross References`, `Symbols`]|[`SettingsUserScope`]|<a id='ui.sidebar.defaultWidgets'>ui.sidebar.defaultWidgets</a>|
| | | |`enum`|`None`| | |
| | | |`enum`|`Symbols`| | |
| | | |`enum`|`Types`| | |
-| | | |`enum`|`Variables`| | |
-| | | |`enum`|`Stack`| | |
-| | | |`enum`|`Strings`| | |
| | | |`enum`|`Tags`| | |
| | | |`enum`|`Memory Map`| | |
+| | | |`enum`|`External Links`| | |
| | | |`enum`|`Debugger`| | |
-|ui|Default Sidebar Reference on Open|Specify a sidebar widget to automatically activate in the reference area when opening a file.|`string`|`Cross References`|[`SettingsUserScope`]|<a id='ui.sidebar.defaultReferenceWidget'>ui.sidebar.defaultReferenceWidget</a>|
-| | | |`enum`|`None`| | |
| | | |`enum`|`Mini Graph`| | |
| | | |`enum`|`Cross References`| | |
+| | | |`enum`|`Other (Compatibility)`| | |
+| | | |`enum`|`Console`| | |
+| | | |`enum`|`Variables`| | |
+| | | |`enum`|`Stack`| | |
+| | | |`enum`|`Strings`| | |
+| | | |`enum`|`Find`| | |
+| | | |`enum`|`Log`| | |
+| | | |`enum`|`Debugger Modules`| | |
+| | | |`enum`|`Stack Trace`| | |
+|ui|Extend Left Sidebar to Bottom of Window|When the left sidebar is open, the sidebar contents will extend to the bottom of the window. If not set, the bottom area will extend to the left edge of the window even when the left sidebar is open.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.sidebar.extendLeftToBottom'>ui.sidebar.extendLeftToBottom</a>|
+|ui|Extend Right Sidebar to Bottom of Window|When the right sidebar is open, the sidebar contents will extend to the bottom of the window. If not set, the bottom area will extend to the right edge of the window even when the right sidebar is open.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.sidebar.extendRightToBottom'>ui.sidebar.extendRightToBottom</a>|
+|ui|Sidebar Icon Size|Size of the icons in the sidebar.|`string`|`standard`|[`SettingsUserScope`]|<a id='ui.sidebar.iconSize'>ui.sidebar.iconSize</a>|
+| | | enum: Compact icons to maximize available screen space.|`enum`|`compact`| | |
+| | | enum: Default icon size.|`enum`|`standard`| | |
+| | | enum: Large icons for more visibility.|`enum`|`large`| | |
+|ui|Left Sidebar Reference Area Toggle Mode|Clicking on sidebar icons below the divider in the left sidebar will toggle the visibility of the icon clicked, regardless of how many sidebar icons are already active in that area. This mode can be used regardless of this setting by shift clicking the sidebar icon.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.sidebar.leftReferenceAreaToggleMode'>ui.sidebar.leftReferenceAreaToggleMode</a>|
|ui|Sidebar Mode|Select how the sidebar should react to tab changes.|`string`|`perTab`|[`SettingsUserScope`]|<a id='ui.sidebar.mode'>ui.sidebar.mode</a>|
| | | enum: Sidebar layout and size is per tab and is remembered when moving between tabs.|`enum`|`perTab`| | |
| | | enum: Sidebar widgets are per tab but the size of the sidebar is static and does not change.|`enum`|`staticSize`| | |
| | | enum: Sidebar layout is fully static and stays in the current layout when moving between tabs.|`enum`|`static`| | |
|ui|Open Sidebar on Startup|Open sidebar to default widgets when Binary Ninja is initially launched.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.sidebar.openOnStartup'>ui.sidebar.openOnStartup</a>|
-|ui|Show Exported Data Variables|Show exported data variables in the symbol list.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showExportedDataVars'>ui.symbolList.showExportedDataVars</a>|
-|ui|Show Exported Functions|Show exported functions in the symbol list.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showExportedFunctions'>ui.symbolList.showExportedFunctions</a>|
-|ui|Show Imports|Show imports in the symbol list.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showImports'>ui.symbolList.showImports</a>|
-|ui|Show Local Data Variables|Show local data variables in the symbol list.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showLocalDataVars'>ui.symbolList.showLocalDataVars</a>|
-|ui|Show Local Functions|Show local functions in the symbol list.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.symbolList.showLocalFunctions'>ui.symbolList.showLocalFunctions</a>|
+|ui|Right Sidebar Reference Area Toggle Mode|Clicking on sidebar icons below the divider in the right sidebar will toggle the visibility of the icon clicked, regardless of how many sidebar icons are already active in that area. This mode can be used regardless of this setting by shift clicking the sidebar icon.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.sidebar.rightReferenceAreaToggleMode'>ui.sidebar.rightReferenceAreaToggleMode</a>|
|ui|Max Tab Filename Length|Truncate filenames longer than this in tab titles.|`number`|`25`|[`SettingsUserScope`]|<a id='ui.tabs.maxFileLength'>ui.tabs.maxFileLength</a>|
|ui|Color Blind Mode|Choose colors that are visible to those with red/green color blindness.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.theme.colorBlind'>ui.theme.colorBlind</a>|
-|ui|Show Entry/Exit Indicators on Blocks|Draws an extra line to indicate which blocks in Graph View are entry / exit points in the function. Blocks that do not return have their indicators drawn in a different color.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.theme.entryExitBlockIndicators'>ui.theme.entryExitBlockIndicators</a>|
-|ui|Theme|Customize the appearance and style of Binary Ninja.|`string`|`Dark`|[`SettingsUserScope`]|<a id='ui.theme.name'>ui.theme.name</a>|
+|ui|Theme|Customize the appearance and style of Binary Ninja.|`string`|`Ninja Edit`|[`SettingsUserScope`]|<a id='ui.theme.name'>ui.theme.name</a>|
| | | |`enum`|`Classic`| | |
| | | |`enum`|`Dark`| | |
| | | |`enum`|`High Contrast`| | |
| | | |`enum`|`Ninja Dark`| | |
+| | | |`enum`|`Ninja Edit`| | |
| | | |`enum`|`Reflection`| | |
+| | | |`enum`|`Slushee Dark`| | |
+| | | |`enum`|`Slushee Light`| | |
| | | |`enum`|`Solarized Dark`| | |
| | | |`enum`|`Solarized Light`| | |
| | | |`enum`|`Summer`| | |
@@ -337,7 +362,7 @@ All settings are uniquely identified with an identifier string. Identifiers are
|ui|Comment Width|Maximum width of comment before wrapping, in characters. A value of 0x0 means no wrapping.|`number`|`80`|[`SettingsUserScope`]|<a id='ui.view.common.commentWidth'>ui.view.common.commentWidth</a>|
|ui|Disassembly Width|Maximum width of disassembly output, in characters. Not used in cases where disassembly width is automatically calculated, e.g. Linear View.|`number`|`80`|[`SettingsUserScope`]|<a id='ui.view.common.disassemblyWidth'>ui.view.common.disassemblyWidth</a>|
|ui|Maximum Symbol Name Length|Maximum allowed length of symbol names (in characters) before truncation is used.|`number`|`64`|[`SettingsUserScope`]|<a id='ui.view.common.maxSymbolWidth'>ui.view.common.maxSymbolWidth</a>|
-|ui|Graph View IL Carousel|Specify the IL view types and order for use with the 'Cycle IL' actions in Graph view.|`array`|[`Disassembly`, `LowLevelIL`, `MediumLevelIL`, `HighLevelIL`]|[`SettingsUserScope`]|<a id='ui.view.graph.carousel'>ui.view.graph.carousel</a>|
+|ui|Graph View IL Carousel|Specify the IL view types and order for use with the 'Cycle IL' actions in Graph view.|`array`|[`Disassembly`, `HighLevelIL`, `LowLevelIL`, `MediumLevelIL`]|[`SettingsUserScope`]|<a id='ui.view.graph.carousel'>ui.view.graph.carousel</a>|
| | | |`enum`|`Disassembly`| | |
| | | |`enum`|`LowLevelIL`| | |
| | | |`enum`|`LiftedIL`| | |
@@ -349,6 +374,7 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | |`enum`|`HighLevelIL`| | |
| | | |`enum`|`HighLevelILSSAForm`| | |
| | | |`enum`|`PseudoC`| | |
+|ui|Show Entry/Exit Indicators on Blocks|Draws an extra line to indicate which blocks in Graph View are entry / exit points in the function. Blocks that do not return have their indicators drawn in a different color.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.view.graph.entryExitBlockIndicators'>ui.view.graph.entryExitBlockIndicators</a>|
|ui|Default IL for Graph View|Default IL for graph view. Other settings (e.g. 'ui.files.restore.viewState') have precedence over the default behavior.|`string`|`Disassembly`|[`SettingsUserScope`]|<a id='ui.view.graph.il'>ui.view.graph.il</a>|
| | | |`enum`|`Disassembly`| | |
| | | |`enum`|`LowLevelIL`| | |
@@ -389,10 +415,20 @@ All settings are uniquely identified with an identifier string. Identifiers are
| | | |`enum`|`HighLevelIL`| | |
| | | |`enum`|`HighLevelILSSAForm`| | |
| | | |`enum`|`PseudoC`| | |
-|ui|Default filter for types view|Default type filter to use in types view.|`string`|`user`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.types.defaultTypeFilter'>ui.view.types.defaultTypeFilter</a>|
-| | | |`enum`|`all`| | |
-| | | |`enum`|`user`| | |
-|ui|TypeView Line Numbers|Controls the display of line numbers in the types view.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.view.types.lineNumbers'>ui.view.types.lineNumbers</a>|
+|ui|Display Raw Symbol Name|Display the original, unaltered name of a symbol as extracted from a load file. The name may be mangled.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.displayRawNames'>ui.view.symbols.displayRawNames</a>|
+|ui|Display Short Symbol Name|Display a shortened version of the full, human-readable representation of the symbol name.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.displayShortNames'>ui.view.symbols.displayShortNames</a>|
+|ui|Hide Auto Symbols|Hide all symbols that are not explicitly defined by a user.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.hideAutoSymbols'>ui.view.symbols.hideAutoSymbols</a>|
+|ui|Symbols Hierarchy Mode|Enables hierarchical organization of symbols in the UI.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsUserScope`]|<a id='ui.view.symbols.hierarchyMode'>ui.view.symbols.hierarchyMode</a>|
+|ui|Seamless Navigation|Enables uninterrupted navigation on item selection without losing focus.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.seamlessNavigation'>ui.view.symbols.seamlessNavigation</a>|
+|ui|Show Exported Data Variables|Show exported data variables in the symbols view.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showExportedDataVariables'>ui.view.symbols.showExportedDataVariables</a>|
+|ui|Show Exported Functions|Show exported functions in the symbols view.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showExportedFunctions'>ui.view.symbols.showExportedFunctions</a>|
+|ui|Show Folders First|Show folders at the top of the view when sorting items in symbols view.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showFoldersFirst'>ui.view.symbols.showFoldersFirst</a>|
+|ui|Show Imports|Show imports in the symbols view.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showImports'>ui.view.symbols.showImports</a>|
+|ui|Show Local Data Variables|Show local data variables in the symbols view.|`boolean`|`False`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showLocalDataVariables'>ui.view.symbols.showLocalDataVariables</a>|
+|ui|Show Local Functions|Show local functions in the symbols view.|`boolean`|`True`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.symbols.showLocalFunctions'>ui.view.symbols.showLocalFunctions</a>|
+|ui|Maximum Lines for Wrapping in Editor|The maximum number of lines in rendered types before line wrapping is always disabled.|`number`|`10000`|[`SettingsUserScope`]|<a id='ui.view.types.maxLinesForWrapping'>ui.view.types.maxLinesForWrapping</a>|
+|ui|Maximum Types in Editor|The maximum number of types to render in the type editor in Types View.|`number`|`100`|[`SettingsUserScope`]|<a id='ui.view.types.maxTypesInEditor'>ui.view.types.maxTypesInEditor</a>|
+|ui|Enable the new Type Browser UI|Enables the new Types UI, with support for using Type Archives and Type Libraries from the UI.|`boolean`|`True`|[`SettingsUserScope`]|<a id='ui.view.types.useTypeBrowser'>ui.view.types.useTypeBrowser</a>|
|ui|Possible Value Set Function Complexity Limit|Function complexity limit for showing possible value set information. Complexity is calculated as the total number of outgoing edges in the function's MLIL SSA form.|`number`|`25`|[`SettingsProjectScope`, `SettingsResourceScope`, `SettingsUserScope`]|<a id='ui.view.variables.pvsComplexityLimit'>ui.view.variables.pvsComplexityLimit</a>|
|ui|File Path in Window Title|Controls whether the window title includes the full file path for the current file.|`boolean`|`False`|[`SettingsUserScope`]|<a id='ui.window.title.showPath'>ui.window.title.showPath</a>|
|updates|Update Channel Preferences|Select update channel and version.|`string`|`None`|[]|<a id='updates.channelPreferences'>updates.channelPreferences</a>|
diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index 740c1ee0..83fd3a0b 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -204,7 +204,7 @@ The following environment variables may be helpful when troubleshooting issues:
## File Associations
-With the addition of projects and type archives, Binary Ninja now includes support for `.bnpr` (project folders, openable on MacOS), `.bnpm` (project metadata, openable on all platforms), and `.bnta` (type archives, openable on all platforms) file formats. If installed fresh, these file associations will automatically be created. However, when using the built-in updater, the association is not currently added. To manually create the association, use the following:
+With the addition of [projects](../guide/projects.md) and [type archives](../guide/types/typearchives.md), Binary Ninja now includes support for `.bnpr` (project folders, openable on MacOS), `.bnpm` (project metadata, openable on all platforms), and `.bnta` (type archives, openable on all platforms) file formats. If installed fresh, these file associations will automatically be created. However, when using the built-in updater, the association is not currently added. To manually create the association, use the following:
### MacOS file associations
diff --git a/docs/guide/type.md b/docs/guide/type.md
deleted file mode 100644
index 15a77d2a..00000000
--- a/docs/guide/type.md
+++ /dev/null
@@ -1,363 +0,0 @@
-# Working with Types, Structures, and Symbols
-
-This document is organized into two sections describing how to work with types in Binary Ninja. The [first section](#basic-types) is how apply and create types.
-
-The second [section](#working-with-types) is how to interact with any type, regardless of its source.
-
-For more about type libraries, signature library, and how to interact with types through the API, see the [applying annotations](../dev/annotation.md) section of the developer guide.
-
-## Basic Types
-
-The biggest culprit of bad decompilation is often missing type information. Therefore, some of the most important actions you can take while reverse engineering is renaming symbols/variables, applying types, and creating new types to apply.
-
-### Renaming Symbols and Variables
-
-![Rename a function >](../img/rename.png "Renaming a function")
-
-Some binaries helpfully have symbol information in them which makes reverse engineering easier. Of course, even if the binary doesn't come with symbol information, you can always add your own. From the UI, just select the function, variable, member, or register you want to change and press `n`. This works on variables as well.
-
-### Applying Structures and Types
-
-Simply select an appropriate token (variable or memory address), and press `y` to bring up the change type dialog. Types can be applied on both disassembly and all levels of IL. Any variables that are shared between the ILs will be updated as types are applied.
-
-![Changing a type](../img/change-type.png "Changing a type")
-
-## Types View
-
-To see all types in a Binary View, use the types view. It can be accessed from the menu `View > Types`. Alternatively, you can access it with the `t` hotkey from most other views, or using `[CMD/CTRL] p` to access the command-palette and typing "types". This is the most common interface for creating structures, unions and types using C-style syntax.
-
-The types view is also available in the sidebar with the `{…}` icon.
-
-For many built-in file formats you'll notice that common headers are already enumerated in the types view. These headers are applied when viewing the binary in [linear view](./index.md#linear-view) and will show the parsed binary data into that structure or type making them particularly useful for binary parsing even of non-executable file formats.
-
-![Types View](../img/types-view.png "Types View")
-
-### Structure Access Annotations
-
-Types view now annotates code references to structure offsets. It uses the same convention as in the graph/linear view. For example, the `__offset(0x8).q` token means the code references the offset 0x8 of this structure, and the size of the access is a qword. This will make it easier to see which offsets of a structure are being used, and aid in the process of creating structure members.
-
-![Type View Accesses](../img/type-view-accesses.png "Type View Accesses")
-
-### Shortcuts
-
-From within the Types view, you can use the following hotkeys to create new types, structures, or unions. Alternatively, you can use the right-click menu to access these options and more.
-
-![Types Right Click Menu >](../img/types-right-click-menu.png "Types Right Click Menu")
-
-* `s` - Create new structure
-* `i` - Create new type
-* `[SHIFT] s` - Creating a new union
-* `1`, `2`, `4`, `8`: The number hotkeys will create a create an integer of the specified size. This additionally works on selections.
-* `d`: If you want to cycle through the different integer sizes, repeatedly pressing `d` has the same effect as pressing the numbers in order.
-* `-`: To quickly toggle integers between signed and unsigned integers, you can use the `-` hotkey.
-
-
-The shortcuts for editing existing elements are:
-
-* `y` - Edit type / field
-* `n` - Rename type / field
-* `l` - Set structure size
-* `u` - undefine field
-
-### Attributes
-
-Structs support the attribute `__packed` to indicate that there is no padding. Additionally, function prototypes support the following keywords to indicate their calling convention or other features:
-
-``` text
-__cdecl
-__stdcall
-__fastcall
-__convention
-__noreturn
-```
-
-To use the `__convention` keyword, pass in the convention name as a parameter argument:
-
-```
-__convention("customconvention")
-```
-
-
-#### Examples
-
-``` C
-enum _flags
-{
- F_X = 0x1,
- F_W = 0x2,
- F_R = 0x4
-};
-```
-
-``` C
-struct Header __packed
-{
- char *name;
- uint32_t version;
- void (* callback)();
- uint16_t size;
- enum _flags flags;
-};
-```
-
-
-## Working With Types
-
-There are two main ways to interact with types from within a binary view. The first is to use the [types view](#types-view), and the second is to take advantage of the [smart structures workflow](#smart-structures-workflow) or otherwise annotate types directly in a disassembly or IL view.
-
-### Direct UI manipulation
-
-The simplest way to directly manipulate types in disassembly is by viewing an existing variable or sequence of bytes in linear view and using the following hotkeys:
-
-
- - `1`, `2`, `4`, `8`: The number hotkeys will create a data variable at the current location if none exists, and then change the size of the variable to an integer in the size of bytes specified in the hotkey.
- - `d`: If you want to cycle through the different integer sizes, repeatedly pressing `d` has the same effect as pressing the numbers in order.
- - `-`: To quickly toggle integers between signed and unsigned integers, you can use the `-` hotkey.
- - `a`: This hotkey sets or creates the current variable to a character array up until and including the next null byte.
- - `o`: `o` will set or create the current variable to be a pointer reference.
- - `*`: If you have a selection of identical variables, `*` will convert them into an array of elements. If you have no selection, the "Create Array" dialog will be shown allowing you to create an array of specific type and count at the current location.
-![Create Array Dialog](../img/create_array.png "Create Array Dialog")
- - `s`: `s` is a magic hotkey described in the next section in greater detail
- - `m`: Used to apply an enumeration display at an integer (more details [below](#enumeration-selector))
-
- Note that you can apply these types to a region of memory as well, not just a single variable. So selecting a large block of bytes and pressing `2` `*` for example will create an array of `int16_t` sized elements.
-
-### Enumeration Selector
-
-![Select Enum Dialog](../img/select_enum_member.png "Select Enum Dialog")
-
-The Enum Dialog, with a default hotkey of `m` can be used to both change the type for data variables, arguments, and local variables to an enum type and also to change the Display Type of constant integers to any matching enumeration members.
-
-When used on an integer, all matching enumeration members will be shown.
-
-1. Filter box to search large lists of matching enums
-1. "New Enum" button to allow creation of a new enum
-1. Enum preview (can also be used to edit an existing enum by double clicking a given line)
-1. Currently selected enum/member (when the enum is selected, the preview will update, and you can also right-click here to change the type)
-1. Name of currently selected enum
-1. Checkbox (set by default) that hides enums with no matching members for the current integer.
-
-However in instances where the hotkey is used on other variables, the display will only be used to apply the enum type to the selection and does not allow editing.
-
-![Apply Enum Type](../img/apply_enum.png "Apply Enum Type")
-
-### Smart Structures Workflow
-
-"Smart Structures" feature enables automatic creation of a structure and its members directly from the disassembly/IL view using the `s` hotkey.
-It simplifies the traditional workflow in which the user first creates a type in the types view and then applies it to disassembly.
-It works in the following ways:
-
-| View | Selection | Current Type | Behavior |
-|--------------------|--------------------------------------------------------------|----------------------|-----------------------------------------------------------------------------------|
-| Linear/Graph | A variable | Not a struct/struct\* | Create structure dialog |
-| Linear/Graph | A variable that is the result an allocation routine | Not a struct/struct\* | Create structure with allocation size |
-| Linear/Graph/Types | A variable, data variable, or a type name | struct/struct\* | Create all members for structure |
-| Linear/Graph/Types | A StructOffsetToken token, e.g., `__offset(0x18)` | N/A | Create current member for structure |
-
-Below are detailed explanation of it:
-
-1. In linear/graph view, if the selection is a variable that is not a structure, a dialog pops up and asks you to create a structure. You can specify the structure's name and size. There is also a checkbox that asks you whether the variable's type should be the structure itself or a pointer to the structure.
-2. In linear/graph view, if the selection is a variable that is not a structure, and it happens to be the result of a memory allocation routine, e.g., `malloc`, a new structure will be created and its size is automatically determined (if possible). The variable's type will be a pointer to the structure.
-3. In linear/graph/types view, If you select a variable whose type is a structure, or a pointer to a structure, BN will try to create all structure field at any offset that has been accessed in the code.
-4. In linear/graph/types view, If you select a StructOffsetToken, BN will try to create a structure member at the current offset.
-
-The automatic member creation mentioned in #3 and #4 takes into consideration both incoming and outgoing type information for the accessed offsets and selects the most confident one as the type for the offset.
-When no type information can be used to create the structure member, we fall back to creating an integer type based on the size of accesses. For example, if we see an access of size 4, we will create an `int32_t`. In case there are different sizes of accesses, we do not create the member. You will need to examine the conflicting size information and decide how to create a member.
-
-
-
-Consider the following example (created using [taped](../files/taped) from the 2011 Ghost in the Shellcode CTF if you'd like to play along at home):
-
-| Step | Preview |
-|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------|
-| Go to address `0x8048e20` and switch to HLIL. | <img src="../img/taped/1.png" alt="Structure Workflow 1"/> |
-| Select variable `var_18` and press `s`. <br/>Since `calloc` is a known allocation routine and the allocation size can be determined to be 0x30, a new structure, `struct_1` is created with size 0x30. | <img src="../img/taped/2.png" alt="Structure Workflow 2"/> |
-| Select an offset, e.g., `__offset(0x4).d` and press `s`. A member will be automatically created. | <img src="../img/taped/3.png" alt="Structure Workflow 3"/> |
-| Alternatively, select the `var_18` or the type name `struct_1` and press `s`. All members in the `struct_1` will be automatically created. | <img src="../img/taped/4.png" alt="Structure Workflow 4"/> |
-| Viewing the automatically created structure members. | <img src="../img/taped/5.png" alt="Structure Workflow 5"/> |
-
-
-The `s` hotkey also works when working with structures in the linear view. Its behavior differs based on the current selection:
-
-
-| Selection | Behavior |
-|--------------------------------------------------------------|-----------------------------------------------------------------------------------|
-| A single byte | Create structure dialog |
-| A range of bytes | Create structure with selection size |
-| A range of bytes covering existing data variables | Create structure with selection size and add existing data vars as struct members |
-
-
-In linear view, if the selection is a single byte outside any function, it will pop up the create structure dialog. If the selection is a range of bytes, a structure of the selection size is created and the start of the selection. If the selection covers any existing data variables, these data variables will become members within the newly created structure.
-
-This also works within data variables with structure type. For example, if the selection is a range of bytes within a structure, a new structure will be created within the existing structure.
-
-
-### Import BNDB File
-
-The Import BNDB File feature imports types from a previous BNDB into your currently open file. In addition, it will apply types for matching symbols in functions and variables. Import BNDB *will not* port symbols from a BNDB with symbols to one without -- the names must already match. Matching functions and porting symbols is beyond the scope of this feature.
-
-![Importing a BNDB](../img/import-bndb.png "Importing a BNDB")
-
-#### Usage
-
-To use this feature select `Import From BNDB` from the `Analysis` menu, use the [command palette](index.md#command-palette), or [bind a hotkey](index.md#custom-hotkeys) and select the BNDB you'd like to import. Wait for the BNDB to load then you'll be presented with a list of things to import.
-
-* Types - Various types to be imported from the source BNDB
-* Functions - Attempt to find target functions whose symbol already matches the symbol of the source BNDB and apply their type
-* Function to Imports - Attempt to find target Imports whose symbol matches the Functions symbols in the source BNDB and apply their type
-* Data Variables - Attempt to find target DataVariables with symbols that match DataVariables in the source BNDB and apply their type
-
-This feature enables a number of workflows:
-
-#### Porting Analysis Between Target Versions
-
-If you're working with version 1 of a file which has symbols and you now want to port your work over to version 2 (as long as they both have symbols). This isn't going to be perfect as this feature isn't interactive and doesn't take into account changes in parameter counts or ordering, so *use this with caution*.
-
-#### Quickly Defining Externs
-
-If you have a binary with externs which don't have TypeLibraries this can allow you to quickly import them (and their types) from another source, this is especially effective when you have debug information for the dependent libraries
-
-### Import Header File
-
-If you already have a collection of headers containing types you want to use, you can import them directly. You can specify the compiler flags that would be used if a compiler were compiling a source file that uses this header. Specifically this means you can/should specify:
-
-- `-isystem<path>` for various system header paths
-- `-I<path>` for various user header paths
-- `-D<macro>=<value>` for macro definitions
-- `-x c -std=c99` to specify C99 mode
-- Other Clang-compatible command-line flags are accepted (eg `-fms-extensions`, `-fms-compatibility`, etc)
-
-You can specify that types from system headers, accessed via `#include <header.h>`, will be in the results. Otherwise, only files from user headers, accessed via `#include "header.h"` will be used.
-
-You can also specify Define Binary Ninja Macros, which makes the type parser include the various parser extensions that Binary Ninja allows in the Type View editors, eg `__packed`, `__padding`, `__syscall`, etc. You probably only want to use this option when importing a header file exported using [Export Header File](#export-header-file).
-
-After specifying the file(s) and flag(s), pressing Preview will give a list of all the types and functions defined in the file(s). You may check or uncheck the box next to any of the types/functions to control whether they will be imported to your analysis.
-
-If there were any parse errors, those will be shown instead of a list of types. Generally speaking, what this means is you're missing either header search paths or compile definitions. See the section below on [finding system headers](#finding-system-headers).
-
-After pressing Import, all the checked types/functions will be added to your analysis. Imported types will override any existing types you had defined so they are disabled by default as indicated via the `Exists Already` column. Imported functions will replace signatures of any functions in your analysis whose name matches signatures found in the header.
-
-![Importing a header file](../img/import-header.png "Importing a header file")
-
-#### Finding System Headers
-
-Since you need to specify the include paths for system headers, you will need to deduce them for the target platform of your analysis. Here are a few tricks that may help:
-
-##### Systems with GCC/Clang (macOS, Linux, etc)
-
-On these systems, you can run a command to print the default search path for compilation:
-
- gcc -Wp,-v -E -
- clang -Wp,-v -E -
-
-For the directories printed by this command, you should include them with `-isystem<path>` in the order specified.
-
-For example on macOS, with Xcode 13:
-
- $ clang -Wp,-v -E -
- clang -cc1 version 13.0.0 (clang-1300.0.29.3) default target arm64-apple-darwin21.6.0
- ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/local/include"
- ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/Library/Frameworks"
- #include "..." search starts here:
- #include <...> search starts here:
- /usr/local/include
- /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
- /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
- /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
- /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks (framework directory)
- End of search list.
-
-From this example, the flags would be: (note: not including the framework directory line)
-
- -isystem/usr/local/include
- -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
- -isystem/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
- -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
-
-Another example on Arch Linux:
-
- $ gcc -Wp,-v -E -
- ignoring nonexistent directory "/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/../../../../x86_64-pc-linux-gnu/include"
- #include "..." search starts here:
- #include <...> search starts here:
- /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
- /usr/local/include
- /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
- /usr/include
- End of search list.
-
-From this example, the flags would be:
-
- -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
- -isystem/usr/local/include
- -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
- -isystem/usr/include
-
-##### For Windows
-
-For windows, there's no easy command to list all the include paths so you have to piece them together from the `Include Directory` property in a Visual Studio project. You also want to include `-x c -std=c99` since Windows headers include lots of C++ types that the type importer currently does not support.
-
-You will end up with something like the following for user mode:
-
- -x c -std=c99
- -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
-
-Or, for kernel mode:
-
- -x c -std=c99
- -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km"
-
-##### Cross-Platform Targets
-
-If you are analyzing a target that is for a different operating system, you need to both find the header include paths for that system, and copy (or mount) them to a location accessible by the computer running Binary Ninja.
-
-### Export Header File
-
-If you want to compile code using the structures you defined during your analysis, you can export all the types to a C-compatible header file that can be used via `#include` by a C compiler. You can also import this header in another analysis session via [Import Header File](#import-header-file), just be sure to enable `Define Binary Ninja Macros` when doing so.
-
-## Platform Types
-
-Binary Ninja pulls type information from a variety of sources. The highest-level source are the platform types loaded for the given platform (which includes operating system and architecture). There are two sources of platform types. The first are shipped with the product in a [binary path](./index.md#directories). The second location is in your [user folder](./index.md#user-folder) and is intended for you to put custom platform types.
-
-???+ Danger "Warning"
- Do NOT make changes to platform types in the binary path as they will be overwritten any time Binary Ninja updates.
-
-Platform types are used to define types that should be available to all programs available on that particular platform. They are only for global common types. Consider, for example, that you might want to add the following on windows:
-
-```
-typedef uint8_t u8;
-```
-
-You could write this type into:
-
-```
-/home/user/.binaryninja/types/platform/windows-x86.c
-```
-
-And any time you opened a 32bit windows binary, that type would be available to use. However, please note that these are not substitutes for [Type Libraries](../dev/annotation.md#type-libraries). Type Libraries are used to provide a collection of types for a given library such as a libc, or common DLL.
-
-???+ Warning "Tip"
- If you don't know the specific platform (and thus filename) you need to create for a given file, just enter `bv.platform` in the scripting console.
-
-### Common Types
-
-You may wish to provide types that are common across multiple architectures or platforms. The easiest way to do this is to use a `#include "filename.c"` line in the specific platform so that any common types will be loaded.
-
-For example, something like:
-
-```
-$ pwd
-/home/user/.binaryninja/types/platform
-$ cat windows-x86.c
-#include "windows.c"
-$ cat windows-x86_64.c
-#include "windows.c"
-$ cat windows.c
-typedef uint8_t u8;
-```
diff --git a/docs/guide/types/basictypes.md b/docs/guide/types/basictypes.md
new file mode 100644
index 00000000..b9530ddb
--- /dev/null
+++ b/docs/guide/types/basictypes.md
@@ -0,0 +1,173 @@
+# Basic Type Editing
+
+The biggest culprit of bad decompilation is often missing type information. Therefore, some of the most important actions you can take while reverse engineering is renaming symbols/variables, applying types, and creating new types to apply.
+
+## Renaming Symbols and Variables
+
+![Rename a function](../../img/rename.png "Renaming a function")
+
+Some binaries helpfully have symbol information in them which makes reverse engineering easier. Of course, even if the binary doesn't come with symbol information, you can always add your own. From the UI, just select the function, variable, member, or register you want to change and press `n`.
+
+## Applying / Changing Structures and Types
+
+Simply select an appropriate token (function, parameter, variable or memory address), and press `y` to bring up the change type dialog. Types can be applied on both disassembly and all levels of IL. Any variables that are shared between the ILs will be updated as types are applied.
+
+![Changing a type](../../img/change-type.png "Changing a type")
+
+## Types View
+
+![Types View](../../img/types-view.png "Types View")
+
+The Types View is the main view for organizing and modifying types in Binary Ninja.
+You can access it in a number of different ways:
+
+- Open it in the sidebar with the {T} icon
+- Open it in the sidebar in the Command Palette under "Focus Types"
+- Switch the current view pane to it by selecting "Types" under the view type menu
+- Switch the current view pane in the Command Palette under "Types"
+
+The Types View comprises two main views: the [Type List](#the-type-list) and the [Type Editor](#the-type-editor).
+There is also a search box that filters the Type List, and a menu button that shows the context menu
+for the active view.
+
+### The Type List
+
+![Types View](../../img/types-list.png "Types View")
+
+The Type List shows you both the types available in your analysis session and types from
+the [various other places](#type-containers) related to your analysis that can be imported.
+Types you select in the Type List will be shown in the Type Editor view, and you can view
+multiple types at once by clicking with Shift or Ctrl (Cmd on macOS). Selected types will
+show cross-references in the [cross-references sidebar pane](../index.md#cross-references).
+You can edit selected types in the Type Editor, or if you double-click a type
+(or use Change Type in the context menu), you can edit them as C source.
+
+Types in the list have their class indicated by icons:
+
+* **S**: Structure types
+* **C**: Class types (a variant of structure types)
+* **U**: Union types (a variant of structure types)
+* **E**: Enumeration types
+* **T**: All other types
+
+#### Type List Actions
+
+* Type Creation
+ * **Create Types from C Source** - Open a text box where you can enter C source type and structure definitions
+ * **Create New Structure** - Create a new blank structure type
+ * **Create New Enumeration** - Create a new blank enumeration type
+ * **Create New Union** - Create a new blank union type
+* Type Editing
+ * **Rename Type** - Rename the currently selected type
+ * **Change Type** - Edit the currently selected type in a text box with C source
+* Type Archives
+ * **Create Type Archive** - Create a [Type Archive](typearchives.md) and attach it to your analysis
+ * **Attach Type Archive** - Attach an existing [Type Archive](typearchives.md) to your analysis
+ * **Detach Type Archive** - Detach an attached [Type Archive](typearchives.md) and disassociate all types from it
+ * **Push Types to Archive** - Push the selected types to a [Type Archive](typearchives.md)
+ * **Pull Types from Archive** - Pull the selected types from a [Type Archive](typearchives.md)
+ * **Disassociate Types from Archive** - Disassociate, or break connections between, the selected types and their associated [Type Archive](typearchives.md)
+* Type Libraries
+ * **Import Type** - Import a type from a [Type Library](../../dev/annotation.md#type-libraries) into your analysis
+ * **Import Type by GUID** - (Windows binary analyses only) Import a COM type by its GUID
+ * **Add Type Library** - Add an existing [Type Library](../../dev/annotation.md#type-libraries) to your analysis
+* Settings
+ * **Search** - Change how the search box filters types
+ * **Type Names** - Search only filters by names of types (default)
+ * **Type and Member Names** - Search filters by both names of types and names of members in structure types
+ * **Full Definition Text** - Search filters by matching the full text representation of types (can be slow for large numbers of types)
+
+#### Type Containers
+
+All of the type containers described in the [type introduction](index.md) are available in the Types View along with `User Types` in a section of its own.
+
+* **User Types**: In your analysis: Types created by you, either manually or through actions/plugins
+* **System Types**: In your analysis: Types created by analysis or imported during analysis, such as from Libraries or Debug Info
+* **Archive**: Types in an attached [Type Archive](typearchives.md). You can edit and delete them, without affecting the types in your analysis, and you can push/pull them into your analysis.
+* **Library**: Types in a [Type Library](../../dev/annotation.md#type-libraries). You cannot edit them, but you can import them into your analysis.
+* **Debug Info**: Types found in [Debug Info](debuginfo.md). You cannot edit them here, but they are copied into the System Types where you can edit them.
+* **Platform**: Types from the analyzed binary's [Platform](platformtypes.md). You cannot edit them here, but they are copied into the System Types where you can edit them.
+
+![Types Containers](../../img/types-containers.png "Type Containers")
+
+### The Type Editor
+
+The Type Editor is the primary interface for editing types used in your analysis. It shows
+whichever types you select in the Type List above, and allows you to edit them in many ways.
+Types are shown in C syntax with various [annotations](#type-annotations). Structure members
+have their offsets indicated on the left, and empty space between structure members is shown
+with `??` marks indicating individual bytes. Selecting members in a structure will show
+[cross-references](../index.md#cross-references) to those members, and double-clicking
+the name of a type will take you to its definition.
+
+#### Type Editor Actions
+
+* Modifying Types
+ * **Change Type** - Edit an entire type, or structure member, as C source
+ * **Rename** - Rename a type or structure member
+ * **Undefine** - Delete a type from your analysis, or delete a structure member
+ * **Set Structure Size** - Manually specify a structure's size, alignment, and packing
+* Creating Structure Members
+ * **Type > Make 8-bit Integer** - Create `uint8_t` members in selection
+ * **Type > Make 16-bit Integer** - Create `uint16_t` members in selection
+ * **Type > Make 32-bit Integer** - Create `uint32_t` members in selection
+ * **Type > Make 64-bit Integer** - Create `uint64_t` members in selection
+ * **Type > Invert Integer Sign** - Toggle integer signedness, e.g. between `uint8_t` and `int8_t`
+ * **Type > Cycle Integer Size** - Change integer member size in order: `uint8_t`, `uint16_t`, `uint32_t`, `uint64_t`
+ * **Type > Make 32-bit Float** - Create `float` members in selection
+ * **Type > Make 64-bit Float** - Create `double` members in selection
+ * **Type > Cycle Float Size** - Change float member size in order: `float`, `double`
+ * **Type > Make Pointer** - Create `void*` members in selection
+ * **Type > Make C String** - Create `char*` members in selection
+ * **Type > Make UTF-16 String** - Create `wchar16*` members in selection
+ * **Type > Make UTF-32 String** - Create `wchar32*` members in selection
+* Utility
+ * **Add Cross Reference from** - Manually add a cross-reference to a type (or member) from an address in the analysis
+* Settings
+ * **Show Inherited Members** - When working with [structures with inheritance](cpp.md#derived-classes), show members from base classes in child classes
+ * **Wrap Lines** - Soft-wrap long text lines
+
+### Type Annotations
+
+The Types view now annotates code references to structure offsets. It uses the same convention as in the graph/linear view. For example, the `__offset(0x8).q` token means the code references the offset 0x8 bytes into this structure, and the size of the access is a qword. This will make it easier to see which offsets of a structure are being used, and aid in the process of creating structure members.
+
+## Attributes
+
+Structs support the attribute `__packed` to indicate that there is no padding. Additionally, function prototypes support the following keywords to indicate their calling convention or other features:
+
+``` text
+__cdecl
+__stdcall
+__fastcall
+__convention
+__noreturn
+```
+
+To use the `__convention` keyword, pass in the convention name as a parameter argument:
+
+```
+__convention("customconvention")
+```
+
+
+## Examples
+
+``` C
+enum _flags
+{
+ F_X = 0x1,
+ F_W = 0x2,
+ F_R = 0x4
+};
+```
+
+``` C
+struct Header __packed
+{
+ char *name;
+ uint32_t version;
+ void (* callback)();
+ uint16_t size;
+ enum _flags flags;
+};
+```
diff --git a/docs/guide/cpp.md b/docs/guide/types/cpp.md
index 1da8d817..455e59fd 100644
--- a/docs/guide/cpp.md
+++ b/docs/guide/types/cpp.md
@@ -16,17 +16,17 @@ A derived class can be defined using the Create Structure dialog. From the Types
dialog can be opened with a default hotkey of `s` or by using the add menu on the right of
the sidebar.
-![Create Structure menu](../img/create_struct_menu.png "Create Structure menu")
+![Create Structure menu](../../img/create-struct-menu.png "Create Structure menu")
First, enter the offset and name of the base structure below the "Base structures" list. The
offset should be where in the derived structure to place the base structure's members, which
will usually be zero for single inheritance.
-![Adding a base structure](../img/create_derived_struct_1.png "Adding a base structure")
+![Adding a base structure](../../img/create-derived-struct-1.png "Adding a base structure")
Click the add button to add the base structure to the new structure.
-![Base structure added](../img/create_derived_struct_2.png "Base structure added")
+![Base structure added](../../img/create-derived-struct-2.png "Base structure added")
The offset will automatically update to be just after the added structure in case you need to
add additional base structures. Click the Create button to create the new structure.
@@ -146,11 +146,11 @@ struct __base(Foo, 0) Bar
## Template Simplifier
-The [`analysis.types.templateSimplifier`](settings.md#analysis.types.templateSimplifier) setting can be helpful when working with C++ symbols.
+The [`analysis.types.templateSimplifier`](../settings.md#analysis.types.templateSimplifier) setting can be helpful when working with C++ symbols.
<div class="juxtapose">
- <img src="../img/before-template-simplification.png" data-label="Before Simplification"/>
- <img src="../img/after-template-simplification.png" data-label="After Simplification"/>
+ <img src="../../img/before-template-simplification.png" data-label="Before Simplification"/>
+ <img src="../../img/after-template-simplification.png" data-label="After Simplification"/>
</div>
## Example
@@ -342,7 +342,7 @@ adding `Animal` as a base structure and then adding `Flying`. The Create Structu
automatically adjust the offset as you add structures. The dialog should look like this after
the base structures are added:
-![Multiple base structures](../img/create_multi_derived_struct.png "Multiple base structures")
+![Multiple base structures](../../img/create-multi-derived-struct.png "Multiple base structures")
After defining and adding the additional member, the `Bird` structure looks like this:
@@ -574,7 +574,7 @@ when navigating the C++ program. For example, clicking on the `make_sound` membe
structure will populate the cross references view with the list of functions that implement the
method:
-![Virtual function table references](../img/vtable_cross_refs.png "Virtual function table references")
+![Virtual function table references](../../img/vtable-cross-refs.png "Virtual function table references")
These cross references are aware of context when viewed from code. For example, in the following
function:
@@ -596,7 +596,7 @@ void Cat::approach(struct Cat* this)
Clicking on `make_sound` will populate the cross references with *only* the functions that are
in `Cat` or derived classes of `Cat`:
-![Virtual function table references with context](../img/vtable_cross_refs_context.png "Virtual function table references with context")
+![Virtual function table references with context](../../img/vtable-cross-refs-context.png "Virtual function table references with context")
## Offset Pointers
diff --git a/docs/guide/debuginfo.md b/docs/guide/types/debuginfo.md
index 0c10943b..c994843c 100644
--- a/docs/guide/debuginfo.md
+++ b/docs/guide/types/debuginfo.md
@@ -8,7 +8,7 @@ Currently debug info plugins are limited to types, function signatures, and data
Out of the box, Binary Ninja supports PDBs and DWARF.
-For PDBs, Binary Ninja will automatically try to source from specified local folders and Microsoft's symbol server ([see the PDB settings for more information](settings.md#all-settings)).
+For PDBs, Binary Ninja will automatically try to source from specified local folders and Microsoft's symbol server ([see the PDB settings for more information](../settings.md#all-settings)).
For DWARF, this includes DWARF information compiled in to ELF binaries, DWARF information in external ELF files (`.dwo`, `.debug`, etc), DWARF information compiled in to Mach-O's, and DWARF information in external `.dSYM` files as well. Support for DWARF information in PEs is [planned](https://github.com/Vector35/binaryninja-api/issues/1555).
diff --git a/docs/guide/types/index.md b/docs/guide/types/index.md
new file mode 100644
index 00000000..acf1046c
--- /dev/null
+++ b/docs/guide/types/index.md
@@ -0,0 +1,18 @@
+# Working with Types, Structures, and Symbols
+
+There's so many things to learn about working with Types in Binary Ninja that we've organized it into several sections!
+
+- [Basic Type Editing](basictypes.md): Brief overview of the basics
+- [Working with Types](type.md): Interacting with types in disassembly and decompilation
+- [Importing/Exporting Types](typeimportexport.md): How to import or export types from header files, archives, or other BNDBs
+
+Additionally, several types of containers for type information are documented here:
+
+- [Debug Info](debuginfo.md): Debug Info can provide additional type information (examples include DWARF and PDB files)
+- [Type Libraries](typelibraries.md): Type Libraries contain types from commonly-used dynamic libraries
+- [Platform Types](platformtypes.md): Types that automatically apply to a platform
+- [Type Archives](typearchives.md): How you can use type archives to share types between analysis databases
+- [Signature Libraries](../../dev/annotation.md#signature-library): Signature libraries are used to match names of functions with signatures for code that is statically compiled
+- [Platform Types](platformtypes.md): Platform types are base types that apply to all binaries on a particular platform
+
+Additionally, make sure to see the [applying annotations](../../dev/annotation.md) section of the developer guide for information about using the API with types and covering the creation of many of the items described below. \ No newline at end of file
diff --git a/docs/guide/types/platformtypes.md b/docs/guide/types/platformtypes.md
new file mode 100644
index 00000000..286615e6
--- /dev/null
+++ b/docs/guide/types/platformtypes.md
@@ -0,0 +1,42 @@
+# Platform Types
+
+Binary Ninja pulls type information from a variety of sources. The highest-level source are the platform types loaded for the given platform (which includes operating system and architecture). There are two sources of platform types. The first are shipped with the product in a [binary path](../index.md#directories). The second location is in your [user folder](../index.md#user-folder) and is intended for you to put custom platform types.
+
+???+ Danger "Warning"
+ Do NOT make changes to platform types in the binary path as they will be overwritten any time Binary Ninja updates.
+
+Platform types are used to define types that should be available to all programs available on that particular platform. They are only for global common types. Consider, for example, that you might want to add the following on windows:
+
+```
+typedef uint8_t u8;
+```
+
+You could write this type into:
+
+```
+/home/user/.binaryninja/types/platform/windows-x86.c
+```
+
+And any time you opened a 32bit windows binary, that type would be available to use. However, please note that these are not substitutes for [Type Libraries](../../dev/annotation.md#type-libraries). Type Libraries are used to provide a collection of types for a given library such as a libc, or common DLL.
+
+???+ Warning "Tip"
+ If you don't know the specific platform (and thus filename) you need to create for a given file, just enter `bv.platform` in the scripting console.
+
+## Common Types
+
+You may wish to provide types that are common across multiple architectures or platforms. The easiest way to do this is to use a `#include "filename.c"` line in the specific platform so that any common types will be loaded.
+
+The base path for these files is in your [user folder](../index.md#user-folder) inside of a "types/platform" subfolder.
+
+For example, something like:
+
+```
+$ pwd
+/home/user/.binaryninja/types/platform
+$ cat windows-x86.c
+#include "windows.c"
+$ cat windows-x86_64.c
+#include "windows.c"
+$ cat windows.c
+typedef uint8_t u8;
+```
diff --git a/docs/guide/types/type.md b/docs/guide/types/type.md
new file mode 100644
index 00000000..5526efa1
--- /dev/null
+++ b/docs/guide/types/type.md
@@ -0,0 +1,88 @@
+# Working with Types, Structures, and Symbols in Decompilation
+
+There are two main ways to interact with types in decompilation or disassembly. The first is to use the [types view](basictypes.md#types-view), and the second is to take advantage of the [smart structures workflow](#smart-structures-workflow) or otherwise annotate types directly in a disassembly or IL view.
+
+## Direct UI manipulation
+
+The simplest way to directly manipulate types in disassembly is by viewing an existing variable or sequence of bytes in linear view and using the following hotkeys:
+
+ - `1`, `2`, `4`, `8`: The number hotkeys will create a data variable at the current location if none exists, and then change the size of the variable to an integer in the size of bytes specified in the hotkey.
+ - `d`: If you want to cycle through the different integer sizes, repeatedly pressing `d` has the same effect as pressing the numbers in order.
+ - `-`: To quickly toggle integers between signed and unsigned integers, you can use the `-` hotkey.
+ - `a`: This hotkey sets or creates the current variable to a character array up until and including the next null byte.
+ - `o`: `o` will set or create the current variable to be a pointer reference.
+ - `*`: If you have a selection of identical variables, `*` will convert them into an array of elements. If you have no selection, the "Create Array" dialog will be shown allowing you to create an array of specific type and count at the current location.
+![Create Array Dialog](../../img/create-array.png "Create Array Dialog")
+ - `s`: `s` is a magic hotkey described in the next section in greater detail
+ - `m`: Used to apply an enumeration display at an integer (more details [below](#enumeration-selector))
+
+ Note that you can apply these types to a region of memory as well, not just a single variable. So selecting a large block of bytes and pressing `2` `*` for example will create an array of `int16_t` sized elements.
+
+## Enumeration Selector
+
+![Select Enum Dialog](../../img/select-enum-member.png "Select Enum Dialog")
+
+The Enum Dialog, with a default hotkey of `m` can be used to both change the type for data variables, arguments, and local variables to an enum type and also to change the Display Type of constant integers to any matching enumeration members.
+
+When used on an integer, all matching enumeration members will be shown.
+
+1. Filter box to search large lists of matching enums
+1. "New Enum" button to allow creation of a new enum
+1. Enum preview (can also be used to edit an existing enum by double clicking a given line)
+1. Currently selected enum/member (when the enum is selected, the preview will update, and you can also right-click here to change the type)
+1. Name of currently selected enum
+1. Checkbox (set by default) that hides enums with no matching members for the current integer.
+
+However in instances where the hotkey is used on other variables, the display will only be used to apply the enum type to the selection and does not allow editing.
+
+## Smart Structures Workflow
+
+![Auto Create Members](../../img/auto-create-members.png "Automatically Creating Struct Members")
+
+"Smart Structures" feature enables automatic creation of a structure and its members directly from the disassembly/IL view using the `s` hotkey.
+It simplifies the traditional workflow in which the user first creates a type in the types view and then applies it to disassembly.
+It works in the following ways:
+
+| View | Selection | Current Type | Behavior |
+|--------------------|--------------------------------------------------------------|----------------------|-----------------------------------------------------------------------------------|
+| Linear/Graph | A variable | Not a struct/struct\* | Create structure dialog |
+| Linear/Graph | A variable that is the result an allocation routine | Not a struct/struct\* | Create structure with allocation size |
+| Linear/Graph/Types | A variable, data variable, or a type name | struct/struct\* | Create all members for structure |
+| Linear/Graph/Types | A StructOffsetToken token, e.g., `__offset(0x18)` | N/A | Create current member for structure |
+
+Below are detailed explanation of it:
+
+1. In linear/graph view, if the selection is a variable that is not a structure, a dialog pops up and asks you to create a structure. You can specify the structure's name and size. There is also a checkbox that asks you whether the variable's type should be the structure itself or a pointer to the structure.
+2. In linear/graph view, if the selection is a variable that is not a structure, and it happens to be the result of a memory allocation routine, e.g., `malloc`, a new structure will be created and its size is automatically determined (if possible). The variable's type will be a pointer to the structure.
+3. In linear/graph/types view, If you select a variable whose type is a structure, or a pointer to a structure, BN will try to create all structure field at any offset that has been accessed in the code.
+4. In linear/graph/types view, If you select a StructOffsetToken, BN will try to create a structure member at the current offset.
+
+The automatic member creation mentioned in #3 and #4 takes into consideration both incoming and outgoing type information for the accessed offsets and selects the most confident one as the type for the offset.
+When no type information can be used to create the structure member, we fall back to creating an integer type based on the size of accesses. For example, if we see an access of size 4, we will create an `int32_t`. In case there are different sizes of accesses, we do not create the member. You will need to examine the conflicting size information and decide how to create a member.
+
+
+
+Consider the following example (created using [taped](../../files/taped) from the 2011 Ghost in the Shellcode CTF if you'd like to play along at home):
+
+| Step | Preview |
+|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------|
+| Go to address `0x8048e20` and switch to HLIL. | <img src="../../img/taped/1.png" alt="Structure Workflow 1"/> |
+| Select variable `var_18` and press `s`. <br/>Since `calloc` is a known allocation routine and the allocation size can be determined to be 0x30, a new structure, `struct_1` is created with size 0x30. | <img src="../../img/taped/2.png" alt="Structure Workflow 2"/> |
+| Select an offset, e.g., `__offset(0x4).d` and press `s`. A member will be automatically created. | <img src="../../img/taped/3.png" alt="Structure Workflow 3"/> |
+| Alternatively, select the `var_18` or the type name `struct_1` and press `s`. All members in the `struct_1` will be automatically created. | <img src="../../img/taped/4.png" alt="Structure Workflow 4"/> |
+| Viewing the automatically created structure members. | <img src="../../img/taped/5.png" alt="Structure Workflow 5"/> |
+
+
+The `s` hotkey also works when working with structures in the linear view. Its behavior differs based on the current selection:
+
+
+| Selection | Behavior |
+|--------------------------------------------------------------|-----------------------------------------------------------------------------------|
+| A single byte | Create structure dialog |
+| A range of bytes | Create structure with selection size |
+| A range of bytes covering existing data variables | Create structure with selection size and add existing data vars as struct members |
+
+
+In linear view, if the selection is a single byte outside any function, it will pop up the create structure dialog. If the selection is a range of bytes, a structure of the selection size is created and the start of the selection. If the selection covers any existing data variables, these data variables will become members within the newly created structure.
+
+This also works within data variables with structure type. For example, if the selection is a range of bytes within a structure, a new structure will be created within the existing structure.
diff --git a/docs/guide/types/typearchives.md b/docs/guide/types/typearchives.md
new file mode 100644
index 00000000..ce605c0d
--- /dev/null
+++ b/docs/guide/types/typearchives.md
@@ -0,0 +1,47 @@
+# Type Archives
+
+Type Archives are files you can use to share types between analysis databases. You can create them and manage their contents in [Types View](./basictypes.md#the-type-list).
+
+![Type Archives](../../img/type-archives.png "Type Archives"){ width="400" }
+
+## Creating and Attaching
+
+Using the context menu in the [Type List](basictypes.md#the-type-list) in Types View, you can create Type Archives using **Create Type Archive**. Simply pick a file location, and one will be created and attached to your analysis. Once you have done this, you can attach that Type Archive to other analyses in the same menu, by instead using **Attach Type Archive**. If you don't want to use a specific Type Archive in your analysis, you can right-click it in the Type List and use **Detach Type Archive**, which will remove any associations made to types it contains, but will not remove any types in your analysis.
+
+???+ Tip "Tip"
+ Type Archives have an associated Platform (e.g. windows-x86_64), which will determine
+ various Platform-specific type details, like pointer width. You may attach a
+ Type Archive to files with a different Platform, but note that these details may
+ cause issues with any types pulled from the Type Archive.
+
+Attached Type Archives are remembered in saved analysis databases, and will be attached on reopen, provided the file still exists. If the Type Archive file is moved (or deleted), then the Type List will report the Type Archive as Disconnected (but still attached). You can reconnect the Type Archive by using **Connect Type Archive** and pointing Binary Ninja at the new location of the Type Archive file.
+
+Enterprise users can create Type Archives in Remote Projects in the same manner, and all changes made to Type Archives in Remote Projects will be automatically synced with the Collaboration Server. Updates made by you are sent immediately, whereas updates made by other users on your server are fetched periodically in the background every 30 seconds (configurable by the `collaboration.autoPollInterval` setting). Once changes have been fetched, you can pull them into your analysis in the same way as described below. You may also attach Type Archives created outside your Remote Project, but note they will not be synced to the Collaboration Server.
+
+## Managing Types
+
+Once you have one or more Type Archives created and attached, you can start using them to store and share types between your analyses:
+
+1. In one analysis, create some types and use **Push Types to Archive** to add them to a Type Archive
+2. In another analysis, you can use **Pull Types from Archive** to import those types from the Type Archive
+3. Now, in either analysis, you can [make changes to those types](basictypes.md#the-type-editor) and once again use **Push Types to Archive** to send the changes to the Type Archive
+4. And after doing so, you can open the other analysis and use **Pull Types from Archive** to receive those changes from the Type Archive
+5. If you push changes to a Type Archive and, before pulling them in the other analysis, change them there as well, you will have to choose which version of the individual types you want to use. Either push or pull the specific types and, when prompted, confirm your choice to use that version.
+
+If you want to rename a type in the Type Archive, you can use **Rename Type** in the context menu in the Type List. You can either rename it in your analysis, and then push the type, or rename it directly in the Type Archive, and then pull the type. Note that renaming a type will cause updates for other types that reference it, which may also need to be pushed or pulled afterward.
+
+If you want to delete a type in the Type Archive, you can select it in the Type List under the Type Archive, and use **Undefine Type**. This will not delete it from your analysis, and indeed if you had instead deleted it from your analysis, it would not have been deleted in the Type Archive. If you delete the type in either place, the association will no longer apply and changes made to the type will not be shown as needing to be pushed or pulled.
+
+If you want to manually disassociate a type in your analysis from a Type Archive, you can use **Disassociate Types from Archive**, and then no changes made to that type, either in the analysis, or in the Type Archive, will be shown as needing to be pushed or pulled.
+
+![Type Archives >](../../img/type-archives-status.png "Type Archives Status"){ width="500" }
+
+When you have pushed or pulled types from a Type Archive, you will see their status reflected in the Type List:
+
+1. Normal type, not associated with a Type Archive
+2. Type associated with a Type Archive with no changes
+3. Type associated with a Type Archive with changes made in the analysis that can be pushed to the Type Archive
+4. Type associated with a Type Archive with changes made in the Type Archive that can be pulled into the analysis
+5. Type associated with a Type Archive with changes made both in the analysis and the Type Archive, that will need you to choose which version to keep
+6. Type associated with a Type Archive that is missing
+
diff --git a/docs/guide/types/typeimportexport.md b/docs/guide/types/typeimportexport.md
new file mode 100644
index 00000000..43fbfa90
--- /dev/null
+++ b/docs/guide/types/typeimportexport.md
@@ -0,0 +1,184 @@
+# Importing Type Information
+
+Type information can be imported from a variety of sources. If you have header files, you can [import a header](#import-header-file). If your types exist in an existing BNDB, you can use [import from a bndb](#import-bndb-file). With the introduction of [type archives](typearchives.md) we recommend migrating away from importing via BNDB to type archives as they allow types to remain synced between different databases.
+
+## Import BNDB File
+
+The Import BNDB File feature imports types from a previous BNDB into your currently open file. In addition, it will apply types for matching symbols in functions and variables. Import BNDB *will not* port symbols from a BNDB with symbols to one without -- the names must already match. Matching functions and porting symbols is beyond the scope of this feature.
+
+![Importing a BNDB](../../img/import-bndb.png "Importing a BNDB")
+
+### Usage
+
+To use this feature select `Import From BNDB` from the `Analysis` menu, use the [command palette](../index.md#command-palette), or [bind a hotkey](../index.md#custom-hotkeys) and select the BNDB you'd like to import. Wait for the BNDB to load then you'll be presented with a list of things to import.
+
+* Types - Various types to be imported from the source BNDB
+* Functions - Attempt to find target functions whose symbol already matches the symbol of the source BNDB and apply their type
+* Function to Imports - Attempt to find target Imports whose symbol matches the Functions symbols in the source BNDB and apply their type
+* Data Variables - Attempt to find target DataVariables with symbols that match DataVariables in the source BNDB and apply their type
+
+This feature enables a number of workflows:
+
+### Porting Analysis Between Target Versions
+
+If you're working with version 1 of a file which has symbols and you now want to port your work over to version 2 (as long as they both have symbols). This isn't going to be perfect as this feature isn't interactive and doesn't take into account changes in parameter counts or ordering, so *use this with caution*.
+
+### Quickly Defining Externs
+
+If you have a binary with externs which don't have TypeLibraries this can allow you to quickly import them (and their types) from another source, this is especially effective when you have debug information for the dependent libraries
+
+## Import Header File
+
+If you already have a collection of headers containing types you want to use, you can import them directly. You can specify the compiler flags that would be used if a compiler were compiling a source file that uses this header. Specifically this means you can/should specify:
+
+- `-isystem<path>` for various system header paths
+- `-I<path>` for various user header paths
+- `-D<macro>=<value>` for macro definitions
+- `-x c -std=c99` to specify C99 mode
+- Other Clang-compatible command-line flags are accepted (eg `-fms-extensions`, `-fms-compatibility`, etc)
+
+You can specify that types from system headers, accessed via `#include <header.h>`, will be in the results. Otherwise, only files from user headers, accessed via `#include "header.h"` will be used.
+
+You can also specify Define Binary Ninja Macros, which makes the type parser include the various parser extensions that Binary Ninja allows in the Type View editors, eg `__packed`, `__padding`, `__syscall`, etc. You probably only want to use this option when importing a header file exported using [Export Header File](#export-header-file).
+
+After specifying the file(s) and flag(s), pressing Preview will give a list of all the types and functions defined in the file(s). You may check or uncheck the box next to any of the types/functions to control whether they will be imported to your analysis.
+
+If there were any parse errors, those will be shown instead of a list of types. Generally speaking, what this means is you're missing either header search paths or compile definitions. See the section below on [finding system headers](#finding-system-headers).
+
+After pressing Import, all the checked types/functions will be added to your analysis. Imported types will override any existing types you had defined so they are disabled by default as indicated via the `Exists Already` column. Imported functions will replace signatures of any functions in your analysis whose name matches signatures found in the header.
+
+![Importing a header file](../../img/import-header.png "Importing a header file")
+
+### Finding System Headers
+
+Since you need to specify the include paths for system headers, you will need to deduce them for the target platform of your analysis. Here are a few tricks that may help:
+
+#### Systems with GCC/Clang (macOS, Linux, etc)
+
+On these systems, you can run a command to print the default search path for compilation:
+
+ gcc -Wp,-v -E -
+ clang -Wp,-v -E -
+
+For the directories printed by this command, you should include them with `-isystem<path>` in the order specified.
+
+For example on macOS, with Xcode 13:
+
+ $ clang -Wp,-v -E -
+ clang -cc1 version 13.0.0 (clang-1300.0.29.3) default target arm64-apple-darwin21.6.0
+ ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/local/include"
+ ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/Library/Frameworks"
+ #include "..." search starts here:
+ #include <...> search starts here:
+ /usr/local/include
+ /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
+ /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
+ /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
+ /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks (framework directory)
+ End of search list.
+
+From this example, the flags would be: (note: not including the framework directory line)
+
+ -isystem/usr/local/include
+ -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
+ -isystem/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
+ -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
+
+Another example on Arch Linux:
+
+ $ gcc -Wp,-v -E -
+ ignoring nonexistent directory "/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/../../../../../../../../x86_64-pc-linux-gnu/include"
+ #include "..." search starts here:
+ #include <...> search starts here:
+ /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
+ /usr/local/include
+ /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
+ /usr/include
+ End of search list.
+
+From this example, the flags would be:
+
+ -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
+ -isystem/usr/local/include
+ -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
+ -isystem/usr/include
+
+##### For Windows
+
+For windows, there's no easy command to list all the include paths so you have to piece them together from the `Include Directory` property in a Visual Studio project. You also want to include `-x c -std=c99` since Windows headers include lots of C++ types that the type importer currently does not support.
+
+You will end up with something like the following for user mode:
+
+ -x c -std=c99
+ -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
+
+Or, for kernel mode:
+
+ -x c -std=c99
+ -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km"
+
+Note that some header files might require manually including a specific `windows.h` header which necessitates specifying a target platform to get the appropriate includes:
+
+ --target=x86_64-pc-windows-msvc
+ -x c -std=c99
+ -include"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um\windows.h"
+ -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+ -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
+
+
+##### Cross-Platform Targets
+
+If you are analyzing a target that is for a different operating system, you need to both find the header include paths for that system, and copy (or mount) them to a location accessible by the computer running Binary Ninja.
+
+### Export Header File
+
+If you want to compile code using the structures you defined during your analysis, you can export all the types to a C-compatible header file that can be used via `#include` by a C compiler. You can also import this header in another analysis session via [Import Header File](#import-header-file), just be sure to enable `Define Binary Ninja Macros` when doing so.
+
+## Platform Types
+
+Binary Ninja pulls type information from a variety of sources. The highest-level source are the platform types loaded for the given platform (which includes operating system and architecture). There are two sources of platform types. The first are shipped with the product in a [binary path](../index.md#directories). The second location is in your [user folder](../index.md#user-folder) and is intended for you to put custom platform types.
+
+???+ Danger "Warning"
+ Do NOT make changes to platform types in the binary path as they will be overwritten any time Binary Ninja updates.
+
+Platform types are used to define types that should be available to all programs available on that particular platform. They are only for global common types. Consider, for example, that you might want to add the following on windows:
+
+```
+typedef uint8_t u8;
+```
+
+You could write this type into:
+
+```
+/home/user/.binaryninja/types/platform/windows-x86.c
+```
+
+And any time you opened a 32bit windows binary, that type would be available to use. However, please note that these are not substitutes for [Type Libraries](../../dev/annotation.md#type-libraries). Type Libraries are used to provide a collection of types for a given library such as a libc, or common DLL.
+
+???+ Warning "Tip"
+ If you don't know the specific platform (and thus filename) you need to create for a given file, just enter `bv.platform` in the scripting console.
+
+### Common Types
+
+You may wish to provide types that are common across multiple architectures or platforms. The easiest way to do this is to use a `#include "filename.c"` line in the specific platform so that any common types will be loaded.
+
+For example, something like:
+
+```
+$ pwd
+/home/user/.binaryninja/types/platform
+$ cat windows-x86.c
+#include "windows.c"
+$ cat windows-x86_64.c
+#include "windows.c"
+$ cat windows.c
+typedef uint8_t u8;
+```
diff --git a/docs/guide/types/typelibraries.md b/docs/guide/types/typelibraries.md
new file mode 100644
index 00000000..28e0b4fb
--- /dev/null
+++ b/docs/guide/types/typelibraries.md
@@ -0,0 +1,37 @@
+# Type Libraries
+
+Type Libraries are collections of type information (structs, enums, function types, etc.), corresponding to specific dynamic libraries that are imported into your analysis. You can browse and import them in the [Types View](./basictypes.md#the-type-list).
+
+__image of Type List showing a couple imported type libraries, with one expanded showing its types__
+
+## Usage
+
+Most of your usage of Type Libraries will be performed automatically by Binary Ninja when you analyze a binary. They are automatically imported based on the libraries that your binary uses. Any library functions or global variables your binary references will have their type signature imported, and any structures those functions and variables reference are imported as well.
+
+__image of linear view showing a bunch of imported functions from a type library__
+
+Compared to [Platform Types](./platformtypes.md), only Type Libraries needed by your binary will be imported into your analysis. If you want to manually import additional Type Libraries (e.g. if your binary dynamically loads a library), you can use the **Import Type Library** action in [Types View](./basictypes.md#the-type-list). Just pick a Type Library from the list shown, and it will be added to the list where you can import types from it.
+
+If you want to use types from a Type Library that have not yet been imported, you can select them in the [Types View](./basictypes.md#the-type-list) and use the **Import Types** action. They will be copied into your analysis's System Types and you can use them in your own structure and function annotations.
+
+## Design and Purpose
+
+Type Libraries contain details about a specific library that is imported by binaries. They contain information about the types used in the library:
+* Types
+ * Structures, Classes, Unions
+ * Enumerations
+ * Typedefs
+* Objects
+ * Function Signatures
+ * Global Variables
+
+Type Libraries are named after the source library they are providing types for. When a binary is opened, Binary Ninja finds all of its linked library dependencies, and looks up Type Libraries for them. Those with a File Name or Alternative Name matching the exact text of a library used by the binary will be imported into the analysis. You can see this process in the Log:
+
+ elf: searching for 'libc.so.6' in type libraries
+ Type library 'libc.so.6' imported
+
+The [Developer Guide](../../dev/typelibraries.md) contains more details about the implementation details of the Type Library format.
+
+## Creating and Modifying
+
+Type Libraries are read-only by design, so while you cannot modify the ones built into Binary Ninja, you can create your own and use them as replacements. While there is no User Interface for doing this, there are plenty of APIs available. Check the [Developer Guide](../../dev/typelibraries.md) for details on how to create a Type Library.
diff --git a/docs/img/BNIL-hlil.png b/docs/img/BNIL-hlil.png
index 07c96dd9..fc5469b2 100644
--- a/docs/img/BNIL-hlil.png
+++ b/docs/img/BNIL-hlil.png
Binary files differ
diff --git a/docs/img/BNIL-llil.png b/docs/img/BNIL-llil.png
index 2b5c56e0..a887ac48 100644
--- a/docs/img/BNIL-llil.png
+++ b/docs/img/BNIL-llil.png
Binary files differ
diff --git a/docs/img/BNIL-mlil.png b/docs/img/BNIL-mlil.png
index 22b0f371..6b865366 100644
--- a/docs/img/BNIL-mlil.png
+++ b/docs/img/BNIL-mlil.png
Binary files differ
diff --git a/docs/img/BNIL-overview.png b/docs/img/BNIL-overview.png
index aef8e665..7c2370e6 100644
--- a/docs/img/BNIL-overview.png
+++ b/docs/img/BNIL-overview.png
Binary files differ
diff --git a/docs/img/BNIL.png b/docs/img/BNIL.png
index 19dafbdf..a89a7481 100644
--- a/docs/img/BNIL.png
+++ b/docs/img/BNIL.png
Binary files differ
diff --git a/docs/img/address-indicator.png b/docs/img/address-indicator.png
index 91aae584..e41f9d69 100644
--- a/docs/img/address-indicator.png
+++ b/docs/img/address-indicator.png
Binary files differ
diff --git a/docs/img/after-template-simplification.png b/docs/img/after-template-simplification.png
index a463b46f..26fbd59d 100755..100644
--- a/docs/img/after-template-simplification.png
+++ b/docs/img/after-template-simplification.png
Binary files differ
diff --git a/docs/img/apply_enum.png b/docs/img/apply_enum.png
deleted file mode 100644
index 0d1c60ae..00000000
--- a/docs/img/apply_enum.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/auto-create-members.png b/docs/img/auto-create-members.png
index b9a25fa1..b1637f9e 100644
--- a/docs/img/auto-create-members.png
+++ b/docs/img/auto-create-members.png
Binary files differ
diff --git a/docs/img/auto-create-one-member.png b/docs/img/auto-create-one-member.png
deleted file mode 100644
index cc0a7250..00000000
--- a/docs/img/auto-create-one-member.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/before-template-simplification.png b/docs/img/before-template-simplification.png
index 35800a39..cd7fb1b1 100755..100644
--- a/docs/img/before-template-simplification.png
+++ b/docs/img/before-template-simplification.png
Binary files differ
diff --git a/docs/img/change-type.png b/docs/img/change-type.png
index 3e7c85b0..cc917fd3 100644
--- a/docs/img/change-type.png
+++ b/docs/img/change-type.png
Binary files differ
diff --git a/docs/img/clear-var-value.png b/docs/img/clear-var-value.png
index 165b7cc4..b2e337e2 100644
--- a/docs/img/clear-var-value.png
+++ b/docs/img/clear-var-value.png
Binary files differ
diff --git a/docs/img/command-palette.png b/docs/img/command-palette.png
index 014071df..0f95e8ce 100644
--- a/docs/img/command-palette.png
+++ b/docs/img/command-palette.png
Binary files differ
diff --git a/docs/img/console-split.png b/docs/img/console-split.png
index f7753252..e0170049 100644
--- a/docs/img/console-split.png
+++ b/docs/img/console-split.png
Binary files differ
diff --git a/docs/img/console.png b/docs/img/console.png
index e4401dea..bd021410 100644
--- a/docs/img/console.png
+++ b/docs/img/console.png
Binary files differ
diff --git a/docs/img/controls.png b/docs/img/controls.png
deleted file mode 100644
index 03dc4cf2..00000000
--- a/docs/img/controls.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/correct-switch-after-uidf.png b/docs/img/correct-switch-after-uidf.png
deleted file mode 100644
index 308af9ab..00000000
--- a/docs/img/correct-switch-after-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create-array.png b/docs/img/create-array.png
new file mode 100644
index 00000000..3e1b5ca2
--- /dev/null
+++ b/docs/img/create-array.png
Binary files differ
diff --git a/docs/img/create-derived-struct-1.png b/docs/img/create-derived-struct-1.png
new file mode 100644
index 00000000..d07ea3f8
--- /dev/null
+++ b/docs/img/create-derived-struct-1.png
Binary files differ
diff --git a/docs/img/create-derived-struct-2.png b/docs/img/create-derived-struct-2.png
new file mode 100644
index 00000000..1b9a7377
--- /dev/null
+++ b/docs/img/create-derived-struct-2.png
Binary files differ
diff --git a/docs/img/create-multi-derived-struct.png b/docs/img/create-multi-derived-struct.png
new file mode 100644
index 00000000..aee72270
--- /dev/null
+++ b/docs/img/create-multi-derived-struct.png
Binary files differ
diff --git a/docs/img/create-struct-menu.png b/docs/img/create-struct-menu.png
new file mode 100644
index 00000000..fff0ec8e
--- /dev/null
+++ b/docs/img/create-struct-menu.png
Binary files differ
diff --git a/docs/img/create_array.png b/docs/img/create_array.png
deleted file mode 100644
index 5e2f7c03..00000000
--- a/docs/img/create_array.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create_derived_struct_1.png b/docs/img/create_derived_struct_1.png
deleted file mode 100644
index b4e6f9b0..00000000
--- a/docs/img/create_derived_struct_1.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create_derived_struct_2.png b/docs/img/create_derived_struct_2.png
deleted file mode 100644
index ebac72ed..00000000
--- a/docs/img/create_derived_struct_2.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create_multi_derived_struct.png b/docs/img/create_multi_derived_struct.png
deleted file mode 100644
index ffa49058..00000000
--- a/docs/img/create_multi_derived_struct.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/create_struct_menu.png b/docs/img/create_struct_menu.png
deleted file mode 100644
index d4eeb130..00000000
--- a/docs/img/create_struct_menu.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/cross-reference-filter.png b/docs/img/cross-reference-filter.png
index c62e9d56..40087e70 100644
--- a/docs/img/cross-reference-filter.png
+++ b/docs/img/cross-reference-filter.png
Binary files differ
diff --git a/docs/img/cross-reference-panel-pin.png b/docs/img/cross-reference-panel-pin.png
index d5cde0ab..26e6ab4b 100644
--- a/docs/img/cross-reference-panel-pin.png
+++ b/docs/img/cross-reference-panel-pin.png
Binary files differ
diff --git a/docs/img/cross-reference-table.png b/docs/img/cross-reference-table.png
index c6700d38..7b64a5f4 100644
--- a/docs/img/cross-reference-table.png
+++ b/docs/img/cross-reference-table.png
Binary files differ
diff --git a/docs/img/cross-reference-tree.png b/docs/img/cross-reference-tree.png
index bedb7c20..d5c55d7d 100644
--- a/docs/img/cross-reference-tree.png
+++ b/docs/img/cross-reference-tree.png
Binary files differ
diff --git a/docs/img/dead-store-after.png b/docs/img/dead-store-after.png
index 24047d08..572eed31 100644
--- a/docs/img/dead-store-after.png
+++ b/docs/img/dead-store-after.png
Binary files differ
diff --git a/docs/img/dead-store-example.png b/docs/img/dead-store-example.png
index 2f5a5159..c063b814 100644
--- a/docs/img/dead-store-example.png
+++ b/docs/img/dead-store-example.png
Binary files differ
diff --git a/docs/img/dead-store-menu.png b/docs/img/dead-store-menu.png
index 71a1a48c..8bb00f6e 100644
--- a/docs/img/dead-store-menu.png
+++ b/docs/img/dead-store-menu.png
Binary files differ
diff --git a/docs/img/efp-dialog-diagram.png b/docs/img/efp-dialog-diagram.png
new file mode 100644
index 00000000..ebd8a96b
--- /dev/null
+++ b/docs/img/efp-dialog-diagram.png
Binary files differ
diff --git a/docs/img/efp_dialog_diagram.png b/docs/img/efp_dialog_diagram.png
deleted file mode 100644
index 0185a3a7..00000000
--- a/docs/img/efp_dialog_diagram.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/external-links-edit-external-library.png b/docs/img/external-links-edit-external-library.png
new file mode 100644
index 00000000..e63aa3da
--- /dev/null
+++ b/docs/img/external-links-edit-external-library.png
Binary files differ
diff --git a/docs/img/external-links-edit-external-location.png b/docs/img/external-links-edit-external-location.png
new file mode 100644
index 00000000..cbb502ef
--- /dev/null
+++ b/docs/img/external-links-edit-external-location.png
Binary files differ
diff --git a/docs/img/external-links-right-click-library.png b/docs/img/external-links-right-click-library.png
new file mode 100644
index 00000000..b51c6432
--- /dev/null
+++ b/docs/img/external-links-right-click-library.png
Binary files differ
diff --git a/docs/img/external-links.png b/docs/img/external-links.png
new file mode 100644
index 00000000..cecc227a
--- /dev/null
+++ b/docs/img/external-links.png
Binary files differ
diff --git a/docs/img/featuremap.png b/docs/img/featuremap.png
index 226ba48e..0ba5a3fd 100644
--- a/docs/img/featuremap.png
+++ b/docs/img/featuremap.png
Binary files differ
diff --git a/docs/img/find.png b/docs/img/find.png
new file mode 100644
index 00000000..ab081ee7
--- /dev/null
+++ b/docs/img/find.png
Binary files differ
diff --git a/docs/img/functionlist.png b/docs/img/functionlist.png
deleted file mode 100644
index a6c6f441..00000000
--- a/docs/img/functionlist.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/graphview.png b/docs/img/graphview.png
index dc71df7e..8f9febee 100644
--- a/docs/img/graphview.png
+++ b/docs/img/graphview.png
Binary files differ
diff --git a/docs/img/hanyu-no-codepage.png b/docs/img/hanyu-no-codepage.png
new file mode 100644
index 00000000..1855bc1f
--- /dev/null
+++ b/docs/img/hanyu-no-codepage.png
Binary files differ
diff --git a/docs/img/hanyu-with-codepage.png b/docs/img/hanyu-with-codepage.png
new file mode 100644
index 00000000..37a87b38
--- /dev/null
+++ b/docs/img/hanyu-with-codepage.png
Binary files differ
diff --git a/docs/img/hex.png b/docs/img/hex.png
index c657ab5a..2ccf58c7 100644
--- a/docs/img/hex.png
+++ b/docs/img/hex.png
Binary files differ
diff --git a/docs/img/hlil-after-uidf.png b/docs/img/hlil-after-uidf.png
deleted file mode 100644
index 314e76dc..00000000
--- a/docs/img/hlil-after-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/hlil-before-uidf.png b/docs/img/hlil-before-uidf.png
deleted file mode 100644
index b05daf74..00000000
--- a/docs/img/hlil-before-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/hlil-braces.png b/docs/img/hlil-braces.png
index 74fbaaca..551c4e97 100644
--- a/docs/img/hlil-braces.png
+++ b/docs/img/hlil-braces.png
Binary files differ
diff --git a/docs/img/hlil-hierarchy-call.png b/docs/img/hlil-hierarchy-call.png
index 184537de..c4cb60ca 100644
--- a/docs/img/hlil-hierarchy-call.png
+++ b/docs/img/hlil-hierarchy-call.png
Binary files differ
diff --git a/docs/img/hlil-scope.png b/docs/img/hlil-scope.png
index d16393a1..62658cea 100644
--- a/docs/img/hlil-scope.png
+++ b/docs/img/hlil-scope.png
Binary files differ
diff --git a/docs/img/hover-uidf.png b/docs/img/hover-uidf.png
deleted file mode 100644
index a9fe6d0b..00000000
--- a/docs/img/hover-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/ilmapping.png b/docs/img/ilmapping.png
index d80a3ab5..bdfc028f 100644
--- a/docs/img/ilmapping.png
+++ b/docs/img/ilmapping.png
Binary files differ
diff --git a/docs/img/import-bndb.png b/docs/img/import-bndb.png
index 4fce92ed..96134c3e 100644
--- a/docs/img/import-bndb.png
+++ b/docs/img/import-bndb.png
Binary files differ
diff --git a/docs/img/import-header.png b/docs/img/import-header.png
index f86b71e8..2158f8e0 100644
--- a/docs/img/import-header.png
+++ b/docs/img/import-header.png
Binary files differ
diff --git a/docs/img/jump-table-uidf.png b/docs/img/jump-table-uidf.png
deleted file mode 100644
index 6d4e8d04..00000000
--- a/docs/img/jump-table-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/keybindings.png b/docs/img/keybindings.png
index 4f4f2a61..f918bc6b 100644
--- a/docs/img/keybindings.png
+++ b/docs/img/keybindings.png
Binary files differ
diff --git a/docs/img/license-popup.png b/docs/img/license-popup.png
index 558d025b..a003bb3d 100644
--- a/docs/img/license-popup.png
+++ b/docs/img/license-popup.png
Binary files differ
diff --git a/docs/img/linear.png b/docs/img/linear.png
index 925c0268..d77c31a7 100644
--- a/docs/img/linear.png
+++ b/docs/img/linear.png
Binary files differ
diff --git a/docs/img/llil-hierarchy.png b/docs/img/llil-hierarchy.png
index 2f1264a4..79b891f2 100644
--- a/docs/img/llil-hierarchy.png
+++ b/docs/img/llil-hierarchy.png
Binary files differ
diff --git a/docs/img/llil-option.png b/docs/img/llil-option.png
new file mode 100644
index 00000000..84017309
--- /dev/null
+++ b/docs/img/llil-option.png
Binary files differ
diff --git a/docs/img/llil_option.png b/docs/img/llil_option.png
deleted file mode 100644
index ee42c3b9..00000000
--- a/docs/img/llil_option.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/logo.png b/docs/img/logo.png
index c1e1ecb1..d117edcf 100644
--- a/docs/img/logo.png
+++ b/docs/img/logo.png
Binary files differ
diff --git a/docs/img/logs.png b/docs/img/logs.png
new file mode 100644
index 00000000..be89c384
--- /dev/null
+++ b/docs/img/logs.png
Binary files differ
diff --git a/docs/img/main.png b/docs/img/main.png
index 688cedc3..c3fa79f0 100644
--- a/docs/img/main.png
+++ b/docs/img/main.png
Binary files differ
diff --git a/docs/img/memory-map-icon.png b/docs/img/memory-map-icon.png
new file mode 100644
index 00000000..116e4a00
--- /dev/null
+++ b/docs/img/memory-map-icon.png
Binary files differ
diff --git a/docs/img/memory-map.png b/docs/img/memory-map.png
index b3f4e825..115da036 100644
--- a/docs/img/memory-map.png
+++ b/docs/img/memory-map.png
Binary files differ
diff --git a/docs/img/merge-variables.png b/docs/img/merge-variables.png
index 8f564f6c..9de2f1af 100644
--- a/docs/img/merge-variables.png
+++ b/docs/img/merge-variables.png
Binary files differ
diff --git a/docs/img/merge-vars-dialog.png b/docs/img/merge-vars-dialog.png
deleted file mode 100644
index 722503c9..00000000
--- a/docs/img/merge-vars-dialog.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/merge-vars.png b/docs/img/merge-vars.png
deleted file mode 100644
index 3038b1db..00000000
--- a/docs/img/merge-vars.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/mini-graph.png b/docs/img/mini-graph.png
new file mode 100644
index 00000000..a723875a
--- /dev/null
+++ b/docs/img/mini-graph.png
Binary files differ
diff --git a/docs/img/mystring.png b/docs/img/mystring.png
deleted file mode 100644
index a14805a3..00000000
--- a/docs/img/mystring.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/navigation.png b/docs/img/navigation.png
index 1210d15f..141aa148 100644
--- a/docs/img/navigation.png
+++ b/docs/img/navigation.png
Binary files differ
diff --git a/docs/img/newtab-compact.png b/docs/img/newtab-compact.png
new file mode 100644
index 00000000..9222a0e4
--- /dev/null
+++ b/docs/img/newtab-compact.png
Binary files differ
diff --git a/docs/img/newtab-personal.png b/docs/img/newtab-personal.png
new file mode 100644
index 00000000..1fdcc22b
--- /dev/null
+++ b/docs/img/newtab-personal.png
Binary files differ
diff --git a/docs/img/newtab-projects.png b/docs/img/newtab-projects.png
new file mode 100644
index 00000000..46e0cc90
--- /dev/null
+++ b/docs/img/newtab-projects.png
Binary files differ
diff --git a/docs/img/objc-analyze-action.png b/docs/img/objc-analyze-action.png
new file mode 100644
index 00000000..0f600bce
--- /dev/null
+++ b/docs/img/objc-analyze-action.png
Binary files differ
diff --git a/docs/img/objc-workflow-selected.png b/docs/img/objc-workflow-selected.png
new file mode 100644
index 00000000..14d4c4ac
--- /dev/null
+++ b/docs/img/objc-workflow-selected.png
Binary files differ
diff --git a/docs/img/objc_analyze_action.png b/docs/img/objc_analyze_action.png
deleted file mode 100644
index 2e486778..00000000
--- a/docs/img/objc_analyze_action.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/objc_workflow_selected.png b/docs/img/objc_workflow_selected.png
deleted file mode 100644
index 51ecef4f..00000000
--- a/docs/img/objc_workflow_selected.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/open-with-options.png b/docs/img/open-with-options.png
index c7f85e10..c90f2905 100644
--- a/docs/img/open-with-options.png
+++ b/docs/img/open-with-options.png
Binary files differ
diff --git a/docs/img/options-setting-uidf.png b/docs/img/options-setting-uidf.png
deleted file mode 100644
index 1205cd5d..00000000
--- a/docs/img/options-setting-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/options.png b/docs/img/options.png
index 86386da3..ecd6e3ba 100644
--- a/docs/img/options.png
+++ b/docs/img/options.png
Binary files differ
diff --git a/docs/img/overview.png b/docs/img/overview.png
index 0029ade0..2c731a2a 100644
--- a/docs/img/overview.png
+++ b/docs/img/overview.png
Binary files differ
diff --git a/docs/img/plugin-manager.png b/docs/img/plugin-manager.png
index 4fa534e5..f376be89 100644
--- a/docs/img/plugin-manager.png
+++ b/docs/img/plugin-manager.png
Binary files differ
diff --git a/docs/img/preferences.png b/docs/img/preferences.png
deleted file mode 100644
index 29b3033e..00000000
--- a/docs/img/preferences.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/projects.png b/docs/img/projects.png
new file mode 100644
index 00000000..9ec04afa
--- /dev/null
+++ b/docs/img/projects.png
Binary files differ
diff --git a/docs/img/pseudo-c.png b/docs/img/pseudo-c.png
index 80113b3e..3152727b 100644
--- a/docs/img/pseudo-c.png
+++ b/docs/img/pseudo-c.png
Binary files differ
diff --git a/docs/img/rename.png b/docs/img/rename.png
index 37aec6fa..f50e297d 100644
--- a/docs/img/rename.png
+++ b/docs/img/rename.png
Binary files differ
diff --git a/docs/img/right-click-uidf.png b/docs/img/right-click-uidf.png
deleted file mode 100644
index 0d9f0266..00000000
--- a/docs/img/right-click-uidf.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/save-choices.png b/docs/img/save-choices.png
index b4304b83..729ecfb1 100644
--- a/docs/img/save-choices.png
+++ b/docs/img/save-choices.png
Binary files differ
diff --git a/docs/img/save-with-options.png b/docs/img/save-with-options.png
index 103ada1c..5db0f06a 100644
--- a/docs/img/save-with-options.png
+++ b/docs/img/save-with-options.png
Binary files differ
diff --git a/docs/img/select-enum-member.png b/docs/img/select-enum-member.png
new file mode 100644
index 00000000..3174ea74
--- /dev/null
+++ b/docs/img/select-enum-member.png
Binary files differ
diff --git a/docs/img/select_enum_member.png b/docs/img/select_enum_member.png
deleted file mode 100644
index fe062f5c..00000000
--- a/docs/img/select_enum_member.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/settings.png b/docs/img/settings.png
index 0518786d..f85f245e 100644
--- a/docs/img/settings.png
+++ b/docs/img/settings.png
Binary files differ
diff --git a/docs/img/sidebar.png b/docs/img/sidebar.png
deleted file mode 100644
index 1e67b263..00000000
--- a/docs/img/sidebar.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/sidebaricons.png b/docs/img/sidebaricons.png
new file mode 100644
index 00000000..d95dc208
--- /dev/null
+++ b/docs/img/sidebaricons.png
Binary files differ
diff --git a/docs/img/sidebars.png b/docs/img/sidebars.png
new file mode 100644
index 00000000..0f69e6ae
--- /dev/null
+++ b/docs/img/sidebars.png
Binary files differ
diff --git a/docs/img/split-var.png b/docs/img/split-var.png
index 72f45e85..94849a5d 100644
--- a/docs/img/split-var.png
+++ b/docs/img/split-var.png
Binary files differ
diff --git a/docs/img/stack.png b/docs/img/stack.png
new file mode 100644
index 00000000..0efad194
--- /dev/null
+++ b/docs/img/stack.png
Binary files differ
diff --git a/docs/img/status-bar.png b/docs/img/status-bar.png
index f4f42870..af8d090d 100644
--- a/docs/img/status-bar.png
+++ b/docs/img/status-bar.png
Binary files differ
diff --git a/docs/img/stringapplied.png b/docs/img/stringapplied.png
deleted file mode 100644
index 994d5179..00000000
--- a/docs/img/stringapplied.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/strings.png b/docs/img/strings.png
new file mode 100644
index 00000000..5f94c6d1
--- /dev/null
+++ b/docs/img/strings.png
Binary files differ
diff --git a/docs/img/symbols-header-menu.png b/docs/img/symbols-header-menu.png
new file mode 100644
index 00000000..712a7b9a
--- /dev/null
+++ b/docs/img/symbols-header-menu.png
Binary files differ
diff --git a/docs/img/symbols-right-click.png b/docs/img/symbols-right-click.png
new file mode 100644
index 00000000..c199b980
--- /dev/null
+++ b/docs/img/symbols-right-click.png
Binary files differ
diff --git a/docs/img/symbols_dragtocreate.png b/docs/img/symbols_dragtocreate.png
deleted file mode 100644
index fa327b0b..00000000
--- a/docs/img/symbols_dragtocreate.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_header_drag.png b/docs/img/symbols_header_drag.png
deleted file mode 100644
index 5863aa4e..00000000
--- a/docs/img/symbols_header_drag.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_header_menu.png b/docs/img/symbols_header_menu.png
deleted file mode 100644
index cb2caf43..00000000
--- a/docs/img/symbols_header_menu.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_overview1.png b/docs/img/symbols_overview1.png
deleted file mode 100644
index 055c0742..00000000
--- a/docs/img/symbols_overview1.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_right_click_NFwS.png b/docs/img/symbols_right_click_NFwS.png
deleted file mode 100644
index b459f4b0..00000000
--- a/docs/img/symbols_right_click_NFwS.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/symbols_truncation.png b/docs/img/symbols_truncation.png
deleted file mode 100644
index fa2de480..00000000
--- a/docs/img/symbols_truncation.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/tags.png b/docs/img/tags.png
new file mode 100644
index 00000000..e257fada
--- /dev/null
+++ b/docs/img/tags.png
Binary files differ
diff --git a/docs/img/taped/1.png b/docs/img/taped/1.png
index 291481c8..3aadee6f 100644
--- a/docs/img/taped/1.png
+++ b/docs/img/taped/1.png
Binary files differ
diff --git a/docs/img/taped/2.png b/docs/img/taped/2.png
index a0c18289..ad597518 100644
--- a/docs/img/taped/2.png
+++ b/docs/img/taped/2.png
Binary files differ
diff --git a/docs/img/taped/3.png b/docs/img/taped/3.png
index b1a5cb96..4a619d7a 100644
--- a/docs/img/taped/3.png
+++ b/docs/img/taped/3.png
Binary files differ
diff --git a/docs/img/taped/4.png b/docs/img/taped/4.png
index 329f6f1f..d56c6f48 100644
--- a/docs/img/taped/4.png
+++ b/docs/img/taped/4.png
Binary files differ
diff --git a/docs/img/taped/5.png b/docs/img/taped/5.png
index 3c45bf51..c67fea43 100644
--- a/docs/img/taped/5.png
+++ b/docs/img/taped/5.png
Binary files differ
diff --git a/docs/img/taped/6.png b/docs/img/taped/6.png
index 60562078..f68ba984 100644
--- a/docs/img/taped/6.png
+++ b/docs/img/taped/6.png
Binary files differ
diff --git a/docs/img/themedocs-console.png b/docs/img/themedocs-console.png
deleted file mode 100644
index a3872270..00000000
--- a/docs/img/themedocs-console.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-graphview.png b/docs/img/themedocs-graphview.png
deleted file mode 100644
index 46fc7282..00000000
--- a/docs/img/themedocs-graphview.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-hexview.png b/docs/img/themedocs-hexview.png
deleted file mode 100644
index f68fe127..00000000
--- a/docs/img/themedocs-hexview.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-highlighting.png b/docs/img/themedocs-highlighting.png
deleted file mode 100644
index c4a08e7e..00000000
--- a/docs/img/themedocs-highlighting.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-linearview.png b/docs/img/themedocs-linearview.png
deleted file mode 100644
index 6fa91b83..00000000
--- a/docs/img/themedocs-linearview.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themedocs-tokens.png b/docs/img/themedocs-tokens.png
deleted file mode 100644
index d36314ca..00000000
--- a/docs/img/themedocs-tokens.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/themes-console.png b/docs/img/themes-console.png
new file mode 100644
index 00000000..7a410034
--- /dev/null
+++ b/docs/img/themes-console.png
Binary files differ
diff --git a/docs/img/themes-graph.png b/docs/img/themes-graph.png
new file mode 100644
index 00000000..df74c012
--- /dev/null
+++ b/docs/img/themes-graph.png
Binary files differ
diff --git a/docs/img/themes-hex.png b/docs/img/themes-hex.png
new file mode 100644
index 00000000..cad30b42
--- /dev/null
+++ b/docs/img/themes-hex.png
Binary files differ
diff --git a/docs/img/themes-hexview.png b/docs/img/themes-hexview.png
new file mode 100644
index 00000000..495eb935
--- /dev/null
+++ b/docs/img/themes-hexview.png
Binary files differ
diff --git a/docs/img/themes-highlighting.png b/docs/img/themes-highlighting.png
new file mode 100644
index 00000000..097bfb28
--- /dev/null
+++ b/docs/img/themes-highlighting.png
Binary files differ
diff --git a/docs/img/themes-linear.png b/docs/img/themes-linear.png
new file mode 100644
index 00000000..392bab47
--- /dev/null
+++ b/docs/img/themes-linear.png
Binary files differ
diff --git a/docs/img/themes-minigraph.png b/docs/img/themes-minigraph.png
new file mode 100644
index 00000000..b3dc1318
--- /dev/null
+++ b/docs/img/themes-minigraph.png
Binary files differ
diff --git a/docs/img/themes-panes.png b/docs/img/themes-panes.png
new file mode 100644
index 00000000..0f88c8be
--- /dev/null
+++ b/docs/img/themes-panes.png
Binary files differ
diff --git a/docs/img/themes-statusbar.png b/docs/img/themes-statusbar.png
new file mode 100644
index 00000000..f35970f8
--- /dev/null
+++ b/docs/img/themes-statusbar.png
Binary files differ
diff --git a/docs/img/themes-tokens.png b/docs/img/themes-tokens.png
new file mode 100644
index 00000000..ed6cc1e2
--- /dev/null
+++ b/docs/img/themes-tokens.png
Binary files differ
diff --git a/docs/img/tiling-panes.png b/docs/img/tiling-panes.png
index 1f0860dd..9503e39a 100644
--- a/docs/img/tiling-panes.png
+++ b/docs/img/tiling-panes.png
Binary files differ
diff --git a/docs/img/type-archives-status.png b/docs/img/type-archives-status.png
new file mode 100644
index 00000000..783703e1
--- /dev/null
+++ b/docs/img/type-archives-status.png
Binary files differ
diff --git a/docs/img/type-archives.png b/docs/img/type-archives.png
new file mode 100644
index 00000000..c202e3b1
--- /dev/null
+++ b/docs/img/type-archives.png
Binary files differ
diff --git a/docs/img/type-view-accesses.png b/docs/img/type-view-accesses.png
deleted file mode 100644
index d34410a9..00000000
--- a/docs/img/type-view-accesses.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/types-containers.png b/docs/img/types-containers.png
new file mode 100644
index 00000000..8fde5275
--- /dev/null
+++ b/docs/img/types-containers.png
Binary files differ
diff --git a/docs/img/types-list.png b/docs/img/types-list.png
new file mode 100644
index 00000000..45bd6c2d
--- /dev/null
+++ b/docs/img/types-list.png
Binary files differ
diff --git a/docs/img/types-right-click-menu-bottom.png b/docs/img/types-right-click-menu-bottom.png
new file mode 100644
index 00000000..b11fbe82
--- /dev/null
+++ b/docs/img/types-right-click-menu-bottom.png
Binary files differ
diff --git a/docs/img/types-right-click-menu-top.png b/docs/img/types-right-click-menu-top.png
new file mode 100644
index 00000000..0b468a14
--- /dev/null
+++ b/docs/img/types-right-click-menu-top.png
Binary files differ
diff --git a/docs/img/types-right-click-menu.png b/docs/img/types-right-click-menu.png
deleted file mode 100644
index c7cb427f..00000000
--- a/docs/img/types-right-click-menu.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/types-view.png b/docs/img/types-view.png
index ed70c3f7..1808216c 100644
--- a/docs/img/types-view.png
+++ b/docs/img/types-view.png
Binary files differ
diff --git a/docs/img/uidf-correct-switch-after.png b/docs/img/uidf-correct-switch-after.png
new file mode 100644
index 00000000..1a8f4299
--- /dev/null
+++ b/docs/img/uidf-correct-switch-after.png
Binary files differ
diff --git a/docs/img/uidf-hlil-after.png b/docs/img/uidf-hlil-after.png
new file mode 100644
index 00000000..1c722c73
--- /dev/null
+++ b/docs/img/uidf-hlil-after.png
Binary files differ
diff --git a/docs/img/uidf-hlil-before.png b/docs/img/uidf-hlil-before.png
new file mode 100644
index 00000000..977104ca
--- /dev/null
+++ b/docs/img/uidf-hlil-before.png
Binary files differ
diff --git a/docs/img/uidf-hover.png b/docs/img/uidf-hover.png
new file mode 100644
index 00000000..fe154352
--- /dev/null
+++ b/docs/img/uidf-hover.png
Binary files differ
diff --git a/docs/img/uidf-jump-table.png b/docs/img/uidf-jump-table.png
new file mode 100644
index 00000000..af179480
--- /dev/null
+++ b/docs/img/uidf-jump-table.png
Binary files differ
diff --git a/docs/img/uidf-options-setting.png b/docs/img/uidf-options-setting.png
new file mode 100644
index 00000000..dfa063aa
--- /dev/null
+++ b/docs/img/uidf-options-setting.png
Binary files differ
diff --git a/docs/img/uidf-right-click.png b/docs/img/uidf-right-click.png
new file mode 100644
index 00000000..fa690f09
--- /dev/null
+++ b/docs/img/uidf-right-click.png
Binary files differ
diff --git a/docs/img/uidf-sidebar.png b/docs/img/uidf-sidebar.png
new file mode 100644
index 00000000..8f5e2a84
--- /dev/null
+++ b/docs/img/uidf-sidebar.png
Binary files differ
diff --git a/docs/img/unicode-settings.png b/docs/img/unicode-settings.png
new file mode 100644
index 00000000..7a223414
--- /dev/null
+++ b/docs/img/unicode-settings.png
Binary files differ
diff --git a/docs/img/variables.png b/docs/img/variables.png
new file mode 100644
index 00000000..441de572
--- /dev/null
+++ b/docs/img/variables.png
Binary files differ
diff --git a/docs/img/view-choices.png b/docs/img/view-choices.png
index 1d379cbb..98aed16e 100644
--- a/docs/img/view-choices.png
+++ b/docs/img/view-choices.png
Binary files differ
diff --git a/docs/img/vtable-cross-refs-context.png b/docs/img/vtable-cross-refs-context.png
new file mode 100644
index 00000000..31dda234
--- /dev/null
+++ b/docs/img/vtable-cross-refs-context.png
Binary files differ
diff --git a/docs/img/vtable-cross-refs.png b/docs/img/vtable-cross-refs.png
new file mode 100644
index 00000000..e900fad1
--- /dev/null
+++ b/docs/img/vtable-cross-refs.png
Binary files differ
diff --git a/docs/img/vtable_cross_refs.png b/docs/img/vtable_cross_refs.png
deleted file mode 100644
index 18b715fe..00000000
--- a/docs/img/vtable_cross_refs.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/vtable_cross_refs_context.png b/docs/img/vtable_cross_refs_context.png
deleted file mode 100644
index 4bd1a242..00000000
--- a/docs/img/vtable_cross_refs_context.png
+++ /dev/null
Binary files differ
diff --git a/docs/index.md b/docs/index.md
index 1e6f5daf..e9e463f4 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,13 +1,10 @@
# Binary Ninja
-A new kind of reverse engineering platform
+[Binary Ninja](https://binary.ninja/) is a reverse engineering platform and decompiler. It focuses on a clean and easy to use interface with a powerful multithreaded analysis built on top of a stack of custom ILs. It can quickly adapt to a variety of architectures, platforms, and compilers.
----
+- To quickly get started as a new user, check out our [Getting Started Guide](getting-started.md).
+- To learn about the user interface, check out the more extensive [User Guide](./guide/index.md).
+- To learn about the API and plugin design, check out the [Developer Guide](./dev/index.md).
+- To get a complete reference for the API, check out the documentation for [Python](https://api.binary.ninja/), [C++](https://api.binary.ninja/cpp/), and [Rust](https://rust.binary.ninja/binaryninja/).
-[Binary Ninja](https://binary.ninja/) is a reverse engineering platform. It focuses on a clean and easy to use interface with a powerful multithreaded analysis built on a custom IL to quickly adapt to a variety of architectures, platforms, and compilers.
-
-- To quickly get started as a new user, check out our [getting started guide](getting-started.md).
-- More in-depth user questions are probably answered in our [user manual](./guide/index.md).
-- Anyone wanting to get started with our powerful API should check out the [developer section](./dev/index.md). Note that this section is different from our API reference for [Python](https://api.binary.ninja/), [CPP](https://api.binary.ninja/cpp/), and [Rust](https://rust.binary.ninja/binaryninja/).
-
-Of course, if you just have some questions, you might find our [discussions](https://github.com/Vector35/binaryninja-api/discussions) forum helpful, search [search our public issue tracker](https://github.com/Vector35/binaryninja-api/issues) or join the more interactive [slack channel](https://slack.binary.ninja/).
+Of course, if you just have some questions, you might find our [discussions](https://github.com/Vector35/binaryninja-api/discussions) forum helpful, search [our public issue tracker](https://github.com/Vector35/binaryninja-api/issues), or join the more interactive [slack channel](https://slack.binary.ninja/).