| Age | Commit message (Collapse) | Author |
|
- Remove the "viral" `BinaryViewExt` trait and its blanket impl
- Split up the binary view type from the custom trait impl
- Simplify and fix bugs regarding custom binary view initialization
- Rewrite Minidump binary view example, parses the PE headers to create proper sections now
- Add some extra documentation
- Add unit test for custom binary view
|
|
- Exposes WARP type objects directly
- Adds processor API (for generating warp files directly)
- Adds file and chunk API
- Misc cleanup
- Simplified the amount of commands
- Replaced the "Create" commands with a purpose built processor dialog
- Added a native QT viewer for WARP files
- Simplified committing to a remote with a purpose built commit dialog
|
|
|
|
view callbacks
|
|
- Added more documentation
- Replaced global named logger for plugins, fixing the issue when the CU has multiple (e.g. statically linked demo)
- Simplified some misc code
This is a breaking change, but I believe there is no better time to make it, we cannot continue to use the `log` crate, it is too limited for our needs.
|
|
function symbol is not warranted
|
|
Should have the same behavior as doing it on a directory
|
|
Can be triggered by trying to run the processor on a file with no functions.
Found this while doing misc performance testing on windows.
|
|
This helps when you have analyzed large binaries and want to create signatures after-the-fact, skipping analysis. This can speed up the time to create large datasets drastically.
|
|
of all the functions
This was caused by the internal flatbuffer verifier reaching the max number of tables, this is fine and the solution is to split the large chunk into smaller ones, effectively creating more flatbuffer "views" of tables.
This is fine from a performance perspective because we already have optimized for many small chunks (e.g. we have a lookup table stored next to each chunk).
I left some comments for future improvements but this should be good now.
Also alongside this change we improved generating performance by 2x on some pathological binaries.
|
|
We do not need to consult the lifted IL if we have already cached the function GUID in the function metadata
|
|
wants the symbol
We were previously constructing the function type, comments and variables to just throw away, wasting precious cpu cycles!
|
|
|
|
|
|
- Added FFI
- Added a sidebar to the UI
- Added project, directory and archive processing
- Added generic `Container` interface for extensible stores of WARP data
- Fixed type references being constructed and pulled incorrectly
- Added HTML, Markdown and JSON report generation
- Made the WARP information added as an analysis activity
- Flattened the signatures directory, the target information is stored in the file now
- Matched function information is stored as function metadata in the database to reliably persist, alongside the function GUID
- Split the matching out from the application, allowing you to match on a given function without applying it
- Added more/better tests
- Added support for binaries with multiple architectures, the functions are now also queried based off the Target, see WARP spec for more details
- Greatly improved support for RISC architectures, see WARP spec for more details
- Greatly improved UX when loading files after the fact, will now sanely rerun the matcher
- Omitted the function type if not a user type, this greatly reduces file size
- Improved support for functions that reference a page aligned base pointer, see WARP spec for more details
- Removed some extra cache structures that were causing erroneous behavior
- Fixed edge-case in LLIL traversal missing some constant pointers, this was a bug in the Rust bindings
- Added support for function comments
- Made long running tasks, such as generating, matching and loading signatures, cancellable where possible
- Made function constraints more versatile, allowing for easy extensions in the future, see WARP spec for details
- Added options to signature generation, such as what data to store, and whether to compress the data or not
- Made all long running tasks prompt the user for required information before the task starts, allowing users to "set it and forget it" and not have to baby sit the finalization of the task
- Myriad of other changes to the actual WARP format that impact performance, file size and general feature set, see https://github.com/Vector35/warp for more details
|