From a6bc43627e3d884c2e9ad559cc67b4d6353dc12e Mon Sep 17 00:00:00 2001
From: Jordan Wiens <jordan@psifertex.com>
Date: Wed, 1 Apr 2020 02:39:22 -0400
Subject: enable auto increment, flesh out type documentation, normalize
 hotkeys

---
 docs/guide/plugins.md |  6 ++--
 docs/guide/type.md    | 86 ++++++++++++++++++++++++++++++++++++++++++---------
 2 files changed, 74 insertions(+), 18 deletions(-)

(limited to 'docs/guide')

diff --git a/docs/guide/plugins.md b/docs/guide/plugins.md
index 22a56e95..ba7bed02 100644
--- a/docs/guide/plugins.md
+++ b/docs/guide/plugins.md
@@ -150,9 +150,9 @@ For the Personal edition, we recommend simply commenting out the `register_` fun
 [angr]: https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/angr_plugin.py
 [nampa]: https://github.com/kenoph/nampa
 [installing the API]: https://github.com/Vector35/binaryninja-api/blob/dev/scripts/install_api.py
-[settings]: ../getting-started.html#ui.debugMode
-[python.interpreter setting]: ../getting-started.html#python.interpreter
+[settings]: ../getting-started.md#ui.debugMode
+[python.interpreter setting]: ../getting-started.md#python.interpreter
 [interaction]: https://api.binary.ninja/binaryninja.interaction-module.html
 [1]: https://github.com/Vector35/binaryninja-api/tree/dev/python/examples/kaitai
 [2]: https://github.com/Vector35/binaryninja-api/tree/dev/python/examples/snippets
-[3]: https://github.com/Vector35/binaryninja-api/tree/dev/python/examples/triage
\ No newline at end of file
+[3]: https://github.com/Vector35/binaryninja-api/tree/dev/python/examples/triage
diff --git a/docs/guide/type.md b/docs/guide/type.md
index f3f091d4..1ed3f59c 100644
--- a/docs/guide/type.md
+++ b/docs/guide/type.md
@@ -12,10 +12,10 @@ There are two main ways to interact with types from within a binary view. The fi
 
 ## Smart Structures Workflow
 
-New to stable version 1.3.2015 is the "Smart Structures" feature. Rather than manually create a type in the type view and then apply it to disassembly, you can create structures directly from disassembly using the `s` hotkey.  Consider the following example (created using [taped](http://captf.com/2011/gits/taped) from the 2011 Ghost in the Shellcode CTF if you'd like to play along at home):
+New to [stable version 1.3.2015](https://binary.ninja/changelog/) is the "Smart Structures" feature. Rather than manually create a type in the type view and then apply it to disassembly, you can create structures directly from disassembly using the `s` hotkey.  Consider the following example (created using [taped](http://captf.com/2011/gits/taped) from the 2011 Ghost in the Shellcode CTF if you'd like to play along at home):
 
 <div class="inline-slides">
-    <ol id="taped">
+    <ol id="inline-slides-text">
         <li id="currentline">Assembly view of the start of <code>0x8048e20</code></li>
         <li>MLIL view of the same basic block</li>
         <li>MLIL view after selecting the return of <code>calloc</code> and pressing <code>s</code></li>
@@ -24,9 +24,8 @@ New to stable version 1.3.2015 is the "Smart Structures" feature. Rather than ma
         <li>Viewing the structure automatically created after this workflow</li>
         <li>Selecting the remaining bytes and turning them into an array using <code>1</code> to turn them all into uint_8 variables, and then <code>*</code> to turn them all into an array</li>
     </ol>
-
-    <div id="light-slider-container">
-        <ul id="light-slider">
+    <div id="image-slider-container">
+        <ul id="image-slider">
             <li>
               <img src="../img/taped-1.png" alt="Structure Workflow 1"/>
             </li>
@@ -52,15 +51,18 @@ New to stable version 1.3.2015 is the "Smart Structures" feature. Rather than ma
     </div>
 </div>
 
+_hover over the image to temporarily pause_
+
+
 <script>
 document.addEventListener("DOMContentLoaded", function(event) {
     let pause = 3000;
-    let slider = $("#light-slider");
+    let slider = $("#image-slider");
     let sliderContainer = $(slider.selector + "-container");
     window.slider = slider.lightSlider({
         item:1,
         loop: false,
-        auto: false,
+        auto: true,
         speed: 200,
         pause: pause,
         slideMargin: 0,
@@ -68,7 +70,7 @@ document.addEventListener("DOMContentLoaded", function(event) {
         autoWidth:false,
         thumbMargin:0,
         onBeforeSlide: function (el) {
-            Array.from($('ol#taped')[0].children).forEach(function(item, index, arr) {
+            Array.from($('ol#inline-slides-text')[0].children).forEach(function(item, index, arr) {
               if (index == el.getCurrentSlideCount() - 1)
                 item.id = "currentline";
               else
@@ -80,7 +82,7 @@ document.addEventListener("DOMContentLoaded", function(event) {
             slider.find('img').each(function() {
                 $(this).parent().css("padding-top", (sliderHeight - this.naturalHeight)/2);
             });
-            slider.removeClass('cS-hidden');
+            slider.removeClass('hiddenc');
         },
         onAfterSlide: function(el) {
             if (el.getCurrentSlideCount() == el.getTotalSlideCount()) {
@@ -95,7 +97,7 @@ document.addEventListener("DOMContentLoaded", function(event) {
             sliderContainer.width(width);
         },
     });
-    Array.from($('ol#taped')[0].children).forEach(function(item, index, arr) {
+    Array.from($('ol#inline-slides-text')[0].children).forEach(function(item, index, arr) {
         item.addEventListener('click', function() { window.slider.goToSlide(index)});
     });
 });
@@ -103,7 +105,7 @@ document.addEventListener("DOMContentLoaded", function(event) {
 
 Note that the last step is entirely optional. Now that we've created a basic structure, and if we happen to do a bit of reverse engineering we learn that this is actually a linked list and that the structure /should/ look like:
 
-```
+```C
 struct Page
 {
     int num;
@@ -115,7 +117,7 @@ struct Page
 ```
 
 Where tapes look like:
-```
+```C
 struct Tape
 {
     int id;
@@ -124,12 +126,18 @@ struct Tape
 };
 ```
 
-We can either update our automatically created structure by pressing `y` to change member types and `n` to change their names, or we can use the [types view](#types-view) to directly import the c code directly and then apply the types using `y`. That gives us a disassembly that looks like:
+![Taped HLIL >](../img/taped-hlil.png "Taped HLIL")
+
+We can either update our automatically created structure by pressing `y` to change member types and `n` to change their names, or we can use the [types view](#types-view) to directly import the c code directly and then apply the types using `y`. That gives us HLIL that now looks like:
 
 
 ## Types View
 
-To see all current types in a Binary View, use the types view. It can be accessed from the menu `View > Types`. Alternatively, you can access it with the `t` hotkey from most other views, or using `[cmd] p` to access the command-palette and typing "types". This is the most common interface for creating structures, unions and types using C-style syntax.
+To see all types in a Binary View, use the types view. It can be accessed from the menu `View > Types`. Alternatively, you can access it with the `t` hotkey from most other views, or using `[CMD/CTRL] p` to access the command-palette and typing "types". This is the most common interface for creating structures, unions and types using C-style syntax.
+
+For many built-in file formats you'll notice that common headers are already enumerated in the types view. These headers are applied when viewing the binary in [linear view](../getting-started.md#linear-view) and will show the parsed binary data into that structure or type making them particularly useful for binary parsing even of non-executable file formats.
+
+![Types View](../img/types-view.png "Types View")
 
 ### Shortcuts and Attributes
 
@@ -139,7 +147,7 @@ From within the Types view, you can use the following hotkeys to create new type
 
 * `s` - Create new structure
 * `i` - Create new type
-* `[shift] s` - Creating a new union
+* `[SHIFT] s` - Creating a new union
 
 The shortcuts for editing existing elements are:
 
@@ -181,5 +189,53 @@ struct Header __packed
 
 # Type Library
 
+_coming soon..._
 
 # Signature Library
+
+While many signatures are [built-in](https://github.com/Vector35/binaryninja-api/issues/1551) and require no interaction to automatically match functions, you may wish to add or modify your own. First, install the [SigKit](https://github.com/Vector35/sigkit/) plugin from the [plugin manager](plugins.md#plugin-manager).
+
+## Running the signature matcher
+
+The signature matcher runs automatically by default once analysis completes. You can turn this off in `Settings > Analysis > Autorun Function Signature Matcher` (or, [analysis.signatureMatcher.autorun](../getting-started.md#analysis.signatureMatcher.autorun) in Settings).
+
+You can also trigger the signature matcher to run from the menu `Tools > Run Analysis Module > Signature Matcher`.
+
+Once the signature matcher runs, it will print a brief report to the console detailing how many functions it matched and will rename matched functions. For example:
+
+```txt
+1 functions matched total, 0 name-only matches, 0 thunks resolved, 33 functions skipped because they were too small
+```
+
+## Generating signature libraries
+
+To generate a signature library for the currently-open binary, use `Tools > Signature Library > Generate Signature Library`. This will generate signatures for all functions in the binary that have a name attached to them. Note that functions with automatically-chosen names such as `sub_401000` will be skipped. Once it's generated, you'll be prompted where to save the resulting signature library.
+
+For headless users, you can generate signature libraries by using the sigkit API ([examples](https://github.com/Vector35/sigkit/tree/master/examples) and [documentation](https://github.com/Vector35/sigkit/blob/master/__init__.py#L46)). For more detailed information, see our blog post describing [signature generation](https://binary.ninja/2020/03/11/signature-libraries.html#signature-generation).
+
+If you are accessing the sigkit API through the Binary Ninja GUI and you've installed the sigkit plugin through the plugin manager, you will need to import sigkit under a different name:
+
+```python
+import Vector35_sigkit as sigkit
+```
+
+## Installing signature libraries
+
+Binary Ninja loads signature libraries from 2 locations:
+
+ - [$INSTALL_DIR](https://docs.binary.ninja/getting-started.html#binary-path)/signatures/$PLATFORM
+ - [$USER_DIR](https://docs.binary.ninja/getting-started.html#user-folder)/signatures/$PLATFORM
+
+**WARNING**: Always place your signature libraries in your user directory. The install path is wiped whenever Binary Ninja auto-updates. You can locate it with `Open Plugin Folder` in the command palette and navigate "up" a directory.
+
+Inside the signatures folder, each platform has its own folder for its set of signatures. For example, `windows-x86_64` and `linux-ppc32` are two sample platforms. When the signature matcher runs, it uses the signature libraries that are relevant to the current binary's platform. (You can check the platform of any binary you have open in the UI using the console and typing `bv.platform`)
+
+### Manipulating signature libraries
+
+You can edit signature libraries programmatically using the sigkit API. A very basic [example](https://github.com/Vector35/sigkit/blob/master/examples/convert_siglib.py) shows how to load and save signature libraries. Note that Binary Ninja only supports signatures in the `.sig` format; the other formats are for debugging. The easiest way to load and save signature libraries in this format are the [`sigkit.load_signature_library()`](https://github.com/Vector35/sigkit/blob/master/__init__.py) and [`sigkit.save_signature_library()`](https://github.com/Vector35/sigkit/blob/master/__init__.py) functions.
+
+To help debug and optimize your signature libraries in a Signature Explorer GUI by using `Tools > Signature Library > Explore Signature Library`. This GUI can be opened through the sigkit API using [`sigkit.signature_explorer()`](https://github.com/Vector35/sigkit/blob/master/__init__.py) and [`sigkit.explore_signature_library()`](https://github.com/Vector35/sigkit/blob/master/sigexplorer.py).
+
+For a text-based approach, you can also export your signature libraries to JSON using the Signature Explorer. Then, you can edit them in a text editor and convert them back to a .sig using the Signature Explorer afterwards. Of course, these conversions are also accessible through the API as the [`sigkit.sig_serialize_json`](https://github.com/Vector35/sigkit/blob/master/sig_serialize_json.py) module, which provides a pickle-like interface. Likewise, [`sigkit.sig_serialize_fb`](https://github.com/Vector35/sigkit/blob/master/sig_serialize_fb.py) provides serialization for the standard .sig format.
+
+
-- 
cgit v1.3.1