Vector35 / Vector35/binaryninja-api

Set Color of Function Name Token For Marking Adversary Functions (or other colors for other reasons)

Open
#7,267 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: WARP Effort: Low Impact: Low UI: Symbols
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

What is the feature you'd like to have?
WARP currently marks matched functions as LibraryFunctionSymbol which is pretty good, but it would be even more powerful if there were one more SymbolType in the enum called MalwareFunctionSymbol. When I am doing annotations, I can make sure that functions written by the adversary get this symbol type, and therefore, when WARP slurps up function information into a signature file, this symbol type is included rather than the library symbol type. All other symbols would continue to default to library. Also, so that these malware functions are nicely differentiated from other types, the color of the text in the GUI should be red rather than the current gold for library functions.

Is your feature request related to a problem?
Being able to differentiate between Library code and Adversary code is super important. Using WARP to mark up new databases so that I don't repeat work is critical. Being able to differentiate between library and malware functions would make the process go faster.

Are any alternative solutions acceptable?
I can always use a prefix like mw_ or whatnot in the symbol name. but what I have described above with having a separate type that I can programmatically operate on in the Python API as well as it having its own separate red color in the GUI would make this way more usable and elegant.

I also tried to monkeypatch the enum as follows, but it didn't work. It just ends in an error if I try to use the newly created symbol:
Image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing WARP's SymbolType handling, including the existing LibraryFunctionSymbol path, the Python API exposure, signature-file generation, and GUI token coloring. The requested result is a distinct malware-function symbol that survives into signatures, is usable through Python, and renders red in the GUI; the issue names no files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
api, desktop, reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.