Vector35 / Vector35/binaryninja-api
Set Color of Function Name Token For Marking Adversary Functions (or other colors for other reasons)
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
What is the feature you'd like to have?
WARP currently marks matched functions as LibraryFunctionSymbol which is pretty good, but it would be even more powerful if there were one more SymbolType in the enum called MalwareFunctionSymbol. When I am doing annotations, I can make sure that functions written by the adversary get this symbol type, and therefore, when WARP slurps up function information into a signature file, this symbol type is included rather than the library symbol type. All other symbols would continue to default to library. Also, so that these malware functions are nicely differentiated from other types, the color of the text in the GUI should be red rather than the current gold for library functions.
Is your feature request related to a problem?
Being able to differentiate between Library code and Adversary code is super important. Using WARP to mark up new databases so that I don't repeat work is critical. Being able to differentiate between library and malware functions would make the process go faster.
Are any alternative solutions acceptable?
I can always use a prefix like mw_ or whatnot in the symbol name. but what I have described above with having a separate type that I can programmatically operate on in the Python API as well as it having its own separate red color in the GUI would make this way more usable and elegant.
I also tried to monkeypatch the enum as follows, but it didn't work. It just ends in an error if I try to use the newly created symbol:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing WARP's SymbolType handling, including the existing LibraryFunctionSymbol path, the Python API exposure, signature-file generation, and GUI token coloring. The requested result is a distinct malware-function symbol that survives into signatures, is usable through Python, and renders red in the GUI; the issue names no files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, python
- Domain
- api, desktop, reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100