search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
50.95k stars 5.81k forks source link

Feature Request: Address tagging #4780

Open sad-dev opened 1 year ago

sad-dev commented 1 year ago

Is your feature request related to a problem? Please describe.

Currently, functions can be tagged (right click -> Function -> Edit tags) with a string tag e.g. "CRYPTO". This is insufficient for most of my tagging needs.

As an example, I was attempting to do the following with the machine learning plugin:

1.) Apply various models on a binary 2.) Tag the addresses with the probabilities different models suggest e.g. "Model1=0.8,Model2=0.5,Model3=0.6..." 3.) Be able to access these tags from scripts

Describe the solution you'd like The tagging system should have the following properties:

1.) Be able to tag addresses and not just functions 2.) Tags should support simple value types e.g. string/integer/double 3.) Tags should be accessible via scripting e.g. getTagValue(Address, String) and getTaggedAddresses(String) (as well as the corresponding setters) 4.) Something similar to the existing Function Tags window to aid searching

Describe alternatives you've considered Maintain my own database and helper scripts to interface with it, or look into plugin-based storage.

ghidracadabra commented 1 year ago

Have you considered using bookmarks? I think they match your use case fairly well if you're willing to store everything as a string. They apply to addresses, can be accessed via scripts, and the Bookmarks window (click the purple checkmark icon) along with various filters should get you pretty close. Note that you can define your own categories for bookmarks.

sad-dev commented 1 year ago

Unless I am mistaken, only one bookmark can be applied to an address at a time. This makes it extremely cumbersome - serializing and deserializing a xml/json/etc. string is the most obvious way to hijack the bookmark for this. It also means that I have to be careful with autoanalysis/scripting as any incoming bookmark might replace my stored values.

If multiple bookmarks on an address is possible then this approach becomes a little more viable as a distasteful hack, but otherwise, it isn't flexible enough to really fit the on-the-fly assignment/modification/deletion of tags - using an external (SQL) database would be easier to script.

ghidracadabra commented 1 year ago

It is possible to have multiple bookmarks at a single address if you add them programmatically using a program's BookmarkManager. If you add a bookmark in the gui, it will automatically assign it a bookmark type of "Note" and also delete any existing bookmarks of that type at that address.

If you create a new bookmark type programmatically and want to see it in the Bookmarks window, you have to click on the little gear icon and select the new type.

sad-dev commented 1 year ago

I'll give it a try - given multiple bookmark types, I can probably write the necessary helper classes to encode/decode the information I need.

sad-dev commented 1 year ago

image

Parsing the bookmarks (for example, to view and filter elements satisfying various value constraints via a TableChooserDialog) is still an annoyance, but I can work with this for now.