Open pdamian opened 1 year ago
The memory diff view should add $$ in case an entry is symbolic. Color background in case concrete / symbolic value changed between entry and leave state
This is currently implemented by coloring different fields. In case there is a difference in value, the name/address is marked green. In case either the entry or leave value is symbolic, the value is marked blue.
Am I misinterpreting your request or is this already implemented?
The rest of the requests seem reasonable.
This is currently implemented by coloring different fields. In case there is a difference in value, the name/address is marked green. In case either the entry or leave value is symbolic, the value is marked blue.
OK, I misinterpreted the colors. Maybe a color legend within Ghidrion would help.
And red then means a mismatch in entry and leave states.
However, one minor problem I detected is that when you have a new entry in the leave state, which is also symbolic (below marked as $$), the coloring is confusing.
Coloring as it is currently implemented: | Address | Entry State | Leave State |
---|---|---|---|
0x1000 (r) | 0x41 $$ (r) |
Proposed coloring: | Address | Entry State | Leave State |
---|---|---|---|
0x1000 (r) | 0x41 $$ (b) |
Color Scheme: r=red, b=blue
The values should only be colored blue (when they are symbolic) - never green or red. The address / register name is colored green, red or none (black).
Note: I think green means equal values, black not equal (as opposed to what you described).
I see, I thought it should basically never happen that an memory entry or register only appears in the entry or exit state. I have changed it to your proposed solution.
Note: I think green means equal values, black not equal (as opposed to what you described).
That was a fun bug to discover. It's fixed in the current release.
OK, I misinterpreted the colors. Maybe a color legend within Ghidrion would help.
Good idea, I'll see what can be done.
strlen
) or block name (e.g..text
), it is no longer possible to "unselect" it and show everything (current workaround: type a filter and remove it afterwards)