search

radareorg / radare2

UNIX-like reverse engineering framework and command-line toolset
https://www.radare.org/
GNU Lesser General Public License v3.0
20.75k stars 3.01k forks source link

Unique coloring for similar immediates #19003

Open swoops opened 3 years ago

swoops commented 3 years ago

Description

Please describe what are you missing or wanting to be improved Recently I read a new syntax coloring technique for programing languages. Instead of highlighting grammar, highlight the things you are likely to mistake. So make sure strcpy and strncpy are easily distinguishable by their color. It would be cool to apply this to immediate values in assembly and the ? command.

For example, it is difficult to distinguish between 0x9d343f8b318614d1 and 0x9d345f8b318614d1. I don't even read that number all the way when I see it, I won't recognize it if I see it again later in code. If later the result of a math operation (from ? cmd) is 0x9d343f8b318614d1, I won't remember the significance of the number. Applying a unique color to similar numbers would help the user remember if they had seen the number before. It would make it easy to see if the same number is used a lot in large chunks of code, or if numbers vary slightly.

Initial implementation could just be a simple hash of the immediate, then index that value from an accepted color space.

** If anyone knows the article I am speaking of, please link it. I can't find it anymore and I would like them to receive credit for the idea.

hlee131 commented 1 year ago

Could I take this issue? If so, could I get some pointers on which files I should be looking at to implement this? Also, what's the build process like during development? Should I be running sys/install.sh after every change I make?

swoops commented 1 year ago

@hlee131 Yeah, feel free to take it.

Once you use sys/install.sh once, you should just be able to run make for each of your updates.

Not sure where to start. I imagine pointer printing is all over the place. I would open /bin/ls like you are going to reverse it, find the first pointer you see in your normal reversing processes and figure out what printed that code. It should be a r_cons_printf so you might break on that.

Sorry I can't be of more help there.