Extending IL and Structure View of Linear Disassembly

[chrepl]

Hey guys,

just a few questions:

1. Is there a documented list of all available tokens used by each LowLevelILOperation or any IL representation? Is it also possible to extend the IL? So far, I understood that there is a function (property) at lowlevelil.py#tokens to represent each token inside an instruction. But these are all calling the core API. The use case would be I want to write a plugin for an obfuscated binary to represent the tokens of an IL instruction in a much clearer way, but currently, I can only read.

2. Can a UI plugin extend the structure view of Linear Disassembly through adding Qt Widgets?

Thanks for your help. 🙏

[chrepl]

1. Will this may be solved by publishing arch-x86 core packages?

[psifertex]

1. No, it is not possible to extend the IL at this time. You can see the published architecture here (https://github.com/Vector35/arch-x86) along with how lifting is done for extensions.

The feature you'd want to use to be able to handle an obfuscated binary like that would be: #1606 where you can translate whole sections of the IL and rewrite it with various changes. That is our intended feature for such a problem though of course, it's not released yet.

2. Yes, UI plugins can technically add anything to the linear disassembly via the appropriate Qt calls, but it wouldn't be super easy because you'd also have to hook in the appropriate scroll methods to update as the IL view scrolled and doing that in python would be slow. That said, this API might be just what you need:
   https://api.binary.ninja/binaryninja.datarender-module.html#module-binaryninja.datarender

[chrepl]

Thank you for your response.

1. Yeah, analysis passes: now "workflows" MVP #1606 sounds great, is there a known release date?

2. binaryninja.datarender.DataRenderer was what I'm looking for. Another question, I can't find which type is used for ctxt in DataRenderer, every time the functions perform_is_valid_for_data, perform_get_lines_for_data is called ctxt is set to None. What is the purpose of ctxt, and the difference between ctxt and context?

Thanks for your help.

[psifertex]

No, no expected release date for 1606 at this time, but it's under active development now, so it'll be done when it's done. :-)

From the documentation linked above:
The context is a list of Type objects which represents the chain of nested objects that is being displayed.

[chrepl]

Thanks, glad to hear that's under development. :) Sorry for my misunderstanding, just to be right: So the documentation pointing as context the argument ctxt, and not the argument context? Because there are two arguments passed to perform_is_valid_for_data and perform_get_lines_for_data, even ctxt and context. I understood from the documentation that the argument context holds a list, but I could not propose what ctxt is holding because it's every call a NoneType. These two-arguments are a little bit confused by the naming. Or maybe ctxt is short for "c-text", not "context"? :D

Thank you @psifertex

[psifertex]

No worries, it's not clear from the issue itself that it's already under development, since we're not sure if it will be completed in time for the 2.3 stable release we haven't tagged it for that.

Ahh, sorry for the confusion. Yes, ctxt is a different variable for the is_valid_for APIs, I don't actually know offhand what that context is, could be a UIContext object, but would be simplest to just test it and log_info(type(ctxt)) to find out for sure.

[chrepl]

Ah, yes, I test it with log_debug(type(ctxt)) already, every time I got a NoneType inside the two functions above. :) But when it has something to do with UIContext, that helps to understand the variable's purpose, I did not try it in _is_valid_for function.
Thank you.