Reverse Engineering Binary Ninja Commercial 3.2.3814

[itsMe]

Binary Ninja Commercial 3.2.3814 (2022-10-28)

Binary Ninja is an interactive disassembler, decompiler, and binary analysis platform for reverse engineers, malware analysts, vulnerability researchers, and software developers that runs on Windows, macOS, and Linux.

https://binary.ninja

Stable Branch Changelog

Note that customers with an active support license can access more frequent updates in the dev channel. This changelog only includes stable build milestones.
3.2.3814 (2022-10-28)

Enhanced Windows Experience
• Improved Enumerations
• Next-Generation PDB Support
• CFG Call Handling
• MS Demangler Improvements

Decompiler Improvements
• Variable Merging/Splitting
• Offset Pointers
• Split Loads and Stores

Objective-C Support
Segments and Sections Editing UI
Default to Clang Type Parser
Named and Computer Licenses for Enterprise

Documentation:
• Vastly improved C++ API docs
• New User Guide Layout

UI Updates
• Feature: Add “Restart and Reopen Files” command
• Feature: “Run Script” Action and menu item
• Feature: Add a recent file right-click menu for ‘Open with Options’
• Feature: Lots of new “magic” console variables
• Feature: Add “Zoom to Fit” and “Zoom to Cursor” hotkeys
• Feature: Add various filtering options to StringsView
• Feature: Add ‘Copy’ options in the ‘Strings’ and ‘Symbols’ views
• Feature: Restore window layout and location when reopening files
• Feature: Show list of imported libraries in TriageView and if they have TypeLibrary information or not
• Feature: Hotkeys for toggling integer size “D” and and sign “-“ in TypesView
• Feature: Kill to end of line hotkey in python console
• Feature: Undo/Redo now show action summaries for what will be done or undone
• Feature: New Light Theme (Summer)
• Improvement: Configurable HLIL tab width
• Improvement: Move exact match to top of symbol list if found
• Improvement: Hotkeys now searchable in the keybindings menu
• Improvement: Wayland support (partial)
• Improvement: Consistency of hotkeys in StackView (1, 2, 3)
• Improvement: Menu organization (1, 2)
• Improvement: Allow programmatically closing a global area widget
• Improvement: “firstnavigate”, prefer triage, and other potentially conflicting default options normalized and documented
• Fix: Text rendering glitch in hex view on Windows
• Fix: Default font on Windows along with other font related improvements
• Fix: Create structure ‘S’ hotkey wasn’t appearing to work during analysis
• Fix: Right-click losing selection
• Fix: BN hangs when it fails to open a URL
• Fix: SettingsView filtering bug when pasting search text
• Fix: ‘Display As’ for array index annotations
• Fix: Various theme handling fixes (1, 2)
• Fix: x86 assembler on Windows
• Fix: Missing linear view updates when creating analysis objects via API

Binary View Improvements
• Improvement: PE more in-depth parsing of the LoadConfig structure
• Improvement: PE create a symbol for the __security_cookie
• Improvement: PE make DataVariables for XFG hashes
• Improvement: PE identify _guard_check_icall and _guard_check_icall_check and their pointers
• Improvement: PE Demangle GNU3 (clang) Mangled Names
• Improvement: ELF Thumb2 entry point detection
• Improvement: Mach-O Create DataVariables for ‘dylib’ and ‘dylib_command’
• Improvement: Mach-O Fix DYLIB and DYLD commands
• Improvement: Mach-O Warn when encountering an unsupported INDIRECT_SYMBOL_LOCAL symbol
• Fix: COFF loader does not respect address size when creating external symbols
• Fix: COFF loader now recognizes (and stops loading) CIL and import library COFF files
• Fix: PE Bug with parsing exception handlers
• Fix: ELF hang when displaying DataVariables when section header count is too high

Analysis
• Feature: Added experimental option for keeping dead code branches
• Feature: Setting to disable “pure” function call elimination
• Feature: Add BinaryView metadata about which libraries have applied type information
• Feature: Type extraction from mangled names is now optional
• Feature: Recognition of thiscall and fastcall conventions on Win32 x86
• Improvement: Add support for indirect tailcall translation
• Improvement: Improved string detection
• Improvement: HLIL to other IL and assembly mappings
• Improvement: Resolve dereferencing a structure into accessing the first member
• Improvement: Create structure references for unknown field offsets
• Improvement: Propagate pointer child type to dereference expression
• Improvement: Template simplifier (from 2.3) now enabled by default
• Improvement: Range clamping to improve jump table detection
• Improvement: Add additional no-return function to Platform types
• Fix: Issue where function analysis could timeout unintentionally
• Fix: Invalid HLIL under some conditions
• Fix: Missing empty cases in switch statements
• Fix: HLIL graph when only default case falls through
• Fix: Crash when wide string ends without null at section boundary
• Fix: Fix hang in Pseudo C
• Fix: Crash when importing function type info from unknown type
• Fix: Constant propagation from writable memory for constant arrays
• Fix: Properly decode and render strings with BOMs
• Fix: Prevent demangler from making function types with single ‘void’ parameter
• Fix: Don’t allow demangled types to override Platform types
• Fix: MS Demangler fix order of multidimensional arrays
• Fix: MS Demangler properly set calling convention
• Fix: MS Demangler disambiguate int/long
• Fix: MS Demangler add implicit ‘this’ pointer when demangling ‘thiscall’
• Fix: MS Demangler demangle SwiftCallingConvention

API
• New API: Merge and split variables
• New API: Variable liveness API for determining soundness of merging/splitting variables
• New API: Components class and notifications
• New API: Get and set offset pointers
• New API: Implement .tokens property on HLIL
• New API: Function.get_variable_by_name
• New API: Get and delete for DebugInfo API
• New API: CallingConvention::GetVariablesForParameters
• New API: BinaryView.get_default_load_settings
• New API: Interaction.run_progress_dialog
• New API: Function.is_thunk
• New API: Notifications for Segment/Section Added/Updated/Removed
• New API: Function.caller_sites
• New API: HLIL_UNREACHABLE
• New Example: Feature map
• Improvement: Add progress callback to DebugInfo:arseInfo
• Improvement: Implement missing APIs in BinaryNinja::Metadata
• Improvement: Add channel to core_version_info
• Improvement: DebugInfo.parse_debug_info returns a boolean
• Improvement: Many type hint additions and fixes
• Improvement: Python/C++ APIs to get registers, register stacks, and flags for LLIL
• Improvement: Allow DataVariable.name to be assigned a QualifiedName
• Improvement: Added a significant amount of C++ API Documentation
• Improvement: New theme for C++ documentation
• Improvement: Allow passing QualifiedNameType instead of QualifiedName to many functions
• Deprecation: BinaryViewTypeArchitectureConstant
• Deprecation: BNLogRegisterLoggerCallback
• Fix: Variable use/def API for aliased variables
• Fix: Platform.os_list
• Fix: DebugInfo.function
• Fix: issue where EnumerationBuilder couldn’t set the width of the enumeration
• Fix: BinaryView.get_functions_by_name to handle cases like sub_main
• Fix: Trying to delete incomplete LowLevelILFunction
• Fix: stack_adjustment.setter
• Fix: Type annotation & documentation for define_auto_symbol_and_var_or_function
• Fix: Issue where notification callbacks were not being called
• Fix: missing debugger_imported definition in PythonScriptingInstance
• Fix: Python exceptions when accessing functions with skipped IL analysis
• Fix: Class hierarchy of HLILRet
• Fix: Core parser not parsing struct __packed foo
• Fix: Ignore UI plugins when loaded in headless

Types
• Fix: Make _Unwind_Resume() __noreturn

Architectures
• Armv7/Thumb2: Critical improvement to analysis of armv7/thumb2 call sites to respect callee function types
• Armv7/Thumb2: Proper lifting for Thumb2 LDM and STR with Rn not included in register list
• Armv7/Thumb2: Add lifting for SMULxx instruction forms
• Armv7/Thumb2: Fix lifting of certain uses of flexible operands (Thank you @ehntoo)
• Armv7/Thumb2: Fix crash on MSR banked instruction
• Armv7/Thumb2: Fix PC-relative alignment issue
• Armv7/Thumb2: Lift msr to basepri as __set_BASEPRI
• Armv7/Thumb2: Added vmov immediate lifting (Thank you @ehntoo)
• Armv7/Thumb2: Fix size of vstr storage (Thank you @ehntoo)
• Arm64: Corrected lifting of *ZR target register
• Arm64: Lifted load-acquire, store-release instructions
• MIPS: Properly handle delay slot rewriting with call targets (Thank you @yrp)
• MIPS: Lifted madd, maddu (Thank you @yrp)
• x86/x86_64: int 0x29 now ends basic blocks

Debugger
• Feature: Add support for remote Windows/macOS/Linux debugging
• Feature: Add basic support for iOS/Android remote debugging
• Improvement: New breakpoint sidebar widget icon
• Improvement: Remain in the debugger sidebar after launching the target or ending the debugging
• Improvement: Register widget refactor
• Improvement: Put the debugger breakpoints widget and registers widgets into a tab widget
• Improvement: Modules widget refactor
• Improvement: Status bar widget refactor
• Improvement: Add history entries support for target console and debugger console
• Fix: Windows x86 debugging
• Fix: Invert debugger icon colors and fix panel icon to not be grayscale
• Fix: Memory leak after using the debugger

Plugins/Plugin Manager
• Improvement: Prioritize plugin name in search filtering
• Improvement: More robust against offline networks and captive portals
• Improvement: Settings to allow disabling official and community plugin repositories

Enterprise
• Feature: Named and computer licenses are now available for Enterprise
• Feature: Project files may now be stored in folders
• Feature: The Enterprise server is now deployable with Docker Swarm
• Feature: The Enterprise server is now deployable with custom SSL certificates
• Improvement: Databases and files can now be downloaded directly from the files list without opening the database first
• Improvement: Syncing has been made significantly faster by avoiding unnecessary analysis cache downloads
• Improvement: A “skip” button has been added on initial launch to avoid waiting for server connection while offline
• Improvement: Changed the way Enterprise server deployments work to allow additional flexibility and customization
• Improvement: Enterprise client updates can now be downloaded and synced to the Enterprise server for only specific platforms
• Fix: The initial login window now correctly responds to other ways to close a window (e.g. Cmd-Q)
• Fix: Disabling plugins via the -p switch is now correctly supported in Enterprise
• Fix: Fixed multiple client crashes related to UI and networking
• Fix: The Enterprise server now correctly works with the compose sub-command included with newer versions of Docker

To see this hidden content, you must like this content.