Allow WARP function information to be applied regardless of GUID

[emesare]

What is the feature you'd like to have?
Allow users to select any WARP function regardless of GUID to apply to a function.

Is your feature request related to a problem?
If the function does not have the same GUID of another function, it does not necessarily mean that the function information stored by WARP is not equivalent.

Additional Information:
This is more of a UX issue, how do we allow selection of all functions in the dataset? If we add a sidebar for WARP this becomes much easier to digest, we can have a search bar with a filter that defaults to just of the same GUID but with the option to filter on other things such as name and type(s).

[utkonos]

The issue I had reported was to force application of WARP information to a single function. However, I want to make my use case more clear.

NSIS is distributed as a set of stubs (ignore the icon, it is just plugged into any stub to make it into an uninstaller stub)

All the stubs are almost identical except for the decompression functions and the functions that call the decompression functions. Also, malware that is distributed as NSIS also have one of these stubs. I have a SigKit based signature set that marks the functions in new malware files with the correct function names. This has been pretty good except for a handful of functions that it can't work for. I've now moved to WARP from SigKit and it has really good success except for a different small set of functions. However, I also have a library of databases that were marked up by SigKit. I now want to use WARP to get all the function types more accurate. However, once a file has been worked by SigKit, it appears impossible to run WARP on the same file. Nothing happens. I'd like to be able to run WARP on the whole file under this condition. In addition to that, I'd like to be able to do some function by function cleanup after a whole WARP run by forcing WARP on single functions that I know are the same, but have different GUIDs.

This may be two separate feature requests btw. Please let me know an I can put in a separate one.

[emesare]

it appears impossible to run WARP on the same file. Nothing happens. I'd like to be able to run WARP on the whole file under this condition. In addition to that, I'd like to be able to do some function by function cleanup after a whole WARP run by forcing WARP on single functions that I know are the same, but have different GUIDs.

This may be two separate feature requests btw. Please let me know an I can put in a separate one.

Yes I believe that would be covered under #6336 as your use case is explicitly "a library of databases that were marked up by SigKit", I take that to mean the databases are already analyzed. In that case WARP will not automatically run and you must manually load the signatures.

Why does WARP not run on analyzed databases? Because it would really suck if you have a bunch of marked up functions and then you updated Binary Ninja and analysis ran again and WARP steamrolled over your marked up function.

I might be misunderstanding and in that case please correct me! Thank you again for your detailed use case. I look forward to improving your workflow!

[utkonos]

Because it would really suck if you have a bunch of marked up functions and then you updated Binary Ninja and analysis ran again and WARP steamrolled over your marked up function.

Fully agree. That would be bad if the user didn't want it.

[emesare]

I realize that @utkonos might also be running into an issue of some of the loading commands only using cached function guid, this would obviously fail due to the analysis not caching guids in the BNDB. This however is easily fixable:

1. Use the version of the guid retrieval that will create if not already existing.
2. Store the guid of the function in the database.

1 can be done immediately, 2 would require a little more effort but can be done easily as well, not exactly sure when the caching would be done but at the end of analysis sounds reasonable.