Version Tracking

# Ghidra Version Tracking

What is Version Tracking?

- Matching functions and data and their markup from an older version of a binary to a new version of a binary

Version Tracking

- Allows for multiple version tracking algorithms
- Has both function and data matching capabilities
- Saves state of version tracking on each matched item so you can come back to it later, change states, etc...
- Matches shown in sortable table with numerous ways to sort and filter so that items in list can be tailored however you like (example: remove when accepted or ignored, show only ones from particular algorithm, etc...
- Shows all possible matches to a particular function (from both programs)

Version Tracking (continued)

- Allows moving of markup from source version to destination version
- Can rerun using current state and add new information to your current version tracking session
- Drag and drop markup items if necessary
- Has validators to help determine if programs are sufficiently analyzed to get good version tracking results
- Provides list of what functions remaining to match

Preparing for Version Tracking

- Both binaries should have similar memory maps
- Both binaries should be mostly disassembled correctly
- Both binaries should have mostly all functions created correctly and with similar calling conventions

Notes:

If the following conditions are not met, the results of Version Tracking will be incomplete or incorrect:

- Both binaries should have similar memory maps

- AVOID: One program with a lot of memory segments and one program with one merged segment
- AVOID: duplicate code segments
- AVOID: same segments with different permissions

- Both binaries should be mostly disassembled correctly

- AVOID: areas where data has been incorrectly turned into code
- AVOID: areas with "red" X's
- AVOID: off-cut references

- Both binaries should have mostly all functions created correctly

- AVOID: missing functions
- AVOID: functions that have been disassembled but are not defined as functions
- AVOID: functions with no returns that have not been marked as such
- AVOID: functions that do not decompile correctly
- AVOID: functions with very different calling conventions

Version Tracking

- The Version Tracking tool is made up of two Code Browsers and a Window that manages runs/result tables all connected via a Version Tracking session.
- A Version Tracking session stores and manages your version tracking programs and match information.
- Source program is the program with interesting markup.
- Destination program is the new program that you want to pull match information into.
- Validators check to see if there are any potential issues with the programs that would keep you from getting good results.

To open the Version Tracking tool do one of the following:

- Click on the blue footprints icon in the Ghidra Program Manager. This will bring up an empty Version Tracking tool. To get started, click on the blue footprints in the empty tool. You will be asked for a session name and to choose the two programs you want to version track.
- Drag one program onto the blue footprint. This will prompt you for a session name and the other program to version track. Make sure you use the swap button to get the source and destination programs correct.
- Drag two programs onto the blue footprint. This will prompt you for a session name. Make sure you use the swap button to get the source and destination programs correct.

The source program is the program with interesting markup.

The destination program is the new program that you want to pull match information into.

Validators check to see if there are any potential issues with the programs that would keep you from getting good results. If you get any warnings or red X's you should inspect and potentially fix any problems in your programs before continuing. Any results that are obtained using programs that are not sufficiently cleaned up are not guaranteed to be complete or correct!

Validators

- Help user determine if programs are ready to version track by showing for each program:

- Number of errors
- Percent analyzed
- Memory Map similarity
- Number of functions
- Numer of non-returning functions
- Number of off-cut references

- To get optimal results, users should fix up issues before proceeding to the next step
- Once finished, two Codebrowsers, one containing source program and one containing destination program, and a session manager window will open.

Correlation Algorithms

- Click on green plus icon in the version tracking session manager to run one or more version correlator at a time
- Correlators include:

- Exact and Similar Data Match Correlators
- Exact and Similar Symbol Name Correlators
- Various types of Exact Function Correlators
- Various Reference Correlators that use results from known matches

- Read help for more detailed information about each

Match Table

- Click on match and both browsers navigate to match items
- Buttons (accept, apply, reject, clear, tag, options)
- Filters (name, score, length, advanced)

- Can apply one or more match at once (select rows in table or do Ctrl-A for whole table selection)
- Special filter button in lower right allows filtering by correlator, match type, and accepted/available matches
Markup Table

- Shows markup matches and their status
- Allows individual markup if necessary
- Highlights current markup in dummy listing view

Decompile/Listing Views

- Shows view of current selection in match table
- Can view as decompiler or listing
- In listing can drag and drop markup to alternate location
- Shows similarity and differences between two match items

Functions List

- Open with Window->Version Tracking functions
- Shows list of all functions in each program by default
- Can change to show only accepted or available matches
- Can manually match items.

Exercise 1

- Import and analyze WallaceSrc.exe and WallaceVersion2.exe from ../ExerciseFiles/VersionTrackFiles.
- Open WallaceSrc.exe in a CodeBrowser and run the MarkupWallaceSrcScript.
- Use the Version Tracking tool to determine what function(s) are different, new, or removed in WallaceVersion2.exe.
- Apply appropriate markup items from WallaceSrc.exe to WallaceVersion2.exe.