Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Version tracking: remove correlator from session? #6352

Open
kitor opened this issue Mar 26, 2024 · 4 comments
Open

Version tracking: remove correlator from session? #6352

kitor opened this issue Mar 26, 2024 · 4 comments
Assignees
Labels
Feature: Version Tracking Status: Internal This is being tracked internally by the Ghidra team

Comments

@kitor
Copy link

kitor commented Mar 26, 2024

Is your feature request related to a problem? Please describe.
I created a version tracking session. Added correlation algorithm that turned out to not work well with my project for whatever reason. I don't see any option to remove that correlator from existing session.

In my particular case I added exact symbol name match over whole address space which slows the workflow a lot due to a lot of symbols. In hope to fix it I added it again, this time limited to address range which is interesting for me... which made it even worse as now it runs twice.

Describe the solution you'd like
Ability to remove correlation algorithm from existing session.

Describe alternatives you've considered

Filtering matches by algorithm doesn't disable it running - in my case symbol match still takes a few seconds on each refresh even though it is not visible.
Starting a new version tracking session will lose all the prior matches.

Additional context
Maybe I'm just missing something? But I tried every button in version tracking window.

@kitor kitor changed the title Version tracking: remove from session? Version tracking: remove correlator from session? Mar 26, 2024
@ryanmkurtz ryanmkurtz added Feature: Version Tracking Status: Triage Information is being gathered labels Mar 26, 2024
@ghidra007
Copy link
Contributor

@kitor You currently cannot remove the matches from correlators but you can filter them out so you can't see them. There is a filter button on the bottom right of the match table that allows you to do this. You can also start over with a new session and not run the correlators you don't like.

@ghidra007 ghidra007 added Status: Prioritize This is currently being prioritized and removed Status: Triage Information is being gathered labels Mar 26, 2024
@kitor
Copy link
Author

kitor commented Mar 26, 2024

Sure, that's what I written in alternatives. Unfortunately filtering doesn't stop processing happen, and with 70k+ matches every reload takes around 8-10 seconds on my 9th gen CPU... I ended up starting over. Yup, that's a firmware where project includes almost entire 32 bit address space...

At least that was pretty quick after some thinking. As I was only interested in already renamed functions it was easy to just accept everything not starting from FUN_(.*)

As for this feature, I see a potential to "prime" matching with exact symbol name match and then get rid of it. Unless there's another way to set "by hand" that function on X at source is Y at destination :)

@astrelsky
Copy link
Contributor

astrelsky commented Mar 27, 2024

As for this feature, I see a potential to "prime" matching with exact symbol name match and then get rid of it. Unless there's another way to set "by hand" that function on X at source is Y at destination :)

This is what I've always done. I mean I've always just deleted the old session, restarted and used that one right away.

@ghidra007
Copy link
Contributor

You can use the Functions window to manually make matches. It's one match at a time because you have to id source and dest function then make match, and so on.
You can also limit what VT correlators run against if you make selections in the source and/or destination program before running the correlators. This will speed things up and give you less results to deal with.

@ghidra007 ghidra007 added Status: Internal This is being tracked internally by the Ghidra team and removed Status: Prioritize This is currently being prioritized labels Apr 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Version Tracking Status: Internal This is being tracked internally by the Ghidra team
Projects
None yet
Development

No branches or pull requests

4 participants