Skip to content

Packetreaders mix#1

Merged
ThiconZ merged 13 commits intothemeldingwars:mainfrom
Xsear:packetreaders-mix
Apr 30, 2023
Merged

Packetreaders mix#1
ThiconZ merged 13 commits intothemeldingwars:mainfrom
Xsear:packetreaders-mix

Conversation

@Xsear
Copy link
Copy Markdown
Contributor

@Xsear Xsear commented Apr 22, 2023

This primarily adds suggestions for the functions used when unpacking network messages. I have put them all at Suggested level as I'm not yet that confident in which namespaces/class they belong to. I have provided some categorization based on my assumptions. I also noted some lua and APT related funcs, but confidence is much lower there.

Xsear added 11 commits March 19, 2023 17:21
These are generally accurate but there is room for some misstakes on which exact types are being read. Also not completely confident on the namespace. The naming is not official and follows some patterns: ReadOptional_ have a behavior of reading 1 byte and something else if the byte was not 0. ReadArray_ use a common pattern with a do while loop reading 1 byte, that many of something, and then repeating if the original byte was 255 to allow for more entries. There are some funcs reading array without this behavior and those should not use the same prefix to avoid confusion.
@ThiconZ
Copy link
Copy Markdown
Member

ThiconZ commented Apr 29, 2023

Most of these names look good. However, not all applications support some of the used symbols in a handful of the names.
Example invalid name used: ReadArray_String+4x4
image

List of all valid characters: :_0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Note there may be some additional characters that are supported based on application and/or context of the name being used. However, to keep things relatively simple the above list should be adhered to for maximum compatibility.

Additionally, some names occur multiple times. All names must be unique. We don't have a standard currently for duplicate names so appending _<DuplicateNumber> for each additional occurrence may be the easiest solution for now.
Example duplicate name occurrence: ReadArray_UInt32

An easy way to scan your file for all duplicate entries is to:

  1. Load the database into the DISASM Name Manager.
  2. Then select the Import Names option from the menu bar.
  3. Set the Import Source to File (JSON).
  4. Select the same file that you loaded as the database.
  5. Leave the Update Category, Status, and Comment of Full Duplicate items option checked.
  6. Click the Import Content button.
  7. Use the list presented on the right-hand side of the Item Deduplication window (if it appears, meaning duplicate entries were found) to identify any instances that require new names.
  8. Note down the entries/update them in your source file/create a new database containing just the items you plan to deduplicate, and import it again. If you apply the currently displayed deduplication it will delete the duplicate occurrences which may result in data loss if you did not save/note them down ahead of time.
    image

@Xsear
Copy link
Copy Markdown
Contributor Author

Xsear commented Apr 30, 2023

Have made a pass to eliminate duplicates and a few names that still had unsupported characters in them.
Now, when testing the import procedure above, it simply states that 0 items were imported, so I hope that should be all duplicates resolved. We have two names with . in them but these are there since previously. (gInterface.mIsEnabled, gInterface.mDll).

@ThiconZ
Copy link
Copy Markdown
Member

ThiconZ commented Apr 30, 2023

The changes all look good now and will be merging them in.

For the . used in variables, since Ghidra and IDA both gracefully handle this character, it can be included in the allowed character list. In IDA it technically is considered invalid and will be silently converted down to a _ without warning.

The allowed character list and duplicate name handling (of appending incrementing numbers) will be added to the ReadMe.d as well.

@ThiconZ ThiconZ merged commit e483b90 into themeldingwars:main Apr 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants