{"id":25563638,"url":"https://github.com/vector35/warp","last_synced_at":"2025-04-12T08:24:24.878Z","repository":{"id":259282190,"uuid":"875643619","full_name":"Vector35/warp","owner":"Vector35","description":"Common format for transferring and applying function information across binary analysis tools","archived":false,"fork":false,"pushed_at":"2024-12-01T23:17:09.000Z","size":181,"stargazers_count":33,"open_issues_count":23,"forks_count":0,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-08T20:55:36.561Z","etag":null,"topics":["analysis","binary","binaryninja","flatbuffers","function-signature","signature","types","warp"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Vector35.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-10-20T14:23:10.000Z","updated_at":"2025-03-25T10:05:30.000Z","dependencies_parsed_at":"2024-10-24T04:00:57.878Z","dependency_job_id":"1251e6c6-f938-4b8f-9630-bfb8d0c8fa60","html_url":"https://github.com/Vector35/warp","commit_stats":null,"previous_names":["vector35/warp"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Vector35%2Fwarp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Vector35%2Fwarp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Vector35%2Fwarp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Vector35%2Fwarp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Vector35","download_url":"https://codeload.github.com/Vector35/warp/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248538276,"owners_count":21120969,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analysis","binary","binaryninja","flatbuffers","function-signature","signature","types","warp"],"created_at":"2025-02-20T20:27:01.173Z","updated_at":"2025-04-12T08:24:24.852Z","avatar_url":"https://github.com/Vector35.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# WARP\n\n**WARP** provides a common format for transferring and applying function information across binary analysis tools.\n\n## WARP Integrations\n\n### Binary Ninja\n\nWARP integration is available as an [open source](https://github.com/Vector35/binaryninja-api/tree/dev/plugins/warp) first-party plugin for [Binary Ninja] and as such ships by default.\n\n## Function Identification\n\nFunction identification is the main way to interact with **WARP**, allowing tooling to utilize **WARP**'s dataset to identify\ncommon functions within any binary efficiently and accurately.\n\n### Integration Requirements\n\nTo integrate with **WARP** function matching you must be able to:\n\n1. Disassemble instructions\n2. Identify basic blocks that make up a function\n3. Identify register groups with implicit extend operation\n4. Identify relocatable instructions (see [What is considered a relocatable operand?](#what-is-considered-a-relocatable-operand))\n\n### Creating a Function GUID\n\nThe function GUID is the UUIDv5 of the basic block GUID's (sorted highest to lowest start address) that make up the function.\n\n#### Example\n\nGiven the following sorted basic blocks:\n\n1. `036cccf0-8239-5b84-a811-60efc2d7eeb0`\n2. `3ed5c023-658d-5511-9710-40814f31af50`\n3. `8a076c92-0ba0-540d-b724-7fd5838da9df`\n\nThe function GUID will be `7a55be03-76b7-5cb5-bae9-4edcf47795ac`.\n\n##### Example Code\n\n```py\nimport uuid\n\ndef uuid5(namespace, name_bytes):\n  \"\"\"Generate a UUID from the SHA-1 hash of a namespace UUID and a name bytes.\"\"\"\n  from hashlib import sha1\n  hash = sha1(namespace.bytes + name_bytes).digest()\n  return uuid.UUID(bytes=hash[:16], version=5)\n\nfunction_namespace = uuid.UUID('0192a179-61ac-7cef-88ed-012296e9492f')\nbb1 = uuid.UUID(\"036cccf0-8239-5b84-a811-60efc2d7eeb0\")\nbb2 = uuid.UUID(\"3ed5c023-658d-5511-9710-40814f31af50\")\nbb3 = uuid.UUID(\"8a076c92-0ba0-540d-b724-7fd5838da9df\")\nfunction = uuid5(function_namespace, bb1.bytes + bb2.bytes + bb3.bytes)\n```\n\n#### What is the UUIDv5 namespace?\n\nThe namespace for Function GUID's is `0192a179-61ac-7cef-88ed-012296e9492f`.\n\n### Creating a Basic Block GUID\n\nThe basic block GUID is the UUIDv5 of the byte sequence of the instructions (sorted in execution order) with the following properties:\n\n1. Zero out all instructions containing a relocatable operand.\n2. Exclude all NOP instructions.\n3. Exclude all instructions that set a register to itself if they are effectively NOPs.\n\n#### When are instructions that set a register to itself removed?\n\nTo support hot-patching we must remove them as they can be injected by the compiler at the start of a function (see: [1] and [2]).\nThis does not affect the accuracy of the function GUID as they are only removed when the instruction is a NOP:\n\n- Register groups with no implicit extension will be removed (see: [3] (under 3.4.1.1))\n\nFor the `x86_64` architecture this means `mov edi, edi` will _not_ be removed, but it _will_ be removed for the `x86` architecture.\n\n#### What is considered a relocatable operand?\n\nAn operand that is used as a pointer to a mapped region.\n\nFor the `x86` architecture the instruction `e8b55b0100` (or `call 0x15bba`) would be zeroed.\n\n#### What is the UUIDv5 namespace?\n\nThe namespace for Basic Block GUID's is `0192a178-7a5f-7936-8653-3cbaa7d6afe7`.\n\n### Function Constraints\n\nFunction constraints allow us to further disambiguate between functions with the same GUID, when creating the functions we store information about the following:\n\n- Called functions\n- Caller functions\n- Adjacent functions\n\nEach entry in the lists above is referred to as a \"constraint\" that can be used to further reduce the number of matches for a given function GUID.\n\n##### Why don't we require matching on constraints for trivial functions?\n\nThe decision to match on constraints is left to the user. While requiring constraint matching for functions\nfrom all datasets can reduce false positives, it may not always be necessary. For example, when transferring functions\nfrom one version of a binary to another version of the same binary, not matching on constraints for trivial functions\nmight be acceptable.\n\n## Comparison of Function Recognition Tools\n\n### WARP vs FLIRT\n\nThe main difference between **WARP** and **FLIRT** is the approach to identification.\n\n#### Function Identification\n\n- **WARP** the function identification is described [here](#function-identification).\n- **FLIRT** uses incomplete function byte sequence with a mask where there is a single function entry (see: [IDA FLIRT Documentation] for a full description).\n\nWhat this means in practice is **WARP** will have less false positives based solely off the initial function identification.\nWhen the returned set of functions is greater than one, we can use the list of [Function Constraints](#function-constraints) to select the best possible match.\nHowever, that comes at the cost of requiring a computed GUID to be created whenever the lookup is requested and that the function GUID is _**always**_ the same.\n\n\n[1]: https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583\n[2]: https://devblogs.microsoft.com/oldnewthing/20221109-00/?p=107373\n[3]: https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf\n[IDA FLIRT Documentation]: https://docs.hex-rays.com/user-guide/signatures/flirt/ida-f.l.i.r.t.-technology-in-depth\n[Binary Ninja]: https://binary.ninja\n[Binary Ninja Integration]: https://github.com/Vector35/binaryninja-api/tree/dev/plugins/warp","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvector35%2Fwarp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvector35%2Fwarp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvector35%2Fwarp/lists"}