xusheng

Results 475 comments of xusheng

> did the other changes supersede this PR? I do not think https://github.com/mandiant/capa/pull/2511 alone can do it, but the combination of these three can probably do: 1. https://github.com/mandiant/capa/pull/2511 2. https://github.com/mandiant/capa/issues/2520...

Hi @williballenthin , finally got some to look at your changes! It seems to me that [binja: provide llil to instruction handlers via ctx](https://github.com/mandiant/capa/pull/2509/commits/73f56f585cb17d30c964192b6bf383ed107a71d8) implements the idea described in https://github.com/mandiant/capa/issues/2520...

I also noticed this. See 0x4018fe in `winter eagle chains properly` to see the stack pointer is incremented when something is pushed onto stack ~~what is yan doing xD~~

The issue is first known in https://github.com/Vector35/binaryninja-api/discussions/5629

The binary is shared in private. V35 folks should search for "answer sad mate solid lunch" to find the binary

In IDA you can select the 0x88 token, and hit T, then input a structure to force the display as a structure offset. However, it is purely a display thing...

We already bind "Ctrl+A" to a "Select All" in the graph view, which selects all lines of the current basic block. We should also bind the action in the linear...

The reason why we used the value of the `memstart_addr` variable is because it sits in a section with read-only semantics: ![Screenshot 2024-08-13 at 12 08 00 PM](https://github.com/user-attachments/assets/80109d26-a9cf-4f7f-b5bd-fbfc72fc0994) ![Screenshot 2024-08-13...

A workaround is to right-click on the `.rodata` section, edit it, and set it to `Writable Data`, then the analysis will be fixed: ![Screenshot 2024-08-13 at 10 20 05 PM](https://github.com/user-attachments/assets/0022b2ee-b5e9-4649-9c8b-bfd97da26617)

Btw, I am just curious -- what actually prompts you to use the ""Select None" action? Normally I would think one can do it by just clicking at a location...