Ghidra Version Tracking

What is Version Tracking?

Matching functions and data and their markup from an older version of a binary to a new version of a binary

Version Tracking

Allows for multiple version tracking algorithms
Has both function and data matching capabilities
Saves state of version tracking on each matched item so you can come back to it later, change states, etc...
Matches shown in sortable table with numerous ways to sort and filter so that items in list can be tailored however you like (example: remove when accepted or ignored, show only ones from particular algorithm, etc...
Shows all possible matches to a particular function (from both programs)

Version Tracking (continued)

Allows moving of markup from source version to destination version
Can rerun using current state and add new information to your current version tracking session
Drag and drop markup items if necessary
Has validators to help determine if programs are sufficiently analyzed to get good version tracking results
Provides list of what functions remaining to match

Preparing for Version Tracking

Both binaries should have similar memory maps
Both binaries should be mostly disassembled correctly
Both binaries should have mostly all functions created correctly and with similar calling conventions

Notes:

If the following conditions are not met, the results of Version Tracking will be incomplete or incorrect:

Both binaries should have similar memory maps

AVOID: One program with a lot of memory segments and one program with one merged segment
AVOID: duplicate code segments
AVOID: same segments with different permissions

Both binaries should be mostly disassembled correctly

AVOID: areas where data has been incorrectly turned into code
AVOID: areas with "red" X's
AVOID: off-cut references

Both binaries should have mostly all functions created correctly

AVOID: missing functions
AVOID: functions that have been disassembled but are not defined as functions
AVOID: functions with no returns that have not been marked as such
AVOID: functions that do not decompile correctly
AVOID: functions with very different calling conventions

Version Tracking

The Version Tracking tool is made up of two Code Browsers and a Window that manages runs/result tables all connected via a Version Tracking session.
A Version Tracking session stores and manages your version tracking programs and match information.
Source program is the program with interesting markup.
Destination program is the new program that you want to pull match information into.
Validators check to see if there are any potential issues with the programs that would keep you from getting good results.

To open the Version Tracking tool do one of the following:

Click on the blue footprints icon in the Ghidra Program Manager. This will bring up an empty Version Tracking tool. To get started, click on the blue footprints in the empty tool. You will be asked for a session name and to choose the two programs you want to version track.
Drag one program onto the blue footprint. This will prompt you for a session name and the other program to version track. Make sure you use the swap button to get the source and destination programs correct.
Drag two programs onto the blue footprint. This will prompt you for a session name. Make sure you use the swap button to get the source and destination programs correct.

The source program is the program with interesting markup.

The destination program is the new program that you want to pull match information into.

Validators check to see if there are any potential issues with the programs that would keep you from getting good results. If you get any warnings or red X's you should inspect and potentially fix any problems in your programs before continuing. Any results that are obtained using programs that are not sufficiently cleaned up are not guaranteed to be complete or correct!

Validators

Help user determine if programs are ready to version track by showing for each program:

Number of errors
Percent analyzed
Memory Map similarity
Number of functions
Numer of non-returning functions
Number of off-cut references

To get optimal results, users should fix up issues before proceeding to the next step
Once finished, two Codebrowsers, one containing source program and one containing destination program, and a session manager window will open.

Correlation Algorithms

Click on green plus icon in the version tracking session manager to run one or more version correlator at a time
Correlators include:

Exact and Similar Data Match Correlators
Exact and Similar Symbol Name Correlators
Various types of Exact Function Correlators
Various Reference Correlators that use results from known matches

Read help for more detailed information about each

Match Table

Click on match and both browsers navigate to match items
Buttons (accept, apply, reject, clear, tag, options)
Filters (name, score, length, advanced)

Can apply one or more match at once (select rows in table or do Ctrl-A for whole table selection)

Special filter button in lower right allows filtering by correlator, match type, and accepted/available matches

Markup Table

Shows markup matches and their status
Allows individual markup if necessary
Highlights current markup in dummy listing view

Decompile/Listing Views

Shows view of current selection in match table
Can view as decompiler or listing
In listing can drag and drop markup to alternate location
Shows similarity and differences between two match items

Functions List

Open with Window->Version Tracking functions
Shows list of all functions in each program by default
Can change to show only accepted or available matches
Can manually match items.

Exercise 1

Import and analyze WallaceSrc.exe and WallaceVersion2.exe from ../ExerciseFiles/VersionTrackFiles.
Open WallaceSrc.exe in a CodeBrowser and run the MarkupWallaceSrcScript.
Use the Version Tracking tool to determine what function(s) are different, new, or removed in WallaceVersion2.exe.
Apply appropriate markup items from WallaceSrc.exe to WallaceVersion2.exe.