## Using the Graph Window

- Overview
- Concepts
- Description
- Hotkeys

### Overview

BinNavi graph windows show disassembled code in graph form. During a code analysis session you will have one or more of these windows open. Among other things you can use them to navigate through code, to annotate code, to create custom graphs, to tag interesting nodes, or to debug the target module.

You can switch graph windows between different perspectives depending on what you are working on. By default the standard perspective is active when a new graph window is opened. This perspective is primarily used for static code analysis. To debug a target process, you can switch to the so called debug perspective which offers all the functionality needed for debugging.

Both the standard perspective and the debug perspective divide graph windows into roughly four parts. In both cases by far the largest part of the graph window is the center part where the disassembled code is shown. When the standard perspective is active, the left side of the graph window provides a panel with different parts that make it easier to navigate through the graph. The right side of the graph window is all about tagging nodes. You can define new node tags there and assign them to nodes in the graph. The bottom part of the graph window is a panel that contains other useful features for analyzing disassembled code.
When the debug perspective is active, the left, right, and bottom parts of the graph window are changed to provide useful debugging information. The left side of the window shows the current register values while the right side shows available debugger options. The bottom of the graph window contains tabs that show the memory of the active process, its loaded dynamic libraries, previously recorded debug traces, and other things.

### Concepts

- Proximity Browsing: The so called Proximity Browsing mode helps you analyze large graphs. Instead of showing all the nodes and edges in the graph, only a subset of the nodes and edges are shown. Proximity Browsing works by hiding all nodes and edges which are not in the direct neighborhood of the currently selected nodes. Whenever a node selection changes, the neighborhood of the selected nodes is updated and nodes are hidden or shown depending on whether they are in that neighborhood. This ensures that only relevant nodes are shown at any given moment.

- Node Tags: Individual nodes of a graph can be tagged with so called node tags. This makes it easy to categorize different nodes into groups.

- Debugging: If a debugger was configured for the module that contains the view shown in the graph window, the view can be debugged from the graph window.

### Description

#### The main menu

The main menu on top of the graph window provides access to many different functions. At first there is the View menu. It provides functions related to the view itself.

- View/Save View: Saves the view to the database.
- View/Save View As: Saves a copy of the view to the database.
- View/Clone View: Creates a copy of the current view and opens it.
- View/Change View Description: Shows a dialog where you can change the name and description of the view.
- View/Print View: Prints the view.
- View/Export: Saves the view to an image file (several different image formats are supported).
- View/Close View: Closes the view.

Then there is the Graph menu. The functions available from this menu are comparable to the ones from the View menu but they are connected more closely to the graph itself.

- Graph/Automatic Layouting: Enables or disables automatic layouting. If automatic layouting is enabled, the graph is layouted automatically after important changes to its structure.
- Graph/Proximity Browsing: Enables or disables proximity browsing. If proximity browsing is enabled, only the nodes in the neighborhood of the currently selected nodes are shown.
- Graph/Graph Settings: Shows a dialog where the appearance and behavior of the graph can be changed.
- Graph/Proximity Browsing Settings: Shows a dialog where the behavior of the proximity browsing mode can be changed.
- Graph/Insert View: Used to load the graph of another view into the current view.
- Graph/Delete Selected Nodes: Deletes all selected nodes from the graph.
- Graph/Delete Unselected Nodes: Deletes all unselected nodes of the graph.
- Graph/Delete Invisible Nodes: Deletes all invisible nodes from the graph.
- Transform/Inline All Functions: Inlines all functions called by the active view.
- Transform/Show REIL Code: Translates the active view to REIL code and shows the REIL graph.
- Transform/Show Dataflow graph: Shows a dataflow graph for the active view.

The next menu is the Selection menu. You can use this menu to select nodes of the graph in different ways.

- Selection/Undo Last Selection: Restores the former selection state after a selection changed.
- Selection/Redo Last Selection: Restores the last selection state after a former selection state was restored using Undo.
- Selection/Group Selection: Creates a new node group and adds the selected nodes to the group.
- Selection/Remove Selected Groups: Removes all selected node groups.
- Selection/Open/Close Selected Groups: Toggles the expansion state of all selected node groups.
- Selection/Select successors of selection: Selects all successors of the currently selected nodes.
- Selection/Select ancestors of selection: Selects all ancestors of the currently selected nodes.
- Selection/Invert selection: Selects all unselected nodes and unselects all selected nodes.
- Selection/Expand selection down: Selects the direct children of all selected nodes.
- Selection/Expand selection up: Selects the direct parents of all selected nodes.
- Selection/Expand selection: Selects the direct children and parents of all selected nodes.
- Selection/Shrink selection up: Unselects all selected nodes without incoming edges from selected nodes.
- Selection/Shrink selection down: Unselects all selected nodes without outgoing edges to selected nodes.
- Selection/Shrink selection: Unselects all selected nodes without incoming edges from selected nodes or outgoing edges to selected nodes.
- Selection/Select by Criteria: Shows a dialog where you can select nodes using more complicated criteria.

The next menu is the Search menu. In this menu the Search settings can be configured that are used by the Search field in the tool bar.

- Search/Visible Only Search: If enabled only visible nodes are considered during a search.
- Search/Selected Only Search: If enabled only selected nodes are considered during a search.
- Search/Case Sensitive Search: If enabled the search is performed case-sensitively.
- Search/Regular Expression Search: If enabled the search interprets the search string as a regular expression. The regular expression syntax used in the search field is equivalent to the Java regular expression syntax.

The next menu is the Plugins menu. You can use this menu to open a scripting dialog which you can use to manipulate the active graph. Furthermore, many plugins that work on views extend this menu to make their functionality accessible.

- Plugins/New Scripting Window: Opens a new scripting dialog that can be used to work with the current graph
- Plugins/Log Window: Opens the plugin log console window.

The last menu is the Window menu.

- Window/Standard Perspective: Switches the graph window into the standard perspective.
- Window/Debug Perspective: Switches the graph window into the debug perspective.
- Window/Show Available Hotkeys: Shows a dialog that lists the available hotkeys.
- Window/Context help: Enables context-sensitive help for the graph window.

#### The tool bar

Like the main menu, the tool bar is another way to quickly access many useful graph operations.

The following buttons are part of the tool bar:

- Zoom In: Zooms into the graph.
- Zoom Out: Zooms out of the graph.
- Zoom Selected: Zooms to make all selected nodes visible.
- Fit to Screen: Zooms to make the whole graph visible.
- Toggle Magnifying Mode: Switches magnifying mode on/off. In magnifying mode you can use a magnifying glass to zoom into the graph.
- Toggle Freeze Mode: Switches freeze mode on/off. If freeze mode is enabled, changes in the node selection do not trigger proximity browsing updates.
- Circular Layout: Layouts the graph in circular mode.
- Orthogonal Layout: Layouts the graph in orthogonal mode.
- Hierarchic Layout: Layouts the graph in hierarchic mode.
- Select successors of selection: Equivalent to the menu Selection/Select successors of selection
- Select ancestors of selection: Equivalent to the menu Selection/Select ancestors of selection
- Invert selection: Equivalent to the menu Selection/Invert selection
- Select by Criteria: Equivalent to the menu Selection/Select by Criteria
- Delete Selected Nodes: Equivalent to the menu Graph/Delete Selected Nodes
- Delete Selected Nodes (Keep Edges): Deletes the selected nodes of the graph and connects the parents of the deleted nodes with the children of the deleted nodes.
- Change the color of selected nodes: Shows a dialog where you can change the background color of the currently selected nodes.

In addition to the buttons, the tool bar provides an address field and a search field. You can use the address field to jump to the node that contains a given address. You can use the search field to search through the graph. The exact behavior of the search can be configured through the Search menu.

To search for a search string, you can enter a string in the search field and hit Enter. The first time you hit Enter, all occurrences of the search string in the graph are highlighted. Consecutive hits of the Enter key show the individual hits. To go back to an earlier hit, you can use CTRL-Enter. A click on the Results button shows a list of all search results.

#### The Graph View

The Graph View is the central part of the graph window. This is the part where you can view and work with disassembled code. Using the left mouse button you can select one or more graph nodes. Using the right mouse button you can navigate through the graph by dragging the graph view. Depending on the current settings (see the section about Graph Settings) it is also possible to zoom or scroll the graph window with the mouse wheel.

Each graph contains up to four different types of nodes. Disassembled code is shown in so called code nodes, whole functions are represented by so called function nodes, large comments can be put in comment nodes, and proximity browsing nodes you navigate while proximity browsing mode is active. All four types of nodes behave slightly differently and offer different options when you right-click on them to bring up a context menu.

The context menu of code nodes offers the following functions:

- Edit Comments: Shows a dialog where you can edit the node and instruction comments of the code node.
- Create Comment Node: Creates a comment node that is attached to the code node. You can store larger comments in comment nodes.
- Selection/Select predecessors: Selects all predecessors of the node.
- Selection/Select successors: Selects all successors of the node.
- Selection/Select nodes from the same function: Selects all nodes that belong to the same function as the clicked node
- Open Subfunction: Opens a function in a new graph window. This option is offered for each function that is called from the code in the code node.
- Inline Subfunction: Replaces a function call in the code with the code from the called function. This option is offered for each function that is called from the code in the code node.
- Unline Subfunction: Undos are previously performed inlining operation. This operation is only available if you are clicking on an inlined node.
- Tag Node: Tags the node with the tag that is currently selected in the tag tree.
- Tag selected Nodes: Tags all selected nodes with the tag that is currently selected in the tag tree.
- Clipboard/Copy address to clipboard: Copies the address of the clicked line to the clipboard.
- Clipboard/Copy line to clipboard: Copies the clicked code line to the clipboard.
- Clipboard/Copy node to clipboard: Copies all the lines from the code node to the clipboard.
- Instruction/Toggle Breakpoint: Sets or removes a breakpoint from the clicked line.
- Instruction/Toggle Breakpoint Status: Enables or disables a breakpoint from the clicked line.
- Instruction/Add Bookmark: Adds a code bookmark to the instruction.
- Instruction/Operands: Contains various operations for working with instruction operands. You can use this menu to track the effects of registers for example.
- Instruction/Advanced/Delete Instruction: Removes the instruction from the node.
- Instruction/Advanced/Split node after instruction: Splits the node into two nodes.
- Instruction/Advanced/Show REIL code: Shows the REIL code of the node.

Depending on what parts of the code node you click on, additional menus become available.

If you click on a numeric literal operand you can choose whether this numerical value is shown as a decimal value, a hexadecimal value, or an ASCII character value. If you click on a local variable, a global variable, or a function you can change their names.

Since function nodes represent whole functions their context menus necessarily look quite different.

The context menu of function nodes offers nearly the same options as the context menu of code nodes.

- Edit Comments: Shows a dialog where you can edit the node and function comments of the function.
- Create Comment Node: Creates a comment node that is attached to the function node. You can store larger comments in comment nodes.
- Selection/Select predecessors: Selects all predecessors of the node.
- Selection/Select successors: Selects all successors of the node.
- Open Function: Opens the function represented by the function node in a new graph window.
- Inline Subfunction: Replaces the function node by the code nodes that form the function.
- Tag Node: Tags the node with the tag that is currently selected in the tag tree.
- Tag Selected Nodes: Tags all selected nodes with the tag that is currently selected in the tag tree.
- Clipboard/Copy line to clipboard: Copies the clicked line to the clipboard.
- Clipboard/Copy node to clipboard: Copies all the lines from the function node to the clipboard.
- Function/Toggle Breakpoint: Sets or removes a breakpoint from the beginning of the function.
- Function/Toggle Breakpoint Status: Enables or disables a breakpoint at the beginning of the function.

You can use group nodes to group arbitrary sets of nodes into a single group. Since it is possible to collapse group nodes, you can replace the appearance of the nodes inside the group by a single group node that is shown in the graph. This is useful when you are doing a bottom-up style of reverse engineering where you discover more and more abstract information along the way.

The context menu of group nodes offers the following options:

- Edit Group Comment: Edits the text that is shown when a group node is collapsed.
- Collapse Group: Collapses expanded group nodes.
- Expand Group: Expands collapsed group nodes.
- Remove Group: Removes the group node from the graph.

Comment nodes can only be deleted or have their text changed. This is reflected in the context menu that is shown when you right-click on a comment node.

Edges that connect the nodes of a graph play another important role in the graph view. Like nodes they support left-clicks and right-clicks too. When you left-click on a node, the screen is zoomed to the target of the edge. This makes it easy to quickly follow control flow paths in the graph.

When you right-click on an edge, a context menu is shown that offers the following options:

- Zoom to Source and Destination Node: Zooms the graph to make the source and destination nodes of the edge visible.
- Zoom to Source Node: Zooms the graph to make the source node of the edge visible.
- Zoom to Destination Node: Zooms the graph to make the destination node of the edge visible.
- Delete Edge: Deletes the edge from the graph.
- Edit Edge Comments: Shows a dialog where the comment text shown on the edge can be changed.

The last of the graph nodes is the circular proximity browsing node. If proximity browsing mode is active and some graph nodes are hidden, proximity browsing nodes are attached to the visible graph nodes that give information about the number of hidden graph nodes.

In the screenshot above two proximity browsing nodes are visible. You can see from the numbers 3 and 20 that the function CreateProcessInternalA has 20 outgoing edges and 3 incoming edges connected to nodes that are currently hidden.

Right-clicking on a proximity browsing node brings up a context menu with the following options:

- Unhide Nodes: Shows the hidden nodes.
- Unhide All Parents: Shows all invisible predecessor nodes of the node.
- Unhide All Children: Shows all invisible successor nodes of the node.
- Unhide and select only: Shows and selects the hidden nodes.
- Unhide and add to selection: Shows the hidden nodes and adds them to the current selection.

### The GUI elements of the Standard Perspective

#### The Graph Overview

The Graph Overview is a small graph view in the upper left corner of the graph window. This overview displays a minimal version of the graph and highlights the part of the graph that is currently visible in the graph view. You can navigate through the graph by clicking on the graph overview, by dragging the mouse in the graph overview, or by using the arrow keys if the graph overview has the input focus. You can also change the visible section of the graph using the graph overview. To do so, you click on and drag the small black square in the lower right corner of the rectangle that represents the visible part of the graph.

#### The Graph Nodes List

The Graph Nodes List is another way to quickly navigate through the graph. This list is a small table on the left side of the graph window that lists information about each node of the graph.

Four different pieces of information are given about each node. The first column of the table contains the number of edges ending at the node while the second column contains the number of edges starting at the node. The third column contains a small description of the node which varies depending on the type of the node. The fourth column shows the background color of the node.

Several different navigation options are available in the table. A single left-click on a row of the table changes the selection state of the corresponding node. A selected node is deselected while an unselected node is selected. A single right-click on the table centers the corresponding node on the screen while a double right-click centers the node and zooms into the graph to maximize the node.

The rows of the Graph Nodes List can have different text colors. If a row is printed in black color, the corresponding node is visible. If a row is printed in red color, the node is visible and selected. If a row is printed in gray color, the node is currently hidden by the proximity browsing mode.

#### The Selection History

In the lower left part of the graph window you can find the Selection History panel that contains a list of previous node selection states. Every time the selection state of a node changes, a snapshot of the selection state is made and put into the list. You can use this list to return to earlier selection states.

The elements of the Selection History list are either so called selection groups or simple selections. A simple selection is a selection state where just one node is selected. A selection group is a selection state where more than one node of the graph is selected. In either case it is possible to return to the whole selection state (by clicking on the Selection Group or Selection node) or to change the selection state of a single graph node (by clicking on the corresponding tree node).

Like the entries in the Graph Nodes list, the nodes of the Selection History tree change color depending on the selection state and the visibility state of the corresponding nodes. The colors used in both controls are the same with one difference. Since groups of the Selection History tree can be partly selected and partly invisible a light red color is used to denote selection groups with this state.

#### The Tagging Panel

The Tagging Panel on the right side of the graph window is used to create new node tags and to assign the tags to nodes of the graph.

A right-click on the tagging panel brings up a context-menu that can be used to create a new Root Tag (like the tag Analyzed in the screenshot). Subsequent right-clicks on existing tags brings up a more advanced context menu with the following options.

- Add Tag to Selected Nodes: Assigns the tag to all currently selected nodes.
- Remove Tag from Selected Nodes: Removes the tag from all currently selected nodes.
- Remove Tag from all Nodes: Removes the tag from all nodes.
- Append Tag: Appends a new child-tag to the tag.
- Inserts Tag: Inserts a new child-tag between the tag and its existing child tags.
- Edit Tag Description: Shows a dialog where you can edit the name and the description of the tag.
- Delete Tag: Deletes the tag from the database.
- Delete Subtree: Deletes the tag and all of its children from the database.

For each existing tag, all nodes tagged with that tag are also shown in the Tagging tree. A right-click on the Tagged Nodes tree nodes brings up a context menu with the following options:

- Select Nodes: Selects all nodes which are part of this tag group.
- Select Visible Nodes: Selects all visible nodes which are part of this tag group.
- Select Subtree Nodes: Selects all nodes which are part of this tag group or of its children.
- Select Visible Subtree Nodes: Selects all visible nodes which are part of this tag group or of its children.
- Unselect Nodes: Deselects all nodes which are part of this tag group.
- Unselect Subtree Nodes: Deselects all nodes which are part of this tag group or of its children.

The meaning of the colors used in the tagging panel equal the ones from the selection history panel.

#### Calling Functions

The Calling Functions panel is the first panel shown at the bottom of the graph window in standard perspective. This panel shows a list of functions that call the functions of the active view. This means if there is a basic block that belongs to function X in the active view, all functions that calls function X are listed in the table.

Right-clicking on the table shows a popup menu that allows you to quickly open calling functions.

#### Register Tracking

The Register Tracking panel shows the results of a register tracking operation. You can track the usage of registers by right-clicking on an instruction and selecting the register you want to track through the Instructions / Operands menu. The Register Tracking algorithm then calculates and shows the registers that depend on the selected register.

The table that shows the results of the Register Tracking calculation contains the following columns:

- Status: Shows the effects of the instruction on the tracked register.
  - Start: The instruction where the tracking operation started.
  - Depends on tracked register: Uses the tracked register in some way.
  - Clears tracked register: The tracked register is overwritten by this instruction but some indirect effects of the tracked register are still active.
  - Clears some effects: Clears some indirect effects of the tracked register.
  - Clears all effects: The tracked register does not have any effects beyond this instruction.
- Address: The address of the instruction described in the row.
- Instruction: The instruction described in the row.
- Reads: Tracked registers used by the instruction.
- Writes: Tracked registers written by the instruction.
- Undefines: Previously tracked registers which are not tracked beyond the instruction.
- Defined: All tracked registers after the instruction.

Once Register Tracking calculated something, you can select rows of the results table to show the results directly in the main graph. By double-right-clicking on individual rows of the table, you can directly jump to individual instructions of the results table.

To clear all effects from the graph, you can click the left button of the Results toolbar. The right button creates a new graph from the register tracking results that only contains the instructions from the results table.

By default, subfunction calls always clear all tracked effects because the algorithm assumes that subfunction calls overwrite all registers. You can change this default behavior in the Settings tab of Register Tracking.

#### Special Instructions

You can highlight instructions that read from the memory, write to the memory, or call subfunctions in the graph. This makes it quick and easy to get an overview of the important instructions of a function.

To highlight special instructions you use the Special Instructions panel.

In the Options tab you can select what instructions you want to highlight in the graph and what color should be used to display them.

#### Code Bookmarks

Code bookmarks allow you to quickly navigate to known instructions in the graph. Setting a code bookmark is done through the Instruction / Add Bookmark context menu that appears when right-clicking on an instruction. Returning to a previously defined instruction is done by clicking on a row of the Code Bookmarks table.

### The GUI elements of the Debug Perspective

### Registers

When you are debugging a target process, its current register values are shown on the left-hand side of the graph window. Right above the registers values, the currently active debugger can be selected if more than one debugger is configured for the active view.

When you right-click on a register value a context menu with the following options appears:

- Copy value to the clipboard: Copies the register value to the clipboard.
- Goto offset: Shows the memory content at the location pointed to by the register value.
- Zoom to Instruction: Zooms to the instruction at the register value address. This menu is only available if there is an instruction with that address in the current view.
- Search View: Searches for views that contain the instruction at the register value address.

#### The Debugger Toolbar

The Debugger Toolbar provides many functions that are available for controlling execution of the the target process.

From left to right, the buttons of the debugger toolbar have the following meaning:

- Attach: Connects to the specified debug client.
- Detach: Detaches the debugger from the target process. The target process keeps running.
- Terminate: Terminates the target process.
- Step Into: Executes the next assembly instruction.
- Step Over: Executes the next assembly instruction but jumps over function calls.
- Step to next block: Executes all assembly instructions until the next basic block is reached.
- Step to end of function: Executes all assembly instructions until the end of the function is reached.
- Resume: Resumes the target process.
- Start Trace Mode: Starts trace mode.
- Stop Trace Mode: Stops trace mode.

#### Memory

The memory panel shows the target memory and the stack view of the active target process.

On the left-hand side you can select what memory region you want to look at. The selected memory region is then shown in the hex window on the lower left-hand side.

The Stack view is shown on the right-hand side of the panel. In this view you can take a look at the current content of the stack and the current location of the stack pointer (shown in red)

Please note that all BinNavi debuggers are remote debuggers that do not update the displayed memory and the displayed stack in real time. If you suspect that the memory content changed, you have to click on the Refresh button to reload the memory manually.

Both the memory view and the stack view provide context menus that pop on on right-clicks. These menus provide display options as well options for working with the content of the memory.

### Modules

The Modules panel provides an overview of the modules that are loaded into the address space of the target process. You can use this panel to find out about the names of loaded libraries as well as their locations and sizes inside the address space.

A context menu is available that allows you to quickly display a module in the memory view is available on right-click.

#### Threads

The Threads panel provides an overview of the active threads of the target process.

#### Breakpoints

The Breakpoints panel shows a list of all active breakpoints as well as their current state.

A context menu for enabling, disabling, and removing breakpoints is available on right-click.

### Traces

The Traces tab shows all previously recorded traces. The left table shows the individual trace runs. The center table shows the events of the currently selected trace run. The right table shows the individual register values and the acquired memory sections.

All three tables have context-menus that provide advanced options for processing the trace data.

### Bookmarks

The Bookmarks panel shows a list of all currently active memory bookmarks. Memory bookmarks can be used to quickly jump to an address in the memory view.

### History

The history panel shows a log of the recently received debugger events. You can use this panel to get an idea about what exactly is going on in the target process.

### Debugger Options

The Debugger Options panel is shown in the lower right corner of the graph window. It provides the following options:

- Show Relocated Offsets: Shows relocated offsets in the graph instead of non-relocated offsets.
- Show Options: Shows options available to the configured debugger.

For more information on using BinNavi to debug target processes, please see the section about debugging with BinNavi in this manual.

#### Hotkeys

Except for the hotkeys which are available through the menus and the toolbar buttons, the following hotkeys can be used in the graph window (a more comprehensive list of available hotkeys is available through the Help/Show Available Hotkeys menu of the graph window):

- Enable node content selection: Press the mouse-wheel or press ALT and left-click into a node to set a caret into the node. Using this caret and SHIFT and the arrow keys it is possible to select the content of the node. Pressing CTRL-C copies the selected content to the clipboard.
- Copy the content of all selected nodes: Press CTRL-C to copy the content of all selected nodes to the clipboard.
- Focus the search field: Press CTRL-F to set the input focus to the search field in the tool bar.
- Focus the address field: Press CTRL-G to set the input focus to the address field in the tool bar.
- Select all visible nodes: CTRL-A selects all visible nodes of the graph
- Navigate through the graph tabs: Use CTRL-PAGEUP and CTRL-PAGEDOWN to navigate through the open graph tabs of a graph window.
- Grey out instructions: Hold CTRL-SHIFT and right-click on an assembly code line to grey out the line.
- Highlight instructions: Hold CTRL-ALT and right-click on an assembly code line to highlight the line.
- Set a breakpoint: Hold SHIFT (or CTRL) and right-click on an assembly code line to set a breakpoint on the line or to remove a breakpoint from the line.
- Toggle between zooming and scrolling: Hold CTRL and use the mouse-wheel to switch between zoom mode and scroll mode (the default behavior of the mouse wheel can be configured in the settings dialog).
- Scroll sideways: When scrolling with the mouse-wheel hold ALT to switch between top-down scrolling to right-left scrolling.
- Change the size of the magnifying glass: When magnifying mode is active, hold CTRL and use the mouse-wheel to change the size of the magnifying glass.