<tutorial>
  <name>Working with Graphs - I</name>
  <description>Once you have successfully imported data from IDA Pro or another
    external data source and you created the BinNavi module you want to work
    with, you can begin to analyze the disassembled data yourself. This tutorial
    introduces you to the basic concepts of working with disassembled data in
    BinNavi.&lt;br/&gt; &lt;br/&gt;
In this tutorial you will learn about the following concepts:&lt;br/&gt;
&lt;ul&gt;
&lt;li&gt;Opening windows for analyzing code&lt;/li&gt;
&lt;li&gt;The general layout of the graph window&lt;/li&gt;
&lt;li&gt;Navigating through disassembled code&lt;/li&gt;
&lt;li&gt;Adding comments to nodes and instructions&lt;/li&gt;
&lt;li&gt;Saving changes&lt;/li&gt;
&lt;/ul&gt;
</description>
  <steps>
    <step>
      <action>0</action>
      <description>This tutorial shows you how disassembled data is presented in
        BinNavi and what the most important concepts for working with
        disassembled data are. Among other things you will learn how to navigate
        through disassembled code, how you can annotate the code with comments,
        and how you can save your changes so that you can use them again at a
        later point in time.&lt;br/&gt; &lt;br/&gt;
Please click on the Next button to continue.
</description>
    </step>
    <step>
      <action>0</action>
      <allowed>-2369159756337681560</allowed>
      <allowed>-9044865055464757942</allowed>
      <allowed>8784926684855833953</allowed>
      <allowed>-7789885643476931774</allowed>
      <allowed>-8750454886776173497</allowed>
      <allowed>-5178343179269965998</allowed>
      <allowed>2804136480786366059</allowed>
      <description>This tutorial requires you to have a configured database and
        you need to have a module created from the primes.exe sample file from
        the tutorials directory of your BinNavi installation. The module created
        from primes.exe will be used throughout the tutorial and you need to
        work with this module if you want to understand all aspects of this
        tutorial.&lt;br/&gt; &lt;br/&gt;
If you do not have a database with the primes.exe module imported please create
the database and/or import primes.exe now. If you are ready to work with the
primes.exe module please click on the next Next button to continue.
</description>
    </step>
    <step>
      <action>-7167187997929184030</action>
      <action>-5295816457628962096</action>
      <description>The default way of working with disassembled code in BinNavi
        is to open a new window that contains the code of the function you want
        to work with. To do so you can simply double-click on the table that
        shows what functions are available in a module and the function
        represented by the line you double-clicked on is opened. Make sure not
        to double-click the Name and Description columns though. These columns
        are editable and double-clicking on those columns allows you to modify
        their current values.&lt;br/&gt; &lt;br/&gt;
Please open the function _main (address 0x401240) of the primes.exe module now.
To do so simply select the module node of primes.exe in the Project Tree and
double-click the row of the _main function in the functions table. To find the
function _main quickly you might want to use the table filter. Alternatively you
can right-click on the row of the function and select the Open in New Window
menu.  </description>
    </step>
    <step>
      <action>0</action>
      <allowed>-7167187997929184030</allowed>
      <allowed>-5295816457628962096</allowed>
      <description>If the load operation is successful, a new window that shows
        the code of the _main function is opened. This so called graph window
        contains the following core parts: &lt;ul&gt;
&lt;li&gt;The code is shown as a graph in the center of the window&lt;/li&gt;
&lt;li&gt;A small overview of the graph in the upper left corner&lt;/li&gt;
&lt;li&gt;A list of all nodes of the graph on the left-hand side&lt;/li&gt;
&lt;li&gt;A tree that allows the user to go back and forth between different
graph states in the lower left corner&lt;/li&gt; &lt;li&gt;Various tabs that
provide specific graph operations at the bottom of the window&lt;/li&gt;
&lt;li&gt;Information about the available node tags on the right side of the
window&lt;/li&gt; &lt;/ul&gt;
Additionaly there is the main menu and the toolbar of the graph window which
gives you access to many different ways to work with the graph. Many of the
options available there are explained in this tutorial and the other tutorials
about working with graphs.&lt;br/&gt; &lt;br/&gt;
Please click on the Next button to continue with this tutorial.
</description>
    </step>
    <step>
      <action>0</action>
      <description>Even though the graph of the _main function is rather small,
        it is still useful to know about the basic options you have for
        navigating through the graph. Most of the time you will simply use your
        mouse to scroll (drag the graph window using the right mouse button) and
        zoom (use your mouse wheel) through the graph. There are two other
        options you should be familiar with though. Using the toolbar of the
        graph window it is possible to jump to addresses and to search through
        graphs.&lt;br/&gt; &lt;br/&gt;
Let's begin with jumping to an address. If you know the address of an
instruction you want to jump to, you can use the Address field in the toolbar on
top of the graph window (hotkey CTRL-G). In this field you can enter the address
of the instruction you want to jump to.&lt;br/&gt; &lt;br/&gt;
To see how the input field works please enter the address 4012D6 and hit Enter.
The graph is then zoomed in such a way that the instruction at offset 4012D6 is
shown in the center of the graph window. If you enter an address which is not
part of the active graph, the input field changes its color to red to signal
that it can not process your request.&lt;br/&gt; &lt;br/&gt;
If you are done playing around with the Address field please hit the Next button
to continue this tutorial.  </description>
    </step>
    <step>
      <action>0</action>
      <allowed>-1618510363590582162</allowed>
      <description>The second major way to navigate through graphs is searching
        for string data. You can search through the open graph by entering the
        phrase you want to search for in the Search input field in the toolbar
        of the graph window. If you hit Enter afterwards, all search results are
        highlighted in the graph.&lt;br/&gt; &lt;br/&gt;
Try to search for the prase "eax" now. This search highlights all occurences of
the register "eax" in the function _main. Repeatedly pressing Enter or
CTRL-Enter allows you to jump forth and back through the search
results.&lt;br/&gt; &lt;br/&gt;
You can also search for more complex phrases. There is a number of search
options you can configure through the Search menu of the main menu. Turn on the
option "Regular Expression Search" for example and search for the phrase
"mov.*eax". This search highlights all "mov" instructions that use the register
eax.&lt;br/&gt; &lt;br/&gt;
When you are done playing around with the search feature please click on the
Next button to continue.  </description>
    </step>
    <step>
      <action>0</action>
      <allowed>-1618510363590582162</allowed>
      <description>Simply viewing disassembled code is often not enough.
        Whenever you are analyzing more complex code you want to add your own
        comments to basic blocks and instructions. In BinNavi there are two
        different comment types, global comments and local comments. The
        difference between these types is simple. Local comments are saved only
        for the graph in which they are set. Global comments are saved for all
        elements of the module that have the same type and the same address as
        the element for which the global comment was saved. This means that if
        you set the global instruction comment of the instruction at address
        401030 this instruction comment shows up whenever the instruction at
        address 401030 is shown, regardless of what graph the instruction
        belongs to. On the other hand, the local instruction comment of the same
        instruction is only shown in the graph where it was set.&lt;br/&gt;
        &lt;br/&gt;
The quickest way to access the dialog where you can change the instruction of
nodes and instructions is to hold the ALT key and right-click on the instruction
whose comments you want to change. This opens the node comments dialog and you
can directly start typing the new local instruction comment of the instruction
you clicked on.&lt;br/&gt; &lt;br/&gt;
In the graph of function _main you can see that there is a conditional branch at
the end of the first basic block. The red branch (taken if the branch condition
is false) leads to a code path that sets an error code (1) and exits the
program. Apparently the jump at address is 0x40127E is very important for the
control flow of the function. You should put a comment there so that you
remember to find out when this jump is taken and when it is not
taken.&lt;br/&gt; &lt;br/&gt;
To set the comment please hold the ALT key and right-click on instruction
0x40127E. In the dialog that appears now you can enter a comment like "TODO:
Find out when this jump is taken".&lt;br/&gt; &lt;br/&gt;
When you are done playing with comments please click on the Next button to
continue.  </description>
    </step>
    <step>
      <action>5182263060599434690</action>
      <description>Local changes to the graph are not automatically saved to the
        database. You need to save them yourself using the menu View / Save View
        or View / Save View As. The function _main is a so called native view.
        Views of this type can not be modified so only the Save View As menu is
        available.&lt;br/&gt; &lt;br/&gt;
The Save View As menu creates a copy of the function _main that includes all
your local changes.&lt;br/&gt; &lt;br/&gt;
Please use the menu Save View As now to create a modified copy of the function
_main.  </description>
    </step>
    <step>
      <action>0</action>
      <description>Congratulations. You have saved your first view. Now you are
        no longer working with the native view _main but with the non-native
        copy you just created. From this point on the Save View menu is
        available in addition to the Save View As menu. Furthermore the view you
        created is now available from the main window if you want to return to
        it later. You can find the new view when you click on the Module Views
        node which you can find in the primes.exe module in the Project
        Tree.&lt;br/&gt; &lt;br/&gt;
Please click on the Next button to continue this tutorial.
</description>
    </step>
    <step>
      <action>0</action>
      <description>This is the end of this tutorial. You are now familiar with
        the most basic concepts of working with disassembled code. You know how
        to open graphs, how to annotate disassembled code with your own
        comments, and how to save your changes. If you want to know more about
        working with graphs please check out the more advanced tutorials or the
        manual.&lt;br/&gt; &lt;br/&gt;
Please click on the Next button to finish this tutorial.
</description>
    </step>
  </steps>
</tutorial>
