<tutorial>
  <name>Working with Projects</name>
  <description>Most of the time when you use BinNavi you will probably work with
    single modules. However, single modules are not enough to analyze how
    different modules interact with each other. To analyze complex processes
    built from more than one module you need to use BinNavi projects. The
    concept of projects allows you to combine different modules to address
    spaces and different address spaces to projects.&lt;br/&gt; &lt;br/&gt;
In this tutorial you will learn about the following concepts:&lt;br/&gt;
&lt;ul&gt;
&lt;li&gt;Setting up Projects&lt;/li&gt;
&lt;li&gt;Configuring Projects&lt;/li&gt;
&lt;li&gt;Forwarding Functions&lt;/li&gt;
&lt;li&gt;Saving Project Views&lt;/li&gt;
&lt;/ul&gt;
</description>
  <steps>
    <step>
      <action>0</action>
      <description>This tutorial shows you how to create projects and address
        spaces and how to fill address spaces with modules that can then be
        analyzed together.&lt;br/&gt; &lt;br/&gt;
Please click on the Next button to continue.
</description>
    </step>
    <step>
      <action>0</action>
      <allowed>-2369159756337681560</allowed>
      <allowed>-9044865055464757942</allowed>
      <allowed>8784926684855833953</allowed>
      <allowed>-7789885643476931774</allowed>
      <allowed>-8750454886776173497</allowed>
      <allowed>-5178343179269965998</allowed>
      <allowed>2804136480786366059</allowed>
      <description>This tutorial requires you to have a configured database and
        you need to have a module created from the primes.exe sample file from
        the tutorials directory of your BinNavi installation. The module created
        from primes.exe will be used throughout the tutorial and you need to
        work with this module if you want to understand all aspects of this
        tutorial.&lt;br/&gt; &lt;br/&gt;
If you do not have a database with the primes.exe module imported please create
the database and/or import primes.exe now. If you are ready to work with the
primes.exe module please click on the next Next button to continue.
</description>
    </step>
    <step>
      <action>0</action>
      <allowed>-2369159756337681560</allowed>
      <allowed>-9044865055464757942</allowed>
      <allowed>8784926684855833953</allowed>
      <allowed>-7789885643476931774</allowed>
      <allowed>-8750454886776173497</allowed>
      <allowed>-5178343179269965998</allowed>
      <allowed>2804136480786366059</allowed>
      <description>In addition to primes.exe this tutorial requires you to have
        a second module. Please disassemble your kernel32.dll from your Windows
        directory, import the data from IDA Pro, and load the BinNavi
        module.&lt;br/&gt; &lt;br/&gt;
When you have loaded kernel32.dll please click on the Next button to continue.
</description>
    </step>
    <step>
      <action>391525432360144407</action>
      <description>To create a new project please right-click on the Projects
        folder in the Project tree and click on the menu Create Project.
      </description>
    </step>
    <step>
      <action>0</action>
      <description>By default each project contains one address space. An
        address space in BinNavi is equivalent to an address space in a target
        process and you can place your main module as well as all the linked
        library the target process uses into the address space. When you have
        done this you can treat the content of the address space just like one
        large module. That allows you to do static and dynamic cross-module
        analysis.&lt;br/&gt; &lt;br/&gt;
Please add the modules primes.exe and kernel32.dll to the default address space
of the module you created now. You can do this by drag &amp; dropping the
modules either from the Project Tree or from any of the tables where the modules
are listed onto the Project Tree node of the address space.&lt;br/&gt;
&lt;br/&gt;
When you have added all modules you want to add please click the Next button to
continue.  </description>
    </step>
    <step>
      <action>0</action>
      <allowed>8225196392842501265</allowed>
      <allowed>4074453405645283084</allowed>
      <description>One of the big advantages of using projects is that you can
        forward imported functions of one module to real functions of another
        module (mostly dynamically loaded libraries). This forwarding makes it
        possible to treat imported functions completely transparently meaning
        that whenever an imported function is analyzed, the real function of the
        library is used instead.&lt;br/&gt; &lt;br/&gt;
Let's forward the imported functions of primes.exe to kernel32.dll
now.&lt;br/&gt; &lt;br/&gt;
If you have disassembled kernel32.dll without debug symbols you can do batch
forwarding. To do so you need to right-click on the module node of primes.exe
and click on the menu Resolve Imported Functions. In the dialog that appears you
select the imported library and to which BinNavi module the imported functions
should be forwarded.&lt;br/&gt; &lt;br/&gt;
If you have disassembled kernel32.dll with debug symbols you can not do batch
forwarding because the names of the functions inside kernel32.dll are mangled.
This means that a function like Sleep is called _Sleep@4 due to additional
information from the debug symbols. In this case you need to right-click on a
function name to forward a function. This needs to be repeated for every
function.&lt;br/&gt; &lt;br/&gt;
Please forward the imported kernel32.dll functions of primes.exe to the BinNavi
module kernel32.dll now. If you only want to forward a single function please
forward IsDebuggerPresent.  </description>
    </step>
    <step>
      <action>-7167187997929184030</action>
      <action>-5295816457628962096</action>
      <allowed>8225196392842501265</allowed>
      <allowed>4074453405645283084</allowed>
      <description>To see one of the effects of this function forwarding please
        open the function ___report_gsfailure of primes.exe.</description>
    </step>
    <step>
      <action>12562710513373420</action>
      <description>The function ___report_gsfailure issues several function
        calls to kernel32.dll functions, most importantly IsDebuggerPresent (see
        address 0x410E27). Right-click on the first basic block of the function
        and select the menu Inline Subfunction /
        IsDebuggerPresent.</description> </step>
    <step>
      <action>5182263060599434690</action>
      <allowed>12562710513373420</allowed>
      <description>The code of the kernel32.dll function IsDebuggerPresent is
        now visible in the current view. For purposes of analysis, there is now
        no functional difference between the code of the imported function
        IsDebuggerPresent and the code of the normal function
        ___report_gsfailure anymore. Code from both functions can be treated
        uniformly during analysis.&lt;br/&gt; &lt;br/&gt;
It is also possible to save the new view. Please do save the view now using the
View / Save View As menu.  </description>
    </step>
    <step>
      <action>0</action>
      <description>The new view was saved and can now be found under the Project
        Views node in the Project Tree.&lt;br/&gt; &lt;br/&gt;
You have now learned the most important aspects about working with projects. You
know how to create and configure projects and you know that imported functions
can be forwarded to dynamic library modules.&lt;br/&gt; &lt;br/&gt;
Please click the Next button to finish this tutorial.
</description>
    </step>
  </steps>
</tutorial>
