break-core

Preface

VisualSource is an encoded and compressed source code format which takes information of a script and turns it into condensed executable information.

This documentation documents how VisualSource 3.0 works in detail.

VisualSource V4 Changes

The encryption and data format is pretty much the same. However, the version was bumped to 0000000000000004 and a change was made to add extra data for blocks attached as an else block. It's stored in a new Property that comes after ChildBlocks called ElseChildBlock. What is stored is average block data (see Block data structure for information on that) and if one is not stored, the value stored is nil.

Data concepts

VisualSource uses 3 different data concepts within it's code:

break-core

Ghidra BSim Basics Tutorial

This is a basic tutorial for using BSim in Ghidra. The main thing it will go over is how to compare matches of functions across binaries and how to navigate the BSim interface.

BEFORE CONTINUING

Your Ghidra version MUST be on 11 or higher to use BSim features.

Enabling BSim

To enable BSim, go into CodeBrowser. Then, click the File tab, then click the Configure button. Then, click the checkbox on the BSim tool. This enables the BSim tab in CodeBrowser.

Creating a BSim Database