Program is a single object that encapsulates reverse engineering knowledge generated for a single component of a software target. Programs allow a target to be decomposed into a set of components, each oriented toward a single address space.This knowledge includes:
- symbol information
- instructions and their comments
- macros
- user defined data
- the underlying bytes (memory)
- program flow information
- a partitioning of program into a set of fragments
- hierarchical grouping of fragments into modules
2. A program is always loosely associated with one and only one language which is set when program is first created and cannot be changed. The association is loose in that it really consists of a name.
3. A program has one and only one address space determined at creation time (and thus one and only one type of address).
4. The fragments in a program always partition that program as a set of code units. In other words each code unit must be in one and only one fragment.
5. A Module can contain only other modules or fragments. Fragments and Modules can be contained in more than one module. A module cannot have duplicates in its children. If additional structure is desired for modules or fragments it must be applied externally by a tool. (ie: Routines).
6. A macro must consist of code units that are all contained in the same fragment. Macros do not need to satisfy any relationship with respect to basic blocks.
7. CodeUnits, Fragments, and Modules may have property, value pairs assigned to them by external plugins. These values may be set and changed by any plugin and persist until the underlying object is deleted.
8. Modules, fragments, and code units may only be deleted by the user.
In comparison basic blocks change, are created, and deleted as a side effect
of other operations.
Instruction Prototype: An Instruction Prototype is the encapsulation of all information for a single cpu instruction. Instruction prototypes are provided by language modules as the result of a parsing bytes. Instruction prototypes do not need an address to exist, but in order to be fully expressed or interpreted need an address and a memory to interpret on.
Data Prototype: A Data Prototype is the encapsulation of all
information for a single CPU data type. The set of available
data prototypes is provided by the Language Module. Data prototypes
are assigned to a particular location to define a Data object at that location.
Macro: A Macro is a substitution of one or more consecutive Code
Units.