Documenting reversed application

Question

I've been reversing a regularly updated application with various tools (mosty IDA, Olly) for a while now, and I always wondered how to document my findings. For example function names, static variables, relations, namespaces, fields, etc...maybe even changes trough version changes, but that's just an extra.

The best thing I came up with is a local MediaWiki, where I create a new page/definition for every function, and stuff, but it's obviously pain in the ass, nearly impossible to maintain. There must be some industry standard right? I wonder if you guys know / use any tool like for this issue.

Edit: Here is the structure I'm using now with in the Wiki : MediaWiki Documentation structure

If you know another solution, I'm looking forward for your answer as well :)

This is virtually the same list of options as for reversing a file format. There are local Wikis as well, also text-based (without any) need for a running DB. IDA itself has a "Notes" view if you need it. — 0xC0000022L, Nov 21 '13 at 14:15
possible duplicate of How do you store your data about a binary while performing analysis? — perror, Nov 21 '13 at 14:51
@perror definitely very close. I won't vote because it will kill the question immediately. It seems this question is more directed towards actually producing some sort of "API" documentation though? — Peter Andersson, Nov 21 '13 at 15:02
Yes, I might remove my vote because I am interested in answers about this topic anyway... Let see what happen. — perror, Nov 21 '13 at 18:22
I don't think that this is a duplicate - the one perror pointed out is more about "How do I store data from reversing?" and this post addresses two questions - "When you reverse something, what data do you find it important to record, and how do you record it?" — dingo_kinznerhook, Nov 25 '13 at 15:10

score 4 · Accepted Answer · edited Dec 25 '18 at 22:45

4

The way this usually works in my experience is that if you have a documentation need outside of the IDB database it's generally because you're trying to share information with other reverse engineers. For this, you may want to take a look at collabREate or the IDA toolbag. The unfortunate truth is that a lot of these projects tend to slow down or die completely due to a lack of interest from the original authors.

Now if your problem is completely centered around documentation, what I also find fairly common is to have header files with the function, class and structure definitions in them with doxygen- or JavaDoc-formatted comments in them. You then use doxygen to generate automatic documentation and class diagrams. This way the documentation becomes completely living, self-maintaining and easily navigated.

edited Dec 25 '18 at 22:45

albert

103
2

answered Nov 21 '13 at 14:56

Peter Andersson

5,701
1
32
49

perhaps you should answer that in the original question (or as well there). – 0xC0000022L Nov 21 '13 at 15:02
@0xC0000022L if this is closed I'll add the answer to perror's question. – Peter Andersson Nov 21 '13 at 15:03
Thank you for your answer! I'll wait a little bit more before closing it. – Dominik Antal Nov 22 '13 at 12:32
@Casual I think the unfortunate or sad truth is that there is no really awesome answer to this question. These sorts of projects pop up, gets abandoned, often due to lack of funding, and never reach the maturity to be the one go to solution. – Peter Andersson Nov 25 '13 at 18:06
@PeterAndersson Yeah, I can hardly find anything on the internetz about this. Thank you for your help anyway! – Dominik Antal Nov 25 '13 at 21:15

Documenting reversed application

1 Answers1