Repository navigation
Conversation
Most of the CHB code uses the method defined in
CHB/bchlib/bCHPreFileIO.ml but the code in CHB/bchanalyze/bCHFileIO.ml
was using its own version.
The differences are:
- The standard puts the binary information in the header itself
whereas this one adds an application node under the header, and adds the
binary information there.
- The standard one includes chb-date and chb-version fields.
- The standard one calls the root node "codehawk-binary-analyzer"
whereas this one calls it "codehawk-binary-analysis".
As an example, the header for xml generated from within bCHFileIO.ml
used to be:
```
<codehawk-binary-analysis>
<header>
<application info="disassembly-status" name="binary.exe" time="2026-10-28 15:54:38"/>
</header>
...
</codehawk-binary-analysis>
```
And now it is:
```
<codehawk-binary-analyzer>
<header chb-date="2026-10-01" chb-version="0.6.0_20261001" info="disassembly-status" name="binary.exe" time="2026-10-28 19:48:18"/>
...
</codehawk-binary-analyzer>
```
sipma
approved these changes
Oct 30, 2026
sipma
left a comment
sipma
left a comment
Contributor
There was a problem hiding this comment.
Thank you! Always saving the disassembly metrics is a good idea.
The metrics are saved to s/<binary>_disassembly.xml. The change to CHB/bchanalyze/bCHFileIO.ml is needed, otherwise the metrics will always be overwritten by the ones from x86 (even if you're not analyzing x86). I went ahead and did this for all architectures. We decided not to gate this by -save_disassembly_status_in_xml since that is only used for X86/PE and the python side of things never passes this command line argument.
… disassembly stats
waskyo
force-pushed
the
always_save_disassembly_metrics
branch
from
November 2, 2026 15:07
21a6526 to
fe4e7fa
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before this change we would only save disassembly metrics when doing full
analysis, now we also save them when doing only disassembly. This allows us
to evaluate how problematic a binary may be without spending too much
effort.
Along the way discovered that the XML files generated in bCHFileIO.ml had
a slightly different structure from the rest. It's not clear why, the differences
seem to be cosmetic, so in the interest of parity I nuked the duplicated
get_bch_rootfrom that file. The first commit in the PR has more details.