Version Tracker datatype/prototype usage

[mumbel]

When using VT I have had a lot of success moving function names to the new images. I typically only name a handful through various scripts that either pull __FUNCTION__ or just known functions. I usually just use exact instruction match and exact function name and let that propagate. It gets quite a few names and gets better and better as I add more analysis. Really big fan of the tool.

One issue is it will sometimes, move function prototypes and types to the new image and I have no clue what decides that or not or why its only some of the time and not all of the time. I would say my usage is consistent, but maybe I'm doing something weird every once and a while.

This is really undesirable at times as it looks like it adds a bunch of .conflict types (if its already a defined struct shouldn't it just use the datatype there and not make a new one or am I seeing an oddity/bug w/ that?) other times its really bad like maybe a 64-image gets mixed in with 32-bit and now prototypes that returned int now all return longlong.

I'm not entirely opposed to the prototype moving, just not sure how to handle the longlong issue. And maybe would prefer opaque pointer structs instead of actually moving the struct. Though maybe the defined structure isn't an issue, just wondering if auto-analysis would make any "permanent"/"lasting" weird decisions based off of a field/pointer being in the wrong place

(this question is maybe meant for @ghidra1 it seems like you have maybe answered VT questions when they come up IIRC)

[astrelsky]

If you click the checkbox you can set the settings for how matches are applied. The other's appear to be the standard data type issues.

I have encountered issues where it randomly decides to stop applying the markup. When that occurs I just restart the tool.

[ghidra1]

I am not very knowledgeable on the Version Tracking feature. If @astrelsky answer above does not work out, @ghidra007 may be able to answer your question.

[ghidra007]

I agree with astrelsky that looking at the settings for how matches are applied is the first place to start to see if you can change the unwanted behavior. It may be the setting for applying function signatures which I believe is defaulted to applying if the number of params match. You may want to turn off applying of function signatures until you inspect the differences and only apply when it will give the desired result.

If that isn't the issue, please respond and we will try to think of other reasons this may be happening.