GView configuration file

GView is configured via GView.ini file (that should be located next to GView executable). If the file is missing, running a simple GView reset command from the CLI should restore it.

The following section should be seen in a GView.ini file:

  • [GView] - a section with the general configuration for GView (cache size, update checks, etc). The Update* keys are described in Updates.

  • [AppCUI] - a section with the general configuration for AppCUI framework (color, frontend, keyboard profile Keyboard.Ctrl / Keyboard.Alt, etc)

  • [Keys.<xxx>] - the keyboard shortcuts changed by the user from the Keyboard shortcuts window (see Keyboard shortcuts)

  • [Type.<XXX>] - various sections that describe characteristics of each supported type in GView

  • [View.<xxx>] - various section for each smart view

  • [SmartAssistants] - the API keys and the settings of the smart assistants (see Smart assistants below)

Temporary folder

Some operations need a real file on disk: the WinTrust verification of a PE extracted from a container, or a ZIP archive nested in another one that is larger than the cache. GView then writes a copy of that object to a private folder GView-<random>, created on first use, that only the current user can access. Each copy is deleted as soon as it is no longer needed and the folder is deleted when GView exits. Copies are named <n>-<object name>, using only [A-Za-z0-9._-] characters; names taken from archive entries are never used as paths.

The folder is created in the system temporary directory, or in the folder set by Config.TemporaryFolder in the [GView] section. Because these copies are often malware, pointing this setting to a folder excluded from the antivirus avoids copies being quarantined while they are in use. If the configured folder does not exist, nothing is written anywhere else: the operation is skipped (WinTrust) or fails (archives that do not fit in the cache).

[GView]
Config.TemporaryFolder = D:\Analysis\GViewTemp

Learning and Evaluation Mode never writes memory-only task content (or anything extracted from it) to this folder, and nothing at all while the course policy restricts Export.

Smart assistants

The [SmartAssistants] section configures the LLM assistants shown in the Smart Assistants panel:

  • <AssistantName> = <API key> - the API key of an assistant, using its name as the key (GeminiPro1.5, GPT4o). An assistant without a key (or with an empty one) is shown as not configured and can not be used.

  • PromptRetries - how many times some queries (for example the function name suggestions of the disassembly view) are sent to the assistant to collect more answers (default 1).

  • ContextCharacterLimit - the maximum size, in characters, of the file context (the information the type plugin extracts from the file, serialized as JSON) that is sent with each prompt. It applies to every assistant. The fields most relevant to the prompt are added first; a field that does not fit is skipped and smaller fields can still be added. The default is 65536 (64K characters, roughly 16K tokens: well inside the context window of the built-in models, while keeping each request small and fast). Values are clamped to 1024 - 1048576 (1K - 1M).

[SmartAssistants]
GeminiPro1.5 = <your Gemini API key>
GPT4o = <your OpenAI API key>
PromptRetries = 1
ContextCharacterLimit = 131072

Types

A [Type.xxx] section usually contains the following:

  • a Description field that explains the type of the plugin

  • a Extension field that can be a simple string or a list of strings containing the list of extensions associated with this field.

    Extension = exe

    or

    Extension = ["h","hpp","cpp","c"]

  • a Pattern field that provides some rules that if match the entire plugin is loaded in memory and checked against the content. This ensures quick validation of the content so that not all plugins are loaded in memory. A pattern is a string with the following format: rule:parameters, where rule can be one of the following:

Rule

Type

Usage

Example

magic

Binary Files

Identifies a binary magic from the start of the file. A magic must be followed by a list of hex values separated with spaces

magic:FF 20 30

startswith

Text Files

Checks if a file starts with a specific text

startswith:#include

linestartswith

Text Files

Checks if one of the first 10 lines from a text file starts with a specific text

linestartswith:#define

Examples:

Pattern = "magic:4D 5A" ; identifies possible Windows binary files (that starts with a ``MZ``)

or

Pattern = ["startswith:ABC","linestartswith:test"] ; identifies a text file where either the first line starts with `ABC`
                                                   ; or there is a line within the first 10 lines that starts with `test`