# Symbols list

The symbol view is accessed using the `F5` shortcut and lists all symbols (imports, exports, internal functions and types) extracted by Malcat. Clicking on a symbol shows the references to this symbol, while double-clicking it navigates to the address of the symbol.

The symbols list in a nutshell

## Overview

In the symbols list, symbols are displayed in a tree (`'.'` is used as separators to build the tree), alongside their address and the number of cross references pointing to them. They are furthermore grouped by type. The types are given below:

Labels

  User labels. These are the ones you can add using the context menu RightClick ‣ Add/edit label. Listing them here allow you to have an overview of your custom locations.

Imports

  All imported APIs, as reported by Malcat File parsers.

Exports

  All exported function, as reported by Malcat File parsers.

Functions

  Here are listed all functions having a name. The name can come from different sources:

  > - From the file’s metadata, e.g. the .NET `MethodDef` table

  > - From debug informations, e.g. the ELF `.symtab` section

  > - From a FLIRT signatures

  Not that anonymous functions are not listed there, because they don’t have any symbol defined. I you want to see the list of all functions

Data

  Here you will find all variable-related symbols. These could be symbols for global variables for instance. Constants identified by Malcat’s Known patterns identification are also listed there.

Typedefs

  Here are listed all symbols pointing to type-definition structures. These kind fo symbols can can from different sources:

  > - From the file’s metadata, e.g. the .NET `TypeDef` table

  > - From RTTI information, e.g. the MSVC vtables

Internal

  This category is currently only used by us when debugging some issues. But in the future, there will be python bindings to add symbols to this category. This will be a way for scripts to add symbols, without polluting the user-defined labels.

By defaults, all nodes of the tree beyond the first level of hierarchy are collapsed. You can expand them all by clicking on the checkbox :menuselection:`Expand all` located on the top of the view.

## Symbol preview / goto

Clicking on a symbol will display all the incoming references to the symbol’s address in the quickview panel.

If you double-click the symbol, you will jump to the start of the symbol. The best view is chosen automatically. It can be the Hexadecimal view or the Structure/text view (the most recently used view is chosen) if the symbol lies outside of a recognized function, otherwise it will be the Disassembly view.

Shortcut | Action
--- | ---
`LeftClick` | Select single symbol / display quick preview
`DoubleLeftClick` | Go to symbol address

## Filtering

The symbols view can potentially display a very large amount of symbols. To make things easier, it is possible to filter the displayed symbols by name using the search box at the top of the string. Filtering is done immediately, no need to press `Enter`. Note that the tree will be automatically expanded to display search results.

Shortcut | Action
--- | ---
``Ctrl`+`F`` | Set focus to the view’s search box

## Copy single/multi

From within the symbols view you can select one or multiple symbols at once, using the usual mouse shortcuts. If you hit ``Ctrl`+`C`` afterwards, you will copy all selected fully-qualified names to the clipboard. Multiple symbols are separated using line returns.

Shortcut | Action
--- | ---
`LeftClick` | Select single symbol / set start of symbols selection
``Shift`+`LeftClick`` | Set end of symbols selection
``Ctrl`+`LeftClick`` | Add/remove single symbol to/from symbols selection
``Ctrl`+`C`` | Copy selected symbols