Jackson's Ghidra Style Guide

When doing collaborative reverse engineering, it's helpful to have a common language. If I'm marking up a binary in Ghidra, I've generally settled on the following conventions:

Symbols I'm unsure of end with a ?; multiple ? indicate additional uncertainty. If you see a function labeled foo? feel free to rename it (although I at least have some level of confidence in that name). At 3 question marks though, I probably haven't even opened the function declaration.

When writing a script to do automated markup with some degree of uncertainty (i.e. name a function based on print strings, or based on a bot), I try to end the symbol name with with a * .

Function names in the imperitive imply that the name is a complete descriptor of the function. (i.e. a function named get_cpuid would just read the cpu id and return it to the caller)

Function names in present tense imply that the described function takes the described action, but does other things too (i.e. a function named gets_cpuid will read cpuid and probably do some conditional processing based on it)