Export findings as markdown (Ctrl+E), and the journal that makes it true

The output of an RE session is what you worked out, and it was locked in a
.i64 that only IDA can read. Ctrl+E (or `drive export`, or the `export` RPC
verb) writes it out: your comments grouped by function with the line each
annotates, the names and prototypes you set, the types you declared.

**The hard part was provenance, and it needed a mechanism, not a filter.**
A database does not record WHO wrote a comment or a name. IDA's analyzer
sets `; switch 73 cases` and `; s1` with the same `set_cmt` a person uses,
and the ELF loader sets `elf_gnu_hash_nbuckets` and `File class: 64-bit`
the same way. Four probes, all negative: the FF_COMM flag is identical,
`get_cmt` returns them all, `generate_disasm_line` tags every one of them
COLOR_REGCMT (not COLOR_AUTOCMT), and they survive with auto-comments
switched off. A first cut filtered by shape and produced a report whose
first screen was ELF header trivia and `; jumptable ... case 99`.

So idatui journals its own edits (idatui/journal.py) into a netnode in the
database: it rides along in the .i64, it is still there next session, and
the report is then exactly what was done here -- 2 findings out of a
database carrying 693 other annotations. Recorded at the choke points in
edit_ctl (rename, name-address, comment, retype) and in the struct editor;
flushed on save, on export and on quit, so no edit pays a round trip.

Without a journal (a database worked on in the IDA GUI, or predating this)
the report falls back to filtering by shape -- dummy names, imports, loader
segments, the analyzer's stereotyped switch/jumptable strings -- and says
so in the document rather than claiming authorship it cannot prove.

idatui/findings.py splits gather (needs IDA) from render (does not), so the
formatting, grouping, sorting, escaping and the empty cases are tested
offline: tests/test_findings.py, 32 checks, no worker, 0.1s. The pilot
scenario covers the round trip that matters -- edit through the UI, export,
find it in the file, and reload the journal from the .i64.

Full suite: 842 passed, 0 failed, 51.2s.

1 files changed, 9 insertions, 1 deletions

diff --git a/idatui/drive.py b/idatui/drive.py
index 825111c..6ba13c6 100644
--- a/idatui/drive.py
+++ b/idatui/drive.py
@@ -296,6 +296,14 @@ def cmd_save(c, args):
     return "  saved"
 
 
+def cmd_export(c, args):
+    """export [path] -- write the session's findings as markdown."""
+    r = c.call("export", **({"path": args[0]} if args else {}))
+    return (f"  {r.get('path')}  ({r.get('bytes', 0)} bytes: "
+            f"{r.get('comments', 0)} comments, {r.get('names', 0)} names, "
+            f"{r.get('types', 0)} types)")
+
+
 def cmd_screen(c, args):
     return c.call("screen").get("text", "")
 
@@ -315,7 +323,7 @@ COMMANDS = {
     "callees": cmd_callees, "callers": cmd_callers, "names": cmd_names,
     "rename": cmd_rename, "mv": cmd_mv, "note": cmd_note, "retype": cmd_retype,
     "save": cmd_save, "screen": cmd_screen, "raw": cmd_raw, "define": cmd_define,
-    "syms": cmd_syms, "fmt": cmd_fmt,
+    "syms": cmd_syms, "fmt": cmd_fmt, "export": cmd_export,
     "binaries": cmd_binaries, "switch": cmd_switch,
 }