Ghidra: bookmarks
A bookmark is a saved jump: an address, a type, and a short note, listed in one window. Comments explain a line. Bookmarks let you return to the handful of addresses that hold the story together.
A bookmark is a row that jumps
Add a bookmark at the cursor from the bookmark action or the marker margin. You pick a type and you type a description short enough to scan in a list. The Listing grows a marker in the margin. Window > Bookmarks shows every mark in this program, and double-clicking a row is a Go To that you do not have to remember the address for. That is the whole feature. It is small because its job is small: hold the addresses you will need again.
Ghidra’s default types are Note, Info, Warning, Error, and Analysis. Use Note for a neutral pin, Info for something you have confirmed, Warning for a disagreement you are not done with, Error for a place the database is wrong, and Analysis for a question an analyzer left behind. The types are a filter in the Bookmarks window. During a long session, showing only Warning is how you find the open questions without rereading every comment.
Marks travel with the database
Because bookmarks live in the program, they are included when you save, when you export a Ghidra zip of the program, and when you check the program into a shared project. A teammate who opens your database sees your pins. Write descriptions that still mean something to a person who was not in the room. “Here” is not a description. “Jump table for status_text, typed as pointers” is.
The margin can get crowded if you pin every interesting line. Pin the turning points: entry, main, the config string, the file-opening function, and any Warning you still owe an answer. The rest can live as names and comments. A bookmark list of two hundred rows is a second program, and nobody reads it.
Lab: three marks and a jump
Set an Info bookmark on the function you confirmed as main, a Note on the default config path, and a Warning on any address where you are genuinely unsure. If you have no such address, pick the status selection and mark it Info as well, with the description “compare chain” or “jump table,” matching what you found. Open the Bookmarks window and double-click each row. The Listing should land on the address you pinned.
Save, close the program, and reopen it. The three rows should still be there. Filter to Warning and confirm the list shrinks. That filter is the habit to keep when the program is larger than harbor-check and the open questions would otherwise sink.
Three marks that carry the harbor lab Info main confirmed by runtime pointer and config string Note default path "/etc/harbor/check.conf" Warning <address> decompiler and Listing disagree, if you have one Error and Analysis exist too. Error is for a place the database is wrong. Analysis is for a place an analyzer left a question.
Diagram
What each mark is for
- Pin
Add a bookmark at the cursor with a type and a one-line description. The margin shows a marker.
- List
Window > Bookmarks lists every mark in the program. Double-click a row to jump.
- Filter
The types are a filter. Notes, warnings, and analysis marks can be shown or hidden as a group.
- Save
Bookmarks live in the program database. They are there after you save and reopen. They are not written into the executable.
Default bookmark types
- Note
A neutral pin. Use it for “come back to this string” or “this call is the handoff to main.”
- Info
A pin on something you have confirmed, such as the function you are willing to call main.
- Warning
A pin on a disagreement: the decompiler and the Listing do not match, or a reference list is empty and you do not know why.
Info main confirmed by runtime pointer and config string Note default path "/etc/harbor/check.conf" Warning <address> decompiler and Listing disagree, if you have one Error and Analysis exist too. Error is for a place the database is wrong. Analysis is for a place an analyzer left a question.
Check yourself
1. You have confirmed main and you want a single window that can jump back to it tomorrow. What do you add?
2. The decompiler shows a loop and the Listing shows a forward jump that never returns to the compare. You cannot resolve it today. Which mark matches?
3. You bookmark four addresses, save the program, and reopen it the next day. Where are the marks?
Comments explain. Bookmarks return.
A plate comment on main is the right place for the evidence sentence. A bookmark on main is the right place to land tomorrow. They do not replace each other. A function can have a careful comment and no bookmark, if you are done with it. A bookmark without a comment is a pin with a thin label, fine for “look here next” and poor as the only record of why. The description field should carry the minimum reason: “runtime pointer plus config string,” not a paragraph.
Navigation history still dies with the session. Bookmarks do not. If you close the laptop in the middle of a chain of calls, the history is the thing you will not get back, and the bookmarks are the thing you will. Pin the start of the chain before you follow it.