Bases:object

__init__(func:Function|None=None)[source]¶

Parameters:

func (Function |None) –

close()→None[source]¶

Return type:

None

propertyfunction:Function|None¶

Bases:object

ArchAndAddr(arch: ‘architecture.Architecture’, addr: int)

__init__(arch:Architecture,addr:int)→None¶

Parameters:

• arch (Architecture) –

• addr (int) –

Return type:

None

addr:int¶

arch:Architecture¶

Bases:object

__init__(function:Function|LowLevelILFunction|MediumLevelILFunction|HighLevelILFunction)[source]¶

Parameters:

function (Function |LowLevelILFunction |MediumLevelILFunction |HighLevelILFunction) –

Bases:object

__init__(handle:LP_BNDisassemblySettings|None=None)[source]¶

Parameters:

handle (LP_BNDisassemblySettings |None) –

staticdefault_graph_settings()→DisassemblySettings[source]¶

Return type:

DisassemblySettings

staticdefault_linear_settings()→DisassemblySettings[source]¶

Return type:

DisassemblySettings

staticdefault_settings()→DisassemblySettings[source]¶

Return type:

DisassemblySettings

is_option_set(option:DisassemblyOption)→bool[source]¶

Parameters:

option (DisassemblyOption) –

Return type:

bool

set_option(option:DisassemblyOption,state:bool=True)→None[source]¶

Parameters:

• option (DisassemblyOption) –

• state (bool) –

Return type:

None

propertymax_symbol_width:int¶

propertywidth:int¶

Bases:object

DisassemblyTextLine(tokens: List[ForwardRef(‘InstructionTextToken’)], address: Optional[int] = None, il_instr: Union[ForwardRef(‘lowlevelil.LowLevelILInstruction’), ForwardRef(‘mediumlevelil.MediumLevelILInstruction’), ForwardRef(‘highlevelil.HighLevelILInstruction’), NoneType] = None, color: Union[ForwardRef(‘_highlight.HighlightColor’), binaryninja.enums.HighlightStandardColor, NoneType] = None, tags: Optional[List[ForwardRef(‘binaryview.Tag’)]] = None, type_info: Optional[binaryninja.function.DisassemblyTextLineTypeInfo] = None)

__init__(tokens:List[InstructionTextToken],address:int|None=None,il_instr:LowLevelILInstruction|MediumLevelILInstruction|HighLevelILInstruction|None=None,color:HighlightColor|HighlightStandardColor|None=None,tags:List[Tag]|None=None,type_info:DisassemblyTextLineTypeInfo|None=None)[source]¶

Parameters:

• tokens (List[InstructionTextToken]) –

• address (int |None) –

• il_instr (LowLevelILInstruction |MediumLevelILInstruction |HighLevelILInstruction |None) –

• color (HighlightColor |HighlightStandardColor |None) –

• tags (List[Tag]|None) –

• type_info (DisassemblyTextLineTypeInfo |None) –

address:int|None¶

propertyaddress_and_indentation_tokens¶

propertyaddress_and_indentation_width¶

highlight:HighlightColor¶

il_instruction:LowLevelILInstruction|MediumLevelILInstruction|HighLevelILInstruction|None¶

tags:List[Tag]¶

tokens:List[InstructionTextToken]¶

propertytotal_width¶

type_info:DisassemblyTextLineTypeInfo|None¶

Bases:object

DisassemblyTextLineTypeInfo(parent_type: Optional[ForwardRef(‘types.Type’)], field_index: int, offset: int)

__init__(parent_type:Type|None,field_index:int,offset:int)→None¶

Parameters:

• parent_type (Type |None) –

• field_index (int) –

• offset (int) –

Return type:

None

field_index:int¶

offset:int¶

parent_type:Type|None¶

Bases:object

__init__(func:Function|LowLevelILFunction|MediumLevelILFunction|HighLevelILFunction|None=None,settings:DisassemblySettings|None=None,handle:BNDisassemblySettings|None=None)[source]¶

Parameters:

• func (Function |LowLevelILFunction |MediumLevelILFunction |HighLevelILFunction |None) –

• settings (DisassemblySettings |None) –

• handle (BNDisassemblySettings |None) –

add_integer_token(tokens:List[InstructionTextToken],int_token:InstructionTextToken,addr:int,arch:Architecture|None=None)→None[source]¶

Parameters:

• tokens (List[InstructionTextToken]) –

• int_token (InstructionTextToken) –

• addr (int) –

• arch (Architecture |None) –

Return type:

None

add_stack_var_reference_tokens(tokens:List[InstructionTextToken],ref:StackVariableReference)→None[source]¶

Parameters:

• tokens (List[InstructionTextToken]) –

• ref (StackVariableReference) –

Return type:

None

add_symbol_token(tokens:List[InstructionTextToken],addr:int,size:int,operand:int|None=None)→bool[source]¶

Parameters:

• tokens (List[InstructionTextToken]) –

• addr (int) –

• size (int) –

• operand (int |None) –

Return type:

bool

get_disassembly_text(addr:int)→Generator[Tuple[DisassemblyTextLine|None,int],None,None][source]¶

Parameters:

addr (int) –

Return type:

Generator[Tuple[DisassemblyTextLine |None,int],None,None]

get_instruction_annotations(addr:int)→List[InstructionTextToken][source]¶

Parameters:

addr (int) –

Return type:

List[InstructionTextToken]

get_instruction_text(addr:int)→Generator[Tuple[DisassemblyTextLine|None,int],None,None][source]¶

Parameters:

addr (int) –

Return type:

Generator[Tuple[DisassemblyTextLine |None,int],None,None]

staticis_integer_token(token:InstructionTextToken)→bool[source]¶

Parameters:

token (InstructionTextToken) –

Return type:

bool

post_process_lines(addr:int,length:int,in_lines:str|List[str]|List[DisassemblyTextLine],indent_spaces:str='')[source]¶

Parameters:

• addr (int) –

• length (int) –

• in_lines (str |List[str]|List[DisassemblyTextLine]) –

• indent_spaces (str) –

reset_deduplicated_comments()→None[source]¶

Return type:

None

wrap_comment(lines:List[DisassemblyTextLine],cur_line:DisassemblyTextLine,comment:str,has_auto_annotations:bool,leading_spaces:str=' ',indent_spaces:str='')→None[source]¶

Parameters:

• lines (List[DisassemblyTextLine]) –

• cur_line (DisassemblyTextLine) –

• comment (str) –

• has_auto_annotations (bool) –

• leading_spaces (str) –

• indent_spaces (str) –

Return type:

None

propertyarch:Architecture¶

propertybasic_block:BasicBlock|None¶

propertyfunction:Function¶

propertyhas_data_flow:bool¶

propertyil:bool¶

propertyil_function:LowLevelILFunction|MediumLevelILFunction|HighLevelILFunction|None¶

propertysettings:DisassemblySettings¶

Bases:object

__init__(view:BinaryView|None=None,handle:LP_BNFunction|None=None)[source]¶

Parameters:

• view (BinaryView |None) –

• handle (LP_BNFunction |None) –

add_guided_source_blocks(addresses:List[Tuple[Architecture,int]])→None[source]¶

add_guided_source_blocks adds blocks to the guided source block list for this function.The specified blocks will have their direct outgoing branch targets analyzed. This automaticallyenables theanalysis.guided.enable setting if it is not already enabled.

Parameters:

• addresses (List[Tuple[Architecture,int]]) – List of (architecture, address) tuples to add

• addresses –

Return type:

None

add_tag(tag_type:str,data:str,addr:int|None=None,auto:bool=False,arch:Architecture|None=None)[source]¶

add_tag creates and adds aTag object on either a function, or onan address inside of a function.

“Function tags” appear at the top of a function and are a good way to label anentire function with some information. If you include an address when you callFunction.add_tag, you’ll create an “address tag”. These are good for labelingspecific instructions.

For tagging arbitrary data, consideradd_tag.

Parameters:

• tag_type (str) – The name of the tag type for this Tag

• data (str) – additional data for the Tag

• addr (int) – address at which to add the tag

• auto (bool) – Whether or not an auto tag

• arch (Architecture) – Architecture for the block in which the Tag is added (optional)

Example:

>>>current_function.add_tag("Important","I think this is the main function")>>>current_function.add_tag("Crashes","Nullpointer dereference",here)

Warning: For performance reasons, this function does not ensure the address youhave supplied is within the function’s bounds.

add_user_code_ref(from_addr:int,to_addr:int,arch:Architecture|None=None)→None[source]¶

add_user_code_ref places a user-defined cross-reference from the instruction atthe given address and architecture to the specified target address. If the specifiedsource instruction is not contained within this function, no action is performed.To remove the reference, useremove_user_code_ref.

Parameters:

• from_addr (int) – virtual address of the source instruction

• to_addr (int) – virtual address of the xref’s destination.

• arch (Architecture) – (optional) architecture of the source instruction

Return type:

None

Example:

>>>current_function.add_user_code_ref(here,0x400000)

add_user_type_field_ref(from_addr:int,name:types.QualifiedNameType,offset:int,from_arch:Architecture|None=None,size:int=0)→None[source]¶

add_user_type_field_ref places a user-defined type field cross-reference from theinstruction at the given address and architecture to the specified type. If the specifiedsource instruction is not contained within this function, no action is performed.To remove the reference, useremove_user_type_field_ref.

Parameters:

• from_addr (int) – virtual address of the source instruction

• name (QualifiedName) – name of the referenced type

• offset (int) – offset of the field, relative to the type

• from_arch (Architecture) – (optional) architecture of the source instruction

• size (int) – (optional) the size of the access

Return type:

None

Example:

>>>current_function.add_user_type_field_ref(here,'A',0x8)

add_user_type_ref(from_addr:int,name:types.QualifiedNameType,from_arch:Architecture|None=None)→None[source]¶

add_user_type_ref places a user-defined type cross-reference from the instruction atthe given address and architecture to the specified type. If the specifiedsource instruction is not contained within this function, no action is performed.To remove the reference, useremove_user_type_ref.

Parameters:

• from_addr (int) – virtual address of the source instruction

• name (QualifiedName) – name of the referenced type

• from_arch (Architecture) – (optional) architecture of the source instruction

Return type:

None

Example:

>>>current_function.add_user_code_ref(here,'A')

analyze()→None[source]¶

analyze causes this function to be analyzed if it’s out of date. This function does not wait for the analysis to finish.

Return type:

None

apply_auto_discovered_type(func_type:str|Type|TypeBuilder)→None[source]¶

Parameters:

func_type (str |Type |TypeBuilder) –

Return type:

None

apply_imported_types(sym:CoreSymbol,type:str|Type|TypeBuilder|None=None)→None[source]¶

Parameters:

• sym (CoreSymbol) –

• type (str |Type |TypeBuilder |None) –

Return type:

None

check_for_debug_report(name:str)→bool[source]¶

check_for_debug_report checks if a function has had a debug report requestedwith the given name, and then, if one has been requested, clears the request internallyso that future calls to this function for that report will return False.

If a function has had a debug report requested, it is the caller of this function’sresponsibility to actually generate and show the debug report.You can usebinaryninja.interaction.show_report_collectionfor showing a debug report from a workflow activity.

Parameters:

name (str) – Name of the debug report

Returns:

True if the report has been requested (and not checked for yet)

Return type:

bool

clear_all_user_var_values()→None[source]¶

Clear all user defined variable values.

Return type:

None

clear_forced_var_version(var:Variable,def_addr:int)→None[source]¶

Parameters:

• var (Variable) –

• def_addr (int) –

Return type:

None

clear_user_var_value(var:Variable,def_addr:int,after:bool=True)→None[source]¶

Clears a previously defined user variable value.

Parameters:

• var (Variable) – Variable for which the value was informed

• def_addr (int) – Address of the definition site of the variable

• after (bool) –

Return type:

None

collapse_region(hash)[source]¶

Collapse a region during rendering:param hash: Hash value of region

create_auto_stack_var(offset:int,var_type:str|Type|TypeBuilder,name:str)→None[source]¶

Parameters:

• offset (int) –

• var_type (str |Type |TypeBuilder) –

• name (str) –

Return type:

None

create_auto_var(var:Variable,var_type:str|Type|TypeBuilder,name:str,ignore_disjoint_uses:bool=False)→None[source]¶

Parameters:

• var (Variable) –

• var_type (str |Type |TypeBuilder) –

• name (str) –

• ignore_disjoint_uses (bool) –

Return type:

None

create_forced_var_version(var:Variable,def_addr:int)→None[source]¶

Parameters:

• var (Variable) –

• def_addr (int) –

Return type:

None

create_graph(graph_type:FunctionViewType|FunctionGraphType|str=FunctionGraphType.NormalFunctionGraph,settings:DisassemblySettings|None=None)→CoreFlowGraph[source]¶

Create a flow graph with the disassembly of this function.

Note

This graph waits for function analysis, so Workflow Activities should instead usecreate_graph_immediate to create graphs with the function contents as-is.

Parameters:

• graph_type (FunctionViewType |FunctionGraphType |str) – IL form of the disassembly in the graph

• settings (DisassemblySettings |None) – Optional settings for the disassembly text renderer

Returns:

Flow graph object

Return type:

CoreFlowGraph

create_graph_immediate(graph_type:FunctionViewType|FunctionGraphType|str=FunctionGraphType.NormalFunctionGraph,settings:DisassemblySettings|None=None)→CoreFlowGraph[source]¶

Create a flow graph with the disassembly of this function, specifically using theinstructions as they are in the function when this is called. You probably want to usethis if you are creating a Debug Report in a Workflow Activity.

Parameters:

• graph_type (FunctionViewType |FunctionGraphType |str) – IL form of the disassembly in the graph

• settings (DisassemblySettings |None) – Optional settings for the disassembly text renderer

Returns:

Flow graph object

Return type:

CoreFlowGraph

create_user_stack_var(offset:int,var_type:str|Type|TypeBuilder,name:str)→None[source]¶

Parameters:

• offset (int) –

• var_type (str |Type |TypeBuilder) –

• name (str) –

Return type:

None

create_user_var(var:Variable,var_type:str|Type|TypeBuilder,name:str,ignore_disjoint_uses:bool=False)→None[source]¶

Parameters:

• var (Variable) –

• var_type (str |Type |TypeBuilder) –

• name (str) –

• ignore_disjoint_uses (bool) –

Return type:

None

delete_auto_stack_var(offset:int)→None[source]¶

Parameters:

offset (int) –

Return type:

None

delete_user_stack_var(offset:int)→None[source]¶

Parameters:

offset (int) –

Return type:

None

delete_user_var(var:Variable)→None[source]¶

Parameters:

var (Variable) –

Return type:

None

expand_all()[source]¶

Expand all regions in the function

expand_region(hash)[source]¶

Un-collapse a region during rendering:param hash: Hash value of region

get_all_user_var_values()→Dict[Variable,Dict[ArchAndAddr,PossibleValueSet]][source]¶

Returns a map of current defined user variable values.

Returns:

Map of user current defined user variable values and their definition sites.

Type:

dict of (Variable,dict of (ArchAndAddr,PossibleValueSet))

Return type:

Dict[Variable,Dict[ArchAndAddr,PossibleValueSet]]

get_basic_block_at(addr:int,arch:Architecture|None=None)→BasicBlock|None[source]¶

get_basic_block_at returns the BasicBlock of the optionally specified Architecturearch at the givenaddressaddr.

Parameters:

• addr (int) – Address of the BasicBlock to retrieve.

• arch (Architecture) – (optional) Architecture of the basic block if different from the Function’s self.arch

Example:

>>>current_function.get_basic_block_at(current_function.start)<block: x86_64@0x100000f30-0x100000f50>

Return type:

BasicBlock |None

get_block_annotations(addr:int,arch:Architecture|None=None)→List[List[InstructionTextToken]][source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

List[List[InstructionTextToken]]

get_call_reg_stack_adjustment(addr:int,arch:Architecture|None=None)→Dict[RegisterStackName,RegisterStackAdjustmentWithConfidence][source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

Dict[RegisterStackName,RegisterStackAdjustmentWithConfidence]

get_call_reg_stack_adjustment_for_reg_stack(addr:int,reg_stack:RegisterStackName|ILRegisterStack|RegisterStackIndex,arch:Architecture|None=None)→RegisterStackAdjustmentWithConfidence[source]¶

Parameters:

• addr (int) –

• reg_stack (RegisterStackName |ILRegisterStack |RegisterStackIndex) –

• arch (Architecture |None) –

Return type:

RegisterStackAdjustmentWithConfidence

get_call_stack_adjustment(addr:int,arch:Architecture|None=None)→OffsetWithConfidence[source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

OffsetWithConfidence

get_call_type_adjustment(addr:int,arch:Architecture|None=None)→Type|None[source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

Type |None

get_callee_for_analysis(platform:Platform,addr:int,exact:bool=False)→Function|None[source]¶

get_callee_for_analysis retrieves the callee function for the specified address and platform.

Note

This method is intended for use by architecture plugins only.

Parameters:

• platform (Platform) – Platform of the callee function

• addr (int) – Address of the callee function

• exact (bool) – If True, only return a function if it exactly matches the address and platform

Returns:

The callee function or None if not found

Return type:

Optional[Function]

get_comment_at(addr:int)→str[source]¶

Parameters:

addr (int) –

Return type:

str

get_constant_data(state:RegisterValueType,value:int,size:int=0)→DataBuffer[source]¶

Parameters:

• state (RegisterValueType) –

• value (int) –

• size (int) –

Return type:

DataBuffer

get_constant_data_and_builtin(state:RegisterValueType,value:int,size:int=0)→Tuple[DataBuffer,BuiltinType][source]¶

Parameters:

• state (RegisterValueType) –

• value (int) –

• size (int) –

Return type:

Tuple[DataBuffer,BuiltinType]

get_constants_referenced_by(addr:int,arch:Architecture|None=None)→List[ConstantReference][source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

List[ConstantReference]

get_constants_referenced_by_address_if_available(addr:int,arch:Architecture|None=None)→List[ConstantReference][source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

List[ConstantReference]

get_early_return(addr:int|HighLevelILInstruction)→EarlyReturn[source]¶

Parameters:

addr (int |HighLevelILInstruction) –

Return type:

EarlyReturn

get_expr_folding(addr:int|HighLevelILInstruction)→ExprFolding[source]¶

Parameters:

addr (int |HighLevelILInstruction) –

Return type:

ExprFolding

get_flags_read_by_lifted_il_instruction(i:InstructionIndex)→List[FlagName][source]¶

Parameters:

i (InstructionIndex) –

Return type:

List[FlagName]

get_flags_written_by_lifted_il_instruction(i:InstructionIndex)→List[FlagName][source]¶

Parameters:

i (InstructionIndex) –

Return type:

List[FlagName]

get_function_tags(auto:bool|None=None,tag_type:str|None=None)→List[Tag][source]¶

get_function_tags gets a list of function Tags for the function.

Parameters:

• auto (bool) – If None, gets all tags, if True, gets auto tags, if False, gets user tags

• tag_type (str) – If None, gets all tags, otherwise only gets tags of the given type

Return type:

list(Tag)

get_guided_source_blocks()→List[Tuple[Architecture,int]][source]¶

get_guided_source_blocks returns the current list of guided source blocks for this function.These blocks have their direct outgoing branch targets analyzed.

Return type:

List[Tuple[Architecture,int]]

Returns:

List of (architecture, address) tuples representing current guided source blocks

get_hlil_var_refs(var:Variable)→List[ILReferenceSource][source]¶

get_hlil_var_refs returns a list of ILReferenceSource objects (IL xrefs or cross-references)that reference the given variable. The variable is a local variable that can be either on the stack,in a register, or in a flag.

Parameters:

var (Variable) – Variable for which to query the xref

Returns:

List of IL References for the given variable

Return type:

list(ILReferenceSource)

Example:

>>>mlil_var=current_hlil[0].operands[0]>>>current_function.get_hlil_var_refs(mlil_var)

get_hlil_var_refs_from(addr:int,length:int|None=None,arch:Architecture|None=None)→List[VariableReferenceSource][source]¶

get_hlil_var_refs_from returns a list of variables referenced by code in the functionfunc,of the architecturearch, and at the addressaddr. If no function is specified, references fromall functions and containing the address will be returned. If no architecture is specified, thearchitecture of the function will be used.

Parameters:

• addr (int) – virtual address to query for variable references

• length (int) – optional length of query

• arch (Architecture) – optional architecture of query

Returns:

list of variables reference sources

Return type:

list(VariableReferenceSource)

get_indirect_branches_at(addr:int,arch:Architecture|None=None)→List[IndirectBranchInfo][source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

List[IndirectBranchInfo]

get_instr_highlight(addr:int,arch:Architecture|None=None)→HighlightColor[source]¶

Example:

>>>current_function.set_user_instr_highlight(here,highlight.HighlightColor(red=0xff,blue=0xff,green=0))>>>current_function.get_instr_highlight(here)<color: #ff00ff>

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

HighlightColor

get_instruction_containing_address(addr:int,arch:Architecture|None=None)→int|None[source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

int |None

get_int_display_type(instr_addr:int,value:int,operand:int,arch:Architecture|None=None)→IntegerDisplayType[source]¶

Get the current text display type for an integer token in the disassembly or IL views

See also seeget_int_display_type_and_typeid

Parameters:

• instr_addr (int) – Address of the instruction or IL line containing the token

• value (int) –value field of the InstructionTextToken object for the token, usually the constant displayed

• operand (int) – Operand index of the token, defined as the number of OperandSeparatorTokens in the disassembly line before the token

• arch (Architecture) – (optional) Architecture of the instruction or IL line containing the token

Return type:

IntegerDisplayType

get_int_display_type_and_typeid(instr_addr:int,value:int,operand:int,arch:~binaryninja.architecture.Architecture|None=None)->(<enum'IntegerDisplayType'>,<class'str'>)[source]¶

Get the current text display type for an integer token in the disassembly or IL views

Parameters:

• instr_addr (int) – Address of the instruction or IL line containing the token

• value (int) –value field of the InstructionTextToken object for the token, usually the constant displayed

• operand (int) – Operand index of the token, defined as the number of OperandSeparatorTokens in the disassembly line before the token

• arch (Architecture) – (optional) Architecture of the instruction or IL line containing the token

Return type:

(<enum ‘IntegerDisplayType’>, <class ‘str’>)

get_int_enum_display_typeid(instr_addr:int,value:int,operand:int,arch:Architecture|None=None)→str[source]¶

Get the current text display enum type for an integer token in the disassembly or IL views.

See also seeget_int_display_type_and_typeid

Parameters:

• instr_addr (int) – Address of the instruction or IL line containing the token

• value (int) –value field of the InstructionTextToken object for the token, usually the constant displayed

• operand (int) – Operand index of the token, defined as the number of OperandSeparatorTokens in the disassembly line before the token

• arch (Architecture) – (optional) Architecture of the instruction or IL line containing the token

Returns:

TypeID for the integer token

Return type:

str

get_lifted_il_at(addr:int,arch:Architecture|None=None)→LowLevelILInstruction|None[source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

LowLevelILInstruction |None

get_lifted_il_flag_definitions_for_use(i:InstructionIndex,flag:FlagName|ILFlag|FlagIndex)→List[InstructionIndex][source]¶

Parameters:

• i (InstructionIndex) –

• flag (FlagName |ILFlag |FlagIndex) –

Return type:

List[InstructionIndex]

get_lifted_il_flag_uses_for_definition(i:InstructionIndex,flag:FlagName|ILFlag|FlagIndex)→List[LowLevelILInstruction][source]¶

Parameters:

• i (InstructionIndex) –

• flag (FlagName |ILFlag |FlagIndex) –

Return type:

List[LowLevelILInstruction]

get_lifted_ils_at(addr:int,arch:Architecture|None=None)→List[LowLevelILInstruction][source]¶

get_lifted_ils_at gets the Lifted IL Instruction(s) corresponding to the given virtual address

Parameters:

• addr (int) – virtual address of the function to be queried

• arch (Architecture) – (optional) Architecture for the given function

Return type:

list(LowLevelILInstruction)

Example:

>>>func=next(bv.functions)>>>func.get_lifted_ils_at(func.start)[<il: push(rbp)>]

get_llil_at(addr:int,arch:Architecture|None=None)→LowLevelILInstruction|None[source]¶

get_llil_at gets the LowLevelILInstruction corresponding to the given virtual address

Parameters:

• addr (int) – virtual address of the instruction to be queried

• arch (Architecture) – (optional) Architecture for the given function

Return type:

LowLevelILInstruction

Example:

>>>func=next(bv.functions)>>>func.get_llil_at(func.start)<il: push(rbp)>

get_llils_at(addr:int,arch:Architecture|None=None)→List[LowLevelILInstruction][source]¶

get_llils_at gets the LowLevelILInstruction(s) corresponding to the given virtual addressSee thedeveloper docs for more information.

Parameters:

• addr (int) – virtual address of the instruction to be queried

• arch (Architecture) – (optional) Architecture for the given function

Return type:

list(LowLevelILInstruction)

Example:

>>>func=next(bv.functions)>>>func.get_llils_at(func.start)[<il: push(rbp)>]

get_low_level_il_at(addr:int,arch:Architecture|None=None)→LowLevelILInstruction|None[source]¶

get_low_level_il_at gets the LowLevelILInstruction corresponding to the given virtual address

Parameters:

• addr (int) – virtual address of the function to be queried

• arch (Architecture) – (optional) Architecture for the given function

Return type:

LowLevelILInstruction

Example:

>>>func=next(bv.functions)>>>func.get_low_level_il_at(func.start)<il: push(rbp)>

get_low_level_il_exits_at(addr:int,arch:Architecture|None=None)→List[int][source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

List[int]

get_low_level_ils_at(addr:int,arch:Architecture|None=None)→List[LowLevelILInstruction][source]¶

get_low_level_ils_at gets the LowLevelILInstruction(s) corresponding to the given virtual addressSee thedeveloper docs for more information.

Parameters:

• addr (int) – virtual address of the instruction to be queried

• arch (Architecture) – (optional) Architecture for the given function

Return type:

list(LowLevelILInstruction)

Example:

>>>func=next(bv.functions)>>>func.get_low_level_ils_at(func.start)[<il: push(rbp)>]

get_mlil_var_refs(var:Variable)→List[ILReferenceSource][source]¶

get_mlil_var_refs returns a list of ILReferenceSource objects (IL xrefs or cross-references)that reference the given variable. The variable is a local variable that can be either on the stack,in a register, or in a flag.This function is related to get_hlil_var_refs(), which returns variable references collectedfrom HLIL. The two can be different in several cases, e.g., multiple variables in MLIL can be mergedinto a single variable in HLIL.

Parameters:

var (Variable) – Variable for which to query the xref

Returns:

List of IL References for the given variable

Return type:

list(ILReferenceSource)

Example:

>>>mlil_var=current_mlil[0].operands[0]>>>current_function.get_mlil_var_refs(mlil_var)

get_mlil_var_refs_from(addr:int,length:int|None=None,arch:Architecture|None=None)→List[VariableReferenceSource][source]¶

get_mlil_var_refs_from returns a list of variables referenced by code in the functionfunc,of the architecturearch, and at the addressaddr. If no function is specified, references fromall functions and containing the address will be returned. If no architecture is specified, thearchitecture of the function will be used.This function is related to get_hlil_var_refs_from(), which returns variable references collectedfrom HLIL. The two can be different in several cases, e.g., multiple variables in MLIL can be mergedinto a single variable in HLIL.

Parameters:

• addr (int) – virtual address to query for variable references

• length (int) – optional length of query

• arch (Architecture) – optional architecture of query

Returns:

list of variable reference sources

Return type:

list(VariableReferenceSource)

get_parameter_at(addr:int,func_type:Type|None,i:int,arch:Architecture|None=None)→RegisterValue[source]¶

Parameters:

• addr (int) –

• func_type (Type |None) –

• i (int) –

• arch (Architecture |None) –

Return type:

RegisterValue

get_parameter_at_low_level_il_instruction(instr:InstructionIndex,func_type:Type,i:int)→RegisterValue[source]¶

Parameters:

• instr (InstructionIndex) –

• func_type (Type) –

• i (int) –

Return type:

RegisterValue

get_reg_value_after(addr:int,reg:RegisterName|ILRegister|RegisterIndex,arch:Architecture|None=None)→RegisterValue[source]¶

get_reg_value_after gets the value instruction address corresponding to the given virtual address

Parameters:

• addr (int) – virtual address of the instruction to query

• reg (str) – string value of native register to query

• arch (Architecture) – (optional) Architecture for the given function

Return type:

RegisterValue

Example:

>>>current_function.get_reg_value_after(0x400dbe,'rdi')<undetermined>

get_reg_value_at(addr:int,reg:RegisterName|ILRegister|RegisterIndex,arch:Architecture|None=None)→RegisterValue[source]¶

get_reg_value_at gets the value the provided string register address corresponding to the given virtual address

Parameters:

• addr (int) – virtual address of the instruction to query

• reg (str) – string value of native register to query

• arch (Architecture) – (optional) Architecture for the given function

Return type:

RegisterValue

Example:

>>>current_function.get_reg_value_at(0x400dbe,'rdi')<const 0x2>

get_reg_value_at_exit(reg:RegisterName|ILRegister|RegisterIndex)→RegisterValue[source]¶

Parameters:

reg (RegisterName |ILRegister |RegisterIndex) –

Return type:

RegisterValue

get_regs_read_by(addr:int,arch:Architecture|None=None)→List[RegisterName][source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

List[RegisterName]

get_regs_written_by(addr:int,arch:Architecture|None=None)→List[RegisterName][source]¶

Parameters:

• addr (int) –

• arch (Architecture |None) –

Return type:

List[RegisterName]

get_stack_contents_after(addr:int,offset:int,size:int,arch:Architecture|None=None)→RegisterValue[source]¶

Parameters:

• addr (int) –

• offset (int) –

• size (int) –

• arch (Architecture |None) –

Return type:

RegisterValue

get_stack_contents_at(addr:int,offset:int,size:int,arch:Architecture|None=None)→RegisterValue[source]¶

get_stack_contents_at returns the RegisterValue for the item on the stack in the current function at thegiven virtual addressaddr, stack offsetoffset and size ofsize. Optionally specifying the architecture.

Parameters:

• addr (int) – virtual address of the instruction to query

• offset (int) – stack offset base of stack

• size (int) – size of memory to query

• arch (Architecture) – (optional) Architecture for the given function

Return type:

RegisterValue

Note

Stack base is zero on entry into the function unless the architecture places the return address on the stack as in (x86/x86_64) where the stack base will start at address_size

Example:

>>>current_function.get_stack_contents_at(0x400fad,-16,4)<range: 0x8 to 0xffffffff>

Parameters:

• addr (int) –

• offset (int) –

• size (int) –

• arch (Architecture |None) –

Return type:

RegisterValue