Bases:object

AddressRange(start: int, end: int)

__init__(start:int,end:int)→None¶

Parameters:

• start (int) –

• end (int) –

Return type:

None

end:int¶

start:int¶

Bases:RegisterValue

ConstantData(value: int, offset: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.UndeterminedValue: 0>, confidence: int = 255, size: int = 0, function: ‘_function.Function’ = None)

__init__(value:int,offset:int,type:RegisterValueType=RegisterValueType.UndeterminedValue,confidence:int=255,size:int=0,function:_function.Function=None)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

• function (_function.Function) –

Return type:

None

propertydata:DataBuffer¶

propertydata_and_builtin:Tuple[DataBuffer,BuiltinType]¶

function:_function.Function=None¶

Bases:RegisterValue

ConstantDataRegisterValue(value: int, offset: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.UndeterminedValue: 0>, confidence: int = 255, size: int = 0)

__init__(value:int,offset:int,type:RegisterValueType=RegisterValueType.UndeterminedValue,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

offset:int¶

value:int¶

Bases:RegisterValue

ConstantPointerRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ConstantPointerValue: 3>, confidence: int = 255, size: int = 0)

__init__(value:int,offset:int=0,type:RegisterValueType=RegisterValueType.ConstantPointerValue,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

offset:int=0¶

type:RegisterValueType=3¶

Bases:object

ConstantReference(value: int, size: int, pointer: bool, intermediate: bool)

__init__(value:int,size:int,pointer:bool,intermediate:bool)→None¶

Parameters:

• value (int) –

• size (int) –

• pointer (bool) –

• intermediate (bool) –

Return type:

None

intermediate:bool¶

pointer:bool¶

size:int¶

value:int¶

Bases:RegisterValue

ConstantRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ConstantValue: 2>, confidence: int = 255, size: int = 0)

__init__(value:int,offset:int=0,type:RegisterValueType=RegisterValueType.ConstantValue,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

offset:int=0¶

type:RegisterValueType=2¶

Bases:object

classCoreVariable is the base class for other variable types,such asVariableNameAndType andVariable

Variables:

• index – Internal identifier

• storage – If this variable is a stack variable(source_type == VariableSourceType.StackVariableSourceType),then the storage location is the offset onto the stack that containsthe first byte of this variable. Otherwise it’s used as an internal identifier.

__init__(_source_type:int,index:int,storage:int)→None¶

Parameters:

• _source_type (int) –

• index (int) –

• storage (int) –

Return type:

None

classmethodfrom_BNVariable(var:BNVariable)[source]¶

Parameters:

var (BNVariable) –

classmethodfrom_identifier(identifier)[source]¶

to_BNVariable()[source]¶

propertyidentifier:int¶

A UID for a variable within a function.

index:int¶

propertysource_type:VariableSourceType¶

Whether this variable was created based off of an underlying register, stack location, or flag.

storage:int¶

Bases:RegisterValue

EntryRegisterValue(value: int = 0, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.EntryValue: 1>, confidence: int = 255, size: int = 0, reg: Optional[ForwardRef(‘binaryninja.architecture.RegisterName’)] = None)

__init__(value:int=0,offset:int=0,type:RegisterValueType=RegisterValueType.EntryValue,confidence:int=255,size:int=0,reg:RegisterName|None=None)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

• reg (RegisterName |None) –

Return type:

None

offset:int=0¶

reg:binaryninja.architecture.RegisterName|None=None¶

type:RegisterValueType=1¶

value:int=0¶

Bases:RegisterValue

ExternalPointerRegisterValue(value: int, offset: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ExternalPointerValue: 4>, confidence: int = 255, size: int = 0)

__init__(value:int,offset:int,type:RegisterValueType=RegisterValueType.ExternalPointerValue,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

type:RegisterValueType=4¶

Bases:RegisterValue

ImportedAddressRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ImportedAddressValue: 7>, confidence: int = 255, size: int = 0)

__init__(value:int,offset:int=0,type:RegisterValueType=RegisterValueType.ImportedAddressValue,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

offset:int=0¶

type:RegisterValueType=7¶

Bases:object

IndirectBranchInfo(source_arch: ‘binaryninja.architecture.Architecture’, source_addr: int, dest_arch: ‘binaryninja.architecture.Architecture’, dest_addr: int, auto_defined: bool)

__init__(source_arch:Architecture,source_addr:int,dest_arch:Architecture,dest_addr:int,auto_defined:bool)→None¶

Parameters:

• source_arch (Architecture) –

• source_addr (int) –

• dest_arch (Architecture) –

• dest_addr (int) –

• auto_defined (bool) –

Return type:

None

auto_defined:bool¶

dest_addr:int¶

dest_arch:Architecture¶

source_addr:int¶

source_arch:Architecture¶

Bases:object

LookupTableEntry(from_values: List[int], to_value: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.LookupTableValue: 10>)

__init__(from_values:List[int],to_value:int,type:RegisterValueType=RegisterValueType.LookupTableValue)→None¶

Parameters:

• from_values (List[int]) –

• to_value (int) –

• type (RegisterValueType) –

Return type:

None

from_values:List[int]¶

to_value:int¶

type:RegisterValueType=10¶

Bases:object

__init__(var_list:List[Variable],confidence:int=255,func:Function|None=None)[source]¶

Parameters:

• var_list (List[Variable]) –

• confidence (int) –

• func (Function |None) –

with_confidence(confidence:int)→ParameterVariables[source]¶

Parameters:

confidence (int) –

Return type:

ParameterVariables

propertyconfidence:int¶

propertyfunction:Function|None¶

propertyvars:List[Variable]¶

Bases:object

class PossibleValueSet PossibleValueSet is used to define possible valuesthat a variable can take. It contains methods to instantiate differentvalue sets such as Constant, Signed/Unsigned Ranges, etc.

__init__(arch=None,value=None)[source]¶

staticconstant(value:int)→PossibleValueSet[source]¶

Create a constant valued PossibleValueSet object.

Parameters:

value (int) – Integer value of the constant

Return type:

PossibleValueSet

staticconstant_ptr(value:int)→PossibleValueSet[source]¶

Create constant pointer valued PossibleValueSet object.

Parameters:

value (int) – Integer value of the constant pointer

Return type:

PossibleValueSet

staticin_set_of_values(values:List[int]|Set[int])→PossibleValueSet[source]¶

Create a PossibleValueSet object for a value in a set of values.

Parameters:

values (list(int)) – List of integer values

Return type:

PossibleValueSet

staticlookup_table_value(lookup_table,mapping)→PossibleValueSet[source]¶

Create a PossibleValueSet object for a value which is a member of alookup table.

Parameters:

• lookup_table (list(LookupTableEntry)) – List of table entries

• mapping (dict of(int,int)) – Mapping used for resolution

Return type:

PossibleValueSet

staticnot_in_set_of_values(values)→PossibleValueSet[source]¶

Create a PossibleValueSet object for a value NOT in a set of values.

Parameters:

values (list(int)) – List of integer values

Return type:

PossibleValueSet

staticsigned_range_value(ranges:List[ValueRange])→PossibleValueSet[source]¶

Create a PossibleValueSet object for a signed range of values.

Parameters:

ranges (list(ValueRange)) – List of ValueRanges

Return type:

PossibleValueSet

Example:

>>>v_1=ValueRange(-5,-1,1)>>>v_2=ValueRange(7,10,1)>>>val=PossibleValueSet.signed_range_value([v_1,v_2])<signed ranges: [<range: -0x5 to -0x1>, <range: 0x7 to 0xa>]>

staticstack_frame_offset(offset:int)→PossibleValueSet[source]¶

Create a PossibleValueSet object for a stack frame offset.

Parameters:

offset (int) – Integer value of the offset

Return type:

PossibleValueSet

staticundetermined()→PossibleValueSet[source]¶

Create a PossibleValueSet object of type UndeterminedValue.

Returns:

PossibleValueSet object of type UndeterminedValue

Return type:

PossibleValueSet

staticunsigned_range_value(ranges:List[ValueRange])→PossibleValueSet[source]¶

Create a PossibleValueSet object for a unsigned signed range of values.

Parameters:

ranges (list(ValueRange)) – List of ValueRanges

Return type:

PossibleValueSet

Example:

>>>v_1=ValueRange(0,5,1)>>>v_2=ValueRange(7,10,1)>>>val=PossibleValueSet.unsigned_range_value([v_1,v_2])<unsigned ranges: [<range: 0x0 to 0x5>, <range: 0x7 to 0xa>]>

propertycount:int¶

propertymapping:Dict[int,int]¶

propertyoffset:int¶

propertyranges:List[ValueRange]¶

propertyreg:RegisterName¶

propertysize:int¶

propertytable:List[LookupTableEntry]¶

propertytype:RegisterValueType¶

propertyvalue:int¶

propertyvalues:Set[int]¶

Bases:object

RegisterValue(value: int, offset: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.UndeterminedValue: 0>, confidence: int = 255, size: int = 0)

__init__(value:int,offset:int,type:RegisterValueType=RegisterValueType.UndeterminedValue,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

classmethodfrom_BNRegisterValue(reg_value:BNRegisterValue|BNRegisterValueWithConfidence,arch:Architecture|None=None)→RegisterValue[source]¶

Parameters:

• reg_value (BNRegisterValue |BNRegisterValueWithConfidence) –

• arch (Architecture |None) –

Return type:

RegisterValue

classmethodto_BNRegisterValue(reg_value:RegisterValue)→BNRegisterValue[source]¶

Parameters:

reg_value (RegisterValue) –

Return type:

BNRegisterValue

confidence:int=255¶

offset:int¶

size:int=0¶

type:RegisterValueType=0¶

value:int¶

Bases:RegisterValue

ReturnAddressRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ReturnAddressValue: 6>, confidence: int = 255, size: int = 0)

__init__(value:int,offset:int=0,type:RegisterValueType=RegisterValueType.ReturnAddressValue,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

offset:int=0¶

type:RegisterValueType=6¶

Bases:RegisterValue

StackFrameOffsetRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.StackFrameOffset: 5>, confidence: int = 255, size: int = 0)

__init__(value:int,offset:int=0,type:RegisterValueType=RegisterValueType.StackFrameOffset,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

offset:int=0¶

type:RegisterValueType=5¶

Bases:object

StackVariableReference(_source_operand: Optional[int], type: ‘binaryninja.types.Type’, name: str, var: ‘Variable’, referenced_offset: int, size: int)

__init__(_source_operand:int|None,type:Type,name:str,var:Variable,referenced_offset:int,size:int)→None¶

Parameters:

• _source_operand (int |None) –

• type (Type) –

• name (str) –

• var (Variable) –

• referenced_offset (int) –

• size (int) –

Return type:

None

name:str¶

referenced_offset:int¶

size:int¶

propertysource_operand¶

type:Type¶

var:Variable¶

Bases:RegisterValue

Undetermined(value: int = 0, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.UndeterminedValue: 0>, confidence: int = 255, size: int = 0)

__init__(value:int=0,offset:int=0,type:RegisterValueType=RegisterValueType.UndeterminedValue,confidence:int=255,size:int=0)→None¶

Parameters:

• value (int) –

• offset (int) –

• type (RegisterValueType) –

• confidence (int) –

• size (int) –

Return type:

None

offset:int=0¶

type:RegisterValueType=0¶

value:int=0¶

Bases:object

ValueRange(start: int, end: int, step: int)

__init__(start:int,end:int,step:int)→None¶

Parameters:

• start (int) –

• end (int) –

• step (int) –

Return type:

None

end:int¶

start:int¶

step:int¶

Bases:CoreVariable

classVariable represents variables in Binary Ninja. Variables are resolvedin medium level IL, so variables objects are only valid for MLIL and above.

__init__(func:Function|LowLevelILFunction|MediumLevelILFunction|HighLevelILFunction,source_type:VariableSourceType,index:int,storage:int)[source]¶

Parameters:

• func (Function |LowLevelILFunction |MediumLevelILFunction |HighLevelILFunction) –

• source_type (VariableSourceType) –

• index (int) –

• storage (int) –

classmethodfrom_BNVariable(func:Function|LowLevelILFunction|MediumLevelILFunction|HighLevelILFunction,var:BNVariable)[source]¶

Parameters:

• func (Function |LowLevelILFunction |MediumLevelILFunction |HighLevelILFunction) –

• var (BNVariable) –

classmethodfrom_core_variable(func:Function|LowLevelILFunction|MediumLevelILFunction|HighLevelILFunction,var:CoreVariable)[source]¶

Parameters:

• func (Function |LowLevelILFunction |MediumLevelILFunction |HighLevelILFunction) –

• var (CoreVariable) –

classmethodfrom_identifier(func:Function|LowLevelILFunction|MediumLevelILFunction|HighLevelILFunction,identifier:int)[source]¶

Parameters:

• func (Function |LowLevelILFunction |MediumLevelILFunction |HighLevelILFunction) –

• identifier (int) –

classmethodfrom_variable_name_and_type(func:Function|LowLevelILFunction|MediumLevelILFunction|HighLevelILFunction,var:VariableNameAndType)[source]¶

Parameters:

• func (Function |LowLevelILFunction |MediumLevelILFunction |HighLevelILFunction) –

• var (VariableNameAndType) –

set_name_and_type_async(name:str|None,new_type:Type)→None[source]¶

set_name_and_type_async provides a way to asynchronously set both the name and type of a variable. This method should be usedwhen speed is of concern.

Parameters:

• name (str |None) –

• new_type (Type) –

Return type:

None

set_name_async(name:str|None)→None[source]¶

set_name_async provides a way to asynchronously set the name of a variable. This method should be usedwhen speed is of concern.

Parameters:

name (str |None) –

Return type:

None

set_type_async(new_type:Type)→None[source]¶

set_type_async provides a way to asynchronously set the type of a variable. This method should be usedwhen speed is of concern.

Parameters:

new_type (Type) –

Return type:

None

propertycore_variable:CoreVariable¶

Retrieve the underlyingCoreVariable class

propertydead_store_elimination:DeadStoreElimination¶

returns the dead store elimination setting for this variable

propertyfunction:Function¶

returns the source Function object which this variable belongs to

propertyil_function:function.ILFunctionType¶

returns the IL Function object which this variable belongs to

index:int¶

propertyis_parameter_variable:bool¶

returns whether this variable is a function parameter

propertylast_seen_name:str¶

Name of the variable, or the name most recently assigned if the variable has since been removed (read-only).

propertyname:str¶

Name of the variable, Settings this property is slow because it ensures that analysis has been updated. If you are renaming many variables, useset_name_async, then callupdate_analysis when complete.

propertyoffset_to_next_variable:int|None¶

returns number of bytes to the next variable on the stack

propertyssa_versions:Generator[int,None,None]¶

Returns the SSA versions associated with this variable. Doesn’t return anything for aliased variables.

storage:int¶

propertytype:Type|None¶

propertyvar_name_and_type:VariableNameAndType¶

Convert toVariableNameAndType

Bases:CoreVariable

classVariableNameAndType is a lightweight wrapper around avariable and its name, useful for shuttling between APIs that requirethem both. WhileVariable hasVariable.name andVariable.type fields, those require additional core callseach time you fetch them.

Variables:

• name – The variable’s name

• type – The variable’s type

__init__(_source_type:int,index:int,storage:int,name:str,type:Type)→None¶

Parameters:

• _source_type (int) –

• index (int) –

• storage (int) –

• name (str) –

• type (Type) –

Return type:

None

classmethodfrom_core_variable(var,name,type)[source]¶

classmethodfrom_identifier(identifier,name,type)[source]¶

name:str¶

type:Type¶