lowlevelil module

binaryninja.lowlevelil.ILFlag(arch, flag)
binaryninja.lowlevelil.ILRegister(arch, reg)
binaryninja.lowlevelil.LowLevelILBasicBlock(...)
binaryninja.lowlevelil.LowLevelILExpr(index) class LowLevelILExpr hold the index of IL Expressions.
binaryninja.lowlevelil.LowLevelILFunction(arch) class LowLevelILFunction contains the list of LowLevelILExpr objects that make up a function. LowLevelILExpr
binaryninja.lowlevelil.LowLevelILInstruction(...) class LowLevelILInstruction Low Level Intermediate Language Instructions are infinite length tree-based
binaryninja.lowlevelil.LowLevelILLabel([handle])
binaryninja.lowlevelil.LowLevelILOperationAndSize(...)
binaryninja.lowlevelil.SSAFlag(flag, version)
binaryninja.lowlevelil.SSARegister(reg, version)
binaryninja.lowlevelil.LLIL_GET_TEMP_REG_INDEX(n)
binaryninja.lowlevelil.LLIL_REG_IS_TEMP(n)
binaryninja.lowlevelil.LLIL_TEMP(n)
class binaryninja.lowlevelil.ILFlag(arch, flag)[source]

Bases: object

class binaryninja.lowlevelil.ILRegister(arch, reg)[source]

Bases: object

info
binaryninja.lowlevelil.LLIL_GET_TEMP_REG_INDEX(n)[source]
binaryninja.lowlevelil.LLIL_REG_IS_TEMP(n)[source]
binaryninja.lowlevelil.LLIL_TEMP(n)[source]
class binaryninja.lowlevelil.LowLevelILBasicBlock(view, handle, owner)[source]

Bases: binaryninja.basicblock.BasicBlock

class binaryninja.lowlevelil.LowLevelILExpr(index)[source]

Bases: object

class LowLevelILExpr hold the index of IL Expressions.

Note

This class shouldn’t be instantiated directly. Rather the helper members of LowLevelILFunction should be used instead.

class binaryninja.lowlevelil.LowLevelILFunction(arch, handle=None, source_func=None)[source]

Bases: object

class LowLevelILFunction contains the list of LowLevelILExpr objects that make up a function. LowLevelILExpr objects can be added to the LowLevelILFunction by calling append and passing the result of the various class methods which return LowLevelILExpr objects.

LowLevelILFlagCondition values used as parameters in the flag_condition method.

LowLevelILFlagCondition Operator Description
LLFC_E == Equal
LLFC_NE != Not equal
LLFC_SLT s< Signed less than
LLFC_ULT u< Unsigned less than
LLFC_SLE s<= Signed less than or equal
LLFC_ULE u<= Unsigned less than or equal
LLFC_SGE s>= Signed greater than or equal
LLFC_UGE u>= Unsigned greater than or equal
LLFC_SGT s> Signed greather than
LLFC_UGT u> Unsigned greater than
LLFC_NEG
Negative
LLFC_POS
Positive
LLFC_O overflow Overflow
LLFC_NO !overflow No overflow
add(size, a, b, flags=None)[source]

add adds expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression add.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

add_carry(size, a, b, carry, flags=None)[source]

add_carry adds with carry expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression adc.<size>{<flags>}(a, b, carry)

Return type:

LowLevelILExpr

add_label_for_address(arch, addr)[source]

add_label_for_address adds a low-level IL label for the given architecture arch at the given virtual address addr

Parameters:
  • arch (Architecture) – Architecture to add labels for
  • addr (int) – the IL address to add a label at
add_label_list(labels)[source]

add_label_list returns a label list expression for the given list of LowLevelILLabel objects.

Parameters:lables (list(LowLevelILLabel)) – the list of LowLevelILLabel to get a label list expression from
Returns:the label list expression
Return type:LowLevelILExpr
add_operand_list(operands)[source]

add_operand_list returns an operand list expression for the given list of integer operands.

Parameters:operands (list(int)) – list of operand numbers
Returns:an operand list expression
Return type:LowLevelILExpr
and_expr(size, a, b, flags=None)[source]

and_expr bitwise and’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression and.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

append(expr)[source]

append adds the LowLevelILExpr expr to the current LowLevelILFunction.

Parameters:expr (LowLevelILExpr) – the LowLevelILExpr to add to the current LowLevelILFunction
Returns:number of LowLevelILExpr in the current function
Return type:int
arith_shift_right(size, a, b, flags=None)[source]

arith_shift_right shifts arithmatic right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression asr.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

basic_blocks

list of LowLevelILBasicBlock objects (read-only)

breakpoint()[source]

breakpoint returns a processor breakpoint expression.

Returns:a breakpoint expression.
Return type:LowLevelILExpr
call(dest)[source]

call returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest

Parameters:dest (LowLevelILExpr) – the expression to call
Returns:The expression call(dest)
Return type:LowLevelILExpr
clear_indirect_branches()[source]
compare_equal(size, a, b)[source]

compare_equal returns comparison expression of size size checking if expression a is equal to expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_not_equal(size, a, b)[source]

compare_not_equal returns comparison expression of size size checking if expression a is not equal to expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_signed_greater_equal(size, a, b)[source]

compare_signed_greater_equal returns comparison expression of size size checking if expression a is signed greater than or equal toexpression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_signed_greater_than(size, a, b)[source]

compare_signed_greater_than returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_signed_less_equal(size, a, b)[source]

compare_signed_less_equal returns comparison expression of size size checking if expression a is signed less than or equal to expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_signed_less_than(size, a, b)[source]

compare_signed_less_than returns comparison expression of size size checking if expression a is signed less than expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_unsigned_greater_equal(size, a, b)[source]

compare_unsigned_greater_equal returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_unsigned_greater_than(size, a, b)[source]

compare_unsigned_greater_than returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_unsigned_less_equal(size, a, b)[source]

compare_unsigned_less_equal returns comparison expression of size size checking if expression a is unsigned less than or equal to expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

compare_unsigned_less_than(size, a, b)[source]

compare_unsigned_less_than returns comparison expression of size size checking if expression a is unsigned less than expression b

Parameters:
Returns:

a comparison expression.

Return type:

LowLevelILExpr

const(size, value)[source]

const returns an expression for the constant integer value with size size

Parameters:
  • size (int) – the size of the constant in bytes
  • value (int) – integer value of the constant
Returns:

A constant expression of given value and size

Return type:

LowLevelILExpr

const_pointer(size, value)[source]

const_pointer returns an expression for the constant pointer value with size size

Parameters:
  • size (int) – the size of the pointer in bytes
  • value (int) – address referenced by pointer
Returns:

A constant expression of given value and size

Return type:

LowLevelILExpr

current_address

Current IL Address (read/write)

div_double_prec_signed(size, hi, lo, b, flags=None)[source]

div_double_prec_signed signed double precision divide using expression hi and expression lo as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression divs.dp.<size>{<flags>}(hi:lo, b)

Return type:

LowLevelILExpr

div_double_prec_unsigned(size, hi, lo, b, flags=None)[source]

div_double_prec_unsigned unsigned double precision divide using expression hi and expression lo as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression divs.dp.<size>{<flags>}(hi:lo, b)

Return type:

LowLevelILExpr

div_signed(size, a, b, flags=None)[source]

div_signed signed divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression divs.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

div_unsigned(size, a, b, flags=None)[source]

div_unsigned unsigned divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression divs.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

expr(operation, a=0, b=0, c=0, d=0, size=0, flags=None)[source]
finalize()[source]

finalize ends the function and computes the list of basic blocks.

Return type:None
flag(reg)[source]

flag returns a flag expression for the given flag name.

Parameters:reg (str) – name of the flag expression to retrieve
Returns:A flag expression of given flag name
Return type:LowLevelILExpr
flag_bit(size, reg, bit)[source]

flag_bit sets the flag named reg and size size to the constant integer value bit

Parameters:
  • size (int) – the size of the flag
  • reg (str) – flag value
  • bit (int) – integer value to set the bit to
Returns:

A constant expression of given value and size FLAG.reg = bit

Return type:

LowLevelILExpr

flag_condition(cond)[source]

flag_condition returns a flag_condition expression for the given LowLevelILFlagCondition

Parameters:cond (LowLevelILFlagCondition) – Flag condition expression to retrieve
Returns:A flag_condition expression
Return type:LowLevelILExpr
get_instruction_start(addr, arch=None)[source]
get_label_for_address(arch, addr)[source]

get_label_for_address returns the LowLevelILLabel for the given Architecture arch and IL address addr.

Parameters:
Returns:

the LowLevelILLabel for the given IL address

Return type:

LowLevelILLabel

get_mapped_medium_level_il_expr_index(expr)[source]
get_mapped_medium_level_il_instruction_index(instr)[source]
get_non_ssa_instruction_index(instr)[source]
get_ssa_flag_definition(flag_ssa)[source]
get_ssa_flag_uses(flag_ssa)[source]
get_ssa_flag_value(flag_ssa)[source]
get_ssa_instruction_index(instr)[source]
get_ssa_memory_definition(index)[source]
get_ssa_memory_uses(index)[source]
get_ssa_reg_definition(reg_ssa)[source]
get_ssa_reg_uses(reg_ssa)[source]
get_ssa_reg_value(reg_ssa)[source]
goto(label)[source]

goto returns a goto expression which jumps to the provided LowLevelILLabel.

Parameters:label (LowLevelILLabel) – Label to jump to
Returns:the LowLevelILExpr that jumps to the provided label
Return type:LowLevelILExpr
if_expr(operand, t, f)[source]

if_expr returns the if expression which depending on condition operand jumps to the LowLevelILLabel t when the condition expression operand is non-zero and f when it’s zero.

Parameters:
Returns:

the LowLevelILExpr for the if expression

Return type:

LowLevelILExpr

jump(dest)[source]

jump returns an expression which jumps (branches) to the expression dest

Parameters:dest (LowLevelILExpr) – the expression to jump to
Returns:The expression jump(dest)
Return type:LowLevelILExpr
load(size, addr)[source]

laod Reads size bytes from the expression addr

Parameters:
  • size (int) – number of bytes to read
  • addr (LowLevelILExpr) – the expression to read memory from
Returns:

The expression [addr].size

Return type:

LowLevelILExpr

logical_shift_right(size, a, b, flags=None)[source]

logical_shift_right shifts logically right expression a by expression b potentially setting flags flags``and returning an expression of ``size bytes.

Parameters:
Returns:

The expression lsr.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

low_part(size, value, flags=None)[source]

low_part truncates value to size bytes

Parameters:
  • size (int) – the size of the result in bytes
  • value (LowLevelILExpr) – the expression to zero extend
Returns:

The expression (value).<size>

Return type:

LowLevelILExpr

mapped_medium_level_il

Medium level IL with mappings between low level IL and medium level IL. Unused stores are not removed. Typically, this should only be used to answer queries on assembly or low level IL where the query is easier to perform on medium level IL.

mark_label(label)[source]

mark_label assigns a LowLevelILLabel to the current IL address.

Parameters:label (LowLevelILLabel) –
Return type:None
medium_level_il

Medium level IL for this low level IL.

mod_double_prec_signed(size, hi, lo, b, flags=None)[source]

mod_double_prec_signed signed double precision modulus using expression hi and expression lo as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression mods.dp.<size>{<flags>}(hi:lo, b)

Return type:

LowLevelILExpr

mod_double_prec_unsigned(size, hi, lo, b, flags=None)[source]

mod_double_prec_unsigned unsigned double precision modulus using expression hi and expression lo as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression modu.dp.<size>{<flags>}(hi:lo, b)

Return type:

LowLevelILExpr

mod_signed(size, a, b, flags=None)[source]

mod_signed signed modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression mods.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

mod_unsigned(size, a, b, flags=None)[source]

mod_unsigned unsigned modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression modu.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

mult(size, a, b, flags=None)[source]

mult multiplies expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression sbc.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

mult_double_prec_signed(size, a, b, flags=None)[source]

mult_double_prec_signed multiplies signed with double precision expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression muls.dp.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

mult_double_prec_unsigned(size, a, b, flags=None)[source]

mult_double_prec_unsigned multiplies unsigned with double precision expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression muls.dp.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

neg_expr(size, value, flags=None)[source]

neg_expr two’s complement sign negation of expression value of size size potentially setting flags

Parameters:
  • size (int) – the size of the result in bytes
  • value (LowLevelILExpr) – the expression to negate
  • flags (str) – optional, flags to set
Returns:

The expression neg.<size>{<flags>}(value)

Return type:

LowLevelILExpr

no_ret()[source]

no_ret returns an expression halts disassembly

Returns:The expression noreturn
Return type:LowLevelILExpr
non_ssa_form

Low level IL in non-SSA (default) form (read-only)

nop()[source]

nop no operation, this instruction does nothing

Returns:The no operation expression
Return type:LowLevelILExpr
not_expr(size, value, flags=None)[source]

not_expr bitwise inverse of expression value of size size potentially setting flags

Parameters:
  • size (int) – the size of the result in bytes
  • value (LowLevelILExpr) – the expression to bitwise invert
  • flags (str) – optional, flags to set
Returns:

The expression not.<size>{<flags>}(value)

Return type:

LowLevelILExpr

operand(n, expr)[source]

operand sets the operand number of the expression expr and passes back expr without modification.

Parameters:
Returns:

returns the expression expr unmodified

Return type:

LowLevelILExpr

or_expr(size, a, b, flags=None)[source]

or_expr bitwise or’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression or.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

pop(size)[source]

pop reads size bytes from the stack, adjusting the stack by size.

Parameters:size (int) – number of bytes to read from the stack
Returns:The expression pop
Return type:LowLevelILExpr
push(size, value)[source]

push writes size bytes from expression value to the stack, adjusting the stack by size.

Parameters:
  • size (int) – number of bytes to write and adjust the stack by
  • value (LowLevelILExpr) – the expression to write
Returns:

The expression push(value)

Return type:

LowLevelILExpr

reg(size, reg)[source]

reg returns a register of size size with name name

Parameters:
  • size (int) – the size of the register in bytes
  • reg (str) – the name of the register
Returns:

A register expression for the given string

Return type:

LowLevelILExpr

ret(dest)[source]

ret returns an expression which jumps (branches) to the expression dest. ret is a special alias for jump that makes the disassembler top disassembling.

Parameters:dest (LowLevelILExpr) – the expression to jump to
Returns:The expression jump(dest)
Return type:LowLevelILExpr
rotate_left(size, a, b, flags=None)[source]

rotate_left bitwise rotates left expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression rol.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

rotate_left_carry(size, a, b, carry, flags=None)[source]

rotate_left_carry bitwise rotates left with carry expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression rlc.<size>{<flags>}(a, b, carry)

Return type:

LowLevelILExpr

rotate_right(size, a, b, flags=None)[source]

rotate_right bitwise rotates right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression ror.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

rotate_right_carry(size, a, b, carry, flags=None)[source]

rotate_right_carry bitwise rotates right with carry expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression rrc.<size>{<flags>}(a, b, carry)

Return type:

LowLevelILExpr

set_current_address(value, arch=None)[source]
set_flag(flag, value)[source]

set_flag sets the flag flag to the LowLevelILExpr value

Parameters:
  • flag (str) – the low register name
  • value (LowLevelILExpr) – an expression to set the flag to
Returns:

The expression FLAG.flag = value

Return type:

LowLevelILExpr

set_indirect_branches(branches)[source]
set_reg(size, reg, value, flags=0)[source]

set_reg sets the register reg of size size to the expression value

Parameters:
  • size (int) – size of the register parameter in bytes
  • reg (str) – the register name
  • value (LowLevelILExpr) – an expression to set the register to
  • flags (str) – which flags are set by this operation
Returns:

The expression reg = value

Return type:

LowLevelILExpr

set_reg_split(size, hi, lo, value, flags=0)[source]

set_reg_split uses hi and lo as a single extended register setting hi:lo to the expression value.

Parameters:
  • size (int) – size of the register parameter in bytes
  • hi (str) – the high register name
  • lo (str) – the low register name
  • value (LowLevelILExpr) – an expression to set the split regiters to
  • flags (str) – which flags are set by this operation
Returns:

The expression hi:lo = value

Return type:

LowLevelILExpr

shift_left(size, a, b, flags=None)[source]

shift_left subtracts with borrow expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression lsl.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

sign_extend(size, value, flags=None)[source]

sign_extend two’s complement sign-extends the expression in value to size bytes

Parameters:
  • size (int) – the size of the result in bytes
  • value (LowLevelILExpr) – the expression to sign extn
  • flags (str) – optional, flags to set
Returns:

The expression sx.<size>(value)

Return type:

LowLevelILExpr

ssa_form

Low level IL in SSA form (read-only)

store(size, addr, value)[source]

store Writes size bytes to expression addr read from expression value

Parameters:
Returns:

The expression [addr].size = value

Return type:

LowLevelILExpr

sub(size, a, b, flags=None)[source]

sub subtracts expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression sub.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

sub_borrow(size, a, b, carry, flags=None)[source]

sub_borrow subtracts with borrow expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression sbb.<size>{<flags>}(a, b, carry)

Return type:

LowLevelILExpr

system_call()[source]

system_call return a system call expression.

Returns:a system call expression.
Return type:LowLevelILExpr
temp_flag_count

Number of temporary flags (read-only)

temp_reg_count

Number of temporary registers (read-only)

test_bit(size, a, b)[source]
trap(value)[source]

trap returns a processor trap (interrupt) expression of the given integer value.

Parameters:value (int) – trap (interrupt) number
Returns:a trap expression.
Return type:LowLevelILExpr
undefined()[source]

undefined returns the undefined expression. This should be used for instructions which perform functions but aren’t important for dataflow or partial emulation purposes.

Returns:the unimplemented expression.
Return type:LowLevelILExpr
unimplemented()[source]

unimplemented returns the unimplemented expression. This should be used for all instructions which aren’t implemented.

Returns:the unimplemented expression.
Return type:LowLevelILExpr
unimplemented_memory_ref(size, addr)[source]

unimplemented_memory_ref a memory reference to expression addr of size size with unimplemented operation.

Parameters:
  • size (int) – size in bytes of the memory reference
  • addr (LowLevelILExpr) – expression to reference memory
Returns:

the unimplemented memory reference expression.

Return type:

LowLevelILExpr

xor_expr(size, a, b, flags=None)[source]

xor_expr xor’s expression a with expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:
Returns:

The expression xor.<size>{<flags>}(a, b)

Return type:

LowLevelILExpr

zero_extend(size, value, flags=None)[source]

zero_extend zero-extends the expression in value to size bytes

Parameters:
  • size (int) – the size of the result in bytes
  • value (LowLevelILExpr) – the expression to zero extend
Returns:

The expression sx.<size>(value)

Return type:

LowLevelILExpr

class binaryninja.lowlevelil.LowLevelILInstruction(func, expr_index, instr_index=None)[source]

Bases: object

class LowLevelILInstruction Low Level Intermediate Language Instructions are infinite length tree-based instructions. Tree-based instructions use infix notation with the left hand operand being the destination operand. Infix notation is thus more natural to read than other notations (e.g. x86 mov eax, 0 vs. LLIL eax = 0).

ILOperations = {<LowLevelILOperation.LLIL_NOP: 0>: [], <LowLevelILOperation.LLIL_SET_REG: 1>: [('dest', 'reg'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_SPLIT: 2>: [('hi', 'reg'), ('lo', 'reg'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_FLAG: 3>: [('dest', 'flag'), ('src', 'expr')], <LowLevelILOperation.LLIL_LOAD: 4>: [('src', 'expr')], <LowLevelILOperation.LLIL_STORE: 5>: [('dest', 'expr'), ('src', 'expr')], <LowLevelILOperation.LLIL_PUSH: 6>: [('src', 'expr')], <LowLevelILOperation.LLIL_POP: 7>: [], <LowLevelILOperation.LLIL_REG: 8>: [('src', 'reg')], <LowLevelILOperation.LLIL_CONST: 9>: [('constant', 'int')], <LowLevelILOperation.LLIL_CONST_PTR: 10>: [('constant', 'int')], <LowLevelILOperation.LLIL_FLAG: 11>: [('src', 'flag')], <LowLevelILOperation.LLIL_FLAG_BIT: 12>: [('src', 'flag'), ('bit', 'int')], <LowLevelILOperation.LLIL_ADD: 13>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_ADC: 14>: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], <LowLevelILOperation.LLIL_SUB: 15>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_SBB: 16>: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], <LowLevelILOperation.LLIL_AND: 17>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_OR: 18>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_XOR: 19>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_LSL: 20>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_LSR: 21>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_ASR: 22>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_ROL: 23>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_RLC: 24>: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], <LowLevelILOperation.LLIL_ROR: 25>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_RRC: 26>: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], <LowLevelILOperation.LLIL_MUL: 27>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MULU_DP: 28>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MULS_DP: 29>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_DIVU: 30>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_DIVU_DP: 31>: [('hi', 'expr'), ('lo', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_DIVS: 32>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_DIVS_DP: 33>: [('hi', 'expr'), ('lo', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MODU: 34>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MODU_DP: 35>: [('hi', 'expr'), ('lo', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MODS: 36>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MODS_DP: 37>: [('hi', 'expr'), ('lo', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_NEG: 38>: [('src', 'expr')], <LowLevelILOperation.LLIL_NOT: 39>: [('src', 'expr')], <LowLevelILOperation.LLIL_SX: 40>: [('src', 'expr')], <LowLevelILOperation.LLIL_ZX: 41>: [('src', 'expr')], <LowLevelILOperation.LLIL_LOW_PART: 42>: [('src', 'expr')], <LowLevelILOperation.LLIL_JUMP: 43>: [('dest', 'expr')], <LowLevelILOperation.LLIL_JUMP_TO: 44>: [('dest', 'expr'), ('targets', 'int_list')], <LowLevelILOperation.LLIL_CALL: 45>: [('dest', 'expr')], <LowLevelILOperation.LLIL_RET: 46>: [('dest', 'expr')], <LowLevelILOperation.LLIL_NORET: 47>: [], <LowLevelILOperation.LLIL_IF: 48>: [('condition', 'expr'), ('true', 'int'), ('false', 'int')], <LowLevelILOperation.LLIL_GOTO: 49>: [('dest', 'int')], <LowLevelILOperation.LLIL_FLAG_COND: 50>: [('condition', 'cond')], <LowLevelILOperation.LLIL_CMP_E: 51>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_NE: 52>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_SLT: 53>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_ULT: 54>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_SLE: 55>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_ULE: 56>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_SGE: 57>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_UGE: 58>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_SGT: 59>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_UGT: 60>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_TEST_BIT: 61>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_BOOL_TO_INT: 62>: [('src', 'expr')], <LowLevelILOperation.LLIL_ADD_OVERFLOW: 63>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_SYSCALL: 64>: [], <LowLevelILOperation.LLIL_BP: 65>: [], <LowLevelILOperation.LLIL_TRAP: 66>: [('vector', 'int')], <LowLevelILOperation.LLIL_UNDEF: 67>: [], <LowLevelILOperation.LLIL_UNIMPL: 68>: [], <LowLevelILOperation.LLIL_UNIMPL_MEM: 69>: [('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_SSA: 70>: [('dest', 'reg_ssa'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_SSA_PARTIAL: 71>: [('full_reg', 'reg_ssa'), ('dest', 'reg'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_SPLIT_SSA: 72>: [('hi', 'expr'), ('lo', 'expr'), ('src', 'expr')], <LowLevelILOperation.LLIL_REG_SPLIT_DEST_SSA: 73>: [('dest', 'reg_ssa')], <LowLevelILOperation.LLIL_REG_SSA: 74>: [('src', 'reg_ssa')], <LowLevelILOperation.LLIL_REG_SSA_PARTIAL: 75>: [('full_reg', 'reg_ssa'), ('src', 'reg')], <LowLevelILOperation.LLIL_SET_FLAG_SSA: 76>: [('dest', 'flag_ssa'), ('src', 'expr')], <LowLevelILOperation.LLIL_FLAG_SSA: 77>: [('src', 'flag_ssa')], <LowLevelILOperation.LLIL_FLAG_BIT_SSA: 78>: [('src', 'flag_ssa'), ('bit', 'int')], <LowLevelILOperation.LLIL_CALL_SSA: 79>: [('output', 'expr'), ('dest', 'expr'), ('stack', 'expr'), ('param', 'expr')], <LowLevelILOperation.LLIL_SYSCALL_SSA: 80>: [('output', 'expr'), ('stack', 'expr'), ('param', 'expr')], <LowLevelILOperation.LLIL_CALL_PARAM_SSA: 81>: [('src', 'reg_ssa_list')], <LowLevelILOperation.LLIL_CALL_STACK_SSA: 82>: [('src', 'reg_ssa'), ('src_memory', 'int')], <LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: 83>: [('dest_memory', 'int'), ('dest', 'reg_ssa_list')], <LowLevelILOperation.LLIL_LOAD_SSA: 84>: [('src', 'expr'), ('src_memory', 'int')], <LowLevelILOperation.LLIL_STORE_SSA: 85>: [('dest', 'expr'), ('dest_memory', 'int'), ('src_memory', 'int'), ('src', 'expr')], <LowLevelILOperation.LLIL_REG_PHI: 86>: [('dest', 'reg_ssa'), ('src', 'reg_ssa_list')], <LowLevelILOperation.LLIL_FLAG_PHI: 87>: [('dest', 'flag_ssa'), ('src', 'flag_ssa_list')], <LowLevelILOperation.LLIL_MEM_PHI: 88>: [('dest_memory', 'int'), ('src_memory', 'int_list')]}
get_flag_value(flag)[source]
get_flag_value_after(flag)[source]
get_possible_flag_values(flag)[source]
get_possible_flag_values_after(flag)[source]
get_possible_reg_values(reg)[source]
get_possible_reg_values_after(reg)[source]
get_possible_stack_contents(offset, size)[source]
get_possible_stack_contents_after(offset, size)[source]
get_reg_value(reg)[source]
get_reg_value_after(reg)[source]
get_stack_contents(offset, size)[source]
get_stack_contents_after(offset, size)[source]
mapped_medium_level_il

Gets the medium level IL expression corresponding to this expression

non_ssa_form

Non-SSA form of expression (read-only)

possible_values

Possible values of expression using path-sensitive static data flow analysis (read-only)

postfix_operands

All operands in the expression tree in postfix order

prefix_operands

All operands in the expression tree in prefix order

ssa_form

SSA form of expression (read-only)

tokens

LLIL tokens (read-only)

value

Value of expression if constant or a known value (read-only)

class binaryninja.lowlevelil.LowLevelILLabel(handle=None)[source]

Bases: object

class binaryninja.lowlevelil.LowLevelILOperationAndSize(operation, size)[source]

Bases: object

class binaryninja.lowlevelil.SSAFlag(flag, version)[source]

Bases: object

class binaryninja.lowlevelil.SSARegister(reg, version)[source]

Bases: object