lowlevelil module

binaryninja.lowlevelil.CoreLowLevelILInstruction(...)

binaryninja.lowlevelil.ILFlag(arch, index)

binaryninja.lowlevelil.ILIntrinsic(arch, index)

binaryninja.lowlevelil.ILRegister(arch, index)

binaryninja.lowlevelil.ILRegisterStack(arch, ...)

binaryninja.lowlevelil.ILSemanticFlagClass(...)

binaryninja.lowlevelil.ILSemanticFlagGroup(...)

binaryninja.lowlevelil.LowLevelILAdc(...)

binaryninja.lowlevelil.LowLevelILAdd(...)

binaryninja.lowlevelil.LowLevelILAddOverflow(...)

binaryninja.lowlevelil.LowLevelILAnd(...)

binaryninja.lowlevelil.LowLevelILAsr(...)

binaryninja.lowlevelil.LowLevelILBasicBlock(...)

The LogLevelILBasicBlock object is returned during analysis and should not be directly instantiated.

binaryninja.lowlevelil.LowLevelILBinaryBase(...)

binaryninja.lowlevelil.LowLevelILBoolToInt(...)

binaryninja.lowlevelil.LowLevelILBp(...)

binaryninja.lowlevelil.LowLevelILCall(...)

binaryninja.lowlevelil.LowLevelILCallOutputSsa(...)

binaryninja.lowlevelil.LowLevelILCallParam(...)

binaryninja.lowlevelil.LowLevelILCallSsa(...)

binaryninja.lowlevelil.LowLevelILCallStackAdjust(...)

binaryninja.lowlevelil.LowLevelILCallStackSsa(...)

binaryninja.lowlevelil.LowLevelILCarryBase(...)

binaryninja.lowlevelil.LowLevelILCeil(...)

binaryninja.lowlevelil.LowLevelILCmpE(...)

binaryninja.lowlevelil.LowLevelILCmpNe(...)

binaryninja.lowlevelil.LowLevelILCmpSge(...)

binaryninja.lowlevelil.LowLevelILCmpSgt(...)

binaryninja.lowlevelil.LowLevelILCmpSle(...)

binaryninja.lowlevelil.LowLevelILCmpSlt(...)

binaryninja.lowlevelil.LowLevelILCmpUge(...)

binaryninja.lowlevelil.LowLevelILCmpUgt(...)

binaryninja.lowlevelil.LowLevelILCmpUle(...)

binaryninja.lowlevelil.LowLevelILCmpUlt(...)

binaryninja.lowlevelil.LowLevelILComparisonBase(...)

binaryninja.lowlevelil.LowLevelILConst(...)

binaryninja.lowlevelil.LowLevelILConstPtr(...)

binaryninja.lowlevelil.LowLevelILConstantBase(...)

binaryninja.lowlevelil.LowLevelILDivs(...)

binaryninja.lowlevelil.LowLevelILDivsDp(...)

binaryninja.lowlevelil.LowLevelILDivu(...)

binaryninja.lowlevelil.LowLevelILDivuDp(...)

binaryninja.lowlevelil.LowLevelILExpr(index)

class LowLevelILExpr hold the index of IL Expressions.

binaryninja.lowlevelil.LowLevelILExternPtr(...)

binaryninja.lowlevelil.LowLevelILFabs(...)

binaryninja.lowlevelil.LowLevelILFadd(...)

binaryninja.lowlevelil.LowLevelILFcmpE(...)

binaryninja.lowlevelil.LowLevelILFcmpGe(...)

binaryninja.lowlevelil.LowLevelILFcmpGt(...)

binaryninja.lowlevelil.LowLevelILFcmpLe(...)

binaryninja.lowlevelil.LowLevelILFcmpLt(...)

binaryninja.lowlevelil.LowLevelILFcmpNe(...)

binaryninja.lowlevelil.LowLevelILFcmpO(...)

binaryninja.lowlevelil.LowLevelILFcmpUo(...)

binaryninja.lowlevelil.LowLevelILFdiv(...)

binaryninja.lowlevelil.LowLevelILFlag(...)

binaryninja.lowlevelil.LowLevelILFlagBit(...)

binaryninja.lowlevelil.LowLevelILFlagBitSsa(...)

binaryninja.lowlevelil.LowLevelILFlagCond(...)

binaryninja.lowlevelil.LowLevelILFlagGroup(...)

binaryninja.lowlevelil.LowLevelILFlagPhi(...)

binaryninja.lowlevelil.LowLevelILFlagSsa(...)

binaryninja.lowlevelil.LowLevelILFloatConst(...)

binaryninja.lowlevelil.LowLevelILFloatConv(...)

binaryninja.lowlevelil.LowLevelILFloatToInt(...)

binaryninja.lowlevelil.LowLevelILFloor(...)

binaryninja.lowlevelil.LowLevelILFmul(...)

binaryninja.lowlevelil.LowLevelILFneg(...)

binaryninja.lowlevelil.LowLevelILFsqrt(...)

binaryninja.lowlevelil.LowLevelILFsub(...)

binaryninja.lowlevelil.LowLevelILFtrunc(...)

binaryninja.lowlevelil.LowLevelILFunction([...])

class LowLevelILFunction contains the list of ExpressionIndex objects that make up a function.

binaryninja.lowlevelil.LowLevelILGoto(...)

binaryninja.lowlevelil.LowLevelILIf(...)

binaryninja.lowlevelil.LowLevelILInstruction(...)

class LowLevelILInstruction Low Level Intermediate Language Instructions are infinite length tree-based instructions.

binaryninja.lowlevelil.LowLevelILIntToFloat(...)

binaryninja.lowlevelil.LowLevelILIntrinsic(...)

binaryninja.lowlevelil.LowLevelILIntrinsicSsa(...)

binaryninja.lowlevelil.LowLevelILJump(...)

binaryninja.lowlevelil.LowLevelILJumpTo(...)

binaryninja.lowlevelil.LowLevelILLabel([handle])

binaryninja.lowlevelil.LowLevelILLoad(...)

binaryninja.lowlevelil.LowLevelILLoadSsa(...)

binaryninja.lowlevelil.LowLevelILLowPart(...)

binaryninja.lowlevelil.LowLevelILLsl(...)

binaryninja.lowlevelil.LowLevelILLsr(...)

binaryninja.lowlevelil.LowLevelILMemPhi(...)

binaryninja.lowlevelil.LowLevelILMods(...)

binaryninja.lowlevelil.LowLevelILModsDp(...)

binaryninja.lowlevelil.LowLevelILModu(...)

binaryninja.lowlevelil.LowLevelILModuDp(...)

binaryninja.lowlevelil.LowLevelILMul(...)

binaryninja.lowlevelil.LowLevelILMulsDp(...)

binaryninja.lowlevelil.LowLevelILMuluDp(...)

binaryninja.lowlevelil.LowLevelILNeg(...)

binaryninja.lowlevelil.LowLevelILNop(...)

binaryninja.lowlevelil.LowLevelILNoret(...)

binaryninja.lowlevelil.LowLevelILNot(...)

binaryninja.lowlevelil.LowLevelILOperationAndSize(...)

binaryninja.lowlevelil.LowLevelILOr(...)

binaryninja.lowlevelil.LowLevelILPop(...)

binaryninja.lowlevelil.LowLevelILPush(...)

binaryninja.lowlevelil.LowLevelILReg(...)

binaryninja.lowlevelil.LowLevelILRegPhi(...)

binaryninja.lowlevelil.LowLevelILRegSplit(...)

binaryninja.lowlevelil.LowLevelILRegSplitDestSsa(...)

binaryninja.lowlevelil.LowLevelILRegSplitSsa(...)

binaryninja.lowlevelil.LowLevelILRegSsa(...)

binaryninja.lowlevelil.LowLevelILRegSsaPartial(...)

binaryninja.lowlevelil.LowLevelILRegStackAbsSsa(...)

binaryninja.lowlevelil.LowLevelILRegStackDestSsa(...)

binaryninja.lowlevelil.LowLevelILRegStackFreeAbsSsa(...)

binaryninja.lowlevelil.LowLevelILRegStackFreeReg(...)

binaryninja.lowlevelil.LowLevelILRegStackFreeRel(...)

binaryninja.lowlevelil.LowLevelILRegStackFreeRelSsa(...)

binaryninja.lowlevelil.LowLevelILRegStackPhi(...)

binaryninja.lowlevelil.LowLevelILRegStackPop(...)

binaryninja.lowlevelil.LowLevelILRegStackPush(...)

binaryninja.lowlevelil.LowLevelILRegStackRel(...)

binaryninja.lowlevelil.LowLevelILRegStackRelSsa(...)

binaryninja.lowlevelil.LowLevelILRet(...)

binaryninja.lowlevelil.LowLevelILRlc(...)

binaryninja.lowlevelil.LowLevelILRol(...)

binaryninja.lowlevelil.LowLevelILRor(...)

binaryninja.lowlevelil.LowLevelILRoundToInt(...)

binaryninja.lowlevelil.LowLevelILRrc(...)

binaryninja.lowlevelil.LowLevelILSbb(...)

binaryninja.lowlevelil.LowLevelILSetFlag(...)

binaryninja.lowlevelil.LowLevelILSetFlagSsa(...)

binaryninja.lowlevelil.LowLevelILSetReg(...)

binaryninja.lowlevelil.LowLevelILSetRegSplit(...)

binaryninja.lowlevelil.LowLevelILSetRegSplitSsa(...)

binaryninja.lowlevelil.LowLevelILSetRegSsa(...)

binaryninja.lowlevelil.LowLevelILSetRegSsaPartial(...)

binaryninja.lowlevelil.LowLevelILSetRegStackAbsSsa(...)

binaryninja.lowlevelil.LowLevelILSetRegStackRel(...)

binaryninja.lowlevelil.LowLevelILSetRegStackRelSsa(...)

binaryninja.lowlevelil.LowLevelILStore(...)

binaryninja.lowlevelil.LowLevelILStoreSsa(...)

binaryninja.lowlevelil.LowLevelILSub(...)

binaryninja.lowlevelil.LowLevelILSx(...)

binaryninja.lowlevelil.LowLevelILSyscall(...)

binaryninja.lowlevelil.LowLevelILSyscallSsa(...)

binaryninja.lowlevelil.LowLevelILTailcall(...)

binaryninja.lowlevelil.LowLevelILTailcallSsa(...)

binaryninja.lowlevelil.LowLevelILTestBit(...)

binaryninja.lowlevelil.LowLevelILTrap(...)

binaryninja.lowlevelil.LowLevelILUnaryBase(...)

binaryninja.lowlevelil.LowLevelILUndef(...)

binaryninja.lowlevelil.LowLevelILUnimpl(...)

binaryninja.lowlevelil.LowLevelILUnimplMem(...)

binaryninja.lowlevelil.LowLevelILXor(...)

binaryninja.lowlevelil.LowLevelILZx(...)

binaryninja.lowlevelil.SSAFlag(flag, version)

binaryninja.lowlevelil.SSARegister(reg, version)

binaryninja.lowlevelil.SSARegisterOrFlag(...)

binaryninja.lowlevelil.SSARegisterStack(...)

class CoreLowLevelILInstruction(operation: binaryninja.enums.LowLevelILOperation, attributes: int, size: int, flags: int, source_operand: <function NewType.<locals>.new_type at 0x1027ead30>, operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex], address: int)[source]

Bases: object

Parameters:

  • operation (LowLevelILOperation) –

  • attributes (int) –

  • size (int) –

  • flags (int) –

  • source_operand (ExpressionIndex) –

  • operands (Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]) –

  • address (int) –

classmethod from_BNLowLevelILInstruction(instr: BNLowLevelILInstruction) → CoreLowLevelILInstruction[source]
Parameters:

instr (BNLowLevelILInstruction) –

Return type:

CoreLowLevelILInstruction

address: int
attributes: int
flags: int
operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]
operation: LowLevelILOperation
size: int
source_operand: ExpressionIndex
class ILFlag(arch: 'architecture.Architecture', index: 'architecture.FlagIndex')[source]

Bases: object

Parameters:
arch: Architecture
index: FlagIndex
property name: FlagName
property temp: bool
class ILIntrinsic(arch: 'architecture.Architecture', index: 'architecture.IntrinsicIndex')[source]

Bases: object

Parameters:
arch: Architecture
index: IntrinsicIndex
property inputs: List[IntrinsicInput]

inputs is only available if the IL intrinsic is an Architecture intrinsic

property name: IntrinsicName
property outputs: List[Type]

outputs is only available if the IL intrinsic is an Architecture intrinsic

class ILRegister(arch: 'architecture.Architecture', index: 'architecture.RegisterIndex')[source]

Bases: object

Parameters:
arch: Architecture
index: RegisterIndex
property info: RegisterInfo
property name: RegisterName
property temp: bool
class ILRegisterStack(arch: 'architecture.Architecture', index: 'architecture.RegisterStackIndex')[source]

Bases: object

Parameters:
arch: Architecture
index: RegisterStackIndex
property info: RegisterStackInfo
property name: RegisterStackName
class ILSemanticFlagClass(arch: 'architecture.Architecture', index: 'architecture.SemanticClassIndex')[source]

Bases: object

Parameters:
arch: Architecture
index: SemanticClassIndex
property name: SemanticClassName
class ILSemanticFlagGroup(arch: 'architecture.Architecture', index: 'architecture.SemanticGroupIndex')[source]

Bases: object

Parameters:
arch: Architecture
index: SemanticGroupIndex
property name: SemanticGroupName
class LowLevelILAdc(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILCarryBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILAdd(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILAddOverflow(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILAnd(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILAsr(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILBasicBlock(handle: LP_BNBasicBlock, owner: LowLevelILFunction, view: Optional[BinaryView])[source]

Bases: BasicBlock

The LogLevelILBasicBlock object is returned during analysis and should not be directly instantiated.

Parameters:
property il_function: LowLevelILFunction
property instruction_count: int
class LowLevelILBinaryBase(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, BinaryOperation

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property left: LowLevelILInstruction
property right: LowLevelILInstruction
class LowLevelILBoolToInt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILBp(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, Terminal

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCall(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, Localcall

Parameters:
property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCallOutputSsa(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, SSA

Parameters:
property dest: List[SSARegister]
property dest_memory: int
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCallParam(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, SSA

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: List[LowLevelILInstruction]
class LowLevelILCallSsa(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, Localcall, SSA

Parameters:
property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property output: List[SSARegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property stack: LowLevelILInstruction
class LowLevelILCallStackAdjust(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, Localcall

Parameters:
property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property reg_stack_adjustments: Dict[RegisterStackName, int]
property stack_adjustment: int
class LowLevelILCallStackSsa(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, SSA

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: SSARegister
property src_memory: int
class LowLevelILCarryBase(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, Carry

Parameters:
property carry: LowLevelILInstruction
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property left: LowLevelILInstruction
property right: LowLevelILInstruction
class LowLevelILCeil(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILCmpE(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpNe(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpSge(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, Signed

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpSgt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, Signed

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpSle(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, Signed

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpSlt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, Signed

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpUge(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpUgt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpUle(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILCmpUlt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILComparisonBase(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Comparison

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILConst(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILConstantBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILConstPtr(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILConstantBase

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILConstantBase(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, Constant

Parameters:
property constant: int
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILDivs(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic, Signed

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILDivsDp(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, DoublePrecision, Signed

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILDivu(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILDivuDp(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, DoublePrecision

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILExpr(index: ExpressionIndex)[source]

Bases: object

class LowLevelILExpr hold the index of IL Expressions.

Note

Deprecated. Use ExpressionIndex instead

Parameters:

index (ExpressionIndex) –

property index: ExpressionIndex
class LowLevelILExternPtr(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILConstantBase

Parameters:
property constant: int
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property offset: int
class LowLevelILFabs(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILFadd(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFcmpE(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFcmpGe(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFcmpGt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFcmpLe(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFcmpLt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFcmpNe(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFcmpO(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFcmpUo(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILComparisonBase, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFdiv(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFlag(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: ILFlag
class LowLevelILFlagBit(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction

Parameters:
property bit: int
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: ILFlag
class LowLevelILFlagBitSsa(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, SSA

Parameters:
property bit: int
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: SSAFlag
class LowLevelILFlagCond(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction

Parameters:
property condition: LowLevelILFlagCondition
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property semantic_class: Optional[ILSemanticFlagClass]
class LowLevelILFlagGroup(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property semantic_group: ILSemanticFlagGroup
class LowLevelILFlagPhi(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, Phi

Parameters:
property dest: SSAFlag
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: List[SSAFlag]
class LowLevelILFlagSsa(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, SSA

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: SSAFlag
class LowLevelILFloatConst(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILConstantBase, FloatingPoint

Parameters:
property constant: Union[int, float]
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFloatConv(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILFloatToInt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILFloor(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILFmul(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFneg(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILFsqrt(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILFsub(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

Parameters:
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
class LowLevelILFtrunc(function: 'LowLevelILFunction', expr_index: <function NewType.<locals>.new_type at 0x1027ead30>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

Parameters:
property detailed_operands: List[Tuple[str, Optional[Union[LowLevelILOperationAndSize, ILRegister, ILFlag, ILIntrinsic, ILRegisterStack, int, Dict[int, int], float, LowLevelILInstruction, Dict[RegisterStackName, int], SSAFlag, SSARegister, SSARegisterStack, ILSemanticFlagClass, ILSemanticFlagGroup, LowLevelILFlagCondition, List[int], List[LowLevelILInstruction], List[Union[ILFlag, ILRegister]], List[SSARegister], List[SSARegisterStack], List[SSAFlag], List[SSARegisterOrFlag]]], str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: Optional[InstructionIndex]
property src: LowLevelILInstruction
class LowLevelILFunction(arch: Optional[Architecture] = None, handle: Optional[BNLowLevelILFunction] = None, source_func: Optional[Function] = None)[source]

Bases: object

class LowLevelILFunction contains the list of ExpressionIndex objects that make up a function. ExpressionIndex objects can be added to the LowLevelILFunction by calling append and passing the result of the various class methods which return ExpressionIndex objects.

LowLevelILFlagCondition values used as parameters in the flag_condition method.

LowLevelILFlagCondition

Operator

Description

LLFC_E

==

Equal

LLFC_NE

!=

Not equal

LLFC_SLT

s<

Signed less than

LLFC_ULT

u<

Unsigned less than

LLFC_SLE

s<=

Signed less than or equal

LLFC_ULE

u<=

Unsigned less than or equal

LLFC_SGE

s>=

Signed greater than or equal

LLFC_UGE

u>=

Unsigned greater than or equal

LLFC_SGT

s>

Signed greater than

LLFC_UGT

u>

Unsigned greater than

LLFC_NEG

Negative

LLFC_POS

Positive

LLFC_O

overflow

Overflow

LLFC_NO

!overflow

No overflow
Parameters:
add(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

add adds expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression add.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

add_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

add_carry adds with carry expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – flags to set

Returns:

The expression adc.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

add_label_for_address(arch: Architecture, addr: int) → None[source]

add_label_for_address adds a low-level IL label for the given architecture arch at the given virtual address addr

Parameters:

  • arch (Architecture) – Architecture to add labels for

  • addr (int) – the IL address to add a label at

Return type:

None

add_label_map(labels: Dict[int, LowLevelILLabel]) → ExpressionIndex[source]

add_label_map returns a label list expression for the given list of LowLevelILLabel objects.

Parameters:

labels (dict(int, LowLevelILLabel)) – the list of LowLevelILLabel to get a label list expression from

Returns:

the label list expression

Return type:

ExpressionIndex

add_operand_list(operands: List[ExpressionIndex]) → ExpressionIndex[source]

add_operand_list returns an operand list expression for the given list of integer operands.

Parameters:

operands (List(Union[ExpressionIndex, ExpressionIndex])) – list of operand numbers

Returns:

an operand list expression

Return type:

ExpressionIndex

and_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

and_expr bitwise and’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression and.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

append(expr: ExpressionIndex) → int[source]

append adds the ExpressionIndex expr to the current LowLevelILFunction.

Parameters:

expr (ExpressionIndex) – the ExpressionIndex to add to the current LowLevelILFunction

Returns:

number of ExpressionIndex in the current function

Return type:

int

arith_shift_right(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

arith_shift_right shifts arithmetic right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression asr.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

breakpoint() → ExpressionIndex[source]

breakpoint returns a processor breakpoint expression.

Returns:

a breakpoint expression.

Return type:

ExpressionIndex

call(dest: ExpressionIndex) → ExpressionIndex[source]

call returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest

Parameters:

dest (ExpressionIndex) – the expression to call

Returns:

The expression call(dest)

Return type:

ExpressionIndex

call_stack_adjust(dest: ExpressionIndex, stack_adjust: int) → ExpressionIndex[source]

call_stack_adjust returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest. After the function exits, stack_adjust is added to the stack pointer register.

Parameters:

  • dest (ExpressionIndex) – the expression to call

  • stack_adjust (int) –

Returns:

The expression call(dest), stack += stack_adjust

Return type:

ExpressionIndex

ceil(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

ceil rounds a floating point value to an integer towards positive infinity

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round up

  • flags (str) – optional, flags to set

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

clear_indirect_branches() → None[source]
Return type:

None

compare_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_equal returns comparison expression of size size checking if expression a is equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_not_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_not_equal returns comparison expression of size size checking if expression a is not equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_signed_greater_equal returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_signed_greater_than returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_signed_less_equal returns comparison expression of size size checking if expression a is signed less than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_signed_less_than returns comparison expression of size size checking if expression a is signed less than expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_unsigned_greater_equal returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_unsigned_greater_than returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_unsigned_less_equal returns comparison expression of size size checking if expression a is unsigned less than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

compare_unsigned_less_than returns comparison expression of size size checking if expression a is unsigned less than expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

Returns:

a comparison expression.

Return type:

ExpressionIndex

const(size: int, value: int) → ExpressionIndex[source]

const returns an expression for the constant integer value with size size

Parameters:

  • size (int) – the size of the constant in bytes

  • value (int) – integer value of the constant

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

const_pointer(size: int, value: int) → ExpressionIndex[source]

const_pointer returns an expression for the constant pointer value with size size

Parameters:

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by pointer

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

create_graph(settings: Optional[DisassemblySettings] = None) → CoreFlowGraph[source]
Parameters:

settings (Optional[DisassemblySettings]) –

Return type:

CoreFlowGraph

div_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

div_double_prec_signed signed double precision divide using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression divs.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

div_double_prec_unsigned unsigned double precision divide using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression divu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

div_signed signed divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression divs.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

div_unsigned unsigned divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression divu.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

expr(operation, a: ExpressionIndex = 0, b: ExpressionIndex = 0, c: ExpressionIndex = 0, d: ExpressionIndex = 0, size: int = 0, flags: Optional[Union[architecture.FlagWriteTypeName, architecture.FlagType, architecture.FlagIndex]] = None) → ExpressionIndex[source]
Parameters:

  • a (ExpressionIndex) –

  • b (ExpressionIndex) –

  • c (ExpressionIndex) –

  • d (ExpressionIndex) –

  • size (int) –

  • flags (Optional[Union[architecture.FlagWriteTypeName, architecture.FlagType, architecture.FlagIndex]]) –

Return type:

ExpressionIndex

finalize() → None[source]

finalize ends the function and computes the list of basic blocks.

Return type:

None

flag(reg: FlagName) → ExpressionIndex[source]

flag returns a flag expression for the given flag name.

Parameters:

reg (architecture.FlagName) – name of the flag expression to retrieve

Returns:

A flag expression of given flag name

Return type:

ExpressionIndex

flag_bit(size: int, reg: FlagName, bit: int) → ExpressionIndex[source]

flag_bit sets the flag named reg and size size to the constant integer value bit

Parameters:

  • size (int) – the size of the flag

  • reg (str) – flag value

  • bit (int) – integer value to set the bit to

Returns:

A constant expression of given value and size FLAG.reg = bit

Return type:

ExpressionIndex

flag_condition(cond: Union[str, LowLevelILFlagCondition, int], sem_class: Optional[architecture.SemanticClassType] = None) → ExpressionIndex[source]

flag_condition returns a flag_condition expression for the given LowLevelILFlagCondition

Parameters:
Returns:

A flag_condition expression

Return type:

ExpressionIndex

flag_group(sem_group: SemanticGroupName) → ExpressionIndex[source]

flag_group returns a flag_group expression for the given semantic flag group

Parameters:

sem_group (SemanticGroupName) – Semantic flag group to access

Returns:

A flag_group expression

Return type:

ExpressionIndex

float_abs(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_abs returns absolute value of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to get the absolute value of

  • flags (str) – optional, flags to set

Returns:

The expression fabs.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_add(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_add adds floating point expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression fadd.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_compare_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

float_compare_equal returns floating point comparison expression of size size checking if expression a is equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression a f== b

Return type:

ExpressionIndex

float_compare_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

float_compare_greater_equal returns floating point comparison expression of size size checking if expression a is greater than or equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression a f>= b

Return type:

ExpressionIndex

float_compare_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

float_compare_greater_than returns floating point comparison expression of size size checking if expression a is greater than expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression a f> b

Return type:

ExpressionIndex

float_compare_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

float_compare_less_equal returns floating point comparison expression of size size checking if expression a is less than or equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression a f<= b

Return type:

ExpressionIndex

float_compare_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

float_compare_less_than returns floating point comparison expression of size size checking if expression a is less than expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression a f< b

Return type:

ExpressionIndex

float_compare_not_equal(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

float_compare_not_equal returns floating point comparison expression of size size checking if expression a is not equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression a f!= b

Return type:

ExpressionIndex

float_compare_ordered(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

float_compare_ordered returns floating point comparison expression of size size checking if expression a is ordered relative to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression is_ordered(a, b)

Return type:

ExpressionIndex

float_compare_unordered(size: int, a: ExpressionIndex, b: ExpressionIndex) → ExpressionIndex[source]

float_compare_unordered returns floating point comparison expression of size size checking if expression a is unordered relative to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression is_unordered(a, b)

Return type:

ExpressionIndex

float_const_double(value: float) → ExpressionIndex[source]

float_const_double returns an expression for the double precision floating point value value

Parameters:

value (float) – float value for the constant

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_const_raw(size: int, value: int) → ExpressionIndex[source]

float_const_raw returns an expression for the constant raw binary floating point value value with size size

Parameters:

  • size (int) – the size of the constant in bytes

  • value (int) – integer value for the raw binary representation of the constant

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_const_single(value: float) → ExpressionIndex[source]

float_const_single returns an expression for the single precision floating point value value

Parameters:

value (float) – float value for the constant

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_convert(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

int_to_float converts floating point value of expression value to size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

Returns:

The expression fconvert.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_div(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_div divides floating point expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression fdiv.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_mult(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_mult multiplies floating point expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression fmul.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_neg(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_neg returns sign negation of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

Returns:

The expression fneg.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_sqrt(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_sqrt returns square root of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to calculate the square root of

  • flags (str) – optional, flags to set

Returns:

The expression sqrt.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_sub(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_sub subtracts floating point expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

Returns:

The expression fsub.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_to_int(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_to_int returns integer value of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to convert to an int

  • flags (str) – optional, flags to set

Returns:

The expression int.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_trunc(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

float_trunc rounds a floating point value to an integer towards zero

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to truncate

  • flags (str) – optional, flags to set

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

floor(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

floor rounds a floating point value to an integer towards negative infinity

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round down

  • flags (str) – optional, flags to set

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

generate_ssa_form() → None[source]

generate_ssa_form generate SSA form given the current LLIL

Return type:

None

get_basic_block_at(index: int) → Optional[BasicBlock][source]

get_basic_block_at returns the BasicBlock at the given LLIL instruction index.

Parameters:

index (int) – Index of the LLIL instruction of the BasicBlock to retrieve.

Example:
>>> current_il_function.get_basic_block_at(current_il_index)
<llil block: x86@19-26>
Return type:

Optional[BasicBlock]

get_high_level_il_expr_index(expr: ExpressionIndex) → Optional[ExpressionIndex][source]
Parameters:

expr (ExpressionIndex) –

Return type:

Optional[ExpressionIndex]

get_high_level_il_instruction_index(instr: InstructionIndex) → Optional[InstructionIndex][source]
Parameters:

instr (InstructionIndex) –

Return type:

Optional[InstructionIndex]

get_instruction_start(addr: int, arch: Optional[Architecture] = None) → Optional[int][source]
Parameters:
Return type:

Optional[int]

get_label_for_address(arch: Architecture, addr: int) → Optional[LowLevelILLabel][source]

get_label_for_address returns the LowLevelILLabel for the given Architecture arch and IL address addr.

Parameters:
Returns:

the LowLevelILLabel for the given IL address

Return type:

LowLevelILLabel

get_mapped_medium_level_il_expr_index(expr: ExpressionIndex) → Optional[ExpressionIndex][source]
Parameters:

expr (ExpressionIndex) –

Return type:

Optional[ExpressionIndex]

get_mapped_medium_level_il_instruction_index(instr: InstructionIndex) → Optional[InstructionIndex][source]
Parameters:

instr (InstructionIndex) –

Return type:

Optional[InstructionIndex]

get_medium_level_il_expr_index(expr: ExpressionIndex) → Optional[ExpressionIndex][source]
Parameters:

expr (ExpressionIndex) –

Return type:

Optional[ExpressionIndex]

get_medium_level_il_expr_indexes(expr: ExpressionIndex) → List[ExpressionIndex][source]
Parameters:

expr (ExpressionIndex) –

Return type:

List[ExpressionIndex]

get_medium_level_il_instruction_index(instr: InstructionIndex) → Optional[InstructionIndex][source]
Parameters:

instr (InstructionIndex) –

Return type:

Optional[InstructionIndex]

get_non_ssa_instruction_index(instr: InstructionIndex) → InstructionIndex[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex

get_ssa_flag_definition(flag_ssa: SSAFlag) → Optional[LowLevelILInstruction][source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

Optional[LowLevelILInstruction]

get_ssa_flag_uses(flag_ssa: SSAFlag) → List[LowLevelILInstruction][source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

List[LowLevelILInstruction]

get_ssa_flag_value(flag_ssa: SSAFlag) → RegisterValue[source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

RegisterValue

get_ssa_instruction_index(instr: InstructionIndex) → InstructionIndex[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex

get_ssa_memory_definition(index: int) → Optional[LowLevelILInstruction][source]
Parameters:

index (int) –

Return type:

Optional[LowLevelILInstruction]

get_ssa_memory_uses(index: int) → List[LowLevelILInstruction][source]
Parameters:

index (int) –

Return type:

List[LowLevelILInstruction]

get_ssa_reg_definition(reg_ssa: SSARegister) → Optional[LowLevelILInstruction][source]
Parameters:

reg_ssa (SSARegister) –

Return type:

Optional[LowLevelILInstruction]

get_ssa_reg_uses(reg_ssa: SSARegister) → List[LowLevelILInstruction][source]
Parameters:

reg_ssa (SSARegister) –

Return type:

List[LowLevelILInstruction]

get_ssa_reg_value(reg_ssa: SSARegister) → RegisterValue[source]
Parameters:

reg_ssa (SSARegister) –

Return type:

RegisterValue

goto(label: LowLevelILLabel) → ExpressionIndex[source]

goto returns a goto expression which jumps to the provided LowLevelILLabel.

Parameters:

label (LowLevelILLabel) – Label to jump to

Returns:

the ExpressionIndex that jumps to the provided label

Return type:

ExpressionIndex

if_expr(operand: ExpressionIndex, t: LowLevelILLabel, f: LowLevelILLabel) → ExpressionIndex[source]

if_expr returns the if expression which depending on condition operand jumps to the LowLevelILLabel t when the condition expression operand is non-zero and f when it’s zero.

Parameters:

  • operand (ExpressionIndex) – comparison expression to evaluate.

  • t (LowLevelILLabel) – Label for the true branch

  • f (LowLevelILLabel) – Label for the false branch

Returns:

the ExpressionIndex for the if expression

Return type:

ExpressionIndex

int_to_float(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

int_to_float returns floating point value of integer expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to convert to a float

  • flags (str) – optional, flags to set

Returns:

The expression float.<size>{<flags>}(value)

Return type:

ExpressionIndex

intrinsic(outputs: List[Union[str, ILRegister, int, ILFlag, RegisterInfo]], intrinsic: architecture.IntrinsicType, params: List[ExpressionIndex], flags: Optional[architecture.FlagType] = None)[source]

intrinsic return an intrinsic expression.

Returns:

an intrinsic expression.

Return type:

ExpressionIndex

Parameters:
jump(dest: ExpressionIndex) → ExpressionIndex[source]

jump returns an expression which jumps (branches) to the expression dest

Parameters:

dest (ExpressionIndex) – the expression to jump to

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

load(size: int, addr: ExpressionIndex) → ExpressionIndex[source]

load Reads size bytes from the expression addr

Parameters:

  • size (int) – number of bytes to read

  • addr (ExpressionIndex) – the expression to read memory from

Returns:

The expression [addr].size

Return type:

ExpressionIndex

logical_shift_right(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

logical_shift_right shifts logically right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression lsr.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

low_part(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

low_part truncates value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to truncate

  • flags (Optional[architecture.FlagType]) –

Returns:

The expression (value).<size>

Return type:

ExpressionIndex

mark_label(label: LowLevelILLabel) → None[source]

mark_label assigns a LowLevelILLabel to the current IL address.

Parameters:

label (LowLevelILLabel) –

Return type:

None

mod_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

mod_double_prec_signed signed double precision modulus using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression mods.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

mod_double_prec_unsigned unsigned double precision modulus using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression modu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

mod_signed signed modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression mods.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

mod_unsigned unsigned modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression modu.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

mult multiplies expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression sbc.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

mult_double_prec_signed multiplies signed with double precision expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression muls.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

mult_double_prec_unsigned multiplies unsigned with double precision expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression mulu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

neg_expr(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

neg_expr two’s complement sign negation of expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

Returns:

The expression neg.<size>{<flags>}(value)

Return type:

ExpressionIndex

no_ret() → ExpressionIndex[source]

no_ret returns an expression that halts disassembly

Returns:

The expression noreturn

Return type:

ExpressionIndex

nop() → ExpressionIndex[source]

nop no operation, this instruction does nothing

Returns:

The no operation expression

Return type:

ExpressionIndex

not_expr(size: int, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

not_expr bitwise inverse of expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to bitwise invert

  • flags (str) – optional, flags to set

Returns:

The expression not.<size>{<flags>}(value)

Return type:

ExpressionIndex

operand(n: int, expr: ExpressionIndex) → ExpressionIndex[source]

operand sets the operand number of the expression expr and passes back expr without modification.

Parameters:

  • n (int) –

  • expr (ExpressionIndex) –

Returns:

returns the expression expr unmodified

Return type:

ExpressionIndex

or_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

or_expr bitwise or’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

Returns:

The expression or.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

pop(size: int) → ExpressionIndex[source]

pop reads size bytes from the stack, adjusting the stack by size.

Parameters:

size (int) – number of bytes to read from the stack

Returns:

The expression pop

Return type:

ExpressionIndex

push(size: int, value: ExpressionIndex) → ExpressionIndex[source]

push writes size bytes from expression value to the stack, adjusting the stack by size.

Parameters:

  • size (int) – number of bytes to write and adjust the stack by

  • value (ExpressionIndex) – the expression to write

Returns:

The expression push(value)

Return type:

ExpressionIndex

reg(size: int, reg: architecture.RegisterType) → ExpressionIndex[source]

reg returns a register of size size with name reg

Parameters:

  • size (int) – the size of the register in bytes

  • reg (str) – the name of the register

Returns:

A register expression for the given string

Return type:

ExpressionIndex

reg_split(size: int, hi: architecture.RegisterType, lo: architecture.RegisterType) → ExpressionIndex[source]

reg_split combines registers of size size with names hi and lo

Parameters:

  • size (int) – the size of the register in bytes

  • hi (str) – register holding high part of value

  • lo (str) – register holding low part of value

Returns:

The expression hi:lo

Return type:

ExpressionIndex

reg_stack_pop(size: int, reg_stack: architecture.RegisterStackType) → ExpressionIndex[source]

reg_stack_pop returns the top entry of size size in register stack with name reg_stack, and removes the entry from the stack

Parameters:

  • size (int) – the size of the register in bytes

  • reg_stack (str) – the name of the register stack

Returns:

The expression reg_stack.pop

Return type:

ExpressionIndex

reg_stack_push(size: int, reg_stack: architecture.RegisterStackType, value: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

reg_stack_push pushes the expression value of size size onto the top of the register stack reg_stack

Parameters:

  • size (int) – size of the register parameter in bytes

  • reg_stack (str) – the register stack name

  • value (ExpressionIndex) – an expression to push

  • flags (str) – which flags are set by this operation

Returns:

The expression reg_stack.push(value)

Return type:

ExpressionIndex

reg_stack_top_relative(size: int, reg_stack: architecture.RegisterStackType, entry: ExpressionIndex) → ExpressionIndex[source]

reg_stack_top_relative returns a register stack entry of size size at top-relative location entry in register stack with name reg_stack

Parameters:

  • size (int) – the size of the register in bytes

  • reg_stack (str) – the name of the register stack

  • entry (ExpressionIndex) – an expression for which stack entry to fetch

Returns:

The expression reg_stack[entry]

Return type:

ExpressionIndex

reloc_pointer(size: int, value: int) → ExpressionIndex[source]

reloc_pointer returns an expression for the constant relocated pointer value with size size

Parameters:

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by pointer

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

replace_expr(original: Union[LowLevelILInstruction, ExpressionIndex, InstructionIndex], new: Union[LowLevelILInstruction, ExpressionIndex, InstructionIndex]) → None[source]

replace_expr allows modification of expressions but ONLY during lifting.

Warning

This function should ONLY be called as a part of a lifter. It will otherwise not do anything useful as there’s no way to trigger re-analysis of IL levels at this time.

Parameters:

  • original (ExpressionIndex) – the ExpressionIndex to replace (may also be an expression index)

  • new (ExpressionIndex) – the ExpressionIndex to add to the current LowLevelILFunction (may also be an expression index)

Return type:

None

ret(dest: ExpressionIndex) → ExpressionIndex[source]

ret returns an expression which jumps (branches) to the expression dest. ret is a special alias for jump that makes the disassembler stop disassembling.

Parameters:

dest (ExpressionIndex) – the expression to jump to

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

rotate_left(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: Optional[architecture.FlagType] = None) → ExpressionIndex[source]

rotate_left bitwise rotates left expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (