lowlevelil module

binaryninja.lowlevelil.ILFlag(arch, flag)

binaryninja.lowlevelil.ILIntrinsic(arch, …)

binaryninja.lowlevelil.ILRegister(arch, reg)

binaryninja.lowlevelil.ILRegisterStack(arch, …)

binaryninja.lowlevelil.ILSemanticFlagClass(…)

binaryninja.lowlevelil.ILSemanticFlagGroup(…)

binaryninja.lowlevelil.LowLevelILBasicBlock(…)

binaryninja.lowlevelil.LowLevelILExpr(index)

class LowLevelILExpr hold the index of IL Expressions.

binaryninja.lowlevelil.LowLevelILFunction([…])

class LowLevelILFunction contains the list of LowLevelILExpr objects that make up a binaryninja.function.

binaryninja.lowlevelil.LowLevelILInstruction(…)

class LowLevelILInstruction Low Level Intermediate Language Instructions are infinite length tree-based instructions.

binaryninja.lowlevelil.LowLevelILLabel([handle])

binaryninja.lowlevelil.LowLevelILOperationAndSize(…)

binaryninja.lowlevelil.SSAFlag(flag, version)

binaryninja.lowlevelil.SSARegister(reg, version)

binaryninja.lowlevelil.SSARegisterOrFlag(…)

binaryninja.lowlevelil.SSARegisterStack(…)

binaryninja.lowlevelil.LLIL_GET_TEMP_REG_INDEX(n)

binaryninja.lowlevelil.LLIL_REG_IS_TEMP(n)

binaryninja.lowlevelil.LLIL_TEMP(n)

binaryninja.lowlevelil.range(*args)

A Python2 and Python3 Compatible Range Generator
class ILFlag(arch, flag)[source]

Bases: object

class ILIntrinsic(arch, intrinsic)[source]

Bases: object

class ILRegister(arch, reg)[source]

Bases: object

info
class ILRegisterStack(arch, reg_stack)[source]

Bases: object

info
class ILSemanticFlagClass(arch, sem_class)[source]

Bases: object

class ILSemanticFlagGroup(arch, sem_group)[source]

Bases: object

class LowLevelILBasicBlock(view, handle, owner)[source]

Bases: binaryninja.basicblock.BasicBlock

class LowLevelILExpr(index)[source]

Bases: object

class LowLevelILExpr hold the index of IL Expressions.

Note

This class shouldn’t be instantiated directly. Rather the helper members of LowLevelILFunction should be used instead.

class LowLevelILFunction(arch=None, handle=None, source_func=None)[source]

Bases: object

class LowLevelILFunction contains the list of LowLevelILExpr objects that make up a binaryninja.function. LowLevelILExpr objects can be added to the LowLevelILFunction by calling append and passing the result of the various class methods which return LowLevelILExpr objects.

LowLevelILFlagCondition values used as parameters in the flag_condition method.

LowLevelILFlagCondition

Operator

Description

LLFC_E

==

Equal

LLFC_NE

!=

Not equal

LLFC_SLT

s<

Signed less than

LLFC_ULT

u<

Unsigned less than

LLFC_SLE

s<=

Signed less than or equal

LLFC_ULE

u<=

Unsigned less than or equal

LLFC_SGE

s>=

Signed greater than or equal

LLFC_UGE

u>=

Unsigned greater than or equal

LLFC_SGT

s>

Signed greater than

LLFC_UGT

u>

Unsigned greater than

LLFC_NEG

Negative

LLFC_POS

Positive

LLFC_O

overflow

Overflow

LLFC_NO

!overflow

No overflow
add(size, a, b, flags=None)[source]

add adds expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression add.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

add_carry(size, a, b, carry, flags=None)[source]

add_carry adds with carry expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression adc.<size>{<flags>}(a, b, carry)

Return type

LowLevelILExpr

add_label_for_address(arch, addr)[source]

add_label_for_address adds a low-level IL label for the given architecture arch at the given virtual address addr

Parameters

  • arch (Architecture) – Architecture to add labels for

  • addr (int) – the IL address to add a label at

add_label_list(labels)[source]

add_label_list returns a label list expression for the given list of LowLevelILLabel objects.

Parameters

lables (list(LowLevelILLabel)) – the list of LowLevelILLabel to get a label list expression from

Returns

the label list expression

Return type

LowLevelILExpr

add_operand_list(operands)[source]

add_operand_list returns an operand list expression for the given list of integer operands.

Parameters

operands (list(int)) – list of operand numbers

Returns

an operand list expression

Return type

LowLevelILExpr

and_expr(size, a, b, flags=None)[source]

and_expr bitwise and’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression and.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

append(expr)[source]

append adds the LowLevelILExpr expr to the current LowLevelILFunction.

Parameters

expr (LowLevelILExpr) – the LowLevelILExpr to add to the current LowLevelILFunction

Returns

number of LowLevelILExpr in the current function

Return type

int

arith_shift_right(size, a, b, flags=None)[source]

arith_shift_right shifts arithmatic right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression asr.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

breakpoint()[source]

breakpoint returns a processor breakpoint expression.

Returns

a breakpoint expression.

Return type

LowLevelILExpr

call(dest)[source]

call returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest

Parameters

dest (LowLevelILExpr) – the expression to call

Returns

The expression call(dest)

Return type

LowLevelILExpr

call_stack_adjust(dest, stack_adjust)[source]

call_stack_adjust returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest. After the function exits, stack_adjust is added to the stack pointer register.

Parameters

dest (LowLevelILExpr) – the expression to call

Returns

The expression call(dest), stack += stack_adjust

Return type

LowLevelILExpr

ceil(size, value, flags=None)[source]

ceil rounds a floating point value to an integer towards positive infinity

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression roundint.<size>{<flags>}(value)

Return type

LowLevelILExpr

clear_indirect_branches()[source]
compare_equal(size, a, b)[source]

compare_equal returns comparison expression of size size checking if expression a is equal to expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_not_equal(size, a, b)[source]

compare_not_equal returns comparison expression of size size checking if expression a is not equal to expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_signed_greater_equal(size, a, b)[source]

compare_signed_greater_equal returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_signed_greater_than(size, a, b)[source]

compare_signed_greater_than returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_signed_less_equal(size, a, b)[source]

compare_signed_less_equal returns comparison expression of size size checking if expression a is signed less than or equal to expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_signed_less_than(size, a, b)[source]

compare_signed_less_than returns comparison expression of size size checking if expression a is signed less than expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_unsigned_greater_equal(size, a, b)[source]

compare_unsigned_greater_equal returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_unsigned_greater_than(size, a, b)[source]

compare_unsigned_greater_than returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_unsigned_less_equal(size, a, b)[source]

compare_unsigned_less_equal returns comparison expression of size size checking if expression a is unsigned less than or equal to expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

compare_unsigned_less_than(size, a, b)[source]

compare_unsigned_less_than returns comparison expression of size size checking if expression a is unsigned less than expression b

Parameters
Returns

a comparison expression.

Return type

LowLevelILExpr

const(size, value)[source]

const returns an expression for the constant integer value with size size

Parameters

  • size (int) – the size of the constant in bytes

  • value (int) – integer value of the constant

Returns

A constant expression of given value and size

Return type

LowLevelILExpr

const_pointer(size, value)[source]

const_pointer returns an expression for the constant pointer value with size size

Parameters

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by pointer

Returns

A constant expression of given value and size

Return type

LowLevelILExpr

create_graph(settings=None)[source]
div_double_prec_signed(size, a, b, flags=None)[source]

div_double_prec_signed signed double precision divide using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression divs.dp.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

div_double_prec_unsigned(size, a, b, flags=None)[source]

div_double_prec_unsigned unsigned double precision divide using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression divu.dp.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

div_signed(size, a, b, flags=None)[source]

div_signed signed divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression divs.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

div_unsigned(size, a, b, flags=None)[source]

div_unsigned unsigned divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression divu.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

expr(operation, a=0, b=0, c=0, d=0, size=0, flags=None)[source]
finalize()[source]

finalize ends the function and computes the list of basic blocks.

Return type

None

flag(reg)[source]

flag returns a flag expression for the given flag name.

Parameters

reg (str) – name of the flag expression to retrieve

Returns

A flag expression of given flag name

Return type

LowLevelILExpr

flag_bit(size, reg, bit)[source]

flag_bit sets the flag named reg and size size to the constant integer value bit

Parameters

  • size (int) – the size of the flag

  • reg (str) – flag value

  • bit (int) – integer value to set the bit to

Returns

A constant expression of given value and size FLAG.reg = bit

Return type

LowLevelILExpr

flag_condition(cond, sem_class=None)[source]

flag_condition returns a flag_condition expression for the given LowLevelILFlagCondition

Parameters
Returns

A flag_condition expression

Return type

LowLevelILExpr

flag_group(sem_group)[source]

flag_group returns a flag_group expression for the given semantic flag group

Parameters

sem_group (str) – Semantic flag group to access

Returns

A flag_group expression

Return type

LowLevelILExpr

float_abs(size, value, flags=None)[source]

float_abs returns absolute value of floating point expression value of size size potentially setting flags

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression fabs.<size>{<flags>}(value)

Return type

LowLevelILExpr

float_add(size, a, b, flags=None)[source]

float_add adds floating point expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression fadd.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

float_compare_equal(size, a, b)[source]

float_compare_equal returns floating point comparison expression of size size checking if expression a is equal to expression b

Parameters
Returns

The expression a f== b

Return type

LowLevelILExpr

float_compare_greater_equal(size, a, b)[source]

float_compare_greater_equal returns floating point comparison expression of size size checking if expression a is greater than or equal to expression b

Parameters
Returns

The expression a f>= b

Return type

LowLevelILExpr

float_compare_greater_than(size, a, b)[source]

float_compare_greater_than returns floating point comparison expression of size size checking if expression a is greater than or equal to expression b

Parameters
Returns

The expression a f> b

Return type

LowLevelILExpr

float_compare_less_equal(size, a, b)[source]

float_compare_less_equal returns floating point comparison expression of size size checking if expression a is less than or equal to expression b

Parameters
Returns

The expression a f<= b

Return type

LowLevelILExpr

float_compare_less_than(size, a, b)[source]

float_compare_less_than returns floating point comparison expression of size size checking if expression a is less than to expression b

Parameters
Returns

The expression a f< b

Return type

LowLevelILExpr

float_compare_not_equal(size, a, b)[source]

float_compare_not_equal returns floating point comparison expression of size size checking if expression a is not equal to expression b

Parameters
Returns

The expression a f!= b

Return type

LowLevelILExpr

float_compare_unordered(size, a, b)[source]

float_compare_unordered returns floating point comparison expression of size size checking if expression a is unordered relative to expression b

Parameters
Returns

The expression is_unordered(a, b)

Return type

LowLevelILExpr

float_const_double(value)[source]

float_const_double returns an expression for the double precision floating point value value

Parameters

value (float) – float value for the constant

Returns

A constant expression of given value and size

Return type

LowLevelILExpr

float_const_raw(size, value)[source]

float_const_raw returns an expression for the constant raw binary floating point value value with size size

Parameters

  • size (int) – the size of the constant in bytes

  • value (int) – integer value for the raw binary representation of the constant

Returns

A constant expression of given value and size

Return type

LowLevelILExpr

float_const_single(value)[source]

float_const_single returns an expression for the single precision floating point value value

Parameters

value (float) – float value for the constant

Returns

A constant expression of given value and size

Return type

LowLevelILExpr

float_convert(size, value, flags=None)[source]

int_to_float converts floating point value of expression value to size size potentially setting flags

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression fconvert.<size>{<flags>}(value)

Return type

LowLevelILExpr

float_div(size, a, b, flags=None)[source]

float_div divides floating point expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression fdiv.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

float_mult(size, a, b, flags=None)[source]

float_mult multiplies floating point expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression fmul.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

float_neg(size, value, flags=None)[source]

float_neg returns sign negation of floating point expression value of size size potentially setting flags

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression fneg.<size>{<flags>}(value)

Return type

LowLevelILExpr

float_sqrt(size, value, flags=None)[source]

float_sqrt returns square root of floating point expression value of size size potentially setting flags

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression sqrt.<size>{<flags>}(value)

Return type

LowLevelILExpr

float_sub(size, a, b, flags=None)[source]

float_sub subtracts floating point expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression fsub.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

float_to_int(size, value, flags=None)[source]

float_to_int returns integer value of floating point expression value of size size potentially setting flags

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression int.<size>{<flags>}(value)

Return type

LowLevelILExpr

float_trunc(size, value, flags=None)[source]

float_trunc rounds a floating point value to an integer towards zero

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression roundint.<size>{<flags>}(value)

Return type

LowLevelILExpr

floor(size, value, flags=None)[source]

floor rounds a floating point value to an integer towards negative infinity

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression roundint.<size>{<flags>}(value)

Return type

LowLevelILExpr

get_instruction_start(addr, arch=None)[source]
get_label_for_address(arch, addr)[source]

get_label_for_address returns the LowLevelILLabel for the given Architecture arch and IL address addr.

Parameters
Returns

the LowLevelILLabel for the given IL address

Return type

LowLevelILLabel

get_mapped_medium_level_il_expr_index(expr)[source]
get_mapped_medium_level_il_instruction_index(instr)[source]
get_medium_level_il_expr_index(expr)[source]
get_medium_level_il_instruction_index(instr)[source]
get_non_ssa_instruction_index(instr)[source]
get_ssa_flag_definition(flag_ssa)[source]
get_ssa_flag_uses(flag_ssa)[source]
get_ssa_flag_value(flag_ssa)[source]
get_ssa_instruction_index(instr)[source]
get_ssa_memory_definition(index)[source]
get_ssa_memory_uses(index)[source]
get_ssa_reg_definition(reg_ssa)[source]
get_ssa_reg_uses(reg_ssa)[source]
get_ssa_reg_value(reg_ssa)[source]
goto(label)[source]

goto returns a goto expression which jumps to the provided LowLevelILLabel.

Parameters

label (LowLevelILLabel) – Label to jump to

Returns

the LowLevelILExpr that jumps to the provided label

Return type

LowLevelILExpr

if_expr(operand, t, f)[source]

if_expr returns the if expression which depending on condition operand jumps to the LowLevelILLabel t when the condition expression operand is non-zero and f when it’s zero.

Parameters
Returns

the LowLevelILExpr for the if expression

Return type

LowLevelILExpr

int_to_float(size, value, flags=None)[source]

int_to_float returns floating point value of integer expression value of size size potentially setting flags

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression float.<size>{<flags>}(value)

Return type

LowLevelILExpr

intrinsic(outputs, intrinsic, params, flags=None)[source]

intrinsic return an intrinsic expression.

Returns

an intrinsic expression.

Return type

LowLevelILExpr

jump(dest)[source]

jump returns an expression which jumps (branches) to the expression dest

Parameters

dest (LowLevelILExpr) – the expression to jump to

Returns

The expression jump(dest)

Return type

LowLevelILExpr

load(size, addr)[source]

load Reads size bytes from the expression addr

Parameters

  • size (int) – number of bytes to read

  • addr (LowLevelILExpr) – the expression to read memory from

Returns

The expression [addr].size

Return type

LowLevelILExpr

logical_shift_right(size, a, b, flags=None)[source]

logical_shift_right shifts logically right expression a by expression b potentially setting flags flags``and returning an expression of ``size bytes.

Parameters
Returns

The expression lsr.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

low_part(size, value, flags=None)[source]

low_part truncates value to size bytes

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to zero extend

Returns

The expression (value).<size>

Return type

LowLevelILExpr

mark_label(label)[source]

mark_label assigns a LowLevelILLabel to the current IL address.

Parameters

label (LowLevelILLabel) –

Return type

None

mod_double_prec_signed(size, a, b, flags=None)[source]

mod_double_prec_signed signed double precision modulus using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression mods.dp.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

mod_double_prec_unsigned(size, a, b, flags=None)[source]

mod_double_prec_unsigned unsigned double precision modulus using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression modu.dp.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

mod_signed(size, a, b, flags=None)[source]

mod_signed signed modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression mods.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

mod_unsigned(size, a, b, flags=None)[source]

mod_unsigned unsigned modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression modu.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

mult(size, a, b, flags=None)[source]

mult multiplies expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression sbc.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

mult_double_prec_signed(size, a, b, flags=None)[source]

mult_double_prec_signed multiplies signed with double precision expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression muls.dp.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

mult_double_prec_unsigned(size, a, b, flags=None)[source]

mult_double_prec_unsigned multiplies unsigned with double precision expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression mulu.dp.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

neg_expr(size, value, flags=None)[source]

neg_expr two’s complement sign negation of expression value of size size potentially setting flags

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression neg.<size>{<flags>}(value)

Return type

LowLevelILExpr

no_ret()[source]

no_ret returns an expression halts disassembly

Returns

The expression noreturn

Return type

LowLevelILExpr

nop()[source]

nop no operation, this instruction does nothing

Returns

The no operation expression

Return type

LowLevelILExpr

not_expr(size, value, flags=None)[source]

not_expr bitwise inverse of expression value of size size potentially setting flags

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to bitwise invert

  • flags (str) – optional, flags to set

Returns

The expression not.<size>{<flags>}(value)

Return type

LowLevelILExpr

operand(n, expr)[source]

operand sets the operand number of the expression expr and passes back expr without modification.

Parameters
Returns

returns the expression expr unmodified

Return type

LowLevelILExpr

or_expr(size, a, b, flags=None)[source]

or_expr bitwise or’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression or.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

pop(size)[source]

pop reads size bytes from the stack, adjusting the stack by size.

Parameters

size (int) – number of bytes to read from the stack

Returns

The expression pop

Return type

LowLevelILExpr

push(size, value)[source]

push writes size bytes from expression value to the stack, adjusting the stack by size.

Parameters

  • size (int) – number of bytes to write and adjust the stack by

  • value (LowLevelILExpr) – the expression to write

Returns

The expression push(value)

Return type

LowLevelILExpr

reg(size, reg)[source]

reg returns a register of size size with name reg

Parameters

  • size (int) – the size of the register in bytes

  • reg (str) – the name of the register

Returns

A register expression for the given string

Return type

LowLevelILExpr

reg_split(size, hi, lo)[source]

reg_split combines registers of size size with names hi and lo

Parameters

  • size (int) – the size of the register in bytes

  • hi (str) – register holding high part of value

  • lo (str) – register holding low part of value

Returns

The expression hi:lo

Return type

LowLevelILExpr

reg_stack_pop(size, reg_stack)[source]

reg_stack_pop returns the top entry of size size in register stack with name reg_stack, and removes the entry from the stack

Parameters

  • size (int) – the size of the register in bytes

  • reg_stack (str) – the name of the register stack

Returns

The expression reg_stack.pop

Return type

LowLevelILExpr

reg_stack_push(size, reg_stack, value, flags=0)[source]

reg_stack_push pushes the expression value of size size onto the top of the register stack reg_stack

Parameters

  • size (int) – size of the register parameter in bytes

  • reg_stack (str) – the register stack name

  • value (LowLevelILExpr) – an expression to push

  • flags (str) – which flags are set by this operation

Returns

The expression reg_stack.push(value)

Return type

LowLevelILExpr

reg_stack_top_relative(size, reg_stack, entry)[source]

reg_stack_top_relative returns a register stack entry of size size at top-relative location entry in register stack with name reg_stack

Parameters

  • size (int) – the size of the register in bytes

  • reg_stack (str) – the name of the register stack

  • entry (LowLevelILExpr) – an expression for which stack entry to fetch

Returns

The expression reg_stack[entry]

Return type

LowLevelILExpr

reloc_pointer(size, value)[source]

reloc_pointer returns an expression for the constant relocated pointer value with size size

Parameters

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by pointer

Returns

A constant expression of given value and size

Return type

LowLevelILExpr

replace_expr(original, new)[source]

replace_expr allows modification of LowLevelILExpressions but ONLY during lifting.

Warning

This function should ONLY be called as a part of a lifter. It will otherwise not do anything useful as there’s no way to trigger re-analysis of IL levels at this time.

Parameters

  • original (LowLevelILExpr) – the LowLevelILExpr to replace (may also be an expression index)

  • new (LowLevelILExpr) – the LowLevelILExpr to add to the current LowLevelILFunction (may also be an expression index)

Return type

None

ret(dest)[source]

ret returns an expression which jumps (branches) to the expression dest. ret is a special alias for jump that makes the disassembler stop disassembling.

Parameters

dest (LowLevelILExpr) – the expression to jump to

Returns

The expression jump(dest)

Return type

LowLevelILExpr

rotate_left(size, a, b, flags=None)[source]

rotate_left bitwise rotates left expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression rol.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

rotate_left_carry(size, a, b, carry, flags=None)[source]

rotate_left_carry bitwise rotates left with carry expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression rlc.<size>{<flags>}(a, b, carry)

Return type

LowLevelILExpr

rotate_right(size, a, b, flags=None)[source]

rotate_right bitwise rotates right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression ror.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

rotate_right_carry(size, a, b, carry, flags=None)[source]

rotate_right_carry bitwise rotates right with carry expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression rrc.<size>{<flags>}(a, b, carry)

Return type

LowLevelILExpr

round_to_int(size, value, flags=None)[source]

round_to_int rounds a floating point value to the nearest integer

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to negate

  • flags (str) – optional, flags to set

Returns

The expression roundint.<size>{<flags>}(value)

Return type

LowLevelILExpr

set_current_address(value, arch=None)[source]
set_current_source_block(block)[source]
set_flag(flag, value)[source]

set_flag sets the flag flag to the LowLevelILExpr value

Parameters

  • flag (str) – the low register name

  • value (LowLevelILExpr) – an expression to set the flag to

Returns

The expression FLAG.flag = value

Return type

LowLevelILExpr

set_indirect_branches(branches)[source]
set_reg(size, reg, value, flags=0)[source]

set_reg sets the register reg of size size to the expression value

Parameters

  • size (int) – size of the register parameter in bytes

  • reg (str) – the register name

  • value (LowLevelILExpr) – an expression to set the register to

  • flags (str) – which flags are set by this operation

Returns

The expression reg = value

Return type

LowLevelILExpr

set_reg_split(size, hi, lo, value, flags=0)[source]

set_reg_split uses hi and lo as a single extended register setting hi:lo to the expression value.

Parameters

  • size (int) – size of the register parameter in bytes

  • hi (str) – the high register name

  • lo (str) – the low register name

  • value (LowLevelILExpr) – an expression to set the split registers to

  • flags (str) – which flags are set by this operation

Returns

The expression hi:lo = value

Return type

LowLevelILExpr

set_reg_stack_top_relative(size, reg_stack, entry, value, flags=0)[source]

set_reg_stack_top_relative sets the top-relative entry entry of size size in register stack reg_stack to the expression value

Parameters

  • size (int) – size of the register parameter in bytes

  • reg_stack (str) – the register stack name

  • entry (LowLevelILExpr) – an expression for which stack entry to set

  • value (LowLevelILExpr) – an expression to set the entry to

  • flags (str) – which flags are set by this operation

Returns

The expression reg_stack[entry] = value

Return type

LowLevelILExpr

shift_left(size, a, b, flags=None)[source]

shift_left subtracts with borrow expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression lsl.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

sign_extend(size, value, flags=None)[source]

sign_extend two’s complement sign-extends the expression in value to size bytes

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to sign extend

  • flags (str) – optional, flags to set

Returns

The expression sx.<size>(value)

Return type

LowLevelILExpr

store(size, addr, value, flags=None)[source]

store Writes size bytes to expression addr read from expression value

Parameters

  • size (int) – number of bytes to write

  • addr (LowLevelILExpr) – the expression to write to

  • value (LowLevelILExpr) – the expression to be written

  • flags (str) – which flags are set by this operation

Returns

The expression [addr].size = value

Return type

LowLevelILExpr

sub(size, a, b, flags=None)[source]

sub subtracts expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression sub.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

sub_borrow(size, a, b, carry, flags=None)[source]

sub_borrow subtracts with borrow expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression sbb.<size>{<flags>}(a, b, carry)

Return type

LowLevelILExpr

system_call()[source]

system_call return a system call expression.

Returns

a system call expression.

Return type

LowLevelILExpr

tailcall(dest)[source]

tailcall returns an expression which jumps (branches) to the expression dest

Parameters

dest (LowLevelILExpr) – the expression to jump to

Returns

The expression tailcall(dest)

Return type

LowLevelILExpr

test_bit(size, a, b)[source]
trap(value)[source]

trap returns a processor trap (interrupt) expression of the given integer value.

Parameters

value (int) – trap (interrupt) number

Returns

a trap expression.

Return type

LowLevelILExpr

undefined()[source]

undefined returns the undefined expression. This should be used for instructions which perform functions but aren’t important for dataflow or partial emulation purposes.

Returns

the unimplemented expression.

Return type

LowLevelILExpr

unimplemented()[source]

unimplemented returns the unimplemented expression. This should be used for all instructions which aren’t implemented.

Returns

the unimplemented expression.

Return type

LowLevelILExpr

unimplemented_memory_ref(size, addr)[source]

unimplemented_memory_ref a memory reference to expression addr of size size with unimplemented operation.

Parameters

  • size (int) – size in bytes of the memory reference

  • addr (LowLevelILExpr) – expression to reference memory

Returns

the unimplemented memory reference expression.

Return type

LowLevelILExpr

xor_expr(size, a, b, flags=None)[source]

xor_expr xor’s expression a with expression b potentially setting flags flags and returning an expression of size bytes.

Parameters
Returns

The expression xor.<size>{<flags>}(a, b)

Return type

LowLevelILExpr

zero_extend(size, value, flags=None)[source]

zero_extend zero-extends the expression in value to size bytes

Parameters

  • size (int) – the size of the result in bytes

  • value (LowLevelILExpr) – the expression to zero extend

Returns

The expression zx.<size>(value)

Return type

LowLevelILExpr

basic_blocks

list of LowLevelILBasicBlock objects (read-only)

current_address

Current IL Address (read/write)

instructions

A generator of llil instructions of the current llil function

mapped_medium_level_il

Medium level IL with mappings between low level IL and medium level IL. Unused stores are not removed. Typically, this should only be used to answer queries on assembly or low level IL where the query is easier to perform on medium level IL.

medium_level_il

Medium level IL for this low level IL.

mlil
mmlil
non_ssa_form

Low level IL in non-SSA (default) form (read-only)

ssa_form

Low level IL in SSA form (read-only)

temp_flag_count

Number of temporary flags (read-only)

temp_reg_count

Number of temporary registers (read-only)

class LowLevelILInstruction(func, expr_index, instr_index=None)[source]

Bases: object

class LowLevelILInstruction Low Level Intermediate Language Instructions are infinite length tree-based instructions. Tree-based instructions use infix notation with the left hand operand being the destination operand. Infix notation is thus more natural to read than other notations (e.g. x86 mov eax, 0 vs. LLIL eax = 0).

get_flag_value(flag)[source]
get_flag_value_after(flag)[source]
get_possible_flag_values(flag)[source]
get_possible_flag_values_after(flag)[source]
get_possible_reg_values(reg)[source]
get_possible_reg_values_after(reg)[source]
get_possible_stack_contents(offset, size)[source]
get_possible_stack_contents_after(offset, size)[source]
get_reg_value(reg)[source]
get_reg_value_after(reg)[source]
get_stack_contents(offset, size)[source]
get_stack_contents_after(offset, size)[source]
ILOperations = {<LowLevelILOperation.LLIL_NOP: 0>: [], <LowLevelILOperation.LLIL_SET_REG: 1>: [('dest', 'reg'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_SPLIT: 2>: [('hi', 'reg'), ('lo', 'reg'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_FLAG: 3>: [('dest', 'flag'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_STACK_REL: 4>: [('stack', 'reg_stack'), ('dest', 'expr'), ('src', 'expr')], <LowLevelILOperation.LLIL_REG_STACK_PUSH: 5>: [('stack', 'reg_stack'), ('src', 'expr')], <LowLevelILOperation.LLIL_LOAD: 6>: [('src', 'expr')], <LowLevelILOperation.LLIL_STORE: 7>: [('dest', 'expr'), ('src', 'expr')], <LowLevelILOperation.LLIL_PUSH: 8>: [('src', 'expr')], <LowLevelILOperation.LLIL_POP: 9>: [], <LowLevelILOperation.LLIL_REG: 10>: [('src', 'reg')], <LowLevelILOperation.LLIL_REG_SPLIT: 11>: [('hi', 'reg'), ('lo', 'reg')], <LowLevelILOperation.LLIL_REG_STACK_REL: 12>: [('stack', 'reg_stack'), ('src', 'expr')], <LowLevelILOperation.LLIL_REG_STACK_POP: 13>: [('stack', 'reg_stack')], <LowLevelILOperation.LLIL_REG_STACK_FREE_REG: 14>: [('dest', 'reg')], <LowLevelILOperation.LLIL_REG_STACK_FREE_REL: 15>: [('stack', 'reg_stack'), ('dest', 'expr')], <LowLevelILOperation.LLIL_CONST: 16>: [('constant', 'int')], <LowLevelILOperation.LLIL_CONST_PTR: 17>: [('constant', 'int')], <LowLevelILOperation.LLIL_EXTERN_PTR: 18>: [('constant', 'int'), ('offset', 'int')], <LowLevelILOperation.LLIL_FLOAT_CONST: 19>: [('constant', 'float')], <LowLevelILOperation.LLIL_FLAG: 20>: [('src', 'flag')], <LowLevelILOperation.LLIL_FLAG_BIT: 21>: [('src', 'flag'), ('bit', 'int')], <LowLevelILOperation.LLIL_ADD: 22>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_ADC: 23>: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], <LowLevelILOperation.LLIL_SUB: 24>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_SBB: 25>: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], <LowLevelILOperation.LLIL_AND: 26>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_OR: 27>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_XOR: 28>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_LSL: 29>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_LSR: 30>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_ASR: 31>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_ROL: 32>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_RLC: 33>: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], <LowLevelILOperation.LLIL_ROR: 34>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_RRC: 35>: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], <LowLevelILOperation.LLIL_MUL: 36>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MULU_DP: 37>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MULS_DP: 38>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_DIVU: 39>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_DIVU_DP: 40>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_DIVS: 41>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_DIVS_DP: 42>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MODU: 43>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MODU_DP: 44>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MODS: 45>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_MODS_DP: 46>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_NEG: 47>: [('src', 'expr')], <LowLevelILOperation.LLIL_NOT: 48>: [('src', 'expr')], <LowLevelILOperation.LLIL_SX: 49>: [('src', 'expr')], <LowLevelILOperation.LLIL_ZX: 50>: [('src', 'expr')], <LowLevelILOperation.LLIL_LOW_PART: 51>: [('src', 'expr')], <LowLevelILOperation.LLIL_JUMP: 52>: [('dest', 'expr')], <LowLevelILOperation.LLIL_JUMP_TO: 53>: [('dest', 'expr'), ('targets', 'int_list')], <LowLevelILOperation.LLIL_CALL: 54>: [('dest', 'expr')], <LowLevelILOperation.LLIL_CALL_STACK_ADJUST: 55>: [('dest', 'expr'), ('stack_adjustment', 'int'), ('reg_stack_adjustments', 'reg_stack_adjust')], <LowLevelILOperation.LLIL_TAILCALL: 56>: [('dest', 'expr')], <LowLevelILOperation.LLIL_RET: 57>: [('dest', 'expr')], <LowLevelILOperation.LLIL_NORET: 58>: [], <LowLevelILOperation.LLIL_IF: 59>: [('condition', 'expr'), ('true', 'int'), ('false', 'int')], <LowLevelILOperation.LLIL_GOTO: 60>: [('dest', 'int')], <LowLevelILOperation.LLIL_FLAG_COND: 61>: [('condition', 'cond'), ('semantic_class', 'sem_class')], <LowLevelILOperation.LLIL_FLAG_GROUP: 62>: [('semantic_group', 'sem_group')], <LowLevelILOperation.LLIL_CMP_E: 63>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_NE: 64>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_SLT: 65>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_ULT: 66>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_SLE: 67>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_ULE: 68>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_SGE: 69>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_UGE: 70>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_SGT: 71>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_CMP_UGT: 72>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_TEST_BIT: 73>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_BOOL_TO_INT: 74>: [('src', 'expr')], <LowLevelILOperation.LLIL_ADD_OVERFLOW: 75>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_SYSCALL: 76>: [], <LowLevelILOperation.LLIL_BP: 77>: [], <LowLevelILOperation.LLIL_TRAP: 78>: [('vector', 'int')], <LowLevelILOperation.LLIL_INTRINSIC: 79>: [('output', 'reg_or_flag_list'), ('intrinsic', 'intrinsic'), ('param', 'expr')], <LowLevelILOperation.LLIL_UNDEF: 80>: [], <LowLevelILOperation.LLIL_UNIMPL: 81>: [], <LowLevelILOperation.LLIL_UNIMPL_MEM: 82>: [('src', 'expr')], <LowLevelILOperation.LLIL_FADD: 83>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FSUB: 84>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FMUL: 85>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FDIV: 86>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FSQRT: 87>: [('src', 'expr')], <LowLevelILOperation.LLIL_FNEG: 88>: [('src', 'expr')], <LowLevelILOperation.LLIL_FABS: 89>: [('src', 'expr')], <LowLevelILOperation.LLIL_FLOAT_TO_INT: 90>: [('src', 'expr')], <LowLevelILOperation.LLIL_INT_TO_FLOAT: 91>: [('src', 'expr')], <LowLevelILOperation.LLIL_FLOAT_CONV: 92>: [('src', 'expr')], <LowLevelILOperation.LLIL_ROUND_TO_INT: 93>: [('src', 'expr')], <LowLevelILOperation.LLIL_FLOOR: 94>: [('src', 'expr')], <LowLevelILOperation.LLIL_CEIL: 95>: [('src', 'expr')], <LowLevelILOperation.LLIL_FTRUNC: 96>: [('src', 'expr')], <LowLevelILOperation.LLIL_FCMP_E: 97>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FCMP_NE: 98>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FCMP_LT: 99>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FCMP_LE: 100>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FCMP_GE: 101>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FCMP_GT: 102>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FCMP_O: 103>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_FCMP_UO: 104>: [('left', 'expr'), ('right', 'expr')], <LowLevelILOperation.LLIL_SET_REG_SSA: 105>: [('dest', 'reg_ssa'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_SSA_PARTIAL: 106>: [('full_reg', 'reg_ssa'), ('dest', 'reg'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_SPLIT_SSA: 107>: [('hi', 'expr'), ('lo', 'expr'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_STACK_REL_SSA: 108>: [('stack', 'expr'), ('dest', 'expr'), ('top', 'expr'), ('src', 'expr')], <LowLevelILOperation.LLIL_SET_REG_STACK_ABS_SSA: 109>: [('stack', 'expr'), ('dest', 'reg'), ('src', 'expr')], <LowLevelILOperation.LLIL_REG_SPLIT_DEST_SSA: 110>: [('dest', 'reg_ssa')], <LowLevelILOperation.LLIL_REG_STACK_DEST_SSA: 111>: [('src', 'reg_stack_ssa_dest_and_src')], <LowLevelILOperation.LLIL_REG_SSA: 112>: [('src', 'reg_ssa')], <LowLevelILOperation.LLIL_REG_SSA_PARTIAL: 113>: [('full_reg', 'reg_ssa'), ('src', 'reg')], <LowLevelILOperation.LLIL_REG_SPLIT_SSA: 114>: [('hi', 'reg_ssa'), ('lo', 'reg_ssa')], <LowLevelILOperation.LLIL_REG_STACK_REL_SSA: 115>: [('stack', 'reg_stack_ssa'), ('src', 'expr'), ('top', 'expr')], <LowLevelILOperation.LLIL_REG_STACK_ABS_SSA: 116>: [('stack', 'reg_stack_ssa'), ('src', 'reg')], <LowLevelILOperation.LLIL_REG_STACK_FREE_REL_SSA: 117>: [('stack', 'expr'), ('dest', 'expr'), ('top', 'expr')], <LowLevelILOperation.LLIL_REG_STACK_FREE_ABS_SSA: 118>: [('stack', 'expr'), ('dest', 'reg')], <LowLevelILOperation.LLIL_SET_FLAG_SSA: 119>: [('dest', 'flag_ssa'), ('src', 'expr')], <LowLevelILOperation.LLIL_FLAG_SSA: 120>: [('src', 'flag_ssa')], <LowLevelILOperation.LLIL_FLAG_BIT_SSA: 121>: [('src', 'flag_ssa'), ('bit', 'int')], <LowLevelILOperation.LLIL_CALL_SSA: 122>: [('output', 'expr'), ('dest', 'expr'), ('stack', 'expr'), ('param', 'expr')], <LowLevelILOperation.LLIL_SYSCALL_SSA: 123>: [('output', 'expr'), ('stack', 'expr'), ('param', 'expr')], <LowLevelILOperation.LLIL_TAILCALL_SSA: 124>: [('output', 'expr'), ('dest', 'expr'), ('stack', 'expr'), ('param', 'expr')], <LowLevelILOperation.LLIL_CALL_PARAM: 125>: [('src', 'expr_list')], <LowLevelILOperation.LLIL_CALL_STACK_SSA: 126>: [('src', 'reg_ssa'), ('src_memory', 'int')], <LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: 127>: [('dest_memory', 'int'), ('dest', 'reg_ssa_list')], <LowLevelILOperation.LLIL_LOAD_SSA: 128>: [('src', 'expr'), ('src_memory', 'int')], <LowLevelILOperation.LLIL_STORE_SSA: 129>: [('dest', 'expr'), ('dest_memory', 'int'), ('src_memory', 'int'), ('src', 'expr')], <LowLevelILOperation.LLIL_INTRINSIC_SSA: 130>: [('output', 'reg_or_flag_ssa_list'), ('intrinsic', 'intrinsic'), ('param', 'expr')], <LowLevelILOperation.LLIL_REG_PHI: 131>: [('dest', 'reg_ssa'), ('src', 'reg_ssa_list')], <LowLevelILOperation.LLIL_REG_STACK_PHI: 132>: [('dest', 'reg_stack_ssa'), ('src', 'reg_stack_ssa_list')], <LowLevelILOperation.LLIL_FLAG_PHI: 133>: [('dest', 'flag_ssa'), ('src', 'flag_ssa_list')], <LowLevelILOperation.LLIL_MEM_PHI: 134>: [('dest_memory', 'int'), ('src_memory', 'int_list')]}
il_basic_block

IL basic block object containing this expression (read-only) (only available on finalized functions)

mapped_medium_level_il

Gets the mapped medium level IL expression corresponding to this expression

medium_level_il

Gets the medium level IL expression corresponding to this expression (may be None for eliminated instructions)

mlil
mmlil
non_ssa_form

Non-SSA form of expression (read-only)

possible_values

Possible values of expression using path-sensitive static data flow analysis (read-only)

postfix_operands

All operands in the expression tree in postfix order

prefix_operands

All operands in the expression tree in prefix order

ssa_form

SSA form of expression (read-only)

tokens

LLIL tokens (read-only)

value

Value of expression if constant or a known value (read-only)

class LowLevelILLabel(handle=None)[source]

Bases: object

class LowLevelILOperationAndSize(operation, size)[source]

Bases: object

class SSAFlag(flag, version)[source]

Bases: object

class SSARegister(reg, version)[source]

Bases: object

class SSARegisterOrFlag(reg_or_flag, version)[source]

Bases: object

class SSARegisterStack(reg_stack, version)[source]

Bases: object

LLIL_GET_TEMP_REG_INDEX(n)[source]
LLIL_REG_IS_TEMP(n)[source]
LLIL_TEMP(n)[source]