lowlevelil module

Class

Description

binaryninja.lowlevelil.CoreLowLevelILInstruction

binaryninja.lowlevelil.ILFlag

binaryninja.lowlevelil.ILIntrinsic

binaryninja.lowlevelil.ILRegister

binaryninja.lowlevelil.ILRegisterStack

binaryninja.lowlevelil.ILSemanticFlagClass

binaryninja.lowlevelil.ILSemanticFlagGroup

binaryninja.lowlevelil.LowLevelILAdc

binaryninja.lowlevelil.LowLevelILAdd

binaryninja.lowlevelil.LowLevelILAddOverflow

binaryninja.lowlevelil.LowLevelILAnd

binaryninja.lowlevelil.LowLevelILAsr

binaryninja.lowlevelil.LowLevelILAssert

binaryninja.lowlevelil.LowLevelILAssertSsa

binaryninja.lowlevelil.LowLevelILBasicBlock

The LogLevelILBasicBlock object is returned during analysis and should not be directly…

binaryninja.lowlevelil.LowLevelILBinaryBase

binaryninja.lowlevelil.LowLevelILBoolToInt

binaryninja.lowlevelil.LowLevelILBp

binaryninja.lowlevelil.LowLevelILCall

binaryninja.lowlevelil.LowLevelILCallOutputSsa

binaryninja.lowlevelil.LowLevelILCallParam

binaryninja.lowlevelil.LowLevelILCallSsa

binaryninja.lowlevelil.LowLevelILCallStackAdjust

binaryninja.lowlevelil.LowLevelILCallStackSsa

binaryninja.lowlevelil.LowLevelILCarryBase

binaryninja.lowlevelil.LowLevelILCeil

binaryninja.lowlevelil.LowLevelILCmpE

binaryninja.lowlevelil.LowLevelILCmpNe

binaryninja.lowlevelil.LowLevelILCmpSge

binaryninja.lowlevelil.LowLevelILCmpSgt

binaryninja.lowlevelil.LowLevelILCmpSle

binaryninja.lowlevelil.LowLevelILCmpSlt

binaryninja.lowlevelil.LowLevelILCmpUge

binaryninja.lowlevelil.LowLevelILCmpUgt

binaryninja.lowlevelil.LowLevelILCmpUle

binaryninja.lowlevelil.LowLevelILCmpUlt

binaryninja.lowlevelil.LowLevelILComparisonBase

binaryninja.lowlevelil.LowLevelILConst

binaryninja.lowlevelil.LowLevelILConstPtr

binaryninja.lowlevelil.LowLevelILConstantBase

binaryninja.lowlevelil.LowLevelILDivs

binaryninja.lowlevelil.LowLevelILDivsDp

binaryninja.lowlevelil.LowLevelILDivu

binaryninja.lowlevelil.LowLevelILDivuDp

binaryninja.lowlevelil.LowLevelILExpr

class LowLevelILExpr hold the index of IL Expressions.

binaryninja.lowlevelil.LowLevelILExternPtr

binaryninja.lowlevelil.LowLevelILFabs

binaryninja.lowlevelil.LowLevelILFadd

binaryninja.lowlevelil.LowLevelILFcmpE

binaryninja.lowlevelil.LowLevelILFcmpGe

binaryninja.lowlevelil.LowLevelILFcmpGt

binaryninja.lowlevelil.LowLevelILFcmpLe

binaryninja.lowlevelil.LowLevelILFcmpLt

binaryninja.lowlevelil.LowLevelILFcmpNe

binaryninja.lowlevelil.LowLevelILFcmpO

binaryninja.lowlevelil.LowLevelILFcmpUo

binaryninja.lowlevelil.LowLevelILFdiv

binaryninja.lowlevelil.LowLevelILFlag

binaryninja.lowlevelil.LowLevelILFlagBit

binaryninja.lowlevelil.LowLevelILFlagBitSsa

binaryninja.lowlevelil.LowLevelILFlagCond

binaryninja.lowlevelil.LowLevelILFlagGroup

binaryninja.lowlevelil.LowLevelILFlagPhi

binaryninja.lowlevelil.LowLevelILFlagSsa

binaryninja.lowlevelil.LowLevelILFloatConst

binaryninja.lowlevelil.LowLevelILFloatConv

binaryninja.lowlevelil.LowLevelILFloatToInt

binaryninja.lowlevelil.LowLevelILFloor

binaryninja.lowlevelil.LowLevelILFmul

binaryninja.lowlevelil.LowLevelILFneg

binaryninja.lowlevelil.LowLevelILForceVer

binaryninja.lowlevelil.LowLevelILForceVerSsa

binaryninja.lowlevelil.LowLevelILFsqrt

binaryninja.lowlevelil.LowLevelILFsub

binaryninja.lowlevelil.LowLevelILFtrunc

binaryninja.lowlevelil.LowLevelILFunction

class LowLevelILFunction contains the list of ExpressionIndex objects that make up a…

binaryninja.lowlevelil.LowLevelILGoto

binaryninja.lowlevelil.LowLevelILIf

binaryninja.lowlevelil.LowLevelILInstruction

class LowLevelILInstruction Low Level Intermediate Language Instructions are infinite length…

binaryninja.lowlevelil.LowLevelILIntToFloat

binaryninja.lowlevelil.LowLevelILIntrinsic

binaryninja.lowlevelil.LowLevelILIntrinsicSsa

binaryninja.lowlevelil.LowLevelILJump

binaryninja.lowlevelil.LowLevelILJumpTo

binaryninja.lowlevelil.LowLevelILLabel

binaryninja.lowlevelil.LowLevelILLoad

binaryninja.lowlevelil.LowLevelILLoadSsa

binaryninja.lowlevelil.LowLevelILLowPart

binaryninja.lowlevelil.LowLevelILLsl

binaryninja.lowlevelil.LowLevelILLsr

binaryninja.lowlevelil.LowLevelILMemPhi

binaryninja.lowlevelil.LowLevelILMemoryIntrinsicOutputSsa

binaryninja.lowlevelil.LowLevelILMemoryIntrinsicSsa

binaryninja.lowlevelil.LowLevelILMods

binaryninja.lowlevelil.LowLevelILModsDp

binaryninja.lowlevelil.LowLevelILModu

binaryninja.lowlevelil.LowLevelILModuDp

binaryninja.lowlevelil.LowLevelILMul

binaryninja.lowlevelil.LowLevelILMulsDp

binaryninja.lowlevelil.LowLevelILMuluDp

binaryninja.lowlevelil.LowLevelILNeg

binaryninja.lowlevelil.LowLevelILNop

binaryninja.lowlevelil.LowLevelILNoret

binaryninja.lowlevelil.LowLevelILNot

binaryninja.lowlevelil.LowLevelILOperationAndSize

binaryninja.lowlevelil.LowLevelILOr

binaryninja.lowlevelil.LowLevelILPop

binaryninja.lowlevelil.LowLevelILPush

binaryninja.lowlevelil.LowLevelILReg

binaryninja.lowlevelil.LowLevelILRegPhi

binaryninja.lowlevelil.LowLevelILRegSplit

binaryninja.lowlevelil.LowLevelILRegSplitDestSsa

binaryninja.lowlevelil.LowLevelILRegSplitSsa

binaryninja.lowlevelil.LowLevelILRegSsa

binaryninja.lowlevelil.LowLevelILRegSsaPartial

binaryninja.lowlevelil.LowLevelILRegStackAbsSsa

binaryninja.lowlevelil.LowLevelILRegStackDestSsa

binaryninja.lowlevelil.LowLevelILRegStackFreeAbsSsa

binaryninja.lowlevelil.LowLevelILRegStackFreeReg

binaryninja.lowlevelil.LowLevelILRegStackFreeRel

binaryninja.lowlevelil.LowLevelILRegStackFreeRelSsa

binaryninja.lowlevelil.LowLevelILRegStackPhi

binaryninja.lowlevelil.LowLevelILRegStackPop

binaryninja.lowlevelil.LowLevelILRegStackPush

binaryninja.lowlevelil.LowLevelILRegStackRel

binaryninja.lowlevelil.LowLevelILRegStackRelSsa

binaryninja.lowlevelil.LowLevelILRet

binaryninja.lowlevelil.LowLevelILRlc

binaryninja.lowlevelil.LowLevelILRol

binaryninja.lowlevelil.LowLevelILRor

binaryninja.lowlevelil.LowLevelILRoundToInt

binaryninja.lowlevelil.LowLevelILRrc

binaryninja.lowlevelil.LowLevelILSbb

binaryninja.lowlevelil.LowLevelILSeparateParamListSsa

binaryninja.lowlevelil.LowLevelILSetFlag

binaryninja.lowlevelil.LowLevelILSetFlagSsa

binaryninja.lowlevelil.LowLevelILSetReg

binaryninja.lowlevelil.LowLevelILSetRegSplit

binaryninja.lowlevelil.LowLevelILSetRegSplitSsa

binaryninja.lowlevelil.LowLevelILSetRegSsa

binaryninja.lowlevelil.LowLevelILSetRegSsaPartial

binaryninja.lowlevelil.LowLevelILSetRegStackAbsSsa

binaryninja.lowlevelil.LowLevelILSetRegStackRel

binaryninja.lowlevelil.LowLevelILSetRegStackRelSsa

binaryninja.lowlevelil.LowLevelILSharedParamSlotSsa

binaryninja.lowlevelil.LowLevelILStore

binaryninja.lowlevelil.LowLevelILStoreSsa

binaryninja.lowlevelil.LowLevelILSub

binaryninja.lowlevelil.LowLevelILSx

binaryninja.lowlevelil.LowLevelILSyscall

binaryninja.lowlevelil.LowLevelILSyscallSsa

binaryninja.lowlevelil.LowLevelILTailcall

binaryninja.lowlevelil.LowLevelILTailcallSsa

binaryninja.lowlevelil.LowLevelILTestBit

binaryninja.lowlevelil.LowLevelILTrap

binaryninja.lowlevelil.LowLevelILUnaryBase

binaryninja.lowlevelil.LowLevelILUndef

binaryninja.lowlevelil.LowLevelILUnimpl

binaryninja.lowlevelil.LowLevelILUnimplMem

binaryninja.lowlevelil.LowLevelILXor

binaryninja.lowlevelil.LowLevelILZx

binaryninja.lowlevelil.SSAFlag

binaryninja.lowlevelil.SSARegister

binaryninja.lowlevelil.SSARegisterOrFlag

binaryninja.lowlevelil.SSARegisterStack
class CoreLowLevelILInstruction[source]

Bases: object

CoreLowLevelILInstruction(operation: binaryninja.enums.LowLevelILOperation, attributes: int, size: int, flags: int, source_operand: <function NewType.<locals>.new_type at 0x112ace310>, operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex], address: int)

__init__(operation: LowLevelILOperation, attributes: int, size: int, flags: int, source_operand: ExpressionIndex, operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex], address: int) → None
Parameters:

  • operation (LowLevelILOperation) –

  • attributes (int) –

  • size (int) –

  • flags (int) –

  • source_operand (ExpressionIndex) –

  • operands (Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]) –

  • address (int) –

Return type:

None

classmethod from_BNLowLevelILInstruction(instr: BNLowLevelILInstruction) → CoreLowLevelILInstruction[source]
Parameters:

instr (BNLowLevelILInstruction) –

Return type:

CoreLowLevelILInstruction

address: int
attributes: int
flags: int
operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]
operation: LowLevelILOperation
size: int
source_operand: ExpressionIndex
class ILFlag[source]

Bases: object

ILFlag(arch: ‘architecture.Architecture’, index: ‘architecture.FlagIndex’)

__init__(arch: Architecture, index: FlagIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: FlagIndex
property name: FlagName
property temp: bool
class ILIntrinsic[source]

Bases: object

ILIntrinsic(arch: ‘architecture.Architecture’, index: ‘architecture.IntrinsicIndex’)

__init__(arch: Architecture, index: IntrinsicIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: IntrinsicIndex
property inputs: List[IntrinsicInput]

inputs is only available if the IL intrinsic is an Architecture intrinsic

property name: IntrinsicName
property outputs: List[Type]

outputs is only available if the IL intrinsic is an Architecture intrinsic

class ILRegister[source]

Bases: object

ILRegister(arch: ‘architecture.Architecture’, index: ‘architecture.RegisterIndex’)

__init__(arch: Architecture, index: RegisterIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: RegisterIndex
property info: RegisterInfo
property name: RegisterName
property temp: bool
class ILRegisterStack[source]

Bases: object

ILRegisterStack(arch: ‘architecture.Architecture’, index: ‘architecture.RegisterStackIndex’)

__init__(arch: Architecture, index: RegisterStackIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: RegisterStackIndex
property info: RegisterStackInfo
property name: RegisterStackName
class ILSemanticFlagClass[source]

Bases: object

ILSemanticFlagClass(arch: ‘architecture.Architecture’, index: ‘architecture.SemanticClassIndex’)

__init__(arch: Architecture, index: SemanticClassIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: SemanticClassIndex
property name: SemanticClassName
class ILSemanticFlagGroup[source]

Bases: object

ILSemanticFlagGroup(arch: ‘architecture.Architecture’, index: ‘architecture.SemanticGroupIndex’)

__init__(arch: Architecture, index: SemanticGroupIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: SemanticGroupIndex
property name: SemanticGroupName
class LowLevelILAdc[source]

Bases: LowLevelILCarryBase

LowLevelILAdc(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILAdd[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILAdd(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILAddOverflow[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILAddOverflow(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILAnd[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILAnd(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILAsr[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILAsr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILAssert[source]

Bases: LowLevelILInstruction

LowLevelILAssert(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constraint: PossibleValueSet
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILRegister
class LowLevelILAssertSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILAssertSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constraint: PossibleValueSet
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegister
class LowLevelILBasicBlock[source]

Bases: BasicBlock

The LogLevelILBasicBlock object is returned during analysis and should not be directly instantiated.

__init__(handle: LP_BNBasicBlock, owner: LowLevelILFunction, view: BinaryView | None)[source]
Parameters:
property il_function: LowLevelILFunction

IL Function of which this block is a part, if the block is part of an IL Function.

property instruction_count: int
class LowLevelILBinaryBase[source]

Bases: LowLevelILInstruction, BinaryOperation

LowLevelILBinaryBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property left: LowLevelILInstruction
property right: LowLevelILInstruction
class LowLevelILBoolToInt[source]

Bases: LowLevelILInstruction

LowLevelILBoolToInt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILBp[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILBp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCall[source]

Bases: LowLevelILInstruction, Localcall

LowLevelILCall(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCallOutputSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILCallOutputSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: List[SSARegister]
property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCallParam[source]

Bases: LowLevelILInstruction, SSA

LowLevelILCallParam(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[LowLevelILInstruction]
class LowLevelILCallSsa[source]

Bases: LowLevelILInstruction, Localcall, SSA

LowLevelILCallSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property output: List[SSARegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property stack: LowLevelILInstruction
class LowLevelILCallStackAdjust[source]

Bases: LowLevelILInstruction, Localcall

LowLevelILCallStackAdjust(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property reg_stack_adjustments: Dict[RegisterStackName, int]
property stack_adjustment: int
class LowLevelILCallStackSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILCallStackSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegister
property src_memory: int
class LowLevelILCarryBase[source]

Bases: LowLevelILInstruction, Carry

LowLevelILCarryBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property carry: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property left: LowLevelILInstruction
property right: LowLevelILInstruction
class LowLevelILCeil[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILCeil(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILCmpE[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpE(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpNe[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpNe(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpSge[source]

Bases: LowLevelILComparisonBase, Signed

LowLevelILCmpSge(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpSgt[source]

Bases: LowLevelILComparisonBase, Signed

LowLevelILCmpSgt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpSle[source]

Bases: LowLevelILComparisonBase, Signed

LowLevelILCmpSle(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpSlt[source]

Bases: LowLevelILComparisonBase, Signed

LowLevelILCmpSlt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpUge[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpUge(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpUgt[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpUgt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpUle[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpUle(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILCmpUlt[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpUlt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILComparisonBase[source]

Bases: LowLevelILBinaryBase, Comparison

LowLevelILComparisonBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILConst[source]

Bases: LowLevelILConstantBase

LowLevelILConst(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILConstPtr[source]

Bases: LowLevelILConstantBase

LowLevelILConstPtr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILConstantBase[source]

Bases: LowLevelILInstruction, Constant

LowLevelILConstantBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constant: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILDivs[source]

Bases: LowLevelILBinaryBase, Arithmetic, Signed

LowLevelILDivs(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILDivsDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision, Signed

LowLevelILDivsDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILDivu[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILDivu(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILDivuDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision

LowLevelILDivuDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILExpr[source]

Bases: object

class LowLevelILExpr hold the index of IL Expressions.

Note

Deprecated. Use ExpressionIndex instead

__init__(index: ExpressionIndex)[source]
Parameters:

index (ExpressionIndex) –

property index: ExpressionIndex
class LowLevelILExternPtr[source]

Bases: LowLevelILConstantBase

LowLevelILExternPtr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constant: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property offset: int
class LowLevelILFabs[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFabs(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILFadd[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILFadd(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFcmpE[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpE(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFcmpGe[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpGe(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFcmpGt[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpGt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFcmpLe[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpLe(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFcmpLt[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpLt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFcmpNe[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpNe(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFcmpO[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpO(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFcmpUo[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpUo(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFdiv[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILFdiv(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFlag[source]

Bases: LowLevelILInstruction

LowLevelILFlag(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILFlag
class LowLevelILFlagBit[source]

Bases: LowLevelILInstruction

LowLevelILFlagBit(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property bit: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILFlag
class LowLevelILFlagBitSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILFlagBitSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property bit: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSAFlag
class LowLevelILFlagCond[source]

Bases: LowLevelILInstruction

LowLevelILFlagCond(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property condition: LowLevelILFlagCondition
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property semantic_class: ILSemanticFlagClass | None
class LowLevelILFlagGroup[source]

Bases: LowLevelILInstruction

LowLevelILFlagGroup(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property semantic_group: ILSemanticFlagGroup
class LowLevelILFlagPhi[source]

Bases: LowLevelILInstruction, Phi

LowLevelILFlagPhi(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSAFlag
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[SSAFlag]
class LowLevelILFlagSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILFlagSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSAFlag
class LowLevelILFloatConst[source]

Bases: LowLevelILConstantBase, FloatingPoint

LowLevelILFloatConst(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constant: int | float
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFloatConv[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFloatConv(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILFloatToInt[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFloatToInt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILFloor[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFloor(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILFmul[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILFmul(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFneg[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFneg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILForceVer[source]

Bases: LowLevelILInstruction

LowLevelILForceVer(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILForceVerSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILForceVerSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegister
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegister
class LowLevelILFsqrt[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFsqrt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILFsub[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILFsub(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILFtrunc[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFtrunc(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILFunction[source]

Bases: object

class LowLevelILFunction contains the list of ExpressionIndex objects that make up a function. ExpressionIndex objects can be added to the LowLevelILFunction by calling append and passing the result of the various class methods which return ExpressionIndex objects.

LowLevelILFlagCondition values used as parameters in the flag_condition method.

LowLevelILFlagCondition

Operator

Description

LLFC_E

==

Equal

LLFC_NE

!=

Not equal

LLFC_SLT

s<

Signed less than

LLFC_ULT

u<

Unsigned less than

LLFC_SLE

s<=

Signed less than or equal

LLFC_ULE

u<=

Unsigned less than or equal

LLFC_SGE

s>=

Signed greater than or equal

LLFC_UGE

u>=

Unsigned greater than or equal

LLFC_SGT

s>

Signed greater than

LLFC_UGT

u>

Unsigned greater than

LLFC_NEG

Negative

LLFC_POS

Positive

LLFC_O

overflow

Overflow

LLFC_NO

!overflow

No overflow
__init__(arch: Architecture | None = None, handle: BNLowLevelILFunction | None = None, source_func: Function | None = None)[source]
Parameters:

  • arch (Architecture | None) –

  • handle (BNLowLevelILFunction | None) –

  • source_func (Function | None) –

add(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

add adds expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression add.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

add_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

add_carry adds with carry expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression adc.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

add_index_list(indices: List[int]) → ExpressionIndex[source]

add_index_list returns an index list expression for the given list of integers.

Parameters:

indices (List(int)) – list of numbers

Returns:

an operand list expression

Return type:

ExpressionIndex

add_label_for_address(arch: Architecture, addr: int) → None[source]

add_label_for_address adds a low-level IL label for the given architecture arch at the given virtual address addr

Parameters:

  • arch (Architecture) – Architecture to add labels for

  • addr (int) – the IL address to add a label at

Return type:

None

add_label_map(labels: Dict[int, LowLevelILLabel], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

add_label_map returns a label list expression for the given list of LowLevelILLabel objects.

Parameters:
Returns:

the label list expression

Return type:

ExpressionIndex

add_operand_list(operands: List[ExpressionIndex]) → ExpressionIndex[source]

add_operand_list returns an operand list expression for the given list of integer operands.

Parameters:

operands (List(Union[ExpressionIndex, ExpressionIndex])) – list of operand numbers

Returns:

an operand list expression

Return type:

ExpressionIndex

and_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

and_expr bitwise and’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression and.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

append(expr: ExpressionIndex) → InstructionIndex[source]

append adds the ExpressionIndex expr to the current LowLevelILFunction.

Parameters:

expr (ExpressionIndex) – the ExpressionIndex to add to the current LowLevelILFunction

Returns:

Index of added instruction in the current function

Return type:

int

arith_shift_right(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

arith_shift_right shifts arithmetic right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression asr.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

assert_expr(size: int, src: architecture.RegisterType, constraint: PossibleValueSet, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

assert_expr assert constraint is the value of the given register src. Used when setting user variable values.

Parameters:

  • size (int) – size of value in the constraint

  • src (RegisterType) – register to constrain

  • constraint (PossibleValueSet) – asserted value of register

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression ASSERT(reg, constraint)

Return type:

ExpressionIndex

bool_to_int(size: int, a: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

bool_to_int returns an expression of size size converting the boolean expression a to an integer

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – boolean expression to be converted

  • loc (ILSourceLocation) – location of returned expression

Returns:

the converted integer expression.

Return type:

ExpressionIndex

breakpoint(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

breakpoint returns a processor breakpoint expression.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

a breakpoint expression.

Return type:

ExpressionIndex

cache_possible_value_set(pvs: PossibleValueSet) → int[source]

Cache a PossibleValueSet in the IL function, returning its index for use in an expression operand :param pvs: PossibleValueSet to cache :return: Index of the PossibleValueSet in the cache

Parameters:

pvs (PossibleValueSet) –

Return type:

int

call(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

call returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest

Parameters:

  • dest (ExpressionIndex) – the expression to call

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression call(dest)

Return type:

ExpressionIndex

call_stack_adjust(dest: ExpressionIndex, stack_adjust: int, reg_stack_adjustments: Dict[architecture.RegisterStackType, int] | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

call_stack_adjust returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest. After the function exits, stack_adjust is added to the stack pointer register.

Parameters:

  • dest (ExpressionIndex) – the expression to call

  • loc (ILSourceLocation) – location of returned expression

  • stack_adjust (int) –

  • reg_stack_adjustments (Dict[architecture.RegisterStackType, int] | None) –

Returns:

The expression call(dest), stack += stack_adjust

Return type:

ExpressionIndex

ceil(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

ceil rounds a floating point value to an integer towards positive infinity

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round up

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

clear_indirect_branches() → None[source]
Return type:

None

compare_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_equal returns comparison expression of size size checking if expression a is equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_not_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_not_equal returns comparison expression of size size checking if expression a is not equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_greater_equal returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_greater_than returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_less_equal returns comparison expression of size size checking if expression a is signed less than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_less_than returns comparison expression of size size checking if expression a is signed less than expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_greater_equal returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_greater_than returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_less_equal returns comparison expression of size size checking if expression a is unsigned less than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_less_than returns comparison expression of size size checking if expression a is unsigned less than expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

const(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

const returns an expression for the constant integer value with size size

Parameters:

  • size (int) – the size of the constant in bytes

  • value (int) – integer value of the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

const_pointer(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

const_pointer returns an expression for the constant pointer value with size size

Parameters:

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by pointer

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

copy_expr(original: LowLevelILInstruction) → ExpressionIndex[source]

copy_expr adds an expression to the function which is equivalent to the given expression

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:

original (LowLevelILInstruction) – the original IL Instruction you want to copy

Returns:

The index of the newly copied expression

Return type:

ExpressionIndex

copy_expr_to(expr: LowLevelILInstruction, dest: LowLevelILFunction, sub_expr_handler: Callable[[LowLevelILInstruction], ExpressionIndex] | None = None) → ExpressionIndex[source]

copy_expr_to deep copies an expression from this function into a target function If provided, the function sub_expr_handler will be called on every copied sub-expression

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:
Returns:

Index of the copied expression in the target function

Return type:

ExpressionIndex

create_graph(settings: DisassemblySettings | None = None) → CoreFlowGraph[source]
Parameters:

settings (DisassemblySettings | None) –

Return type:

CoreFlowGraph

create_graph_immediate(settings: DisassemblySettings | None = None) → CoreFlowGraph[source]
Parameters:

settings (DisassemblySettings | None) –

Return type:

CoreFlowGraph

div_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_double_prec_signed signed double precision divide using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divs.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_double_prec_unsigned unsigned double precision divide using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_signed signed divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divs.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_unsigned unsigned divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divu.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

expr(operation, a: ExpressionIndex = 0, b: ExpressionIndex = 0, c: ExpressionIndex = 0, d: ExpressionIndex = 0, size: int = 0, flags: architecture.FlagWriteTypeName | architecture.FlagType | architecture.FlagIndex | int | None = None, source_location: ILSourceLocation | None = None) → ExpressionIndex[source]
Parameters:

  • a (ExpressionIndex) –

  • b (ExpressionIndex) –

  • c (ExpressionIndex) –

  • d (ExpressionIndex) –

  • size (int) –

  • flags (architecture.FlagWriteTypeName | architecture.FlagType | architecture.FlagIndex | int | None) –

  • source_location (ILSourceLocation | None) –

Return type:

ExpressionIndex

extern_pointer(size: int, value: int, offset: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

extern_pointer returns an expression for the constant external pointer value with size size at offset offset

Parameters:

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by pointer

  • offset (int) – offset into external pointer

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

finalize() → None[source]

finalize ends the function and computes the list of basic blocks.

Return type:

None

flag(flag: architecture.FlagType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

flag returns a flag expression for the given flag name.

Parameters:

  • flag (architecture.FlagType) – flag expression to retrieve

  • loc (ILSourceLocation) – location of returned expression

Returns:

A flag expression of given flag name

Return type:

ExpressionIndex

flag_bit(size: int, flag: architecture.FlagType, bit: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

flag_bit sets the flag named flag and size size to the constant integer value bit

Parameters:

  • size (int) – the size of the flag

  • flag (str) – flag value

  • bit (int) – integer value to set the bit to

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size FLAG.flag = bit

Return type:

ExpressionIndex

flag_condition(cond: str | LowLevelILFlagCondition | int, sem_class: architecture.SemanticClassType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

flag_condition returns a flag_condition expression for the given LowLevelILFlagCondition

Parameters:
Returns:

A flag_condition expression

Return type:

ExpressionIndex

flag_group(sem_group: SemanticGroupName, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

flag_group returns a flag_group expression for the given semantic flag group

Parameters:

  • sem_group (SemanticGroupName) – Semantic flag group to access

  • loc (ILSourceLocation) – location of returned expression

Returns:

A flag_group expression

Return type:

ExpressionIndex

float_abs(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_abs returns absolute value of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to get the absolute value of

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fabs.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_add(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_add adds floating point expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fadd.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_compare_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_equal returns floating point comparison expression of size size checking if expression a is equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f== b

Return type:

ExpressionIndex

float_compare_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_greater_equal returns floating point comparison expression of size size checking if expression a is greater than or equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f>= b

Return type:

ExpressionIndex

float_compare_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_greater_than returns floating point comparison expression of size size checking if expression a is greater than expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f> b

Return type:

ExpressionIndex

float_compare_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_less_equal returns floating point comparison expression of size size checking if expression a is less than or equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f<= b

Return type:

ExpressionIndex

float_compare_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_less_than returns floating point comparison expression of size size checking if expression a is less than expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f< b

Return type:

ExpressionIndex

float_compare_not_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_not_equal returns floating point comparison expression of size size checking if expression a is not equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f!= b

Return type:

ExpressionIndex

float_compare_ordered(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_ordered returns floating point comparison expression of size size checking if expression a is ordered relative to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression is_ordered(a, b)

Return type:

ExpressionIndex

float_compare_unordered(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_unordered returns floating point comparison expression of size size checking if expression a is unordered relative to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression is_unordered(a, b)

Return type:

ExpressionIndex

float_const_double(value: float, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_double returns an expression for the double precision floating point value value

Parameters:

  • value (float) – float value for the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_const_raw(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_raw returns an expression for the constant raw binary floating point value value with size size

Parameters:

  • size (int) – the size of the constant in bytes

  • value (int) – integer value for the raw binary representation of the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_const_single(value: float, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_single returns an expression for the single precision floating point value value

Parameters:

  • value (float) – float value for the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_convert(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

int_to_float converts floating point value of expression value to size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fconvert.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_div(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_div divides floating point expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fdiv.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_mult(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_mult multiplies floating point expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fmul.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_neg(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_neg returns sign negation of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fneg.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_sqrt(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_sqrt returns square root of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to calculate the square root of

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sqrt.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_sub(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_sub subtracts floating point expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fsub.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_to_int(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_to_int returns integer value of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to convert to an int

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression int.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_trunc(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_trunc rounds a floating point value to an integer towards zero

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to truncate

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

floor(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

floor rounds a floating point value to an integer towards negative infinity

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round down

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

force_ver(size: int, dest: architecture.RegisterType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

force_ver creates a new version of the register dest Effectively, this is like saying r0#2 = r0#1 which MLIL can then use as a new variable definition site.

Parameters:

  • size (int) – size of the register

  • dest (RegisterType) – the register to force a new version of

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression FORCE_VER(reg)

Return type:

ExpressionIndex

generate_ssa_form() → None[source]

generate_ssa_form generate SSA form given the current LLIL

Return type:

None

get_basic_block_at(index: int) → BasicBlock | None[source]

get_basic_block_at returns the BasicBlock at the given LLIL instruction index.

Parameters:

index (int) – Index of the LLIL instruction of the BasicBlock to retrieve.

Example:
>>> current_il_function.get_basic_block_at(current_il_index)
<llil block: x86@19-26>
Return type:

BasicBlock | None

get_exits_for_instr(idx: InstructionIndex) → List[InstructionIndex][source]
Parameters:

idx (InstructionIndex) –

Return type:

List[InstructionIndex]

get_expr(index: ExpressionIndex) → LowLevelILInstruction | None[source]

get_expr retrieves the IL expression at a given expression index in the function.

Warning

Not all IL expressions are valid, even if their index is within the bounds of the function, they might not be used by the function and might not contain properly structured data.

Parameters:

index (ExpressionIndex) – Index of desired expression in function

Returns:

A LowLevelILInstruction object for the expression, if it exists. Otherwise, None

Return type:

LowLevelILInstruction | None

get_expr_count() → int[source]

get_expr_count gives a the total number of expressions in this IL function

You can use this to enumerate all expressions in conjunction with get_expr

Warning

Not all IL expressions are valid, even if their index is within the returned value from this, they might not be used by the function and might not contain properly structured data.

Returns:

The number of expressions in the function

Return type:

int

get_expr_index_for_instruction(instr: InstructionIndex) → ExpressionIndex[source]
Parameters:

instr (InstructionIndex) –

Return type:

ExpressionIndex

get_high_level_il_expr_index(expr: ExpressionIndex) → ExpressionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

ExpressionIndex | None

get_high_level_il_instruction_index(instr: InstructionIndex) → InstructionIndex | None[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex | None

get_instruction_index_for_expr(expr: ExpressionIndex) → InstructionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

InstructionIndex | None

get_instruction_start(addr: int, arch: Architecture | None = None) → InstructionIndex | None[source]
Parameters:
Return type:

InstructionIndex | None

get_instructions_at(addr: int, arch: Architecture | None = None) → List[InstructionIndex][source]

get_instructions_at gets the InstructionIndex(s) corresponding to the given virtual address See the docs for mappings between ils for more information.

Parameters:

  • addr (int) – virtual address of the instruction to be queried

  • arch (Architecture) – (optional) Architecture for the given function

Return type:

list(InstructionIndex)

Example:
>>> func = next(bv.functions)
>>> func.llil.get_instructions_at(func.start)
[0]
get_label_for_address(arch: Architecture, addr: int) → LowLevelILLabel | None[source]

get_label_for_address returns the LowLevelILLabel for the given Architecture arch and IL address addr.

Parameters:
Returns:

the LowLevelILLabel for the given IL address

Return type:

LowLevelILLabel

get_label_for_source_instruction(i: InstructionIndex) → LowLevelILLabel | None[source]

Get the LowLevelILLabel for a given source instruction. The returned label is to an internal object with the same lifetime as the containing LowLevelILFunction.

Parameters:

i (InstructionIndex) – The source instruction index

Returns:

The LowLevelILLabel for the source instruction

Return type:

LowLevelILLabel | None

get_mapped_medium_level_il_expr_index(expr: ExpressionIndex) → ExpressionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

ExpressionIndex | None

get_mapped_medium_level_il_instruction_index(instr: InstructionIndex) → InstructionIndex | None[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex | None

get_medium_level_il_expr_index(expr: ExpressionIndex) → ExpressionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

ExpressionIndex | None

get_medium_level_il_expr_indexes(expr: ExpressionIndex) → List[ExpressionIndex][source]
Parameters:

expr (ExpressionIndex) –

Return type:

List[ExpressionIndex]

get_medium_level_il_instruction_index(instr: InstructionIndex) → InstructionIndex | None[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex | None

get_non_ssa_instruction_index(instr: InstructionIndex) → InstructionIndex[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex

get_ssa_flag_definition(flag_ssa: SSAFlag) → LowLevelILInstruction | None[source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

LowLevelILInstruction | None

get_ssa_flag_uses(flag_ssa: SSAFlag) → List[LowLevelILInstruction][source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

List[LowLevelILInstruction]

get_ssa_flag_value(flag_ssa: SSAFlag) → RegisterValue[source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

RegisterValue

get_ssa_instruction_index(instr: InstructionIndex) → InstructionIndex[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex

get_ssa_memory_definition(index: int) → LowLevelILInstruction | None[source]
Parameters:

index (int) –

Return type:

LowLevelILInstruction | None

get_ssa_memory_uses(index: int) → List[LowLevelILInstruction][source]
Parameters:

index (int) –

Return type:

List[LowLevelILInstruction]

get_ssa_reg_definition(reg_ssa: SSARegister) → LowLevelILInstruction | None[source]
Parameters:

reg_ssa (SSARegister) –

Return type:

LowLevelILInstruction | None

get_ssa_reg_uses(reg_ssa: SSARegister) → List[LowLevelILInstruction][source]
Parameters:

reg_ssa (SSARegister) –

Return type:

List[LowLevelILInstruction]

get_ssa_reg_value(reg_ssa: SSARegister) → RegisterValue[source]
Parameters:

reg_ssa (SSARegister) –

Return type:

RegisterValue

goto(label: LowLevelILLabel, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

goto returns a goto expression which jumps to the provided LowLevelILLabel.

Parameters:
Returns:

the ExpressionIndex that jumps to the provided label

Return type:

ExpressionIndex

if_expr(operand: ExpressionIndex, t: LowLevelILLabel, f: LowLevelILLabel, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

if_expr returns the if expression which depending on condition operand jumps to the LowLevelILLabel t when the condition expression operand is non-zero and f when it’s zero.

Parameters:
Returns:

the ExpressionIndex for the if expression

Return type:

ExpressionIndex

int_to_float(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

int_to_float returns floating point value of integer expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to convert to a float

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression float.<size>{<flags>}(value)

Return type:

ExpressionIndex

intrinsic(outputs: List[str | ILRegister | int | ILFlag | RegisterInfo], intrinsic: architecture.IntrinsicType, params: List[ExpressionIndex], flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None)[source]

intrinsic return an intrinsic expression.

Parameters:
Returns:

an intrinsic expression.

Return type:

ExpressionIndex

jump(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

jump returns an expression which jumps (branches) to the expression dest

Parameters:

  • dest (ExpressionIndex) – the expression to jump to

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

jump_to(dest: ExpressionIndex, targets: Dict[int, LowLevelILLabel], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

jump_to returns an expression which jumps (branches) various targets in targets choosing the target in targets based on the value calculated by dest

Parameters:

  • dest (ExpressionIndex) – the expression choosing which jump target to use

  • targets (Dict[int, LowLevelILLabel]) – the list of targets for jump locations

  • loc (ILSourceLocation) – location of returned expression

  • targets –

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

load(size: int, addr: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

load Reads size bytes from the expression addr

Parameters:

  • size (int) – number of bytes to read

  • addr (ExpressionIndex) – the expression to read memory from

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression [addr].size

Return type:

ExpressionIndex

logical_shift_right(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

logical_shift_right shifts logically right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression lsr.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

low_part(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

low_part truncates value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to truncate

  • loc (ILSourceLocation) – location of returned expression

  • flags (architecture.FlagType | None) –

Returns:

The expression (value).<size>

Return type:

ExpressionIndex

mark_label(label: LowLevelILLabel) → None[source]

mark_label assigns a LowLevelILLabel to the current IL address.

Parameters:

label (LowLevelILLabel) –

Return type:

None

mod_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_double_prec_signed signed double precision modulus using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mods.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_double_prec_unsigned unsigned double precision modulus using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression modu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_signed signed modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mods.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_unsigned unsigned modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression modu.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult multiplies expression a by expression b potentially setting flags flags and returning an expression. Both the operands and return value are size bytes as the product’s upper half is discarded.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mul.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult_double_prec_signed multiplies signed with double (2*size bytes) precision expression a by expression b, each size bytes and potentially setting flags flags and returning an expression of 2*size bytes.

Note

The output expression is 2*size bytes in size, but will be rendered as muls.dp.<size>.

Parameters:

  • size (int) – the size of the input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression muls.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult_double_prec_unsigned multiplies unsigned with double (2*size bytes) precision expression a by expression b, each size bytes and potentially setting flags flags and returning an expression of 2*size bytes.

Note

The output expression is 2*size bytes in size, but will be rendered as mulu.dp.<size>.

Parameters:

  • size (int) – the size of the input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mulu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

neg_expr(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

neg_expr two’s complement sign negation of expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression neg.<size>{<flags>}(value)

Return type:

ExpressionIndex

no_ret(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

no_ret returns an expression that halts disassembly

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

The expression noreturn

Return type:

ExpressionIndex

nop(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

nop no operation, this instruction does nothing

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

The no operation expression

Return type:

ExpressionIndex

not_expr(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

not_expr bitwise inverse of expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to bitwise invert

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression not.<size>{<flags>}(value)

Return type:

ExpressionIndex

operand(n: int, expr: ExpressionIndex) → ExpressionIndex[source]

operand sets the operand number of the expression expr and passes back expr without modification.

Parameters:

  • n (int) –

  • expr (ExpressionIndex) –

Returns:

returns the expression expr unmodified

Return type:

ExpressionIndex

or_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

or_expr bitwise or’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression or.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

pop(size: int, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

pop reads size bytes from the stack, adjusting the stack by size.

Parameters:

  • size (int) – number of bytes to read from the stack

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression pop

Return type:

ExpressionIndex

prepare_to_copy_block(src: LowLevelILBasicBlock)[source]

prepare_to_copy_block sets up state when copying a function in preparation of copying the instructions from the block src

Parameters:

src (LowLevelILBasicBlock) – block about to be copied from

prepare_to_copy_function(src: LowLevelILFunction)[source]

prepare_to_copy_function sets up state in this LLIL function in preparation of copying instructions from src

Parameters:

src (LowLevelILFunction) – function about to be copied from

push(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

push writes size bytes from expression value to the stack, adjusting the stack by size.

Parameters:

  • size (int) – number of bytes to write and adjust the stack by

  • value (ExpressionIndex) – the expression to write

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression push(value)

Return type:

ExpressionIndex

reg(size: int, reg: architecture.RegisterType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg returns a register of size size with name reg

Parameters:

  • size (int) – the size of the register in bytes

  • reg (str) – the name of the register

  • loc (ILSourceLocation) – location of returned expression

Returns:

A register expression for the given string

Return type:

ExpressionIndex

reg_split(size: int, hi: architecture.RegisterType, lo: architecture.RegisterType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_split combines registers of size size with names hi and lo

Parameters:

  • size (int) – the size of the register in bytes

  • hi (str) – register holding high part of value

  • lo (str) – register holding low part of value

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression hi:lo

Return type:

ExpressionIndex

reg_stack_free_reg(reg: architecture.RegisterType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_free_reg clears the given register reg from its register stack without affecting the register at the top of the register stack.

Parameters:

  • reg (str) – the register being marked free

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression __free_slot(reg)

Return type:

ExpressionIndex

reg_stack_free_top_relative(reg_stack: architecture.RegisterStackType, entry: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_free_top_relative clears an entry in the register stack reg_stack at a top-relative position specified by the value of entry.

Parameters:

  • reg_stack (str) – the register stack name

  • entry (ExpressionIndex) – expression to calculate the top-relative position

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression __free_slot(reg_stack[entry])

Return type:

ExpressionIndex

reg_stack_pop(size: int, reg_stack: architecture.RegisterStackType, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_pop returns the top entry of size size in register stack with name reg_stack, and removes the entry from the stack

Parameters:

  • size (int) – the size of the register in bytes

  • reg_stack (str) – the name of the register stack

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg_stack.pop

Return type:

ExpressionIndex

reg_stack_push(size: int, reg_stack: architecture.RegisterStackType, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_push pushes the expression value of size size onto the top of the register stack reg_stack

Parameters:

  • size (int) – size of the register parameter in bytes

  • reg_stack (str) – the register stack name

  • value (ExpressionIndex) – an expression to push

  • flags (str) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg_stack.push(value)

Return type:

ExpressionIndex

reg_stack_top_relative(size: int, reg_stack: architecture.RegisterStackType, entry: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_top_relative returns a register stack entry of size size at top-relative location entry in register stack with name reg_stack

Parameters:

  • size (int) – the size of the register in bytes

  • reg_stack (str) – the name of the register stack

  • entry (ExpressionIndex) – an expression for which stack entry to fetch

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg_stack[entry]

Return type:

ExpressionIndex

replace_expr(original: LowLevelILInstruction | ExpressionIndex | InstructionIndex, new: LowLevelILInstruction | ExpressionIndex | InstructionIndex) → None[source]

replace_expr allows modification of expressions but ONLY during lifting.

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:

  • original (ExpressionIndex) – the ExpressionIndex to replace (may also be an expression index)

  • new (ExpressionIndex) – the ExpressionIndex to add to the current LowLevelILFunction (may also be an expression index)

Return type:

None

ret(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

ret returns an expression which jumps (branches) to the expression dest. ret is a special alias for jump that makes the disassembler stop disassembling.

Parameters:

  • dest (ExpressionIndex) – the expression to jump to

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

rotate_left(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_left bitwise rotates left expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rol.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

rotate_left_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_left_carry bitwise rotates left with carry expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rlc.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

rotate_right(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_right bitwise rotates right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression ror.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

rotate_right_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_right_carry bitwise rotates right with carry expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rrc.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

round_to_int(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

round_to_int rounds a floating point value to the nearest integer

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round to the nearest integer

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

set_current_address(value: int, arch: Architecture | None = None) → None[source]
Parameters:
Return type:

None

set_current_source_block(block) → None[source]
Return type:

None

set_expr_attributes(expr: LowLevelILInstruction | ExpressionIndex | InstructionIndex, value: Set[ILInstructionAttribute] | List[ILInstructionAttribute])[source]

set_expr_attributes allows modification of instruction attributes but ONLY during lifting.

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:

  • expr (ExpressionIndex) – the ExpressionIndex to replace (may also be an expression index)

  • value (set(ILInstructionAttribute)) – the set of attributes to place on the instruction

Return type:

None

set_flag(flag: architecture.FlagType, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

set_flag sets the flag flag to the ExpressionIndex value

Parameters:

  • flag (str) – the low register name

  • value (ExpressionIndex) – an expression to set the flag to

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression FLAG.flag = value

Return type:

ExpressionIndex

set_indirect_branches(branches: List[Tuple[Architecture, int]]) → None[source]
Parameters:

branches (List[Tuple[Architecture, int]]) –

Return type:

None

set_reg(size: int, reg: architecture.RegisterType, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

set_reg sets the register reg of size size to the expression value

Parameters:

  • size (int) – size of the register parameter in bytes

  • reg (str) – the register name

  • value (ExpressionIndex) – an expression to set the register to

  • flags (str) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg = value

Return type:

ExpressionIndex

set_reg_split(size: int, hi: architecture.RegisterType, lo: architecture.RegisterType, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

set_reg_split uses hi and lo as a single extended register setting hi:lo to the expression value.

Parameters:

  • size (int) – size of the register parameter in bytes

  • hi (str) – the high register name

  • lo (str) – the low register name

  • value (ExpressionIndex) – an expression to set the split registers to

  • flags (str) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression hi:lo = value

Return type:

ExpressionIndex

set_reg_stack_top_relative(size: int, reg_stack: architecture.RegisterStackType, entry: ExpressionIndex, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

set_reg_stack_top_relative sets the top-relative entry entry of size size in register stack reg_stack to the expression value

Parameters:

  • size (int) – size of the register parameter in bytes

  • reg_stack (str) – the register stack name

  • entry (ExpressionIndex) – an expression for which stack entry to set

  • value (ExpressionIndex) – an expression to set the entry to

  • flags (str) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg_stack[entry] = value

Return type:

ExpressionIndex

shift_left(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

shift_left shifts left expression a by expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression lsl.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

sign_extend(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sign_extend two’s complement sign-extends the expression in value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to sign extend

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sx.<size>(value)

Return type:

ExpressionIndex

store(size: int, addr: ExpressionIndex, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

store Writes size bytes to expression addr read from expression value

Parameters:

  • size (int) – number of bytes to write

  • addr (ExpressionIndex) – the expression to write to

  • value (ExpressionIndex) – the expression to be written

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression [addr].size = value

Return type:

ExpressionIndex

sub(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sub subtracts expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sub.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

sub_borrow(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sub_borrow subtracts with borrow expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sbb.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

system_call(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

system_call return a system call expression.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

a system call expression.

Return type:

ExpressionIndex

tailcall(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

tailcall returns an expression which jumps (branches) to the expression dest

Parameters:

  • dest (ExpressionIndex) – the expression to jump to

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression tailcall(dest)

Return type:

ExpressionIndex

test_bit(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

test_bit returns an expression of size size that tells whether expression a has its bit with an index of the expression b is set

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – an expression to be tested

  • b (ExpressionIndex) – an expression for the index of the big

  • loc (ILSourceLocation) – location of returned expression

Returns:

the result expression.

Return type:

ExpressionIndex

translate(expr_handler: Callable[[LowLevelILFunction, LowLevelILBasicBlock, LowLevelILInstruction], ExpressionIndex]) → LowLevelILFunction[source]

translate clones an IL function and modifies its expressions as specified by a given expr_handler, returning the updated IL function.

Parameters:

expr_handler (Callable[[LowLevelILFunction, LowLevelILBasicBlock, LowLevelILInstruction], ExpressionIndex]) –

Function to modify an expression and copy it to the new function. The function should have the following signature:

expr_handler(new_func: LowLevelILFunction, old_block: LowLevelILBasicBlock, old_instr: LowLevelILInstruction) -> ExpressionIndex

Where:

  • new_func (LowLevelILFunction): New function to receive translated instructions

  • old_block (LowLevelILBasicBlock): Original block containing old_instr

  • old_instr (LowLevelILInstruction): Original instruction

  • returns (ExpressionIndex): Expression index of newly created instruction in new_func

Returns:

Cloned IL function with modifications

Return type:

LowLevelILFunction

trap(value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

trap returns a processor trap (interrupt) expression of the given integer value.

Parameters:

  • value (int) – trap (interrupt) number

  • loc (ILSourceLocation) – location of returned expression

Returns:

a trap expression.

Return type:

ExpressionIndex

traverse(cb: Callable[[LowLevelILInstruction, Any], Any], *args: Any, **kwargs: Any) → Iterator[Any][source]

traverse iterates through all the instructions in the LowLevelILFunction and calls the callback function for each instruction and sub-instruction. See the Developer Docs for more examples.

Parameters:

  • cb (Callable[[LowLevelILInstruction, Any], Any]) – The callback function to call for each node in the LowLevelILInstruction

  • args (Any) – Custom user-defined arguments

  • kwargs (Any) – Custom user-defined keyword arguments

  • cb –

Returns:

An iterator of the results of the callback function

Return type:

Iterator[Any]

Example:
>>> def find_constants(instr) -> Optional[int]:
...     if isinstance(instr, Constant):
...         return instr.constant
>>> print(list(current_il_function.traverse(find_constants)))
undefined(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

undefined returns the undefined expression. This should be used for instructions which perform functions but aren’t important for dataflow or partial emulation purposes.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

the undefined expression.

Return type:

ExpressionIndex

unimplemented(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

unimplemented returns the unimplemented expression. This should be used for all instructions which aren’t implemented.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

the unimplemented expression.

Return type:

ExpressionIndex

unimplemented_memory_ref(size: int, addr: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

unimplemented_memory_ref a memory reference to expression addr of size size with unimplemented operation.

Parameters:

  • size (int) – size in bytes of the memory reference

  • addr (ExpressionIndex) – expression to reference memory

  • loc (ILSourceLocation) – location of returned expression

Returns:

the unimplemented memory reference expression.

Return type:

ExpressionIndex

visit(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool]) → bool[source]

Iterates over all the instructions in the function and calls the callback function for each instruction and each sub-instruction.

Parameters:

cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILFunction.traverse instead.

visit_all(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool]) → bool[source]

Iterates over all the instructions in the function and calls the callback function for each instruction and their operands.

Parameters:

cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILFunction.traverse instead.

visit_operands(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool]) → bool[source]
Iterates over all the instructions in the function and calls the callback function for each operand and

the operands of each sub-instruction.

Parameters:

cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILFunction.traverse instead.

xor_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

xor_expr xor’s expression a with expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression xor.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

zero_extend(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

zero_extend zero-extends the expression in value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to zero extend

  • loc (ILSourceLocation) – location of returned expression

  • flags (architecture.FlagType | None) –

Returns:

The expression zx.<size>(value)

Return type:

ExpressionIndex

property arch: Architecture
property basic_blocks: LowLevelILBasicBlockList
property current_address: int

Current IL Address (read/write)

property flags: List[SSAFlag]

List of flags used in this IL

property il_form: FunctionGraphType
property instructions: Generator[LowLevelILInstruction, None, None]

A generator of llil instructions of the current llil function

property is_thunk: bool

Returns True if the function starts with a Tailcall (read-only)

property mapped_medium_level_il: MediumLevelILFunction

Medium level IL with mappings between low level IL and medium level IL. Unused stores are not removed. Typically, this should only be used to answer queries on assembly or low level IL where the query is easier to perform on medium level IL.

property medium_level_il: MediumLevelILFunction

Medium level IL for this low level IL.

property memory_versions: List[int]

List of memory versions used in this IL

property mlil: MediumLevelILFunction
property mmlil: MediumLevelILFunction
property non_ssa_form: LowLevelILFunction

Low level IL in non-SSA (default) form (read-only)

property reg_stacks: List[SSARegisterStack]

List of register stacks used in this IL

property register_stacks: List[SSARegisterStack]

Deprecated, use reg_stacks instead. List of register stacks used in this IL

property registers: List[SSARegister]

Deprecated, use regs instead. List of registers used in this IL

property regs: List[SSARegister]

List of registers used in this IL

property source_function: Function | None
property ssa_flags: List[SSAFlag]

List of all SSA flags and versions used in this IL

property ssa_flags_without_versions: List[SSAFlag]

List of SSA flags used in this IL

property ssa_form: LowLevelILFunction

Low level IL in SSA form (read-only)

property ssa_reg_stacks: List[SSARegisterStack]

List of all SSA register stacks and versions used in this IL

property ssa_reg_stacks_without_versions: List[SSARegisterStack]

List of SSA register stacks used in this IL

property ssa_register_stacks: List[SSARegisterStack]
property ssa_registers: List[SSARegister]
property ssa_regs: List[SSARegister]

List of all SSA registers and versions used in this IL

property ssa_regs_without_versions: List[SSARegister]

List of SSA registers used in this IL

property ssa_vars: List[SSARegister | SSARegisterStack | SSAFlag]

This is the union LowLevelILFunction.ssa_regs, LowLevelILFunction.ssa_reg_stacks, and LowLevelILFunction.ssa_flags

property ssa_vars_without_versions: List[SSARegister | SSARegisterStack | SSAFlag]

This is the union LowLevelILFunction.ssa_regs_without_versions, LowLevelILFunction.ssa_reg_stacks_without_versions, and LowLevelILFunction.ssa_flags_without_versions

property temp_flag_count: int

Number of temporary flags (read-only)

property temp_reg_count: int

Number of temporary registers (read-only)

property vars: List[ILRegister | ILRegisterStack | ILFlag]

This is the union LowLevelILFunction.regs, LowLevelILFunction.reg_stacks, and LowLevelILFunction.flags

property view: BinaryView | None
class LowLevelILGoto[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILGoto(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: InstructionIndex
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILIf[source]

Bases: LowLevelILInstruction, ControlFlow

LowLevelILIf(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property condition: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property false: InstructionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property true: InstructionIndex
class LowLevelILInstruction[source]

Bases: BaseILInstruction

class LowLevelILInstruction Low Level Intermediate Language Instructions are infinite length tree-based instructions. Tree-based instructions use infix notation with the left hand operand being the destination operand. Infix notation is thus more natural to read than other notations (e.g. x86 mov eax, 0 vs. LLIL eax = 0).

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

copy_to(dest: LowLevelILFunction, sub_expr_handler: Callable[[LowLevelILInstruction], ExpressionIndex] | None = None) → ExpressionIndex[source]

copy_to deep copies an expression into a new IL function. If provided, the function sub_expr_handler will be called on every copied sub-expression

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:
Returns:

Index of the copied expression in the target function

Return type:

ExpressionIndex

classmethod create(func: LowLevelILFunction, expr_index: ExpressionIndex, instr_index: InstructionIndex | None = None) → LowLevelILInstruction[source]
Parameters:

  • func (LowLevelILFunction) –

  • expr_index (ExpressionIndex) –

  • instr_index (InstructionIndex | None) –

Return type:

LowLevelILInstruction

get_flag_value(flag: architecture.FlagType) → RegisterValue[source]
Parameters:

flag (architecture.FlagType) –

Return type:

RegisterValue

get_flag_value_after(flag: architecture.FlagType) → RegisterValue[source]
Parameters:

flag (architecture.FlagType) –

Return type:

RegisterValue

get_possible_flag_values(flag: architecture.FlagType, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_flag_values_after(flag: architecture.FlagType, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_reg_values(reg: architecture.RegisterType, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_reg_values_after(reg: architecture.RegisterType, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_stack_contents(offset: int, size: int, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_stack_contents_after(offset: int, size: int, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_values(options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:

options (List[DataFlowQueryOption] | None) –

Return type:

PossibleValueSet

get_reg_value(reg: architecture.RegisterType) → RegisterValue[source]
Parameters:

reg (architecture.RegisterType) –

Return type:

RegisterValue

get_reg_value_after(reg: architecture.RegisterType) → RegisterValue[source]
Parameters:

reg (architecture.RegisterType) –

Return type:

RegisterValue

get_stack_contents(offset: int, size: int) → RegisterValue[source]
Parameters:

  • offset (int) –

  • size (int) –

Return type:

RegisterValue

get_stack_contents_after(offset: int, size: int) → RegisterValue[source]
Parameters:

  • offset (int) –

  • size (int) –

Return type:

RegisterValue

static show_llil_hierarchy()[source]

Opens a new tab showing the LLIL hierarchy which includes classes which can easily be used with isinstance to match multiple types of IL instructions.

traverse(cb: Callable[[LowLevelILInstruction, Any], Any], *args: Any, **kwargs: Any) → Iterator[Any][source]

traverse is a generator that allows you to traverse the LowLevelILInstruction in a depth-first manner. It will yield the result of the callback function for each node in the tree. Arguments can be passed to the callback function using args and kwargs. See the Developer Docs for more examples.

Parameters:

  • cb (Callable[[LowLevelILInstruction, Any], Any]) – The callback function to call for each node in the LowLevelILInstruction

  • args (Any) – Custom user-defined arguments

  • kwargs (Any) – Custom user-defined keyword arguments

  • cb –

Returns:

An iterator of the results of the callback function

Return type:

Iterator[Any]

Example:
>>> def get_constant_less_than_value(inst: LowLevelILInstruction, value: int) -> int:
>>>     if isinstance(inst, Constant) and inst.constant < value:
>>>         return inst.constant
>>>
>>> list(inst.traverse(get_constant_less_than_value, 10))
visit(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool], name: str = 'root', parent: LowLevelILInstruction | None = None) → bool[source]

Visits all LowLevelILInstructions in the operands of this instruction and any sub-instructions.

Parameters:

  • cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (LowLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILInstruction.traverse instead.

visit_all(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool], name: str = 'root', parent: LowLevelILInstruction | None = None) → bool[source]

Visits all operands of this instruction and all operands of any sub-instructions. Using pre-order traversal.

Parameters:

  • cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (LowLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILInstruction.traverse instead.

visit_operands(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool], name: str = 'root', parent: LowLevelILInstruction | None = None) → bool[source]

Visits all leaf operands of this instruction and any sub-instructions.

Parameters:

  • cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (LowLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILInstruction.traverse instead.

ILOperations: ClassVar[Dict[LowLevelILOperation, List[Tuple[str, str]]]] = {LowLevelILOperation.LLIL_NOP: [], LowLevelILOperation.LLIL_SET_REG: [('dest', 'reg'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_SPLIT: [('hi', 'reg'), ('lo', 'reg'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_FLAG: [('dest', 'flag'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_STACK_REL: [('stack', 'reg_stack'), ('dest', 'expr'), ('src', 'expr')], LowLevelILOperation.LLIL_REG_STACK_PUSH: [('stack', 'reg_stack'), ('src', 'expr')], LowLevelILOperation.LLIL_LOAD: [('src', 'expr')], LowLevelILOperation.LLIL_STORE: [('dest', 'expr'), ('src', 'expr')], LowLevelILOperation.LLIL_PUSH: [('src', 'expr')], LowLevelILOperation.LLIL_POP: [], LowLevelILOperation.LLIL_REG: [('src', 'reg')], LowLevelILOperation.LLIL_REG_SPLIT: [('hi', 'reg'), ('lo', 'reg')], LowLevelILOperation.LLIL_REG_STACK_REL: [('stack', 'reg_stack'), ('src', 'expr')], LowLevelILOperation.LLIL_REG_STACK_POP: [('stack', 'reg_stack')], LowLevelILOperation.LLIL_REG_STACK_FREE_REG: [('dest', 'reg')], LowLevelILOperation.LLIL_REG_STACK_FREE_REL: [('stack', 'reg_stack'), ('dest', 'expr')], LowLevelILOperation.LLIL_CONST: [('constant', 'int')], LowLevelILOperation.LLIL_CONST_PTR: [('constant', 'int')], LowLevelILOperation.LLIL_EXTERN_PTR: [('constant', 'int'), ('offset', 'int')], LowLevelILOperation.LLIL_FLOAT_CONST: [('constant', 'float')], LowLevelILOperation.LLIL_FLAG: [('src', 'flag')], LowLevelILOperation.LLIL_FLAG_BIT: [('src', 'flag'), ('bit', 'int')], LowLevelILOperation.LLIL_ADD: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_ADC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], LowLevelILOperation.LLIL_SUB: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_SBB: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], LowLevelILOperation.LLIL_AND: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_OR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_XOR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_LSL: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_LSR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_ASR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_ROL: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_RLC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], LowLevelILOperation.LLIL_ROR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_RRC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], LowLevelILOperation.LLIL_MUL: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MULU_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MULS_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_DIVU: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_DIVU_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_DIVS: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_DIVS_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MODU: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MODU_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MODS: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MODS_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_NEG: [('src', 'expr')], LowLevelILOperation.LLIL_NOT: [('src', 'expr')], LowLevelILOperation.LLIL_SX: [('src', 'expr')], LowLevelILOperation.LLIL_ZX: [('src', 'expr')], LowLevelILOperation.LLIL_LOW_PART: [('src', 'expr')], LowLevelILOperation.LLIL_JUMP: [('dest', 'expr')], LowLevelILOperation.LLIL_JUMP_TO: [('dest', 'expr'), ('targets', 'target_map')], LowLevelILOperation.LLIL_CALL: [('dest', 'expr')], LowLevelILOperation.LLIL_CALL_STACK_ADJUST: [('dest', 'expr'), ('stack_adjustment', 'int'), ('reg_stack_adjustments', 'reg_stack_adjust')], LowLevelILOperation.LLIL_TAILCALL: [('dest', 'expr')], LowLevelILOperation.LLIL_RET: [('dest', 'expr')], LowLevelILOperation.LLIL_NORET: [], LowLevelILOperation.LLIL_IF: [('condition', 'expr'), ('true', 'int'), ('false', 'int')], LowLevelILOperation.LLIL_GOTO: [('dest', 'int')], LowLevelILOperation.LLIL_FLAG_COND: [('condition', 'cond'), ('semantic_class', 'sem_class')], LowLevelILOperation.LLIL_FLAG_GROUP: [('semantic_group', 'sem_group')], LowLevelILOperation.LLIL_CMP_E: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_NE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_SLT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_ULT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_SLE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_ULE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_SGE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_UGE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_SGT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_UGT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_TEST_BIT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_BOOL_TO_INT: [('src', 'expr')], LowLevelILOperation.LLIL_ADD_OVERFLOW: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_SYSCALL: [], LowLevelILOperation.LLIL_BP: [], LowLevelILOperation.LLIL_TRAP: [('vector', 'int')], LowLevelILOperation.LLIL_INTRINSIC: [('output', 'reg_or_flag_list'), ('intrinsic', 'intrinsic'), ('param', 'expr')], LowLevelILOperation.LLIL_UNDEF: [], LowLevelILOperation.LLIL_UNIMPL: [], LowLevelILOperation.LLIL_UNIMPL_MEM: [('src', 'expr')], LowLevelILOperation.LLIL_FADD: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FSUB: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FMUL: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FDIV: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FSQRT: [('src', 'expr')], LowLevelILOperation.LLIL_FNEG: [('src', 'expr')], LowLevelILOperation.LLIL_FABS: [('src', 'expr')], LowLevelILOperation.LLIL_FLOAT_TO_INT: [('src', 'expr')], LowLevelILOperation.LLIL_INT_TO_FLOAT: [('src', 'expr')], LowLevelILOperation.LLIL_FLOAT_CONV: [('src', 'expr')], LowLevelILOperation.LLIL_ROUND_TO_INT: [('src', 'expr')], LowLevelILOperation.LLIL_FLOOR: [('src', 'expr')], LowLevelILOperation.LLIL_CEIL: [('src', 'expr')], LowLevelILOperation.LLIL_FTRUNC: [('src', 'expr')], LowLevelILOperation.LLIL_FCMP_E: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_NE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_LT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_LE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_GE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_GT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_O: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_UO: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_SET_REG_SSA: [('dest', 'reg_ssa'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_SSA_PARTIAL: [('full_reg', 'reg_ssa'), ('dest', 'reg'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_SPLIT_SSA: [('hi', 'expr'), ('lo', 'expr'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_STACK_REL_SSA: [('stack', 'expr'), ('dest', 'expr'), ('top', 'expr'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_STACK_ABS_SSA: [('stack', 'expr'), ('dest', 'reg'), ('src', 'expr')], LowLevelILOperation.LLIL_REG_SPLIT_DEST_SSA: [('dest', 'reg_ssa')], LowLevelILOperation.LLIL_REG_STACK_DEST_SSA: [('src', 'reg_stack_ssa_dest_and_src')], LowLevelILOperation.LLIL_REG_SSA: [('src', 'reg_ssa')], LowLevelILOperation.LLIL_REG_SSA_PARTIAL: [('full_reg', 'reg_ssa'), ('src', 'reg')], LowLevelILOperation.LLIL_REG_SPLIT_SSA: [('hi', 'reg_ssa'), ('lo', 'reg_ssa')], LowLevelILOperation.LLIL_REG_STACK_REL_SSA: [('stack', 'reg_stack_ssa'), ('src', 'expr'), ('top', 'expr')], LowLevelILOperation.LLIL_REG_STACK_ABS_SSA: [('stack', 'reg_stack_ssa'), ('src', 'reg')], LowLevelILOperation.LLIL_REG_STACK_FREE_REL_SSA: [('stack', 'expr'), ('dest', 'expr'), ('top', 'expr')], LowLevelILOperation.LLIL_REG_STACK_FREE_ABS_SSA: [('stack', 'expr'), ('dest', 'reg')], LowLevelILOperation.LLIL_SET_FLAG_SSA: [('dest', 'flag_ssa'), ('src', 'expr')], LowLevelILOperation.LLIL_FLAG_SSA: [('src', 'flag_ssa')], LowLevelILOperation.LLIL_FLAG_BIT_SSA: [('src', 'flag_ssa'), ('bit', 'int')], LowLevelILOperation.LLIL_CALL_SSA: [('output', 'expr'), ('dest', 'expr'), ('stack', 'expr'), ('param', 'expr')], LowLevelILOperation.LLIL_SYSCALL_SSA: [('output', 'expr'), ('stack', 'expr'), ('param', 'expr')], LowLevelILOperation.LLIL_TAILCALL_SSA: [('output', 'expr'), ('dest', 'expr'), ('stack', 'expr'), ('param', 'expr')], LowLevelILOperation.LLIL_CALL_PARAM: [('src', 'expr_list')], LowLevelILOperation.LLIL_CALL_STACK_SSA: [('src', 'reg_ssa'), ('src_memory', 'int')], LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: [('dest_memory', 'int'), ('dest', 'reg_ssa_list')], LowLevelILOperation.LLIL_SEPARATE_PARAM_LIST_SSA: [('src', 'expr_list')], LowLevelILOperation.LLIL_SHARED_PARAM_SLOT_SSA: [('src', 'expr_list')], LowLevelILOperation.LLIL_MEMORY_INTRINSIC_OUTPUT_SSA: [('dest_memory', 'int'), ('output', 'reg_ssa_list')], LowLevelILOperation.LLIL_LOAD_SSA: [('src', 'expr'), ('src_memory', 'int')], LowLevelILOperation.LLIL_STORE_SSA: [('dest', 'expr'), ('dest_memory', 'int'), ('src_memory', 'int'), ('src', 'expr')], LowLevelILOperation.LLIL_INTRINSIC_SSA: [('output', 'reg_or_flag_ssa_list'), ('intrinsic', 'intrinsic'), ('param', 'expr')], LowLevelILOperation.LLIL_MEMORY_INTRINSIC_SSA: [('output', 'expr'), ('intrinsic', 'intrinsic'), ('params', 'expr_list'), ('src_memory', 'int')], LowLevelILOperation.LLIL_REG_PHI: [('dest', 'reg_ssa'), ('src', 'reg_ssa_list')], LowLevelILOperation.LLIL_REG_STACK_PHI: [('dest', 'reg_stack_ssa'), ('src', 'reg_stack_ssa_list')], LowLevelILOperation.LLIL_FLAG_PHI: [('dest', 'flag_ssa'), ('src', 'flag_ssa_list')], LowLevelILOperation.LLIL_MEM_PHI: [('dest_memory', 'int'), ('src_memory', 'int_list')]}
property address: int
property attributes: Set[ILInstructionAttribute]

The set of optional attributes placed on the instruction

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property flags: FlagWriteTypeName | None
function: LowLevelILFunction
property high_level_il: HighLevelILInstruction | None

Gets the high level IL expression corresponding to this expression (may be None for eliminated instructions)

property hlil: HighLevelILInstruction | None
property hlils: List[HighLevelILInstruction]
property il_basic_block: LowLevelILBasicBlock

IL basic block object containing this expression (read-only) (only available on finalized functions)

instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property mapped_medium_level_il: MediumLevelILInstruction | None

Gets the mapped medium level IL expression corresponding to this expression

property medium_level_il: MediumLevelILInstruction | None

Gets the medium level IL expression corresponding to this expression (may be None for eliminated instructions)

property mlil: MediumLevelILInstruction | None
property mlils: List[MediumLevelILInstruction]
property mmlil: MediumLevelILInstruction | None
property non_ssa_form: LowLevelILInstruction

Non-SSA form of expression (read-only)

property operands: List[LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None]

Operands for the instruction

Consider using more specific APIs for src, dest, params, etc where appropriate.

property operation: LowLevelILOperation
property possible_values: PossibleValueSet

Possible values of expression using path-sensitive static data flow analysis (read-only)

property postfix_operands: List[LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None]

All operands in the expression tree in postfix order

property prefix_operands: List[LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None]

All operands in the expression tree in prefix order

property raw_flags: int
property raw_operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]

Raw operand expression indices as specified by the core structure (read-only)

property size: int
property source_location: ILSourceLocation
property source_operand: ExpressionIndex | None
property ssa_form: LowLevelILInstruction

SSA form of expression (read-only)

property tokens: List[InstructionTextToken]

LLIL tokens (read-only)

property value: RegisterValue

Value of expression if constant or a known value (read-only)

class LowLevelILIntToFloat[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILIntToFloat(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILIntrinsic[source]

Bases: LowLevelILInstruction, Intrinsic

LowLevelILIntrinsic(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property intrinsic: ILIntrinsic
property output: List[ILFlag | ILRegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
class LowLevelILIntrinsicSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILIntrinsicSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property intrinsic: ILIntrinsic
property output: List[SSARegisterOrFlag]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
class LowLevelILJump[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILJump(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILJumpTo[source]

Bases: LowLevelILInstruction

LowLevelILJumpTo(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property targets: Dict[int, int]
class LowLevelILLabel[source]

Bases: object

__init__(handle: BNLowLevelILLabel | None = None)[source]
Parameters:

handle (BNLowLevelILLabel | None) –

property operand: InstructionIndex
property ref: bool
property resolved: bool
class LowLevelILLoad[source]

Bases: LowLevelILInstruction, Load

LowLevelILLoad(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILLoadSsa[source]

Bases: LowLevelILInstruction, Load, SSA

LowLevelILLoadSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property src_memory: int
class LowLevelILLowPart[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILLowPart(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILLsl[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILLsl(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILLsr[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILLsr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILMemPhi[source]

Bases: LowLevelILInstruction, Memory, Phi

LowLevelILMemPhi(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src_memory: List[int]
class LowLevelILMemoryIntrinsicOutputSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILMemoryIntrinsicOutputSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property output: List[SSARegisterOrFlag]
class LowLevelILMemoryIntrinsicSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILMemoryIntrinsicSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property intrinsic: ILIntrinsic
property output: List[SSARegisterOrFlag]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property src_memory: int
class LowLevelILMods[source]

Bases: LowLevelILBinaryBase, Arithmetic, Signed

LowLevelILMods(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILModsDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision, Signed

LowLevelILModsDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILModu[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILModu(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILModuDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision

LowLevelILModuDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILMul[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILMul(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILMulsDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision

LowLevelILMulsDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILMuluDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision

LowLevelILMuluDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILNeg[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILNeg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILNop[source]

Bases: LowLevelILInstruction

LowLevelILNop(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILNoret[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILNoret(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILNot[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILNot(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILOperationAndSize[source]

Bases: object

LowLevelILOperationAndSize(operation: ‘LowLevelILOperation’, size: int)

__init__(operation: LowLevelILOperation, size: int) → None
Parameters:
Return type:

None

operation: LowLevelILOperation
size: int
class LowLevelILOr[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILOr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILPop[source]

Bases: LowLevelILInstruction, StackOperation

LowLevelILPop(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILPush[source]

Bases: LowLevelILInstruction, StackOperation

LowLevelILPush(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILReg[source]

Bases: LowLevelILInstruction

LowLevelILReg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILRegister
class LowLevelILRegPhi[source]

Bases: LowLevelILInstruction, Phi

LowLevelILRegPhi(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[SSARegister]
class LowLevelILRegSplit[source]

Bases: LowLevelILInstruction

LowLevelILRegSplit(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
property hi: ILRegister
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property lo: ILRegister
class LowLevelILRegSplitDestSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILRegSplitDestSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILRegSplitSsa[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILRegSplitSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
property hi: SSARegister
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property lo: SSARegister
class LowLevelILRegSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILRegSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegister
class LowLevelILRegSsaPartial[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILRegSsaPartial(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property full_reg: SSARegister
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILRegister
class LowLevelILRegStackAbsSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILRegStackAbsSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILRegister
property stack: SSARegisterStack
class LowLevelILRegStackDestSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILRegStackDestSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegisterStack
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegisterStack
class LowLevelILRegStackFreeAbsSsa[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackFreeAbsSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property stack: LowLevelILInstruction
class LowLevelILRegStackFreeReg[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackFreeReg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILRegStackFreeRel[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackFreeRel(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property stack: ILRegisterStack
class LowLevelILRegStackFreeRelSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILRegStackFreeRelSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property stack: LowLevelILInstruction
property top: LowLevelILInstruction
class LowLevelILRegStackPhi[source]

Bases: LowLevelILInstruction, RegisterStack, Phi

LowLevelILRegStackPhi(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegisterStack
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[SSARegisterStack]
class LowLevelILRegStackPop[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackPop(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property stack: ILRegisterStack
class LowLevelILRegStackPush[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackPush(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: ILRegisterStack
class LowLevelILRegStackRel[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackRel(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: ILRegisterStack
class LowLevelILRegStackRelSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILRegStackRelSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: SSARegisterStack
property top: LowLevelILInstruction
class LowLevelILRet[source]

Bases: LowLevelILInstruction, Return

LowLevelILRet(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILRlc[source]

Bases: LowLevelILCarryBase

LowLevelILRlc(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILRol[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILRol(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILRor[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILRor(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILRoundToInt[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILRoundToInt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILRrc[source]

Bases: LowLevelILCarryBase

LowLevelILRrc(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILSbb[source]

Bases: LowLevelILCarryBase

LowLevelILSbb(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILSeparateParamListSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILSeparateParamListSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[LowLevelILInstruction]
class LowLevelILSetFlag[source]

Bases: LowLevelILInstruction

LowLevelILSetFlag(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILFlag
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILSetFlagSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILSetFlagSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSAFlag
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILSetReg[source]

Bases: LowLevelILInstruction, SetReg

LowLevelILSetReg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILSetRegSplit[source]

Bases: LowLevelILInstruction, SetReg

LowLevelILSetRegSplit(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
property hi: ILRegister
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property lo: ILRegister
property src: LowLevelILInstruction
class LowLevelILSetRegSplitSsa[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILSetRegSplitSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
property hi: LowLevelILInstruction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property lo: LowLevelILInstruction
property src: LowLevelILInstruction
class LowLevelILSetRegSsa[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILSetRegSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILSetRegSsaPartial[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILSetRegSsaPartial(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property full_reg: SSARegister
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILSetRegStackAbsSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILSetRegStackAbsSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: LowLevelILInstruction
class LowLevelILSetRegStackRel[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILSetRegStackRel(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: ILRegisterStack
class LowLevelILSetRegStackRelSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILSetRegStackRelSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: LowLevelILInstruction
property top: LowLevelILInstruction
class LowLevelILSharedParamSlotSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILSharedParamSlotSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[LowLevelILInstruction]
class LowLevelILStore[source]

Bases: LowLevelILInstruction, Store

LowLevelILStore(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILStoreSsa[source]

Bases: LowLevelILInstruction, Store, SSA

LowLevelILStoreSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property src_memory: int
class LowLevelILSub[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILSub(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILSx[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILSx(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILSyscall[source]

Bases: LowLevelILInstruction, Syscall

LowLevelILSyscall(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILSyscallSsa[source]

Bases: LowLevelILInstruction, Syscall, SSA

LowLevelILSyscallSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property output: List[SSARegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property stack: LowLevelILCallStackSsa
property stack_memory: int
property stack_reg: SSARegister
class LowLevelILTailcall[source]

Bases: LowLevelILInstruction, Tailcall

LowLevelILTailcall(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILTailcallSsa[source]

Bases: LowLevelILInstruction, Tailcall, SSA, Terminal

LowLevelILTailcallSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property output: List[SSARegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property stack: LowLevelILInstruction
class LowLevelILTestBit[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILTestBit(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILTrap[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILTrap(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property vector: int
class LowLevelILUnaryBase[source]

Bases: LowLevelILInstruction, UnaryOperation

LowLevelILUnaryBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILUndef[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILUndef(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILUnimpl[source]

Bases: LowLevelILInstruction

LowLevelILUnimpl(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILUnimplMem[source]

Bases: LowLevelILInstruction, Memory

LowLevelILUnimplMem(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
class LowLevelILXor[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILXor(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class LowLevelILZx[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILZx(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
class SSAFlag[source]

Bases: object

SSAFlag(flag: binaryninja.lowlevelil.ILFlag, version: int)

__init__(flag: ILFlag, version: int) → None
Parameters:
Return type:

None

flag: ILFlag
version: int
class SSARegister[source]

Bases: object

SSARegister(reg: binaryninja.lowlevelil.ILRegister, version: int)

__init__(reg: ILRegister, version: int) → None
Parameters:
Return type:

None

reg: ILRegister
version: int
class SSARegisterOrFlag[source]

Bases: object

SSARegisterOrFlag(reg_or_flag: Union[binaryninja.lowlevelil.ILRegister, binaryninja.lowlevelil.ILFlag], version: int)

__init__(reg_or_flag: ILRegister | ILFlag, version: int) → None
Parameters:
Return type:

None

reg_or_flag: ILRegister | ILFlag
version: int
class SSARegisterStack[source]

Bases: object

SSARegisterStack(reg_stack: binaryninja.lowlevelil.ILRegisterStack, version: int)

__init__(reg_stack: ILRegisterStack, version: int) → None
Parameters:
Return type:

None

reg_stack: ILRegisterStack
version: int
LLIL_GET_TEMP_REG_INDEX(n: ILRegister | int) → int[source]
Parameters:

n (ILRegister | int) –

Return type:

int

LLIL_REG_IS_TEMP(n: ILRegister | int) → bool[source]
Parameters:

n (ILRegister | int) –

Return type:

bool

LLIL_TEMP(n: ILRegister | int) → RegisterIndex[source]
Parameters:

n (ILRegister | int) –

Return type:

RegisterIndex

CoreLowLevelILInstruction

class CoreLowLevelILInstruction[source]

Bases: object

CoreLowLevelILInstruction(operation: binaryninja.enums.LowLevelILOperation, attributes: int, size: int, flags: int, source_operand: <function NewType.<locals>.new_type at 0x112ace310>, operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex], address: int)

__init__(operation: LowLevelILOperation, attributes: int, size: int, flags: int, source_operand: ExpressionIndex, operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex], address: int) → None
Parameters:

  • operation (LowLevelILOperation) –

  • attributes (int) –

  • size (int) –

  • flags (int) –

  • source_operand (ExpressionIndex) –

  • operands (Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]) –

  • address (int) –

Return type:

None

classmethod from_BNLowLevelILInstruction(instr: BNLowLevelILInstruction) → CoreLowLevelILInstruction[source]
Parameters:

instr (BNLowLevelILInstruction) –

Return type:

CoreLowLevelILInstruction

address: int
attributes: int
flags: int
operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]
operation: LowLevelILOperation
size: int
source_operand: ExpressionIndex

ILFlag

class ILFlag[source]

Bases: object

ILFlag(arch: ‘architecture.Architecture’, index: ‘architecture.FlagIndex’)

__init__(arch: Architecture, index: FlagIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: FlagIndex
property name: FlagName
property temp: bool

ILIntrinsic

class ILIntrinsic[source]

Bases: object

ILIntrinsic(arch: ‘architecture.Architecture’, index: ‘architecture.IntrinsicIndex’)

__init__(arch: Architecture, index: IntrinsicIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: IntrinsicIndex
property inputs: List[IntrinsicInput]

inputs is only available if the IL intrinsic is an Architecture intrinsic

property name: IntrinsicName
property outputs: List[Type]

outputs is only available if the IL intrinsic is an Architecture intrinsic

ILRegister

class ILRegister[source]

Bases: object

ILRegister(arch: ‘architecture.Architecture’, index: ‘architecture.RegisterIndex’)

__init__(arch: Architecture, index: RegisterIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: RegisterIndex
property info: RegisterInfo
property name: RegisterName
property temp: bool

ILRegisterStack

class ILRegisterStack[source]

Bases: object

ILRegisterStack(arch: ‘architecture.Architecture’, index: ‘architecture.RegisterStackIndex’)

__init__(arch: Architecture, index: RegisterStackIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: RegisterStackIndex
property info: RegisterStackInfo
property name: RegisterStackName

ILSemanticFlagClass

class ILSemanticFlagClass[source]

Bases: object

ILSemanticFlagClass(arch: ‘architecture.Architecture’, index: ‘architecture.SemanticClassIndex’)

__init__(arch: Architecture, index: SemanticClassIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: SemanticClassIndex
property name: SemanticClassName

ILSemanticFlagGroup

class ILSemanticFlagGroup[source]

Bases: object

ILSemanticFlagGroup(arch: ‘architecture.Architecture’, index: ‘architecture.SemanticGroupIndex’)

__init__(arch: Architecture, index: SemanticGroupIndex) → None
Parameters:
Return type:

None

arch: Architecture
index: SemanticGroupIndex
property name: SemanticGroupName

LowLevelILAdc

class LowLevelILAdc[source]

Bases: LowLevelILCarryBase

LowLevelILAdc(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILAdd

class LowLevelILAdd[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILAdd(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILAddOverflow

class LowLevelILAddOverflow[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILAddOverflow(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILAnd

class LowLevelILAnd[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILAnd(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILAsr

class LowLevelILAsr[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILAsr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILAssert

class LowLevelILAssert[source]

Bases: LowLevelILInstruction

LowLevelILAssert(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constraint: PossibleValueSet
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILRegister

LowLevelILAssertSsa

class LowLevelILAssertSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILAssertSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constraint: PossibleValueSet
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegister

LowLevelILBasicBlock

class LowLevelILBasicBlock[source]

Bases: BasicBlock

The LogLevelILBasicBlock object is returned during analysis and should not be directly instantiated.

__init__(handle: LP_BNBasicBlock, owner: LowLevelILFunction, view: BinaryView | None)[source]
Parameters:
property il_function: LowLevelILFunction

IL Function of which this block is a part, if the block is part of an IL Function.

property instruction_count: int

LowLevelILBinaryBase

class LowLevelILBinaryBase[source]

Bases: LowLevelILInstruction, BinaryOperation

LowLevelILBinaryBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property left: LowLevelILInstruction
property right: LowLevelILInstruction

LowLevelILBoolToInt

class LowLevelILBoolToInt[source]

Bases: LowLevelILInstruction

LowLevelILBoolToInt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILBp

class LowLevelILBp[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILBp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCall

class LowLevelILCall[source]

Bases: LowLevelILInstruction, Localcall

LowLevelILCall(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCallOutputSsa

class LowLevelILCallOutputSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILCallOutputSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: List[SSARegister]
property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCallParam

class LowLevelILCallParam[source]

Bases: LowLevelILInstruction, SSA

LowLevelILCallParam(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[LowLevelILInstruction]

LowLevelILCallSsa

class LowLevelILCallSsa[source]

Bases: LowLevelILInstruction, Localcall, SSA

LowLevelILCallSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property output: List[SSARegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property stack: LowLevelILInstruction

LowLevelILCallStackAdjust

class LowLevelILCallStackAdjust[source]

Bases: LowLevelILInstruction, Localcall

LowLevelILCallStackAdjust(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property reg_stack_adjustments: Dict[RegisterStackName, int]
property stack_adjustment: int

LowLevelILCallStackSsa

class LowLevelILCallStackSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILCallStackSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegister
property src_memory: int

LowLevelILCarryBase

class LowLevelILCarryBase[source]

Bases: LowLevelILInstruction, Carry

LowLevelILCarryBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property carry: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property left: LowLevelILInstruction
property right: LowLevelILInstruction

LowLevelILCeil

class LowLevelILCeil[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILCeil(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILCmpE

class LowLevelILCmpE[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpE(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpNe

class LowLevelILCmpNe[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpNe(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpSge

class LowLevelILCmpSge[source]

Bases: LowLevelILComparisonBase, Signed

LowLevelILCmpSge(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpSgt

class LowLevelILCmpSgt[source]

Bases: LowLevelILComparisonBase, Signed

LowLevelILCmpSgt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpSle

class LowLevelILCmpSle[source]

Bases: LowLevelILComparisonBase, Signed

LowLevelILCmpSle(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpSlt

class LowLevelILCmpSlt[source]

Bases: LowLevelILComparisonBase, Signed

LowLevelILCmpSlt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpUge

class LowLevelILCmpUge[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpUge(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpUgt

class LowLevelILCmpUgt[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpUgt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpUle

class LowLevelILCmpUle[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpUle(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILCmpUlt

class LowLevelILCmpUlt[source]

Bases: LowLevelILComparisonBase

LowLevelILCmpUlt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILComparisonBase

class LowLevelILComparisonBase[source]

Bases: LowLevelILBinaryBase, Comparison

LowLevelILComparisonBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILConst

class LowLevelILConst[source]

Bases: LowLevelILConstantBase

LowLevelILConst(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILConstPtr

class LowLevelILConstPtr[source]

Bases: LowLevelILConstantBase

LowLevelILConstPtr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILConstantBase

class LowLevelILConstantBase[source]

Bases: LowLevelILInstruction, Constant

LowLevelILConstantBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constant: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILDivs

class LowLevelILDivs[source]

Bases: LowLevelILBinaryBase, Arithmetic, Signed

LowLevelILDivs(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILDivsDp

class LowLevelILDivsDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision, Signed

LowLevelILDivsDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILDivu

class LowLevelILDivu[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILDivu(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILDivuDp

class LowLevelILDivuDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision

LowLevelILDivuDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILExpr

class LowLevelILExpr[source]

Bases: object

class LowLevelILExpr hold the index of IL Expressions.

Note

Deprecated. Use ExpressionIndex instead

__init__(index: ExpressionIndex)[source]
Parameters:

index (ExpressionIndex) –

property index: ExpressionIndex

LowLevelILExternPtr

class LowLevelILExternPtr[source]

Bases: LowLevelILConstantBase

LowLevelILExternPtr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constant: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property offset: int

LowLevelILFabs

class LowLevelILFabs[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFabs(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILFadd

class LowLevelILFadd[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILFadd(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFcmpE

class LowLevelILFcmpE[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpE(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFcmpGe

class LowLevelILFcmpGe[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpGe(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFcmpGt

class LowLevelILFcmpGt[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpGt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFcmpLe

class LowLevelILFcmpLe[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpLe(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFcmpLt

class LowLevelILFcmpLt[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpLt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFcmpNe

class LowLevelILFcmpNe[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpNe(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFcmpO

class LowLevelILFcmpO[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpO(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFcmpUo

class LowLevelILFcmpUo[source]

Bases: LowLevelILComparisonBase, FloatingPoint

LowLevelILFcmpUo(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFdiv

class LowLevelILFdiv[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILFdiv(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFlag

class LowLevelILFlag[source]

Bases: LowLevelILInstruction

LowLevelILFlag(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILFlag

LowLevelILFlagBit

class LowLevelILFlagBit[source]

Bases: LowLevelILInstruction

LowLevelILFlagBit(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property bit: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILFlag

LowLevelILFlagBitSsa

class LowLevelILFlagBitSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILFlagBitSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property bit: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSAFlag

LowLevelILFlagCond

class LowLevelILFlagCond[source]

Bases: LowLevelILInstruction

LowLevelILFlagCond(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property condition: LowLevelILFlagCondition
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property semantic_class: ILSemanticFlagClass | None

LowLevelILFlagGroup

class LowLevelILFlagGroup[source]

Bases: LowLevelILInstruction

LowLevelILFlagGroup(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property semantic_group: ILSemanticFlagGroup

LowLevelILFlagPhi

class LowLevelILFlagPhi[source]

Bases: LowLevelILInstruction, Phi

LowLevelILFlagPhi(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSAFlag
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[SSAFlag]

LowLevelILFlagSsa

class LowLevelILFlagSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILFlagSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSAFlag

LowLevelILFloatConst

class LowLevelILFloatConst[source]

Bases: LowLevelILConstantBase, FloatingPoint

LowLevelILFloatConst(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property constant: int | float
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFloatConv

class LowLevelILFloatConv[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFloatConv(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILFloatToInt

class LowLevelILFloatToInt[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFloatToInt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILFloor

class LowLevelILFloor[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFloor(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILFmul

class LowLevelILFmul[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILFmul(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFneg

class LowLevelILFneg[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFneg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILForceVer

class LowLevelILForceVer[source]

Bases: LowLevelILInstruction

LowLevelILForceVer(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILForceVerSsa

class LowLevelILForceVerSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILForceVerSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegister
expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegister

LowLevelILFsqrt

class LowLevelILFsqrt[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFsqrt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILFsub

class LowLevelILFsub[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILFsub(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILFtrunc

class LowLevelILFtrunc[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILFtrunc(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILFunction

class LowLevelILFunction[source]

Bases: object

class LowLevelILFunction contains the list of ExpressionIndex objects that make up a function. ExpressionIndex objects can be added to the LowLevelILFunction by calling append and passing the result of the various class methods which return ExpressionIndex objects.

LowLevelILFlagCondition values used as parameters in the flag_condition method.

LowLevelILFlagCondition

Operator

Description

LLFC_E

==

Equal

LLFC_NE

!=

Not equal

LLFC_SLT

s<

Signed less than

LLFC_ULT

u<

Unsigned less than

LLFC_SLE

s<=

Signed less than or equal

LLFC_ULE

u<=

Unsigned less than or equal

LLFC_SGE

s>=

Signed greater than or equal

LLFC_UGE

u>=

Unsigned greater than or equal

LLFC_SGT

s>

Signed greater than

LLFC_UGT

u>

Unsigned greater than

LLFC_NEG

Negative

LLFC_POS

Positive

LLFC_O

overflow

Overflow

LLFC_NO

!overflow

No overflow
__init__(arch: Architecture | None = None, handle: BNLowLevelILFunction | None = None, source_func: Function | None = None)[source]
Parameters:

  • arch (Architecture | None) –

  • handle (BNLowLevelILFunction | None) –

  • source_func (Function | None) –

add(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

add adds expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression add.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

add_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

add_carry adds with carry expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression adc.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

add_index_list(indices: List[int]) → ExpressionIndex[source]

add_index_list returns an index list expression for the given list of integers.

Parameters:

indices (List(int)) – list of numbers

Returns:

an operand list expression

Return type:

ExpressionIndex

add_label_for_address(arch: Architecture, addr: int) → None[source]

add_label_for_address adds a low-level IL label for the given architecture arch at the given virtual address addr

Parameters:

  • arch (Architecture) – Architecture to add labels for

  • addr (int) – the IL address to add a label at

Return type:

None

add_label_map(labels: Dict[int, LowLevelILLabel], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

add_label_map returns a label list expression for the given list of LowLevelILLabel objects.

Parameters:
Returns:

the label list expression

Return type:

ExpressionIndex

add_operand_list(operands: List[ExpressionIndex]) → ExpressionIndex[source]

add_operand_list returns an operand list expression for the given list of integer operands.

Parameters:

operands (List(Union[ExpressionIndex, ExpressionIndex])) – list of operand numbers

Returns:

an operand list expression

Return type:

ExpressionIndex

and_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

and_expr bitwise and’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression and.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

append(expr: ExpressionIndex) → InstructionIndex[source]

append adds the ExpressionIndex expr to the current LowLevelILFunction.

Parameters:

expr (ExpressionIndex) – the ExpressionIndex to add to the current LowLevelILFunction

Returns:

Index of added instruction in the current function

Return type:

int

arith_shift_right(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

arith_shift_right shifts arithmetic right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression asr.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

assert_expr(size: int, src: architecture.RegisterType, constraint: PossibleValueSet, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

assert_expr assert constraint is the value of the given register src. Used when setting user variable values.

Parameters:

  • size (int) – size of value in the constraint

  • src (RegisterType) – register to constrain

  • constraint (PossibleValueSet) – asserted value of register

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression ASSERT(reg, constraint)

Return type:

ExpressionIndex

bool_to_int(size: int, a: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

bool_to_int returns an expression of size size converting the boolean expression a to an integer

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – boolean expression to be converted

  • loc (ILSourceLocation) – location of returned expression

Returns:

the converted integer expression.

Return type:

ExpressionIndex

breakpoint(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

breakpoint returns a processor breakpoint expression.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

a breakpoint expression.

Return type:

ExpressionIndex

cache_possible_value_set(pvs: PossibleValueSet) → int[source]

Cache a PossibleValueSet in the IL function, returning its index for use in an expression operand :param pvs: PossibleValueSet to cache :return: Index of the PossibleValueSet in the cache

Parameters:

pvs (PossibleValueSet) –

Return type:

int

call(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

call returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest

Parameters:

  • dest (ExpressionIndex) – the expression to call

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression call(dest)

Return type:

ExpressionIndex

call_stack_adjust(dest: ExpressionIndex, stack_adjust: int, reg_stack_adjustments: Dict[architecture.RegisterStackType, int] | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

call_stack_adjust returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression dest. After the function exits, stack_adjust is added to the stack pointer register.

Parameters:

  • dest (ExpressionIndex) – the expression to call

  • loc (ILSourceLocation) – location of returned expression

  • stack_adjust (int) –

  • reg_stack_adjustments (Dict[architecture.RegisterStackType, int] | None) –

Returns:

The expression call(dest), stack += stack_adjust

Return type:

ExpressionIndex

ceil(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

ceil rounds a floating point value to an integer towards positive infinity

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round up

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

clear_indirect_branches() → None[source]
Return type:

None

compare_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_equal returns comparison expression of size size checking if expression a is equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_not_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_not_equal returns comparison expression of size size checking if expression a is not equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_greater_equal returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_greater_than returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_less_equal returns comparison expression of size size checking if expression a is signed less than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_less_than returns comparison expression of size size checking if expression a is signed less than expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_greater_equal returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_greater_than returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_less_equal returns comparison expression of size size checking if expression a is unsigned less than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_less_than returns comparison expression of size size checking if expression a is unsigned less than expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

const(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

const returns an expression for the constant integer value with size size

Parameters:

  • size (int) – the size of the constant in bytes

  • value (int) – integer value of the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

const_pointer(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

const_pointer returns an expression for the constant pointer value with size size

Parameters:

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by pointer

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

copy_expr(original: LowLevelILInstruction) → ExpressionIndex[source]

copy_expr adds an expression to the function which is equivalent to the given expression

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:

original (LowLevelILInstruction) – the original IL Instruction you want to copy

Returns:

The index of the newly copied expression

Return type:

ExpressionIndex

copy_expr_to(expr: LowLevelILInstruction, dest: LowLevelILFunction, sub_expr_handler: Callable[[LowLevelILInstruction], ExpressionIndex] | None = None) → ExpressionIndex[source]

copy_expr_to deep copies an expression from this function into a target function If provided, the function sub_expr_handler will be called on every copied sub-expression

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:
Returns:

Index of the copied expression in the target function

Return type:

ExpressionIndex

create_graph(settings: DisassemblySettings | None = None) → CoreFlowGraph[source]
Parameters:

settings (DisassemblySettings | None) –

Return type:

CoreFlowGraph

create_graph_immediate(settings: DisassemblySettings | None = None) → CoreFlowGraph[source]
Parameters:

settings (DisassemblySettings | None) –

Return type:

CoreFlowGraph

div_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_double_prec_signed signed double precision divide using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divs.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_double_prec_unsigned unsigned double precision divide using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_signed signed divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divs.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

div_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_unsigned unsigned divide expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divu.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

expr(operation, a: ExpressionIndex = 0, b: ExpressionIndex = 0, c: ExpressionIndex = 0, d: ExpressionIndex = 0, size: int = 0, flags: architecture.FlagWriteTypeName | architecture.FlagType | architecture.FlagIndex | int | None = None, source_location: ILSourceLocation | None = None) → ExpressionIndex[source]
Parameters:

  • a (ExpressionIndex) –

  • b (ExpressionIndex) –

  • c (ExpressionIndex) –

  • d (ExpressionIndex) –

  • size (int) –

  • flags (architecture.FlagWriteTypeName | architecture.FlagType | architecture.FlagIndex | int | None) –

  • source_location (ILSourceLocation | None) –

Return type:

ExpressionIndex

extern_pointer(size: int, value: int, offset: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

extern_pointer returns an expression for the constant external pointer value with size size at offset offset

Parameters:

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by pointer

  • offset (int) – offset into external pointer

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

finalize() → None[source]

finalize ends the function and computes the list of basic blocks.

Return type:

None

flag(flag: architecture.FlagType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

flag returns a flag expression for the given flag name.

Parameters:

  • flag (architecture.FlagType) – flag expression to retrieve

  • loc (ILSourceLocation) – location of returned expression

Returns:

A flag expression of given flag name

Return type:

ExpressionIndex

flag_bit(size: int, flag: architecture.FlagType, bit: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

flag_bit sets the flag named flag and size size to the constant integer value bit

Parameters:

  • size (int) – the size of the flag

  • flag (str) – flag value

  • bit (int) – integer value to set the bit to

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size FLAG.flag = bit

Return type:

ExpressionIndex

flag_condition(cond: str | LowLevelILFlagCondition | int, sem_class: architecture.SemanticClassType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

flag_condition returns a flag_condition expression for the given LowLevelILFlagCondition

Parameters:
Returns:

A flag_condition expression

Return type:

ExpressionIndex

flag_group(sem_group: SemanticGroupName, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

flag_group returns a flag_group expression for the given semantic flag group

Parameters:

  • sem_group (SemanticGroupName) – Semantic flag group to access

  • loc (ILSourceLocation) – location of returned expression

Returns:

A flag_group expression

Return type:

ExpressionIndex

float_abs(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_abs returns absolute value of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to get the absolute value of

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fabs.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_add(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_add adds floating point expression a to expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fadd.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_compare_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_equal returns floating point comparison expression of size size checking if expression a is equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f== b

Return type:

ExpressionIndex

float_compare_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_greater_equal returns floating point comparison expression of size size checking if expression a is greater than or equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f>= b

Return type:

ExpressionIndex

float_compare_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_greater_than returns floating point comparison expression of size size checking if expression a is greater than expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f> b

Return type:

ExpressionIndex

float_compare_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_less_equal returns floating point comparison expression of size size checking if expression a is less than or equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f<= b

Return type:

ExpressionIndex

float_compare_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_less_than returns floating point comparison expression of size size checking if expression a is less than expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f< b

Return type:

ExpressionIndex

float_compare_not_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_not_equal returns floating point comparison expression of size size checking if expression a is not equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f!= b

Return type:

ExpressionIndex

float_compare_ordered(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_ordered returns floating point comparison expression of size size checking if expression a is ordered relative to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression is_ordered(a, b)

Return type:

ExpressionIndex

float_compare_unordered(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_unordered returns floating point comparison expression of size size checking if expression a is unordered relative to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression is_unordered(a, b)

Return type:

ExpressionIndex

float_const_double(value: float, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_double returns an expression for the double precision floating point value value

Parameters:

  • value (float) – float value for the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_const_raw(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_raw returns an expression for the constant raw binary floating point value value with size size

Parameters:

  • size (int) – the size of the constant in bytes

  • value (int) – integer value for the raw binary representation of the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_const_single(value: float, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_single returns an expression for the single precision floating point value value

Parameters:

  • value (float) – float value for the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_convert(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

int_to_float converts floating point value of expression value to size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fconvert.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_div(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_div divides floating point expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fdiv.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_mult(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_mult multiplies floating point expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fmul.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_neg(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_neg returns sign negation of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fneg.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_sqrt(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_sqrt returns square root of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to calculate the square root of

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sqrt.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_sub(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_sub subtracts floating point expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fsub.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

float_to_int(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_to_int returns integer value of floating point expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to convert to an int

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression int.<size>{<flags>}(value)

Return type:

ExpressionIndex

float_trunc(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_trunc rounds a floating point value to an integer towards zero

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to truncate

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

floor(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

floor rounds a floating point value to an integer towards negative infinity

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round down

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

force_ver(size: int, dest: architecture.RegisterType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

force_ver creates a new version of the register dest Effectively, this is like saying r0#2 = r0#1 which MLIL can then use as a new variable definition site.

Parameters:

  • size (int) – size of the register

  • dest (RegisterType) – the register to force a new version of

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression FORCE_VER(reg)

Return type:

ExpressionIndex

generate_ssa_form() → None[source]

generate_ssa_form generate SSA form given the current LLIL

Return type:

None

get_basic_block_at(index: int) → BasicBlock | None[source]

get_basic_block_at returns the BasicBlock at the given LLIL instruction index.

Parameters:

index (int) – Index of the LLIL instruction of the BasicBlock to retrieve.

Example:
>>> current_il_function.get_basic_block_at(current_il_index)
<llil block: x86@19-26>
Return type:

BasicBlock | None

get_exits_for_instr(idx: InstructionIndex) → List[InstructionIndex][source]
Parameters:

idx (InstructionIndex) –

Return type:

List[InstructionIndex]

get_expr(index: ExpressionIndex) → LowLevelILInstruction | None[source]

get_expr retrieves the IL expression at a given expression index in the function.

Warning

Not all IL expressions are valid, even if their index is within the bounds of the function, they might not be used by the function and might not contain properly structured data.

Parameters:

index (ExpressionIndex) – Index of desired expression in function

Returns:

A LowLevelILInstruction object for the expression, if it exists. Otherwise, None

Return type:

LowLevelILInstruction | None

get_expr_count() → int[source]

get_expr_count gives a the total number of expressions in this IL function

You can use this to enumerate all expressions in conjunction with get_expr

Warning

Not all IL expressions are valid, even if their index is within the returned value from this, they might not be used by the function and might not contain properly structured data.

Returns:

The number of expressions in the function

Return type:

int

get_expr_index_for_instruction(instr: InstructionIndex) → ExpressionIndex[source]
Parameters:

instr (InstructionIndex) –

Return type:

ExpressionIndex

get_high_level_il_expr_index(expr: ExpressionIndex) → ExpressionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

ExpressionIndex | None

get_high_level_il_instruction_index(instr: InstructionIndex) → InstructionIndex | None[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex | None

get_instruction_index_for_expr(expr: ExpressionIndex) → InstructionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

InstructionIndex | None

get_instruction_start(addr: int, arch: Architecture | None = None) → InstructionIndex | None[source]
Parameters:
Return type:

InstructionIndex | None

get_instructions_at(addr: int, arch: Architecture | None = None) → List[InstructionIndex][source]

get_instructions_at gets the InstructionIndex(s) corresponding to the given virtual address See the docs for mappings between ils for more information.

Parameters:

  • addr (int) – virtual address of the instruction to be queried

  • arch (Architecture) – (optional) Architecture for the given function

Return type:

list(InstructionIndex)

Example:
>>> func = next(bv.functions)
>>> func.llil.get_instructions_at(func.start)
[0]
get_label_for_address(arch: Architecture, addr: int) → LowLevelILLabel | None[source]

get_label_for_address returns the LowLevelILLabel for the given Architecture arch and IL address addr.

Parameters:
Returns:

the LowLevelILLabel for the given IL address

Return type:

LowLevelILLabel

get_label_for_source_instruction(i: InstructionIndex) → LowLevelILLabel | None[source]

Get the LowLevelILLabel for a given source instruction. The returned label is to an internal object with the same lifetime as the containing LowLevelILFunction.

Parameters:

i (InstructionIndex) – The source instruction index

Returns:

The LowLevelILLabel for the source instruction

Return type:

LowLevelILLabel | None

get_mapped_medium_level_il_expr_index(expr: ExpressionIndex) → ExpressionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

ExpressionIndex | None

get_mapped_medium_level_il_instruction_index(instr: InstructionIndex) → InstructionIndex | None[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex | None

get_medium_level_il_expr_index(expr: ExpressionIndex) → ExpressionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

ExpressionIndex | None

get_medium_level_il_expr_indexes(expr: ExpressionIndex) → List[ExpressionIndex][source]
Parameters:

expr (ExpressionIndex) –

Return type:

List[ExpressionIndex]

get_medium_level_il_instruction_index(instr: InstructionIndex) → InstructionIndex | None[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex | None

get_non_ssa_instruction_index(instr: InstructionIndex) → InstructionIndex[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex

get_ssa_flag_definition(flag_ssa: SSAFlag) → LowLevelILInstruction | None[source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

LowLevelILInstruction | None

get_ssa_flag_uses(flag_ssa: SSAFlag) → List[LowLevelILInstruction][source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

List[LowLevelILInstruction]

get_ssa_flag_value(flag_ssa: SSAFlag) → RegisterValue[source]
Parameters:

flag_ssa (SSAFlag) –

Return type:

RegisterValue

get_ssa_instruction_index(instr: InstructionIndex) → InstructionIndex[source]
Parameters:

instr (InstructionIndex) –

Return type:

InstructionIndex

get_ssa_memory_definition(index: int) → LowLevelILInstruction | None[source]
Parameters:

index (int) –

Return type:

LowLevelILInstruction | None

get_ssa_memory_uses(index: int) → List[LowLevelILInstruction][source]
Parameters:

index (int) –

Return type:

List[LowLevelILInstruction]

get_ssa_reg_definition(reg_ssa: SSARegister) → LowLevelILInstruction | None[source]
Parameters:

reg_ssa (SSARegister) –

Return type:

LowLevelILInstruction | None

get_ssa_reg_uses(reg_ssa: SSARegister) → List[LowLevelILInstruction][source]
Parameters:

reg_ssa (SSARegister) –

Return type:

List[LowLevelILInstruction]

get_ssa_reg_value(reg_ssa: SSARegister) → RegisterValue[source]
Parameters:

reg_ssa (SSARegister) –

Return type:

RegisterValue

goto(label: LowLevelILLabel, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

goto returns a goto expression which jumps to the provided LowLevelILLabel.

Parameters:
Returns:

the ExpressionIndex that jumps to the provided label

Return type:

ExpressionIndex

if_expr(operand: ExpressionIndex, t: LowLevelILLabel, f: LowLevelILLabel, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

if_expr returns the if expression which depending on condition operand jumps to the LowLevelILLabel t when the condition expression operand is non-zero and f when it’s zero.

Parameters:
Returns:

the ExpressionIndex for the if expression

Return type:

ExpressionIndex

int_to_float(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

int_to_float returns floating point value of integer expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to convert to a float

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression float.<size>{<flags>}(value)

Return type:

ExpressionIndex

intrinsic(outputs: List[str | ILRegister | int | ILFlag | RegisterInfo], intrinsic: architecture.IntrinsicType, params: List[ExpressionIndex], flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None)[source]

intrinsic return an intrinsic expression.

Parameters:
Returns:

an intrinsic expression.

Return type:

ExpressionIndex

jump(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

jump returns an expression which jumps (branches) to the expression dest

Parameters:

  • dest (ExpressionIndex) – the expression to jump to

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

jump_to(dest: ExpressionIndex, targets: Dict[int, LowLevelILLabel], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

jump_to returns an expression which jumps (branches) various targets in targets choosing the target in targets based on the value calculated by dest

Parameters:

  • dest (ExpressionIndex) – the expression choosing which jump target to use

  • targets (Dict[int, LowLevelILLabel]) – the list of targets for jump locations

  • loc (ILSourceLocation) – location of returned expression

  • targets –

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

load(size: int, addr: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

load Reads size bytes from the expression addr

Parameters:

  • size (int) – number of bytes to read

  • addr (ExpressionIndex) – the expression to read memory from

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression [addr].size

Return type:

ExpressionIndex

logical_shift_right(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

logical_shift_right shifts logically right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression lsr.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

low_part(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

low_part truncates value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to truncate

  • loc (ILSourceLocation) – location of returned expression

  • flags (architecture.FlagType | None) –

Returns:

The expression (value).<size>

Return type:

ExpressionIndex

mark_label(label: LowLevelILLabel) → None[source]

mark_label assigns a LowLevelILLabel to the current IL address.

Parameters:

label (LowLevelILLabel) –

Return type:

None

mod_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_double_prec_signed signed double precision modulus using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mods.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_double_prec_unsigned unsigned double precision modulus using expression a as a single double precision register by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression modu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_signed signed modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mods.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mod_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_unsigned unsigned modulus expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression modu.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult multiplies expression a by expression b potentially setting flags flags and returning an expression. Both the operands and return value are size bytes as the product’s upper half is discarded.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mul.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult_double_prec_signed multiplies signed with double (2*size bytes) precision expression a by expression b, each size bytes and potentially setting flags flags and returning an expression of 2*size bytes.

Note

The output expression is 2*size bytes in size, but will be rendered as muls.dp.<size>.

Parameters:

  • size (int) – the size of the input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression muls.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

mult_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult_double_prec_unsigned multiplies unsigned with double (2*size bytes) precision expression a by expression b, each size bytes and potentially setting flags flags and returning an expression of 2*size bytes.

Note

The output expression is 2*size bytes in size, but will be rendered as mulu.dp.<size>.

Parameters:

  • size (int) – the size of the input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mulu.dp.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

neg_expr(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

neg_expr two’s complement sign negation of expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression neg.<size>{<flags>}(value)

Return type:

ExpressionIndex

no_ret(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

no_ret returns an expression that halts disassembly

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

The expression noreturn

Return type:

ExpressionIndex

nop(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

nop no operation, this instruction does nothing

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

The no operation expression

Return type:

ExpressionIndex

not_expr(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

not_expr bitwise inverse of expression value of size size potentially setting flags

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to bitwise invert

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression not.<size>{<flags>}(value)

Return type:

ExpressionIndex

operand(n: int, expr: ExpressionIndex) → ExpressionIndex[source]

operand sets the operand number of the expression expr and passes back expr without modification.

Parameters:

  • n (int) –

  • expr (ExpressionIndex) –

Returns:

returns the expression expr unmodified

Return type:

ExpressionIndex

or_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

or_expr bitwise or’s expression a and expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression or.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

pop(size: int, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

pop reads size bytes from the stack, adjusting the stack by size.

Parameters:

  • size (int) – number of bytes to read from the stack

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression pop

Return type:

ExpressionIndex

prepare_to_copy_block(src: LowLevelILBasicBlock)[source]

prepare_to_copy_block sets up state when copying a function in preparation of copying the instructions from the block src

Parameters:

src (LowLevelILBasicBlock) – block about to be copied from

prepare_to_copy_function(src: LowLevelILFunction)[source]

prepare_to_copy_function sets up state in this LLIL function in preparation of copying instructions from src

Parameters:

src (LowLevelILFunction) – function about to be copied from

push(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

push writes size bytes from expression value to the stack, adjusting the stack by size.

Parameters:

  • size (int) – number of bytes to write and adjust the stack by

  • value (ExpressionIndex) – the expression to write

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression push(value)

Return type:

ExpressionIndex

reg(size: int, reg: architecture.RegisterType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg returns a register of size size with name reg

Parameters:

  • size (int) – the size of the register in bytes

  • reg (str) – the name of the register

  • loc (ILSourceLocation) – location of returned expression

Returns:

A register expression for the given string

Return type:

ExpressionIndex

reg_split(size: int, hi: architecture.RegisterType, lo: architecture.RegisterType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_split combines registers of size size with names hi and lo

Parameters:

  • size (int) – the size of the register in bytes

  • hi (str) – register holding high part of value

  • lo (str) – register holding low part of value

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression hi:lo

Return type:

ExpressionIndex

reg_stack_free_reg(reg: architecture.RegisterType, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_free_reg clears the given register reg from its register stack without affecting the register at the top of the register stack.

Parameters:

  • reg (str) – the register being marked free

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression __free_slot(reg)

Return type:

ExpressionIndex

reg_stack_free_top_relative(reg_stack: architecture.RegisterStackType, entry: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_free_top_relative clears an entry in the register stack reg_stack at a top-relative position specified by the value of entry.

Parameters:

  • reg_stack (str) – the register stack name

  • entry (ExpressionIndex) – expression to calculate the top-relative position

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression __free_slot(reg_stack[entry])

Return type:

ExpressionIndex

reg_stack_pop(size: int, reg_stack: architecture.RegisterStackType, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_pop returns the top entry of size size in register stack with name reg_stack, and removes the entry from the stack

Parameters:

  • size (int) – the size of the register in bytes

  • reg_stack (str) – the name of the register stack

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg_stack.pop

Return type:

ExpressionIndex

reg_stack_push(size: int, reg_stack: architecture.RegisterStackType, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_push pushes the expression value of size size onto the top of the register stack reg_stack

Parameters:

  • size (int) – size of the register parameter in bytes

  • reg_stack (str) – the register stack name

  • value (ExpressionIndex) – an expression to push

  • flags (str) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg_stack.push(value)

Return type:

ExpressionIndex

reg_stack_top_relative(size: int, reg_stack: architecture.RegisterStackType, entry: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

reg_stack_top_relative returns a register stack entry of size size at top-relative location entry in register stack with name reg_stack

Parameters:

  • size (int) – the size of the register in bytes

  • reg_stack (str) – the name of the register stack

  • entry (ExpressionIndex) – an expression for which stack entry to fetch

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg_stack[entry]

Return type:

ExpressionIndex

replace_expr(original: LowLevelILInstruction | ExpressionIndex | InstructionIndex, new: LowLevelILInstruction | ExpressionIndex | InstructionIndex) → None[source]

replace_expr allows modification of expressions but ONLY during lifting.

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:

  • original (ExpressionIndex) – the ExpressionIndex to replace (may also be an expression index)

  • new (ExpressionIndex) – the ExpressionIndex to add to the current LowLevelILFunction (may also be an expression index)

Return type:

None

ret(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

ret returns an expression which jumps (branches) to the expression dest. ret is a special alias for jump that makes the disassembler stop disassembling.

Parameters:

  • dest (ExpressionIndex) – the expression to jump to

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

rotate_left(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_left bitwise rotates left expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rol.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

rotate_left_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_left_carry bitwise rotates left with carry expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rlc.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

rotate_right(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_right bitwise rotates right expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression ror.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

rotate_right_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_right_carry bitwise rotates right with carry expression a by expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rrc.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

round_to_int(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

round_to_int rounds a floating point value to the nearest integer

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round to the nearest integer

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>{<flags>}(value)

Return type:

ExpressionIndex

set_current_address(value: int, arch: Architecture | None = None) → None[source]
Parameters:
Return type:

None

set_current_source_block(block) → None[source]
Return type:

None

set_expr_attributes(expr: LowLevelILInstruction | ExpressionIndex | InstructionIndex, value: Set[ILInstructionAttribute] | List[ILInstructionAttribute])[source]

set_expr_attributes allows modification of instruction attributes but ONLY during lifting.

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:

  • expr (ExpressionIndex) – the ExpressionIndex to replace (may also be an expression index)

  • value (set(ILInstructionAttribute)) – the set of attributes to place on the instruction

Return type:

None

set_flag(flag: architecture.FlagType, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

set_flag sets the flag flag to the ExpressionIndex value

Parameters:

  • flag (str) – the low register name

  • value (ExpressionIndex) – an expression to set the flag to

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression FLAG.flag = value

Return type:

ExpressionIndex

set_indirect_branches(branches: List[Tuple[Architecture, int]]) → None[source]
Parameters:

branches (List[Tuple[Architecture, int]]) –

Return type:

None

set_reg(size: int, reg: architecture.RegisterType, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

set_reg sets the register reg of size size to the expression value

Parameters:

  • size (int) – size of the register parameter in bytes

  • reg (str) – the register name

  • value (ExpressionIndex) – an expression to set the register to

  • flags (str) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg = value

Return type:

ExpressionIndex

set_reg_split(size: int, hi: architecture.RegisterType, lo: architecture.RegisterType, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

set_reg_split uses hi and lo as a single extended register setting hi:lo to the expression value.

Parameters:

  • size (int) – size of the register parameter in bytes

  • hi (str) – the high register name

  • lo (str) – the low register name

  • value (ExpressionIndex) – an expression to set the split registers to

  • flags (str) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression hi:lo = value

Return type:

ExpressionIndex

set_reg_stack_top_relative(size: int, reg_stack: architecture.RegisterStackType, entry: ExpressionIndex, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

set_reg_stack_top_relative sets the top-relative entry entry of size size in register stack reg_stack to the expression value

Parameters:

  • size (int) – size of the register parameter in bytes

  • reg_stack (str) – the register stack name

  • entry (ExpressionIndex) – an expression for which stack entry to set

  • value (ExpressionIndex) – an expression to set the entry to

  • flags (str) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression reg_stack[entry] = value

Return type:

ExpressionIndex

shift_left(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

shift_left shifts left expression a by expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression lsl.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

sign_extend(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sign_extend two’s complement sign-extends the expression in value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to sign extend

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sx.<size>(value)

Return type:

ExpressionIndex

store(size: int, addr: ExpressionIndex, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

store Writes size bytes to expression addr read from expression value

Parameters:

  • size (int) – number of bytes to write

  • addr (ExpressionIndex) – the expression to write to

  • value (ExpressionIndex) – the expression to be written

  • flags (FlagType) – which flags are set by this operation

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression [addr].size = value

Return type:

ExpressionIndex

sub(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sub subtracts expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sub.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

sub_borrow(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sub_borrow subtracts with borrow expression b from expression a potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carry flag expression

  • flags (str) – flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sbb.<size>{<flags>}(a, b, carry)

Return type:

ExpressionIndex

system_call(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

system_call return a system call expression.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

a system call expression.

Return type:

ExpressionIndex

tailcall(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

tailcall returns an expression which jumps (branches) to the expression dest

Parameters:

  • dest (ExpressionIndex) – the expression to jump to

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression tailcall(dest)

Return type:

ExpressionIndex

test_bit(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

test_bit returns an expression of size size that tells whether expression a has its bit with an index of the expression b is set

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – an expression to be tested

  • b (ExpressionIndex) – an expression for the index of the big

  • loc (ILSourceLocation) – location of returned expression

Returns:

the result expression.

Return type:

ExpressionIndex

translate(expr_handler: Callable[[LowLevelILFunction, LowLevelILBasicBlock, LowLevelILInstruction], ExpressionIndex]) → LowLevelILFunction[source]

translate clones an IL function and modifies its expressions as specified by a given expr_handler, returning the updated IL function.

Parameters:

expr_handler (Callable[[LowLevelILFunction, LowLevelILBasicBlock, LowLevelILInstruction], ExpressionIndex]) –

Function to modify an expression and copy it to the new function. The function should have the following signature:

expr_handler(new_func: LowLevelILFunction, old_block: LowLevelILBasicBlock, old_instr: LowLevelILInstruction) -> ExpressionIndex

Where:

  • new_func (LowLevelILFunction): New function to receive translated instructions

  • old_block (LowLevelILBasicBlock): Original block containing old_instr

  • old_instr (LowLevelILInstruction): Original instruction

  • returns (ExpressionIndex): Expression index of newly created instruction in new_func

Returns:

Cloned IL function with modifications

Return type:

LowLevelILFunction

trap(value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

trap returns a processor trap (interrupt) expression of the given integer value.

Parameters:

  • value (int) – trap (interrupt) number

  • loc (ILSourceLocation) – location of returned expression

Returns:

a trap expression.

Return type:

ExpressionIndex

traverse(cb: Callable[[LowLevelILInstruction, Any], Any], *args: Any, **kwargs: Any) → Iterator[Any][source]

traverse iterates through all the instructions in the LowLevelILFunction and calls the callback function for each instruction and sub-instruction. See the Developer Docs for more examples.

Parameters:

  • cb (Callable[[LowLevelILInstruction, Any], Any]) – The callback function to call for each node in the LowLevelILInstruction

  • args (Any) – Custom user-defined arguments

  • kwargs (Any) – Custom user-defined keyword arguments

  • cb –

Returns:

An iterator of the results of the callback function

Return type:

Iterator[Any]

Example:
>>> def find_constants(instr) -> Optional[int]:
...     if isinstance(instr, Constant):
...         return instr.constant
>>> print(list(current_il_function.traverse(find_constants)))
undefined(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

undefined returns the undefined expression. This should be used for instructions which perform functions but aren’t important for dataflow or partial emulation purposes.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

the undefined expression.

Return type:

ExpressionIndex

unimplemented(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

unimplemented returns the unimplemented expression. This should be used for all instructions which aren’t implemented.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

the unimplemented expression.

Return type:

ExpressionIndex

unimplemented_memory_ref(size: int, addr: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

unimplemented_memory_ref a memory reference to expression addr of size size with unimplemented operation.

Parameters:

  • size (int) – size in bytes of the memory reference

  • addr (ExpressionIndex) – expression to reference memory

  • loc (ILSourceLocation) – location of returned expression

Returns:

the unimplemented memory reference expression.

Return type:

ExpressionIndex

visit(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool]) → bool[source]

Iterates over all the instructions in the function and calls the callback function for each instruction and each sub-instruction.

Parameters:

cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILFunction.traverse instead.

visit_all(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool]) → bool[source]

Iterates over all the instructions in the function and calls the callback function for each instruction and their operands.

Parameters:

cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILFunction.traverse instead.

visit_operands(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool]) → bool[source]
Iterates over all the instructions in the function and calls the callback function for each operand and

the operands of each sub-instruction.

Parameters:

cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILFunction.traverse instead.

xor_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

xor_expr xor’s expression a with expression b potentially setting flags flags and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • flags (str) – optional, flags to set

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression xor.<size>{<flags>}(a, b)

Return type:

ExpressionIndex

zero_extend(size: int, value: ExpressionIndex, flags: architecture.FlagType | None = None, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

zero_extend zero-extends the expression in value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to zero extend

  • loc (ILSourceLocation) – location of returned expression

  • flags (architecture.FlagType | None) –

Returns:

The expression zx.<size>(value)

Return type:

ExpressionIndex

property arch: Architecture
property basic_blocks: LowLevelILBasicBlockList
property current_address: int

Current IL Address (read/write)

property flags: List[SSAFlag]

List of flags used in this IL

property il_form: FunctionGraphType
property instructions: Generator[LowLevelILInstruction, None, None]

A generator of llil instructions of the current llil function

property is_thunk: bool

Returns True if the function starts with a Tailcall (read-only)

property mapped_medium_level_il: MediumLevelILFunction

Medium level IL with mappings between low level IL and medium level IL. Unused stores are not removed. Typically, this should only be used to answer queries on assembly or low level IL where the query is easier to perform on medium level IL.

property medium_level_il: MediumLevelILFunction

Medium level IL for this low level IL.

property memory_versions: List[int]

List of memory versions used in this IL

property mlil: MediumLevelILFunction
property mmlil: MediumLevelILFunction
property non_ssa_form: LowLevelILFunction

Low level IL in non-SSA (default) form (read-only)

property reg_stacks: List[SSARegisterStack]

List of register stacks used in this IL

property register_stacks: List[SSARegisterStack]

Deprecated, use reg_stacks instead. List of register stacks used in this IL

property registers: List[SSARegister]

Deprecated, use regs instead. List of registers used in this IL

property regs: List[SSARegister]

List of registers used in this IL

property source_function: Function | None
property ssa_flags: List[SSAFlag]

List of all SSA flags and versions used in this IL

property ssa_flags_without_versions: List[SSAFlag]

List of SSA flags used in this IL

property ssa_form: LowLevelILFunction

Low level IL in SSA form (read-only)

property ssa_reg_stacks: List[SSARegisterStack]

List of all SSA register stacks and versions used in this IL

property ssa_reg_stacks_without_versions: List[SSARegisterStack]

List of SSA register stacks used in this IL

property ssa_register_stacks: List[SSARegisterStack]
property ssa_registers: List[SSARegister]
property ssa_regs: List[SSARegister]

List of all SSA registers and versions used in this IL

property ssa_regs_without_versions: List[SSARegister]

List of SSA registers used in this IL

property ssa_vars: List[SSARegister | SSARegisterStack | SSAFlag]

This is the union LowLevelILFunction.ssa_regs, LowLevelILFunction.ssa_reg_stacks, and LowLevelILFunction.ssa_flags

property ssa_vars_without_versions: List[SSARegister | SSARegisterStack | SSAFlag]

This is the union LowLevelILFunction.ssa_regs_without_versions, LowLevelILFunction.ssa_reg_stacks_without_versions, and LowLevelILFunction.ssa_flags_without_versions

property temp_flag_count: int

Number of temporary flags (read-only)

property temp_reg_count: int

Number of temporary registers (read-only)

property vars: List[ILRegister | ILRegisterStack | ILFlag]

This is the union LowLevelILFunction.regs, LowLevelILFunction.reg_stacks, and LowLevelILFunction.flags

property view: BinaryView | None

LowLevelILGoto

class LowLevelILGoto[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILGoto(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: InstructionIndex
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILIf

class LowLevelILIf[source]

Bases: LowLevelILInstruction, ControlFlow

LowLevelILIf(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property condition: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property false: InstructionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property true: InstructionIndex

LowLevelILInstruction

class LowLevelILInstruction[source]

Bases: BaseILInstruction

class LowLevelILInstruction Low Level Intermediate Language Instructions are infinite length tree-based instructions. Tree-based instructions use infix notation with the left hand operand being the destination operand. Infix notation is thus more natural to read than other notations (e.g. x86 mov eax, 0 vs. LLIL eax = 0).

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

copy_to(dest: LowLevelILFunction, sub_expr_handler: Callable[[LowLevelILInstruction], ExpressionIndex] | None = None) → ExpressionIndex[source]

copy_to deep copies an expression into a new IL function. If provided, the function sub_expr_handler will be called on every copied sub-expression

Warning

This function should ONLY be called as a part of a lifter or workflow. It will otherwise not do anything useful as analysis will not be running.

Parameters:
Returns:

Index of the copied expression in the target function

Return type:

ExpressionIndex

classmethod create(func: LowLevelILFunction, expr_index: ExpressionIndex, instr_index: InstructionIndex | None = None) → LowLevelILInstruction[source]
Parameters:

  • func (LowLevelILFunction) –

  • expr_index (ExpressionIndex) –

  • instr_index (InstructionIndex | None) –

Return type:

LowLevelILInstruction

get_flag_value(flag: architecture.FlagType) → RegisterValue[source]
Parameters:

flag (architecture.FlagType) –

Return type:

RegisterValue

get_flag_value_after(flag: architecture.FlagType) → RegisterValue[source]
Parameters:

flag (architecture.FlagType) –

Return type:

RegisterValue

get_possible_flag_values(flag: architecture.FlagType, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_flag_values_after(flag: architecture.FlagType, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_reg_values(reg: architecture.RegisterType, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_reg_values_after(reg: architecture.RegisterType, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_stack_contents(offset: int, size: int, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_stack_contents_after(offset: int, size: int, options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:
Return type:

PossibleValueSet

get_possible_values(options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:

options (List[DataFlowQueryOption] | None) –

Return type:

PossibleValueSet

get_reg_value(reg: architecture.RegisterType) → RegisterValue[source]
Parameters:

reg (architecture.RegisterType) –

Return type:

RegisterValue

get_reg_value_after(reg: architecture.RegisterType) → RegisterValue[source]
Parameters:

reg (architecture.RegisterType) –

Return type:

RegisterValue

get_stack_contents(offset: int, size: int) → RegisterValue[source]
Parameters:

  • offset (int) –

  • size (int) –

Return type:

RegisterValue

get_stack_contents_after(offset: int, size: int) → RegisterValue[source]
Parameters:

  • offset (int) –

  • size (int) –

Return type:

RegisterValue

static show_llil_hierarchy()[source]

Opens a new tab showing the LLIL hierarchy which includes classes which can easily be used with isinstance to match multiple types of IL instructions.

traverse(cb: Callable[[LowLevelILInstruction, Any], Any], *args: Any, **kwargs: Any) → Iterator[Any][source]

traverse is a generator that allows you to traverse the LowLevelILInstruction in a depth-first manner. It will yield the result of the callback function for each node in the tree. Arguments can be passed to the callback function using args and kwargs. See the Developer Docs for more examples.

Parameters:

  • cb (Callable[[LowLevelILInstruction, Any], Any]) – The callback function to call for each node in the LowLevelILInstruction

  • args (Any) – Custom user-defined arguments

  • kwargs (Any) – Custom user-defined keyword arguments

  • cb –

Returns:

An iterator of the results of the callback function

Return type:

Iterator[Any]

Example:
>>> def get_constant_less_than_value(inst: LowLevelILInstruction, value: int) -> int:
>>>     if isinstance(inst, Constant) and inst.constant < value:
>>>         return inst.constant
>>>
>>> list(inst.traverse(get_constant_less_than_value, 10))
visit(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool], name: str = 'root', parent: LowLevelILInstruction | None = None) → bool[source]

Visits all LowLevelILInstructions in the operands of this instruction and any sub-instructions.

Parameters:

  • cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (LowLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILInstruction.traverse instead.

visit_all(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool], name: str = 'root', parent: LowLevelILInstruction | None = None) → bool[source]

Visits all operands of this instruction and all operands of any sub-instructions. Using pre-order traversal.

Parameters:

  • cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (LowLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILInstruction.traverse instead.

visit_operands(cb: Callable[[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str, LowLevelILInstruction | None], bool], name: str = 'root', parent: LowLevelILInstruction | None = None) → bool[source]

Visits all leaf operands of this instruction and any sub-instructions.

Parameters:

  • cb (LowLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (LowLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Return type:

bool

Deprecated since version 4.0.4907: Use LowLevelILInstruction.traverse instead.

ILOperations: ClassVar[Dict[LowLevelILOperation, List[Tuple[str, str]]]] = {LowLevelILOperation.LLIL_NOP: [], LowLevelILOperation.LLIL_SET_REG: [('dest', 'reg'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_SPLIT: [('hi', 'reg'), ('lo', 'reg'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_FLAG: [('dest', 'flag'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_STACK_REL: [('stack', 'reg_stack'), ('dest', 'expr'), ('src', 'expr')], LowLevelILOperation.LLIL_REG_STACK_PUSH: [('stack', 'reg_stack'), ('src', 'expr')], LowLevelILOperation.LLIL_LOAD: [('src', 'expr')], LowLevelILOperation.LLIL_STORE: [('dest', 'expr'), ('src', 'expr')], LowLevelILOperation.LLIL_PUSH: [('src', 'expr')], LowLevelILOperation.LLIL_POP: [], LowLevelILOperation.LLIL_REG: [('src', 'reg')], LowLevelILOperation.LLIL_REG_SPLIT: [('hi', 'reg'), ('lo', 'reg')], LowLevelILOperation.LLIL_REG_STACK_REL: [('stack', 'reg_stack'), ('src', 'expr')], LowLevelILOperation.LLIL_REG_STACK_POP: [('stack', 'reg_stack')], LowLevelILOperation.LLIL_REG_STACK_FREE_REG: [('dest', 'reg')], LowLevelILOperation.LLIL_REG_STACK_FREE_REL: [('stack', 'reg_stack'), ('dest', 'expr')], LowLevelILOperation.LLIL_CONST: [('constant', 'int')], LowLevelILOperation.LLIL_CONST_PTR: [('constant', 'int')], LowLevelILOperation.LLIL_EXTERN_PTR: [('constant', 'int'), ('offset', 'int')], LowLevelILOperation.LLIL_FLOAT_CONST: [('constant', 'float')], LowLevelILOperation.LLIL_FLAG: [('src', 'flag')], LowLevelILOperation.LLIL_FLAG_BIT: [('src', 'flag'), ('bit', 'int')], LowLevelILOperation.LLIL_ADD: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_ADC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], LowLevelILOperation.LLIL_SUB: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_SBB: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], LowLevelILOperation.LLIL_AND: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_OR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_XOR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_LSL: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_LSR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_ASR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_ROL: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_RLC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], LowLevelILOperation.LLIL_ROR: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_RRC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], LowLevelILOperation.LLIL_MUL: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MULU_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MULS_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_DIVU: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_DIVU_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_DIVS: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_DIVS_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MODU: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MODU_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MODS: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_MODS_DP: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_NEG: [('src', 'expr')], LowLevelILOperation.LLIL_NOT: [('src', 'expr')], LowLevelILOperation.LLIL_SX: [('src', 'expr')], LowLevelILOperation.LLIL_ZX: [('src', 'expr')], LowLevelILOperation.LLIL_LOW_PART: [('src', 'expr')], LowLevelILOperation.LLIL_JUMP: [('dest', 'expr')], LowLevelILOperation.LLIL_JUMP_TO: [('dest', 'expr'), ('targets', 'target_map')], LowLevelILOperation.LLIL_CALL: [('dest', 'expr')], LowLevelILOperation.LLIL_CALL_STACK_ADJUST: [('dest', 'expr'), ('stack_adjustment', 'int'), ('reg_stack_adjustments', 'reg_stack_adjust')], LowLevelILOperation.LLIL_TAILCALL: [('dest', 'expr')], LowLevelILOperation.LLIL_RET: [('dest', 'expr')], LowLevelILOperation.LLIL_NORET: [], LowLevelILOperation.LLIL_IF: [('condition', 'expr'), ('true', 'int'), ('false', 'int')], LowLevelILOperation.LLIL_GOTO: [('dest', 'int')], LowLevelILOperation.LLIL_FLAG_COND: [('condition', 'cond'), ('semantic_class', 'sem_class')], LowLevelILOperation.LLIL_FLAG_GROUP: [('semantic_group', 'sem_group')], LowLevelILOperation.LLIL_CMP_E: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_NE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_SLT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_ULT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_SLE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_ULE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_SGE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_UGE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_SGT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_CMP_UGT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_TEST_BIT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_BOOL_TO_INT: [('src', 'expr')], LowLevelILOperation.LLIL_ADD_OVERFLOW: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_SYSCALL: [], LowLevelILOperation.LLIL_BP: [], LowLevelILOperation.LLIL_TRAP: [('vector', 'int')], LowLevelILOperation.LLIL_INTRINSIC: [('output', 'reg_or_flag_list'), ('intrinsic', 'intrinsic'), ('param', 'expr')], LowLevelILOperation.LLIL_UNDEF: [], LowLevelILOperation.LLIL_UNIMPL: [], LowLevelILOperation.LLIL_UNIMPL_MEM: [('src', 'expr')], LowLevelILOperation.LLIL_FADD: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FSUB: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FMUL: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FDIV: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FSQRT: [('src', 'expr')], LowLevelILOperation.LLIL_FNEG: [('src', 'expr')], LowLevelILOperation.LLIL_FABS: [('src', 'expr')], LowLevelILOperation.LLIL_FLOAT_TO_INT: [('src', 'expr')], LowLevelILOperation.LLIL_INT_TO_FLOAT: [('src', 'expr')], LowLevelILOperation.LLIL_FLOAT_CONV: [('src', 'expr')], LowLevelILOperation.LLIL_ROUND_TO_INT: [('src', 'expr')], LowLevelILOperation.LLIL_FLOOR: [('src', 'expr')], LowLevelILOperation.LLIL_CEIL: [('src', 'expr')], LowLevelILOperation.LLIL_FTRUNC: [('src', 'expr')], LowLevelILOperation.LLIL_FCMP_E: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_NE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_LT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_LE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_GE: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_GT: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_O: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_FCMP_UO: [('left', 'expr'), ('right', 'expr')], LowLevelILOperation.LLIL_SET_REG_SSA: [('dest', 'reg_ssa'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_SSA_PARTIAL: [('full_reg', 'reg_ssa'), ('dest', 'reg'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_SPLIT_SSA: [('hi', 'expr'), ('lo', 'expr'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_STACK_REL_SSA: [('stack', 'expr'), ('dest', 'expr'), ('top', 'expr'), ('src', 'expr')], LowLevelILOperation.LLIL_SET_REG_STACK_ABS_SSA: [('stack', 'expr'), ('dest', 'reg'), ('src', 'expr')], LowLevelILOperation.LLIL_REG_SPLIT_DEST_SSA: [('dest', 'reg_ssa')], LowLevelILOperation.LLIL_REG_STACK_DEST_SSA: [('src', 'reg_stack_ssa_dest_and_src')], LowLevelILOperation.LLIL_REG_SSA: [('src', 'reg_ssa')], LowLevelILOperation.LLIL_REG_SSA_PARTIAL: [('full_reg', 'reg_ssa'), ('src', 'reg')], LowLevelILOperation.LLIL_REG_SPLIT_SSA: [('hi', 'reg_ssa'), ('lo', 'reg_ssa')], LowLevelILOperation.LLIL_REG_STACK_REL_SSA: [('stack', 'reg_stack_ssa'), ('src', 'expr'), ('top', 'expr')], LowLevelILOperation.LLIL_REG_STACK_ABS_SSA: [('stack', 'reg_stack_ssa'), ('src', 'reg')], LowLevelILOperation.LLIL_REG_STACK_FREE_REL_SSA: [('stack', 'expr'), ('dest', 'expr'), ('top', 'expr')], LowLevelILOperation.LLIL_REG_STACK_FREE_ABS_SSA: [('stack', 'expr'), ('dest', 'reg')], LowLevelILOperation.LLIL_SET_FLAG_SSA: [('dest', 'flag_ssa'), ('src', 'expr')], LowLevelILOperation.LLIL_FLAG_SSA: [('src', 'flag_ssa')], LowLevelILOperation.LLIL_FLAG_BIT_SSA: [('src', 'flag_ssa'), ('bit', 'int')], LowLevelILOperation.LLIL_CALL_SSA: [('output', 'expr'), ('dest', 'expr'), ('stack', 'expr'), ('param', 'expr')], LowLevelILOperation.LLIL_SYSCALL_SSA: [('output', 'expr'), ('stack', 'expr'), ('param', 'expr')], LowLevelILOperation.LLIL_TAILCALL_SSA: [('output', 'expr'), ('dest', 'expr'), ('stack', 'expr'), ('param', 'expr')], LowLevelILOperation.LLIL_CALL_PARAM: [('src', 'expr_list')], LowLevelILOperation.LLIL_CALL_STACK_SSA: [('src', 'reg_ssa'), ('src_memory', 'int')], LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: [('dest_memory', 'int'), ('dest', 'reg_ssa_list')], LowLevelILOperation.LLIL_SEPARATE_PARAM_LIST_SSA: [('src', 'expr_list')], LowLevelILOperation.LLIL_SHARED_PARAM_SLOT_SSA: [('src', 'expr_list')], LowLevelILOperation.LLIL_MEMORY_INTRINSIC_OUTPUT_SSA: [('dest_memory', 'int'), ('output', 'reg_ssa_list')], LowLevelILOperation.LLIL_LOAD_SSA: [('src', 'expr'), ('src_memory', 'int')], LowLevelILOperation.LLIL_STORE_SSA: [('dest', 'expr'), ('dest_memory', 'int'), ('src_memory', 'int'), ('src', 'expr')], LowLevelILOperation.LLIL_INTRINSIC_SSA: [('output', 'reg_or_flag_ssa_list'), ('intrinsic', 'intrinsic'), ('param', 'expr')], LowLevelILOperation.LLIL_MEMORY_INTRINSIC_SSA: [('output', 'expr'), ('intrinsic', 'intrinsic'), ('params', 'expr_list'), ('src_memory', 'int')], LowLevelILOperation.LLIL_REG_PHI: [('dest', 'reg_ssa'), ('src', 'reg_ssa_list')], LowLevelILOperation.LLIL_REG_STACK_PHI: [('dest', 'reg_stack_ssa'), ('src', 'reg_stack_ssa_list')], LowLevelILOperation.LLIL_FLAG_PHI: [('dest', 'flag_ssa'), ('src', 'flag_ssa_list')], LowLevelILOperation.LLIL_MEM_PHI: [('dest_memory', 'int'), ('src_memory', 'int_list')]}
property address: int
property attributes: Set[ILInstructionAttribute]

The set of optional attributes placed on the instruction

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property flags: FlagWriteTypeName | None
function: LowLevelILFunction
property high_level_il: HighLevelILInstruction | None

Gets the high level IL expression corresponding to this expression (may be None for eliminated instructions)

property hlil: HighLevelILInstruction | None
property hlils: List[HighLevelILInstruction]
property il_basic_block: LowLevelILBasicBlock

IL basic block object containing this expression (read-only) (only available on finalized functions)

instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property mapped_medium_level_il: MediumLevelILInstruction | None

Gets the mapped medium level IL expression corresponding to this expression

property medium_level_il: MediumLevelILInstruction | None

Gets the medium level IL expression corresponding to this expression (may be None for eliminated instructions)

property mlil: MediumLevelILInstruction | None
property mlils: List[MediumLevelILInstruction]
property mmlil: MediumLevelILInstruction | None
property non_ssa_form: LowLevelILInstruction

Non-SSA form of expression (read-only)

property operands: List[LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None]

Operands for the instruction

Consider using more specific APIs for src, dest, params, etc where appropriate.

property operation: LowLevelILOperation
property possible_values: PossibleValueSet

Possible values of expression using path-sensitive static data flow analysis (read-only)

property postfix_operands: List[LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None]

All operands in the expression tree in postfix order

property prefix_operands: List[LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None]

All operands in the expression tree in prefix order

property raw_flags: int
property raw_operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]

Raw operand expression indices as specified by the core structure (read-only)

property size: int
property source_location: ILSourceLocation
property source_operand: ExpressionIndex | None
property ssa_form: LowLevelILInstruction

SSA form of expression (read-only)

property tokens: List[InstructionTextToken]

LLIL tokens (read-only)

property value: RegisterValue

Value of expression if constant or a known value (read-only)

LowLevelILIntToFloat

class LowLevelILIntToFloat[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILIntToFloat(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILIntrinsic

class LowLevelILIntrinsic[source]

Bases: LowLevelILInstruction, Intrinsic

LowLevelILIntrinsic(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property intrinsic: ILIntrinsic
property output: List[ILFlag | ILRegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]

LowLevelILIntrinsicSsa

class LowLevelILIntrinsicSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILIntrinsicSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property intrinsic: ILIntrinsic
property output: List[SSARegisterOrFlag]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]

LowLevelILJump

class LowLevelILJump[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILJump(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILJumpTo

class LowLevelILJumpTo[source]

Bases: LowLevelILInstruction

LowLevelILJumpTo(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property targets: Dict[int, int]

LowLevelILLabel

class LowLevelILLabel[source]

Bases: object

__init__(handle: BNLowLevelILLabel | None = None)[source]
Parameters:

handle (BNLowLevelILLabel | None) –

property operand: InstructionIndex
property ref: bool
property resolved: bool

LowLevelILLoad

class LowLevelILLoad[source]

Bases: LowLevelILInstruction, Load

LowLevelILLoad(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILLoadSsa

class LowLevelILLoadSsa[source]

Bases: LowLevelILInstruction, Load, SSA

LowLevelILLoadSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property src_memory: int

LowLevelILLowPart

class LowLevelILLowPart[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILLowPart(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILLsl

class LowLevelILLsl[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILLsl(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILLsr

class LowLevelILLsr[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILLsr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILMemPhi

class LowLevelILMemPhi[source]

Bases: LowLevelILInstruction, Memory, Phi

LowLevelILMemPhi(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src_memory: List[int]

LowLevelILMemoryIntrinsicOutputSsa

class LowLevelILMemoryIntrinsicOutputSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILMemoryIntrinsicOutputSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property output: List[SSARegisterOrFlag]

LowLevelILMemoryIntrinsicSsa

class LowLevelILMemoryIntrinsicSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILMemoryIntrinsicSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property intrinsic: ILIntrinsic
property output: List[SSARegisterOrFlag]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property src_memory: int

LowLevelILMods

class LowLevelILMods[source]

Bases: LowLevelILBinaryBase, Arithmetic, Signed

LowLevelILMods(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILModsDp

class LowLevelILModsDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision, Signed

LowLevelILModsDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILModu

class LowLevelILModu[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILModu(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILModuDp

class LowLevelILModuDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision

LowLevelILModuDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILMul

class LowLevelILMul[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILMul(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILMulsDp

class LowLevelILMulsDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision

LowLevelILMulsDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILMuluDp

class LowLevelILMuluDp[source]

Bases: LowLevelILBinaryBase, DoublePrecision

LowLevelILMuluDp(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILNeg

class LowLevelILNeg[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILNeg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILNop

class LowLevelILNop[source]

Bases: LowLevelILInstruction

LowLevelILNop(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILNoret

class LowLevelILNoret[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILNoret(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILNot

class LowLevelILNot[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILNot(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILOperationAndSize

class LowLevelILOperationAndSize[source]

Bases: object

LowLevelILOperationAndSize(operation: ‘LowLevelILOperation’, size: int)

__init__(operation: LowLevelILOperation, size: int) → None
Parameters:
Return type:

None

operation: LowLevelILOperation
size: int

LowLevelILOr

class LowLevelILOr[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILOr(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILPop

class LowLevelILPop[source]

Bases: LowLevelILInstruction, StackOperation

LowLevelILPop(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILPush

class LowLevelILPush[source]

Bases: LowLevelILInstruction, StackOperation

LowLevelILPush(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILReg

class LowLevelILReg[source]

Bases: LowLevelILInstruction

LowLevelILReg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILRegister

LowLevelILRegPhi

class LowLevelILRegPhi[source]

Bases: LowLevelILInstruction, Phi

LowLevelILRegPhi(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[SSARegister]

LowLevelILRegSplit

class LowLevelILRegSplit[source]

Bases: LowLevelILInstruction

LowLevelILRegSplit(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
property hi: ILRegister
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property lo: ILRegister

LowLevelILRegSplitDestSsa

class LowLevelILRegSplitDestSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILRegSplitDestSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILRegSplitSsa

class LowLevelILRegSplitSsa[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILRegSplitSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
property hi: SSARegister
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property lo: SSARegister

LowLevelILRegSsa

class LowLevelILRegSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILRegSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegister

LowLevelILRegSsaPartial

class LowLevelILRegSsaPartial[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILRegSsaPartial(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property full_reg: SSARegister
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILRegister

LowLevelILRegStackAbsSsa

class LowLevelILRegStackAbsSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILRegStackAbsSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: ILRegister
property stack: SSARegisterStack

LowLevelILRegStackDestSsa

class LowLevelILRegStackDestSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILRegStackDestSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegisterStack
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: SSARegisterStack

LowLevelILRegStackFreeAbsSsa

class LowLevelILRegStackFreeAbsSsa[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackFreeAbsSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property stack: LowLevelILInstruction

LowLevelILRegStackFreeReg

class LowLevelILRegStackFreeReg[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackFreeReg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILRegStackFreeRel

class LowLevelILRegStackFreeRel[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackFreeRel(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property stack: ILRegisterStack

LowLevelILRegStackFreeRelSsa

class LowLevelILRegStackFreeRelSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILRegStackFreeRelSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property stack: LowLevelILInstruction
property top: LowLevelILInstruction

LowLevelILRegStackPhi

class LowLevelILRegStackPhi[source]

Bases: LowLevelILInstruction, RegisterStack, Phi

LowLevelILRegStackPhi(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegisterStack
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[SSARegisterStack]

LowLevelILRegStackPop

class LowLevelILRegStackPop[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackPop(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property stack: ILRegisterStack

LowLevelILRegStackPush

class LowLevelILRegStackPush[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackPush(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: ILRegisterStack

LowLevelILRegStackRel

class LowLevelILRegStackRel[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILRegStackRel(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: ILRegisterStack

LowLevelILRegStackRelSsa

class LowLevelILRegStackRelSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILRegStackRelSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: SSARegisterStack
property top: LowLevelILInstruction

LowLevelILRet

class LowLevelILRet[source]

Bases: LowLevelILInstruction, Return

LowLevelILRet(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILRlc

class LowLevelILRlc[source]

Bases: LowLevelILCarryBase

LowLevelILRlc(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILRol

class LowLevelILRol[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILRol(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILRor

class LowLevelILRor[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILRor(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILRoundToInt

class LowLevelILRoundToInt[source]

Bases: LowLevelILInstruction, FloatingPoint, Arithmetic

LowLevelILRoundToInt(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILRrc

class LowLevelILRrc[source]

Bases: LowLevelILCarryBase

LowLevelILRrc(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILSbb

class LowLevelILSbb[source]

Bases: LowLevelILCarryBase

LowLevelILSbb(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILSeparateParamListSsa

class LowLevelILSeparateParamListSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILSeparateParamListSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[LowLevelILInstruction]

LowLevelILSetFlag

class LowLevelILSetFlag[source]

Bases: LowLevelILInstruction

LowLevelILSetFlag(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILFlag
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILSetFlagSsa

class LowLevelILSetFlagSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILSetFlagSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSAFlag
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILSetReg

class LowLevelILSetReg[source]

Bases: LowLevelILInstruction, SetReg

LowLevelILSetReg(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILSetRegSplit

class LowLevelILSetRegSplit[source]

Bases: LowLevelILInstruction, SetReg

LowLevelILSetRegSplit(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
property hi: ILRegister
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property lo: ILRegister
property src: LowLevelILInstruction

LowLevelILSetRegSplitSsa

class LowLevelILSetRegSplitSsa[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILSetRegSplitSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
property hi: LowLevelILInstruction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property lo: LowLevelILInstruction
property src: LowLevelILInstruction

LowLevelILSetRegSsa

class LowLevelILSetRegSsa[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILSetRegSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: SSARegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILSetRegSsaPartial

class LowLevelILSetRegSsaPartial[source]

Bases: LowLevelILInstruction, SetReg, SSA

LowLevelILSetRegSsaPartial(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property full_reg: SSARegister
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILSetRegStackAbsSsa

class LowLevelILSetRegStackAbsSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILSetRegStackAbsSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: ILRegister
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: LowLevelILInstruction

LowLevelILSetRegStackRel

class LowLevelILSetRegStackRel[source]

Bases: LowLevelILInstruction, RegisterStack

LowLevelILSetRegStackRel(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: ILRegisterStack

LowLevelILSetRegStackRelSsa

class LowLevelILSetRegStackRelSsa[source]

Bases: LowLevelILInstruction, RegisterStack, SSA

LowLevelILSetRegStackRelSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property stack: LowLevelILInstruction
property top: LowLevelILInstruction

LowLevelILSharedParamSlotSsa

class LowLevelILSharedParamSlotSsa[source]

Bases: LowLevelILInstruction, SSA

LowLevelILSharedParamSlotSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: List[LowLevelILInstruction]

LowLevelILStore

class LowLevelILStore[source]

Bases: LowLevelILInstruction, Store

LowLevelILStore(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILStoreSsa

class LowLevelILStoreSsa[source]

Bases: LowLevelILInstruction, Store, SSA

LowLevelILStoreSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property dest_memory: int
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction
property src_memory: int

LowLevelILSub

class LowLevelILSub[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILSub(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILSx

class LowLevelILSx[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILSx(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILSyscall

class LowLevelILSyscall[source]

Bases: LowLevelILInstruction, Syscall

LowLevelILSyscall(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILSyscallSsa

class LowLevelILSyscallSsa[source]

Bases: LowLevelILInstruction, Syscall, SSA

LowLevelILSyscallSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property output: List[SSARegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property stack: LowLevelILCallStackSsa
property stack_memory: int
property stack_reg: SSARegister

LowLevelILTailcall

class LowLevelILTailcall[source]

Bases: LowLevelILInstruction, Tailcall

LowLevelILTailcall(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILTailcallSsa

class LowLevelILTailcallSsa[source]

Bases: LowLevelILInstruction, Tailcall, SSA, Terminal

LowLevelILTailcallSsa(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property dest: LowLevelILInstruction
property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property output: List[SSARegister]
property param: LowLevelILCallParam
property params: List[LowLevelILInstruction]
property stack: LowLevelILInstruction

LowLevelILTestBit

class LowLevelILTestBit[source]

Bases: LowLevelILBinaryBase, Arithmetic, FloatingPoint

LowLevelILTestBit(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILTrap

class LowLevelILTrap[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILTrap(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property vector: int

LowLevelILUnaryBase

class LowLevelILUnaryBase[source]

Bases: LowLevelILInstruction, UnaryOperation

LowLevelILUnaryBase(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILUndef

class LowLevelILUndef[source]

Bases: LowLevelILInstruction, Terminal

LowLevelILUndef(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILUnimpl

class LowLevelILUnimpl[source]

Bases: LowLevelILInstruction

LowLevelILUnimpl(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILUnimplMem

class LowLevelILUnimplMem[source]

Bases: LowLevelILInstruction, Memory

LowLevelILUnimplMem(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

property detailed_operands: List[Tuple[str, LowLevelILOperationAndSize | ILRegister | ILFlag | ILIntrinsic | ILRegisterStack | int | Dict[int, int] | float | LowLevelILInstruction | Dict[RegisterStackName, int] | SSAFlag | SSARegister | SSARegisterStack | ILSemanticFlagClass | ILSemanticFlagGroup | LowLevelILFlagCondition | List[int] | List[LowLevelILInstruction] | List[ILFlag | ILRegister] | List[SSARegister] | List[SSARegisterStack] | List[SSAFlag] | List[SSARegisterOrFlag] | None, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None
property src: LowLevelILInstruction

LowLevelILXor

class LowLevelILXor[source]

Bases: LowLevelILBinaryBase, Arithmetic

LowLevelILXor(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

LowLevelILZx

class LowLevelILZx[source]

Bases: LowLevelILUnaryBase, Arithmetic

LowLevelILZx(function: ‘LowLevelILFunction’, expr_index: <function NewType.<locals>.new_type at 0x112ace310>, instr: binaryninja.lowlevelil.CoreLowLevelILInstruction, instr_index: Optional[InstructionIndex])

__init__(function: LowLevelILFunction, expr_index: ExpressionIndex, instr: CoreLowLevelILInstruction, instr_index: InstructionIndex | None) → None
Parameters:
Return type:

None

expr_index: ExpressionIndex
function: LowLevelILFunction
instr: CoreLowLevelILInstruction
instr_index: InstructionIndex | None

SSAFlag

class SSAFlag[source]

Bases: object

SSAFlag(flag: binaryninja.lowlevelil.ILFlag, version: int)

__init__(flag: ILFlag, version: int) → None
Parameters:
Return type:

None

flag: ILFlag
version: int

SSARegister

class SSARegister[source]

Bases: object

SSARegister(reg: binaryninja.lowlevelil.ILRegister, version: int)

__init__(reg: ILRegister, version: int) → None
Parameters:
Return type:

None

reg: ILRegister
version: int

SSARegisterOrFlag

class SSARegisterOrFlag[source]

Bases: object

SSARegisterOrFlag(reg_or_flag: Union[binaryninja.lowlevelil.ILRegister, binaryninja.lowlevelil.ILFlag], version: int)

__init__(reg_or_flag: ILRegister | ILFlag, version: int) → None
Parameters:
Return type:

None

reg_or_flag: ILRegister | ILFlag
version: int

SSARegisterStack

class SSARegisterStack[source]

Bases: object

SSARegisterStack(reg_stack: binaryninja.lowlevelil.ILRegisterStack, version: int)

__init__(reg_stack: ILRegisterStack, version: int) → None
Parameters:
Return type:

None

reg_stack: ILRegisterStack
version: int