variable module

binaryninja.variable.AddressRange(start, end)

binaryninja.variable.ConstantData(value, ...)

binaryninja.variable.ConstantDataRegisterValue(...)

binaryninja.variable.ConstantPointerRegisterValue(...)

binaryninja.variable.ConstantReference(...)

binaryninja.variable.ConstantRegisterValue(...)

binaryninja.variable.CoreVariable(...)

class CoreVariable is the base class for other variable types, such as VariableNameAndType and Variable

binaryninja.variable.EntryRegisterValue(...)

binaryninja.variable.ExternalPointerRegisterValue(...)

binaryninja.variable.ImportedAddressRegisterValue(...)

binaryninja.variable.IndirectBranchInfo(...)

binaryninja.variable.LookupTableEntry(...)

binaryninja.variable.ParameterVariables(var_list)

Note

This object is a "passive" object. Any changes you make to it will not be reflected in the core and vice-versa. If you wish to update a core version of this object you should use the appropriate API.

binaryninja.variable.PossibleValueSet([...])

class PossibleValueSet PossibleValueSet is used to define possible values that a variable can take.

binaryninja.variable.RegisterValue(value, ...)

binaryninja.variable.ReturnAddressRegisterValue(...)

binaryninja.variable.StackFrameOffsetRegisterValue(...)

binaryninja.variable.StackVariableReference(...)

binaryninja.variable.Undetermined(value, ...)

binaryninja.variable.ValueRange(start, end, step)

binaryninja.variable.Variable(func, ...)

class Variable represents variables in Binary Ninja.

binaryninja.variable.VariableNameAndType(...)

class VariableNameAndType is a lightweight wrapper around a variable and its name, useful for shuttling between APIs that require them both.
class AddressRange(start: int, end: int)[source]

Bases: object

Parameters:

  • start (int) –

  • end (int) –

end: int
start: int
class ConstantData(value: int, offset: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.UndeterminedValue: 0>, confidence: int = 255, size: int = 0, function: '_function.Function' = None)[source]

Bases: RegisterValue

Parameters:
property data: DataBuffer
function: _function.Function = None
class ConstantDataRegisterValue(value: int, offset: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.UndeterminedValue: 0>, confidence: int = 255, size: int = 0)[source]

Bases: RegisterValue

Parameters:
offset: int
value: int
class ConstantPointerRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ConstantPointerValue: 3>, confidence: int = 255, size: int = 0)[source]

Bases: RegisterValue

Parameters:
offset: int = 0
type: RegisterValueType = 3
class ConstantReference(value: int, size: int, pointer: bool, intermediate: bool)[source]

Bases: object

Parameters:

  • value (int) –

  • size (int) –

  • pointer (bool) –

  • intermediate (bool) –

intermediate: bool
pointer: bool
size: int
value: int
class ConstantRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ConstantValue: 2>, confidence: int = 255, size: int = 0)[source]

Bases: RegisterValue

Parameters:
offset: int = 0
type: RegisterValueType = 2
class CoreVariable(_source_type: int, index: int, storage: int)[source]

Bases: object

class CoreVariable is the base class for other variable types, such as VariableNameAndType and Variable

Variables:

  • index – Internal identifier

  • storage – If this variable is a stack variable (source_type == VariableSourceType.StackVariableSourceType), then the storage location is the offset onto the stack that contains the first byte of this variable. Otherwise it’s used as an internal identifier.

Parameters:

  • _source_type (int) –

  • index (int) –

  • storage (int) –

classmethod from_BNVariable(var: BNVariable)[source]
Parameters:

var (BNVariable) –

classmethod from_identifier(identifier)[source]
to_BNVariable()[source]
property identifier: int

A UID for a variable within a function.

index: int
property source_type: VariableSourceType

Whether this variable was created based off of an underlying register, stack location, or flag.

storage: int
class EntryRegisterValue(value: int = 0, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.EntryValue: 1>, confidence: int = 255, size: int = 0, reg: Optional[ForwardRef('binaryninja.architecture.RegisterName')] = None)[source]

Bases: RegisterValue

Parameters:
offset: int = 0
reg: binaryninja.architecture.RegisterName | None = None
type: RegisterValueType = 1
value: int = 0
class ExternalPointerRegisterValue(value: int, offset: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ExternalPointerValue: 4>, confidence: int = 255, size: int = 0)[source]

Bases: RegisterValue

Parameters:
type: RegisterValueType = 4
class ImportedAddressRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ImportedAddressValue: 7>, confidence: int = 255, size: int = 0)[source]

Bases: RegisterValue

Parameters:
offset: int = 0
type: RegisterValueType = 7
class IndirectBranchInfo(source_arch: 'binaryninja.architecture.Architecture', source_addr: int, dest_arch: 'binaryninja.architecture.Architecture', dest_addr: int, auto_defined: bool)[source]

Bases: object

Parameters:
auto_defined: bool
dest_addr: int
dest_arch: Architecture
source_addr: int
source_arch: Architecture
class LookupTableEntry(from_values: List[int], to_value: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.LookupTableValue: 10>)[source]

Bases: object

Parameters:
from_values: List[int]
to_value: int
type: RegisterValueType = 10
class ParameterVariables(var_list: List[Variable], confidence: int = 255, func: Function | None = None)[source]

Bases: object

Note

This object is a “passive” object. Any changes you make to it will not be reflected in the core and vice-versa. If you wish to update a core version of this object you should use the appropriate API.

Parameters:
with_confidence(confidence: int) → ParameterVariables[source]
Parameters:

confidence (int) –

Return type:

ParameterVariables

property confidence: int
property function: Function | None
property vars: List[Variable]
class PossibleValueSet(arch=None, value=None)[source]

Bases: object

class PossibleValueSet PossibleValueSet is used to define possible values that a variable can take. It contains methods to instantiate different value sets such as Constant, Signed/Unsigned Ranges, etc.

Note

This object is a “passive” object. Any changes you make to it will not be reflected in the core and vice-versa. If you wish to update a core version of this object you should use the appropriate API.

static constant(value: int) → PossibleValueSet[source]

Create a constant valued PossibleValueSet object.

Parameters:

value (int) – Integer value of the constant

Return type:

PossibleValueSet

static constant_ptr(value: int) → PossibleValueSet[source]

Create constant pointer valued PossibleValueSet object.

Parameters:

value (int) – Integer value of the constant pointer

Return type:

PossibleValueSet

static in_set_of_values(values: List[int] | Set[int]) → PossibleValueSet[source]

Create a PossibleValueSet object for a value in a set of values.

Parameters:

values (list(int)) – List of integer values

Return type:

PossibleValueSet

static lookup_table_value(lookup_table, mapping) → PossibleValueSet[source]

Create a PossibleValueSet object for a value which is a member of a lookuptable.

Parameters:
Return type:

PossibleValueSet

static not_in_set_of_values(values) → PossibleValueSet[source]

Create a PossibleValueSet object for a value NOT in a set of values.

Parameters:

values (list(int)) – List of integer values

Return type:

PossibleValueSet

static signed_range_value(ranges: List[ValueRange]) → PossibleValueSet[source]

Create a PossibleValueSet object for a signed range of values.

Parameters:

ranges (list(ValueRange)) – List of ValueRanges

Return type:

PossibleValueSet

Example:
>>> v_1 = ValueRange(-5, -1, 1)
>>> v_2 = ValueRange(7, 10, 1)
>>> val = PossibleValueSet.signed_range_value([v_1, v_2])
<signed ranges: [<range: -0x5 to -0x1>, <range: 0x7 to 0xa>]>
static stack_frame_offset(offset: int) → PossibleValueSet[source]

Create a PossibleValueSet object for a stack frame offset.

Parameters:

offset (int) – Integer value of the offset

Return type:

PossibleValueSet

static undetermined() → PossibleValueSet[source]

Create a PossibleValueSet object of type UndeterminedValue.

Returns:

PossibleValueSet object of type UndeterminedValue

Return type:

PossibleValueSet

static unsigned_range_value(ranges: List[ValueRange]) → PossibleValueSet[source]

Create a PossibleValueSet object for a unsigned signed range of values.

Parameters:

ranges (list(ValueRange)) – List of ValueRanges

Return type:

PossibleValueSet

Example:
>>> v_1 = ValueRange(0, 5, 1)
>>> v_2 = ValueRange(7, 10, 1)
>>> val = PossibleValueSet.unsigned_range_value([v_1, v_2])
<unsigned ranges: [<range: 0x0 to 0x5>, <range: 0x7 to 0xa>]>
property count: int
property mapping: Dict[int, int]
property offset: int
property ranges: List[ValueRange]
property reg: RegisterName
property size: int
property table: List[LookupTableEntry]
property type: RegisterValueType
property value: int
property values: Set[int]
class RegisterValue(value: int, offset: int, type: binaryninja.enums.RegisterValueType = <RegisterValueType.UndeterminedValue: 0>, confidence: int = 255, size: int = 0)[source]

Bases: object

Parameters:
classmethod from_BNRegisterValue(reg_value: BNRegisterValue | BNRegisterValueWithConfidence, arch: Architecture | None = None) → RegisterValue[source]
Parameters:

  • reg_value (BNRegisterValue | BNRegisterValueWithConfidence) –

  • arch (Architecture | None) –

Return type:

RegisterValue

confidence: int = 255
offset: int
size: int = 0
type: RegisterValueType = 0
value: int
class ReturnAddressRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.ReturnAddressValue: 6>, confidence: int = 255, size: int = 0)[source]

Bases: RegisterValue

Parameters:
offset: int = 0
type: RegisterValueType = 6
class StackFrameOffsetRegisterValue(value: int, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.StackFrameOffset: 5>, confidence: int = 255, size: int = 0)[source]

Bases: RegisterValue

Parameters:
offset: int = 0
type: RegisterValueType = 5
class StackVariableReference(_source_operand: int | None, type: 'binaryninja.types.Type', name: str, var: 'Variable', referenced_offset: int, size: int)[source]

Bases: object

Parameters:

  • _source_operand (int | None) –

  • type (Type) –

  • name (str) –

  • var (Variable) –

  • referenced_offset (int) –

  • size (int) –

name: str
referenced_offset: int
size: int
property source_operand
type: Type
var: Variable
class Undetermined(value: int = 0, offset: int = 0, type: binaryninja.enums.RegisterValueType = <RegisterValueType.UndeterminedValue: 0>, confidence: int = 255, size: int = 0)[source]

Bases: RegisterValue

Parameters:
offset: int = 0
type: RegisterValueType = 0
value: int = 0
class ValueRange(start: int, end: int, step: int)[source]

Bases: object

Parameters:

  • start (int) –

  • end (int) –

  • step (int) –

end: int
start: int
step: int
class Variable(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, source_type: VariableSourceType, index: int, storage: int)[source]

Bases: CoreVariable

class Variable represents variables in Binary Ninja. Variables are resolved in medium level IL, so variables objects are only valid for MLIL and above.

Parameters:
classmethod from_BNVariable(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, var: BNVariable)[source]
Parameters:
classmethod from_core_variable(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, var: CoreVariable)[source]
Parameters:
classmethod from_identifier(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, identifier: int)[source]
Parameters:
classmethod from_variable_name_and_type(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, var: VariableNameAndType)[source]
Parameters:
set_name_and_type_async(name: str | None, new_type: Type) → None[source]

set_name_and_type_async provides a way to asynchronously set both the name and type of a variable. This method should be used when speed is of concern.

Parameters:

  • name (str | None) –

  • new_type (Type) –

Return type:

None

set_name_async(name: str | None) → None[source]

set_name_async provides a way to asynchronously set the name of a variable. This method should be used when speed is of concern.

Parameters:

name (str | None) –

Return type:

None

set_type_async(new_type: Type) → None[source]

set_type_async provides a way to asynchronously set the type of a variable. This method should be used when speed is of concern.

Parameters:

new_type (Type) –

Return type:

None

property core_variable: CoreVariable

Retrieve the underlying CoreVariable class

property dead_store_elimination: DeadStoreElimination

returns the dead store elimination setting for this variable

property function: Function

returns the source Function object which this variable belongs to

index: int
property is_parameter_variable: bool

returns whether this variable is a function parameter

property last_seen_name: str

Name of the variable, or the name most recently assigned if the variable has since been removed (read-only).

property name: str

Name of the variable, Settings thisslow because it ensures that analysis has been updated.

property offset_to_next_variable: int | None

returns number of bytes to the next variable on the stack

property ssa_versions: Generator[int, None, None]

Returns the SSA versions associated with this variable. Doesn’t return anything for aliased variables.

storage: int
property type: Type | None
property var_name_and_type: VariableNameAndType

Convert to VariableNameAndType

class VariableNameAndType(_source_type: int, index: int, storage: int, name: str, type: Type)[source]

Bases: CoreVariable

class VariableNameAndType is a lightweight wrapper around a variable and its name, useful for shuttling between APIs that require them both. While Variable has Variable.name and Variable.type fields, those require additional core calls each time you fetch them.

Variables:

  • name – The variable’s name

  • type – The variable’s type

Parameters:

  • _source_type (int) –

  • index (int) –

  • storage (int) –

  • name (str) –

  • type (Type) –

classmethod from_core_variable(var, name, type)[source]
classmethod from_identifier(identifier, name, type)[source]
name: str
type: Type