highlevelil module

binaryninja.highlevelil.CoreHighLevelILInstruction(...)

binaryninja.highlevelil.GotoLabel(function, id)

binaryninja.highlevelil.HighLevelILAdc(...)

binaryninja.highlevelil.HighLevelILAdd(...)

binaryninja.highlevelil.HighLevelILAddOverflow(...)

binaryninja.highlevelil.HighLevelILAddressOf(...)

binaryninja.highlevelil.HighLevelILAnd(...)

binaryninja.highlevelil.HighLevelILArrayIndex(...)

binaryninja.highlevelil.HighLevelILArrayIndexSsa(...)

binaryninja.highlevelil.HighLevelILAsr(...)

binaryninja.highlevelil.HighLevelILAssert(...)

binaryninja.highlevelil.HighLevelILAssertSsa(...)

binaryninja.highlevelil.HighLevelILAssign(...)

binaryninja.highlevelil.HighLevelILAssignMemSsa(...)

binaryninja.highlevelil.HighLevelILAssignUnpack(...)

binaryninja.highlevelil.HighLevelILAssignUnpackMemSsa(...)

binaryninja.highlevelil.HighLevelILBasicBlock(...)

The HighLevelILBasicBlock object is returned during analysis and should not be directly instantiated.

binaryninja.highlevelil.HighLevelILBinaryBase(...)

binaryninja.highlevelil.HighLevelILBlock(...)

binaryninja.highlevelil.HighLevelILBoolToInt(...)

binaryninja.highlevelil.HighLevelILBp(...)

binaryninja.highlevelil.HighLevelILBreak(...)

binaryninja.highlevelil.HighLevelILCall(...)

binaryninja.highlevelil.HighLevelILCallSsa(...)

binaryninja.highlevelil.HighLevelILCarryBase(...)

binaryninja.highlevelil.HighLevelILCase(...)

binaryninja.highlevelil.HighLevelILCeil(...)

binaryninja.highlevelil.HighLevelILCmpE(...)

binaryninja.highlevelil.HighLevelILCmpNe(...)

binaryninja.highlevelil.HighLevelILCmpSge(...)

binaryninja.highlevelil.HighLevelILCmpSgt(...)

binaryninja.highlevelil.HighLevelILCmpSle(...)

binaryninja.highlevelil.HighLevelILCmpSlt(...)

binaryninja.highlevelil.HighLevelILCmpUge(...)

binaryninja.highlevelil.HighLevelILCmpUgt(...)

binaryninja.highlevelil.HighLevelILCmpUle(...)

binaryninja.highlevelil.HighLevelILCmpUlt(...)

binaryninja.highlevelil.HighLevelILComparisonBase(...)

binaryninja.highlevelil.HighLevelILConst(...)

binaryninja.highlevelil.HighLevelILConstData(...)

binaryninja.highlevelil.HighLevelILConstPtr(...)

binaryninja.highlevelil.HighLevelILContinue(...)

binaryninja.highlevelil.HighLevelILDeref(...)

binaryninja.highlevelil.HighLevelILDerefField(...)

binaryninja.highlevelil.HighLevelILDerefFieldSsa(...)

binaryninja.highlevelil.HighLevelILDerefSsa(...)

binaryninja.highlevelil.HighLevelILDivs(...)

binaryninja.highlevelil.HighLevelILDivsDp(...)

binaryninja.highlevelil.HighLevelILDivu(...)

binaryninja.highlevelil.HighLevelILDivuDp(...)

binaryninja.highlevelil.HighLevelILDoWhile(...)

binaryninja.highlevelil.HighLevelILDoWhileSsa(...)

binaryninja.highlevelil.HighLevelILExternPtr(...)

binaryninja.highlevelil.HighLevelILFabs(...)

binaryninja.highlevelil.HighLevelILFadd(...)

binaryninja.highlevelil.HighLevelILFcmpE(...)

binaryninja.highlevelil.HighLevelILFcmpGe(...)

binaryninja.highlevelil.HighLevelILFcmpGt(...)

binaryninja.highlevelil.HighLevelILFcmpLe(...)

binaryninja.highlevelil.HighLevelILFcmpLt(...)

binaryninja.highlevelil.HighLevelILFcmpNe(...)

binaryninja.highlevelil.HighLevelILFcmpO(...)

binaryninja.highlevelil.HighLevelILFcmpUo(...)

binaryninja.highlevelil.HighLevelILFdiv(...)

binaryninja.highlevelil.HighLevelILFloatConst(...)

binaryninja.highlevelil.HighLevelILFloatConv(...)

binaryninja.highlevelil.HighLevelILFloatToInt(...)

binaryninja.highlevelil.HighLevelILFloor(...)

binaryninja.highlevelil.HighLevelILFmul(...)

binaryninja.highlevelil.HighLevelILFneg(...)

binaryninja.highlevelil.HighLevelILFor(...)

binaryninja.highlevelil.HighLevelILForSsa(...)

binaryninja.highlevelil.HighLevelILForceVer(...)

binaryninja.highlevelil.HighLevelILForceVerSsa(...)

binaryninja.highlevelil.HighLevelILFsqrt(...)

binaryninja.highlevelil.HighLevelILFsub(...)

binaryninja.highlevelil.HighLevelILFtrunc(...)

binaryninja.highlevelil.HighLevelILFunction([...])

class HighLevelILFunction contains the a HighLevelILInstruction object that makes up the abstract syntax tree of a function.

binaryninja.highlevelil.HighLevelILGoto(...)

binaryninja.highlevelil.HighLevelILIf(...)

binaryninja.highlevelil.HighLevelILImport(...)

binaryninja.highlevelil.HighLevelILInstruction(...)

class HighLevelILInstruction High Level Intermediate Language Instructions form an abstract syntax tree of the code.

binaryninja.highlevelil.HighLevelILIntToFloat(...)

binaryninja.highlevelil.HighLevelILIntrinsic(...)

binaryninja.highlevelil.HighLevelILIntrinsicSsa(...)

binaryninja.highlevelil.HighLevelILJump(...)

binaryninja.highlevelil.HighLevelILLabel(...)

binaryninja.highlevelil.HighLevelILLowPart(...)

binaryninja.highlevelil.HighLevelILLsl(...)

binaryninja.highlevelil.HighLevelILLsr(...)

binaryninja.highlevelil.HighLevelILMemPhi(...)

binaryninja.highlevelil.HighLevelILMods(...)

binaryninja.highlevelil.HighLevelILModsDp(...)

binaryninja.highlevelil.HighLevelILModu(...)

binaryninja.highlevelil.HighLevelILModuDp(...)

binaryninja.highlevelil.HighLevelILMul(...)

binaryninja.highlevelil.HighLevelILMulsDp(...)

binaryninja.highlevelil.HighLevelILMuluDp(...)

binaryninja.highlevelil.HighLevelILNeg(...)

binaryninja.highlevelil.HighLevelILNop(...)

binaryninja.highlevelil.HighLevelILNoret(...)

binaryninja.highlevelil.HighLevelILNot(...)

binaryninja.highlevelil.HighLevelILOperationAndSize(...)

binaryninja.highlevelil.HighLevelILOr(...)

binaryninja.highlevelil.HighLevelILRet(...)

binaryninja.highlevelil.HighLevelILRlc(...)

binaryninja.highlevelil.HighLevelILRol(...)

binaryninja.highlevelil.HighLevelILRor(...)

binaryninja.highlevelil.HighLevelILRoundToInt(...)

binaryninja.highlevelil.HighLevelILRrc(...)

binaryninja.highlevelil.HighLevelILSbb(...)

binaryninja.highlevelil.HighLevelILSplit(...)

binaryninja.highlevelil.HighLevelILStructField(...)

binaryninja.highlevelil.HighLevelILSub(...)

binaryninja.highlevelil.HighLevelILSwitch(...)

binaryninja.highlevelil.HighLevelILSx(...)

binaryninja.highlevelil.HighLevelILSyscall(...)

binaryninja.highlevelil.HighLevelILSyscallSsa(...)

binaryninja.highlevelil.HighLevelILTailcall(...)

binaryninja.highlevelil.HighLevelILTestBit(...)

binaryninja.highlevelil.HighLevelILTrap(...)

binaryninja.highlevelil.HighLevelILUnaryBase(...)

binaryninja.highlevelil.HighLevelILUndef(...)

binaryninja.highlevelil.HighLevelILUnimpl(...)

binaryninja.highlevelil.HighLevelILUnimplMem(...)

binaryninja.highlevelil.HighLevelILUnreachable(...)

binaryninja.highlevelil.HighLevelILVar(...)

binaryninja.highlevelil.HighLevelILVarDeclare(...)

binaryninja.highlevelil.HighLevelILVarInit(...)

binaryninja.highlevelil.HighLevelILVarInitSsa(...)

binaryninja.highlevelil.HighLevelILVarPhi(...)

binaryninja.highlevelil.HighLevelILVarSsa(...)

binaryninja.highlevelil.HighLevelILWhile(...)

binaryninja.highlevelil.HighLevelILWhileSsa(...)

binaryninja.highlevelil.HighLevelILXor(...)

binaryninja.highlevelil.HighLevelILZx(...)

class CoreHighLevelILInstruction(operation: HighLevelILOperation, attributes: int, source_operand: int, size: int, operands: Tuple[binaryninja.highlevelil.ExpressionIndex, binaryninja.highlevelil.ExpressionIndex, binaryninja.highlevelil.ExpressionIndex, binaryninja.highlevelil.ExpressionIndex, binaryninja.highlevelil.ExpressionIndex], address: int, parent: binaryninja.highlevelil.ExpressionIndex)[source]

Bases: object

Parameters:

  • operation (HighLevelILOperation) –

  • attributes (int) –

  • source_operand (int) –

  • size (int) –

  • operands (Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]) –

  • address (int) –

  • parent (ExpressionIndex) –

classmethod from_BNHighLevelILInstruction(instr: BNHighLevelILInstruction) → CoreHighLevelILInstruction[source]
Parameters:

instr (BNHighLevelILInstruction) –

Return type:

CoreHighLevelILInstruction

address: int
attributes: int
operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]
operation: HighLevelILOperation
parent: ExpressionIndex
size: int
source_operand: int
class GotoLabel(function: 'HighLevelILFunction', id: int)[source]

Bases: object

Parameters:
property definition: HighLevelILInstruction | None
function: HighLevelILFunction
id: int
property label_id: int
property name: str
property uses: List[HighLevelILInstruction]
class HighLevelILAdc(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILCarryBase

Parameters:
class HighLevelILAdd(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILAddOverflow(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILAddressOf(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase

Parameters:
property vars_address_taken: List[SSAVariable | Variable]

Non-unique list of variables whose address is taken by instruction

Note

This property has some nuance to it, so use carefully. This property will return only those variable which directly have their address taken such as &var_4 or &var_8.d but not those which are involved in an address calculation such as &(var_4 + 0) or &var_4[0] even though they may be functionally equivalent.

class HighLevelILAnd(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILArrayIndex(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property index: HighLevelILInstruction
property src: HighLevelILInstruction
class HighLevelILArrayIndexSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSA

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property index: HighLevelILInstruction
property src: HighLevelILInstruction
property src_memory: int
class HighLevelILAsr(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILAssert(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property constraint: PossibleValueSet
property src: Variable
class HighLevelILAssertSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSA

Parameters:
property constraint: PossibleValueSet
property src: SSAVariable
class HighLevelILAssign(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SetVar

Parameters:
property dest: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: HighLevelILInstruction
property vars_written: List[SSAVariable | Variable]

List of variables value is written by this instruction

class HighLevelILAssignMemSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSA

Parameters:
property dest: HighLevelILInstruction
property dest_memory: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: HighLevelILInstruction
property src_memory: int
class HighLevelILAssignUnpack(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SetVar

Parameters:
property dest: List[HighLevelILInstruction]
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: HighLevelILInstruction
property vars_written: List[SSAVariable | Variable]

List of variables value is written by this instruction

class HighLevelILAssignUnpackMemSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSA, Memory

Parameters:
property dest: List[HighLevelILInstruction]
property dest_memory: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: HighLevelILInstruction
property src_memory: int
class HighLevelILBasicBlock(handle: LP_BNBasicBlock, owner: HighLevelILFunction, view: BinaryView | None)[source]

Bases: BasicBlock

The HighLevelILBasicBlock object is returned during analysis and should not be directly instantiated.

Parameters:
property il_function: HighLevelILFunction

IL Function of which this block is a part, if the block is part of an IL Function.

property instruction_count: int
class HighLevelILBinaryBase(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, BinaryOperation

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property left: HighLevelILInstruction
property right: HighLevelILInstruction
class HighLevelILBlock(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property body: List[HighLevelILInstruction]
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILBoolToInt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase

Parameters:
class HighLevelILBp(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Terminal

Parameters:
class HighLevelILBreak(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Terminal

Parameters:
class HighLevelILCall(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Localcall

Parameters:
property dest: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property params: List[HighLevelILInstruction]
class HighLevelILCallSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Localcall, SSA

Parameters:
property dest: HighLevelILInstruction
property dest_memory: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property params: List[HighLevelILInstruction]
property src_memory: int
class HighLevelILCarryBase(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Arithmetic

Parameters:
property carry: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property left: HighLevelILInstruction
property right: HighLevelILInstruction
class HighLevelILCase(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property body: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property values: List[HighLevelILInstruction]
class HighLevelILCeil(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILCmpE(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase

Parameters:
class HighLevelILCmpNe(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase

Parameters:
class HighLevelILCmpSge(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, Signed

Parameters:
class HighLevelILCmpSgt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, Signed

Parameters:
class HighLevelILCmpSle(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, Signed

Parameters:
class HighLevelILCmpSlt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, Signed

Parameters:
class HighLevelILCmpUge(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase

Parameters:
class HighLevelILCmpUgt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase

Parameters:
class HighLevelILCmpUle(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase

Parameters:
class HighLevelILCmpUlt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase

Parameters:
class HighLevelILComparisonBase(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Comparison

Parameters:
class HighLevelILConst(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Constant

Parameters:
property constant: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILConstData(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Constant

Parameters:
property constant_data: ConstantData
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILConstPtr(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Constant

Parameters:
property constant: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property string: Tuple[str, StringType] | None
class HighLevelILContinue(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, ControlFlow

Parameters:
class HighLevelILDeref(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase

Parameters:
class HighLevelILDerefField(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property member_index: int | None
property offset: int
property src: HighLevelILInstruction
class HighLevelILDerefFieldSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSA

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property member_index: int | None
property offset: int
property src: HighLevelILInstruction
property src_memory: int
class HighLevelILDerefSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSA

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: HighLevelILInstruction
property src_memory: int
class HighLevelILDivs(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Signed

Parameters:
class HighLevelILDivsDp(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Signed, DoublePrecision

Parameters:
class HighLevelILDivu(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILDivuDp(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, DoublePrecision

Parameters:
class HighLevelILDoWhile(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Loop

Parameters:
property body: HighLevelILInstruction
property condition: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILDoWhileSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Loop, SSA

Parameters:
property body: HighLevelILInstruction
property condition: HighLevelILInstruction
property condition_phi: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILExternPtr(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Constant

Parameters:
property constant: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property offset: int
class HighLevelILFabs(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILFadd(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, FloatingPoint

Parameters:
class HighLevelILFcmpE(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, FloatingPoint

Parameters:
class HighLevelILFcmpGe(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, FloatingPoint

Parameters:
class HighLevelILFcmpGt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, FloatingPoint

Parameters:
class HighLevelILFcmpLe(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, FloatingPoint

Parameters:
class HighLevelILFcmpLt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, FloatingPoint

Parameters:
class HighLevelILFcmpNe(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, FloatingPoint

Parameters:
class HighLevelILFcmpO(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, FloatingPoint

Parameters:
class HighLevelILFcmpUo(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase, FloatingPoint

Parameters:
class HighLevelILFdiv(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, FloatingPoint

Parameters:
class HighLevelILFloatConst(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Constant

Parameters:
property constant: float
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILFloatConv(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILFloatToInt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILFloor(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILFmul(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, FloatingPoint

Parameters:
class HighLevelILFneg(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILFor(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Loop

Parameters:
property body: HighLevelILInstruction
property condition: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property init: HighLevelILInstruction
property update: HighLevelILInstruction
class HighLevelILForSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Loop, SSA

Parameters:
property body: HighLevelILInstruction
property condition: HighLevelILInstruction
property condition_phi: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property init: HighLevelILInstruction
property update: HighLevelILInstruction
class HighLevelILForceVer(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property dest: Variable
property src: Variable
class HighLevelILForceVerSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSA

Parameters:
property dest: SSAVariable
property src: SSAVariable
class HighLevelILFsqrt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILFsub(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, FloatingPoint

Parameters:
class HighLevelILFtrunc(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILFunction(arch: Architecture | None = None, handle: BNHighLevelILFunction | None = None, source_func: Function | None = None)[source]

Bases: object

class HighLevelILFunction contains the a HighLevelILInstruction object that makes up the abstract syntax tree of a function.

Parameters:

  • arch (Architecture | None) –

  • handle (BNHighLevelILFunction | None) –

  • source_func (Function | None) –

add(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

add adds expression a to expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression add.<size>(a, b)

Return type:

ExpressionIndex

add_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

add_carry adds expression a to expression b with carry from carry returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carried value expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression adc.<size>(a, b, carry)

Return type:

ExpressionIndex

add_operand_list(operands: List[int]) → ExpressionIndex[source]

add_operand_list returns an operand list expression for the given list of integer operands.

Parameters:

operands (list(int)) – list of operand numbers

Returns:

an operand list expression

Return type:

ExpressionIndex

address_of(src: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

address_of takes the address of src

Parameters:

  • src (ExpressionIndex) – the expression having its address taken

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression &src

Return type:

ExpressionIndex

and_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

and_expr bitwise and’s expression a and expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression and.<size>(a, b)

Return type:

ExpressionIndex

arith_shift_right(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

arith_shift_right arithmetically right shifts expression a by expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression asr.<size>(a, b)

Return type:

ExpressionIndex

array_index(size: int, src: ExpressionIndex, idx: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

array_index references an item at index idx in the array in src of size size

Parameters:

  • size (int) – size of the item in the array

  • src (ExpressionIndex) – expression for the array

  • idx (ExpressionIndex) – expression for the index into the array

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression src[idx].size

Return type:

ExpressionIndex

assign(size: int, dest: ExpressionIndex, src: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

assign assign expression src to expression dest

Parameters:

  • size (int) – size of the expression

  • dest (ExpressionIndex) – expression being assigned

  • src (ExpressionIndex) – value being assigned to the expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression dest = src

Return type:

ExpressionIndex

assign_unpack(size: int, output: List[ExpressionIndex], src: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

assign_unpack assign expression src to a list of expressions in output of size size

Parameters:

  • size (int) – size of the expression

  • output (List[ExpressionIndex]) – expressions being assigned

  • src (ExpressionIndex) – value being assigned to the expressions

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression output... = src

Return type:

ExpressionIndex

block(exprs: List[ExpressionIndex], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

block a block expression containing multiple child expressions

Parameters:

  • exprs (List[ExpressionIndex]) – child expressions in the block

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression `` { exprs… } ``

Return type:

ExpressionIndex

bool_to_int(size: int, a: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

bool_to_int returns an expression of size size converting the boolean expression a to an integer

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – boolean expression to be converted

  • loc (ILSourceLocation) – location of returned expression

Returns:

the converted integer expression.

Return type:

ExpressionIndex

break_expr(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

break break out of a loop or switch statement

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

The expression break

Return type:

ExpressionIndex

breakpoint(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

breakpoint returns a processor breakpoint expression.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

a breakpoint expression.

Return type:

ExpressionIndex

call(dest: ExpressionIndex, params: List[ExpressionIndex], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

call returns an expression which calls the function in the expression dest with the parameters defined in params

Parameters:

  • dest (ExpressionIndex) – the expression to call

  • params (List[ExpressionIndex]) – parameter variables

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression call(dest, params...)

Return type:

ExpressionIndex

case(values: List[ExpressionIndex], expr: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

case a switch case for values values with body expr

Parameters:

  • values (List[ExpressionIndex]) – matched values for the case

  • expr (ExpressionIndex) – body of switch case

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression case values...: { expr }

Return type:

ExpressionIndex

ceil(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

ceil rounds a floating point value to an integer towards positive infinity

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round up

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>(value)

Return type:

ExpressionIndex

compare_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_equal returns comparison expression of size size checking if expression a is equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_not_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_not_equal returns comparison expression of size size checking if expression a is not equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_greater_equal returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_greater_than returns comparison expression of size size checking if expression a is signed greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_less_equal returns comparison expression of size size checking if expression a is signed less than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_signed_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_signed_less_than returns comparison expression of size size checking if expression a is signed less than expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_greater_equal returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_greater_than returns comparison expression of size size checking if expression a is unsigned greater than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_less_equal returns comparison expression of size size checking if expression a is unsigned less than or equal to expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

compare_unsigned_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

compare_unsigned_less_than returns comparison expression of size size checking if expression a is unsigned less than expression b

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – LHS of comparison

  • b (ExpressionIndex) – RHS of comparison

  • loc (ILSourceLocation) – location of returned expression

Returns:

a comparison expression.

Return type:

ExpressionIndex

const(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

const returns an expression for the constant integer value of size size

Parameters:

  • size (int) – the size of the constant in bytes

  • value (int) – integer value of the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

const_data(size: int, data: ConstantData, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

const_data returns an expression for the constant data data

Parameters:
Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

const_pointer(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

const_pointer returns an expression for the constant pointer value of size size

Parameters:

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by the pointer

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

continue_expr(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

continue continue to the top of a loop statement

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

The expression continue

Return type:

ExpressionIndex

copy_expr(original: HighLevelILInstruction) → ExpressionIndex[source]

copy_expr adds an expression to the function which is equivalent to the given expression

Parameters:

original (HighLevelILInstruction) – the original IL Instruction you want to copy

Returns:

The index of the newly copied expression

Return type:

ExpressionIndex

create_graph(settings: DisassemblySettings | None = None) → CoreFlowGraph[source]
Parameters:

settings (DisassemblySettings | None) –

Return type:

CoreFlowGraph

deref(size: int, src: ExpressionIndex, loc: ILSourceLocation | None) → ExpressionIndex[source]

deref dereferences expression src and reads a value of size size

Parameters:

  • size (int) – size of the read

  • src (ExpressionIndex) – expression being read

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression (*src).size

Return type:

ExpressionIndex

deref_field(size: int, src: ExpressionIndex, offset: int, member_index: int, loc: ILSourceLocation | None) → ExpressionIndex[source]

deref_field dereferences structure field in expression src at offset offset and index member_index of size size

Parameters:

  • size (int) – size of the read

  • src (ExpressionIndex) – expression of structure being read

  • offset (int) – offset of field in the structure

  • member_index (int) – index of field in the structure

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression src->offset.size

Return type:

ExpressionIndex

div_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_double_prec_signed signed divides double precision expression a by expression b and returns an expression. The first operand is of size 2*size bytes and the other operand and return value are of size size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divs.dp.<size>(a, b)

Return type:

ExpressionIndex

div_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_double_prec_unsigned unsigned divides double precision expression a by expression b and returns an expression. The first operand is of size 2*size bytes and the other operand and return value are of size size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divu.dp.<size>(a, b)

Return type:

ExpressionIndex

div_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_signed signed divides expression a by expression b and returns an expression. Both the operands and return value are size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divs.<size>(a, b)

Return type:

ExpressionIndex

div_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

div_unsigned unsigned divides expression a by expression b and returns an expression. Both the operands and return value are size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression divu.<size>(a, b)

Return type:

ExpressionIndex

do_while_expr(condition: ExpressionIndex, loop_expr: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

do_while_expr a do-while-loop expression with a condition and loop body.

Parameters:

  • condition (ExpressionIndex) – expression for the loop condition

  • loop_expr (ExpressionIndex) – expression for the loop body

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression do { loop_expr } while (condition)

Return type:

ExpressionIndex

expr(operation: str | HighLevelILOperation, a: int = 0, b: int = 0, c: int = 0, d: int = 0, e: int = 0, size: int = 0, source_location: ILSourceLocation | None = None) → ExpressionIndex[source]
Parameters:
Return type:

ExpressionIndex

extern_pointer(size: int, value: int, offset: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

extern_pointer returns an expression for the external pointer value at offset offset of size size

Parameters:

  • size (int) – the size of the pointer in bytes

  • value (int) – address referenced by the pointer

  • offset (int) – offset applied to the address

  • loc (ILSourceLocation | None) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

finalize() → None[source]

finalize ends the function and computes the list of basic blocks.

Return type:

None

float_abs(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_abs returns absolute value of floating point expression value of size size

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to get the absolute value of

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fabs.<size>(value)

Return type:

ExpressionIndex

float_add(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_add adds floating point expression a to expression b and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fadd.<size>(a, b)

Return type:

ExpressionIndex

float_compare_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_equal returns floating point comparison expression of size size checking if expression a is equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f== b

Return type:

ExpressionIndex

float_compare_greater_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_greater_equal returns floating point comparison expression of size size checking if expression a is greater than or equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f>= b

Return type:

ExpressionIndex

float_compare_greater_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_greater_than returns floating point comparison expression of size size checking if expression a is greater than expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f> b

Return type:

ExpressionIndex

float_compare_less_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_less_equal returns floating point comparison expression of size size checking if expression a is less than or equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f<= b

Return type:

ExpressionIndex

float_compare_less_than(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_less_than returns floating point comparison expression of size size checking if expression a is less than expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f< b

Return type:

ExpressionIndex

float_compare_not_equal(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_not_equal returns floating point comparison expression of size size checking if expression a is not equal to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression a f!= b

Return type:

ExpressionIndex

float_compare_ordered(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_ordered returns floating point comparison expression of size size checking if expression a is ordered relative to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression is_ordered(a, b)

Return type:

ExpressionIndex

float_compare_unordered(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_compare_unordered returns floating point comparison expression of size size checking if expression a is unordered relative to expression b

Parameters:

  • size (int) – the size of the operands in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression is_unordered(a, b)

Return type:

ExpressionIndex

float_const_double(value: float, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_double returns an expression for the double precision floating point value value

Parameters:

  • value (float) – float value for the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_const_raw(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_raw returns an expression for the constant raw binary floating point value value with size size

Parameters:

  • size (int) – the size of the constant in bytes

  • value (int) – integer value for the raw binary representation of the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_const_single(value: float, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_const_single returns an expression for the single precision floating point value value

Parameters:

  • value (float) – float value for the constant

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

float_convert(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

int_to_float converts floating point value of expression value to size size

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fconvert.<size>(value)

Return type:

ExpressionIndex

float_div(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_div divides floating point expression a by expression b and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fdiv.<size>(a, b)

Return type:

ExpressionIndex

float_mult(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_mult multiplies floating point expression a by expression b and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fmul.<size>(a, b)

Return type:

ExpressionIndex

float_neg(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_neg returns sign negation of floating point expression value of size size

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fneg.<size>(value)

Return type:

ExpressionIndex

float_sqrt(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_sqrt returns square root of floating point expression value of size size

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to calculate the square root of

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sqrt.<size>(value)

Return type:

ExpressionIndex

float_sub(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_sub subtracts floating point expression b from expression a and returning an expression of size bytes.

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression fsub.<size>(a, b)

Return type:

ExpressionIndex

float_to_int(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_to_int returns integer value of floating point expression value of size size

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to convert to an int

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression int.<size>(value)

Return type:

ExpressionIndex

float_trunc(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

float_trunc rounds a floating point value to an integer towards zero

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to truncate

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>(value)

Return type:

ExpressionIndex

floor(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

floor rounds a floating point value to an integer towards negative infinity

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round down

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>(value)

Return type:

ExpressionIndex

for_expr(init_expr: ExpressionIndex, condition: ExpressionIndex, update_expr: ExpressionIndex, loop_expr: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

for-expr a for-loop expression with an initializer, condition, updater, and loop body.

Parameters:

  • init_expr (ExpressionIndex) – expression for the loop initializer

  • condition (ExpressionIndex) – expression for the loop condition

  • update_expr (ExpressionIndex) – expression for the loop updater

  • loop_expr (ExpressionIndex) – expression for the loop body

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression for (init_expr ; condition ; update_expr) { loop_expr }

Return type:

ExpressionIndex

generate_ssa_form(variables: List[Variable] | None = None) → None[source]

generate_ssa_form generate SSA form given the current HLIL

Parameters:

variables (list(Variable)) – optional list of aliased variables

Return type:

None

get_basic_block_at(index: int) → BasicBlock | None[source]

get_basic_block_at returns the BasicBlock at the given HLIL instruction index.

Parameters:

index (int) – Index of the HLIL instruction of the BasicBlock to retrieve.

Example:
>>> current_il_function.get_basic_block_at(current_il_index)
<llil block: x86@19-26>
Return type:

BasicBlock | None

get_expr(index: ExpressionIndex, as_ast: bool = True) → HighLevelILInstruction | None[source]

get_expr retrieves the IL expression at a given expression index in the function.

Warning

Not all IL expressions are valid, even if their index is within the bounds of the function, they might not be used by the function and might not contain properly structured data.

Parameters:

  • index (ExpressionIndex) – Index of desired expression in function

  • as_ast (bool) – Whether to return the expression as a full AST or a single instruction (defaults to AST)

Returns:

A HighLevelILInstruction object for the expression, if it exists. Otherwise, None

Return type:

HighLevelILInstruction | None

get_expr_count() → int[source]

get_expr_count gives a the total number of expressions in this IL function

You can use this to enumerate all expressions in conjunction with get_expr

Warning

Not all IL expressions are valid, even if their index is within the bounds of the function, they might not be used by the function and might not contain properly structured data.

Returns:

The number of expressions in the function

Return type:

int

get_expr_type(expr_index: int) → Type | None[source]

Get type of expression

Parameters:

expr_index (int) – index of the expression to retrieve

Return type:

Optional[’types.Type’]

get_label(label_idx: int) → HighLevelILInstruction | None[source]
Parameters:

label_idx (int) –

Return type:

HighLevelILInstruction | None

get_label_uses(label_idx: int) → List[HighLevelILInstruction][source]
Parameters:

label_idx (int) –

Return type:

List[HighLevelILInstruction]

get_medium_level_il_expr_index(expr: ExpressionIndex) → ExpressionIndex | None[source]
Parameters:

expr (ExpressionIndex) –

Return type:

ExpressionIndex | None

get_medium_level_il_expr_indexes(expr: ExpressionIndex) → List[ExpressionIndex][source]
Parameters:

expr (ExpressionIndex) –

Return type:

List[ExpressionIndex]

get_non_ssa_instruction_index(instr: int) → int[source]
Parameters:

instr (int) –

Return type:

int

get_ssa_instruction_index(instr: int) → int[source]
Parameters:

instr (int) –

Return type:

int

get_ssa_memory_definition(version: int) → HighLevelILInstruction | None[source]
Parameters:

version (int) –

Return type:

HighLevelILInstruction | None

get_ssa_memory_uses(version: int) → List[HighLevelILInstruction][source]
Parameters:

version (int) –

Return type:

List[HighLevelILInstruction]

get_ssa_var_definition(ssa_var: SSAVariable | HighLevelILVarSsa) → HighLevelILInstruction | None[source]

Gets the instruction that contains the given SSA variable’s definition.

Since SSA variables can only be defined once, this will return the single instruction where that occurs. For SSA variable version 0s, which don’t have definitions, this will return None instead.

Parameters:

ssa_var (SSAVariable | HighLevelILVarSsa) –

Return type:

HighLevelILInstruction | None

get_ssa_var_uses(ssa_var: SSAVariable | HighLevelILVarSsa) → List[HighLevelILInstruction][source]

Gets all the instructions that use the given SSA variable.

Parameters:

ssa_var (SSAVariable | HighLevelILVarSsa) –

Return type:

List[HighLevelILInstruction]

get_var_definitions(var: Variable) → List[HighLevelILInstruction][source]
Parameters:

var (Variable) –

Return type:

List[HighLevelILInstruction]

get_var_uses(var: Variable) → List[HighLevelILInstruction][source]
Parameters:

var (Variable) –

Return type:

List[HighLevelILInstruction]

goto(target: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

goto unconditionally branch to a label

Parameters:

  • target (int) – target of the goto

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression goto(target)

Return type:

ExpressionIndex

if_expr(condition: ExpressionIndex, true_expr: ExpressionIndex, false_expr: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

if_expr an if-statement expression with a condition and true/false branches. An else statement is included if the false_expr is not a NOP expression

Parameters:

  • condition (ExpressionIndex) – expression for the condition to test

  • true_expr (ExpressionIndex) – expression for the true branch

  • false_expr (ExpressionIndex) – expression for the false branch

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression if (condition) { true_expr } else { false_expr }

Return type:

ExpressionIndex

imported_address(size: int, value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

imported_address returns an expression for an imported value with address value and size size

Parameters:

  • size (int) – size of the imported value

  • value (int) – address of the imported value

  • loc (ILSourceLocation) – location of returned expression

Returns:

A constant expression of given value and size

Return type:

ExpressionIndex

int_to_float(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

int_to_float returns floating point value of integer expression value of size size

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to convert to a float

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression float.<size>(value)

Return type:

ExpressionIndex

intrinsic(intrinsic: IntrinsicName | ILIntrinsic | IntrinsicIndex, params: List[ExpressionIndex], loc: ILSourceLocation | None = None)[source]

intrinsic return an intrinsic expression.

Parameters:

  • intrinsic (IntrinsicType) – which intrinsic to call

  • params (List[ExpressionIndex]) – parameters to intrinsic

  • loc (ILSourceLocation) – location of returned expression

Returns:

an intrinsic expression.

Return type:

ExpressionIndex

is_ssa_var_live(ssa_var: SSAVariable) → bool[source]

is_ssa_var_live determines if ssa_var is live at any point in the function

Parameters:

ssa_var (SSAVariable) – the SSA variable to query

Returns:

whether the variable is live at any point in the function

Return type:

bool

is_ssa_var_live_at(ssa_var: SSAVariable, instr: InstructionIndex) → bool[source]

is_ssa_var_live_at determines if ssa_var is live at a given point in the function; counts phi’s as uses

Parameters:

  • ssa_var (SSAVariable) –

  • instr (InstructionIndex) –

Return type:

bool

is_var_live_at(var: Variable, instr: InstructionIndex) → bool[source]

is_var_live_at determines if var is live at a given point in the function

Parameters:

  • var (Variable) –

  • instr (InstructionIndex) –

Return type:

bool

jump(dest: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

jump unconditionally branch to an expression by value

Parameters:

  • dest (ExpressionIndex) – target of the jump

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression jump(dest)

Return type:

ExpressionIndex

label(target: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

label create a label expression at a target

Parameters:

  • target (int) – target of the label

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression target:

Return type:

ExpressionIndex

logical_shift_right(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

logical_shift_right logically right shifts expression a by expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression lsr.<size>(a, b)

Return type:

ExpressionIndex

low_part(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

low_part truncates the expression in value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to zero extend

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression (value).<size>

Return type:

ExpressionIndex

mod_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_double_prec_signed signed modulus double precision expression a by expression b and returns an expression. The first operand is of size 2*size bytes and the other operand and return value are of size size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mods.dp.<size>(a, b)

Return type:

ExpressionIndex

mod_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_double_prec_unsigned unsigned modulus double precision expression a by expression b and returns an expression. The first operand is of size 2*size bytes and the other operand and return value are of size size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression modu.dp.<size>(a, b)

Return type:

ExpressionIndex

mod_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_signed signed modulus expression a by expression b and returns an expression. Both the operands and return value are size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mods.<size>(a, b)

Return type:

ExpressionIndex

mod_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mod_unsigned unsigned modulus expression a by expression b and returns an expression. Both the operands and return value are size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression modu.<size>(a, b)

Return type:

ExpressionIndex

mult(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult multiplies expression a by expression b and returns an expression. Both the operands and return value are size bytes as the product’s upper half is discarded.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mult.<size>(a, b)

Return type:

ExpressionIndex

mult_double_prec_signed(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult_double_prec_signed signed multiplies expression a by expression b and returns an expression. Both the operands are size bytes and the returned expression is of size 2*size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression muls.dp.<2*size>(a, b)

Return type:

ExpressionIndex

mult_double_prec_unsigned(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

mult_double_prec_unsigned unsigned multiplies expression a by expression b and returnisan expression. Both the operands are size bytes and the returned expression is of size 2*size bytes.

Parameters:

  • size (int) – the size of the result and input operands, in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression mulu.dp.<2*size>(a, b)

Return type:

ExpressionIndex

neg_expr(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

neg_expr two’s complement sign negation of expression value of size size

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to negate

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression neg.<size>(value)

Return type:

ExpressionIndex

no_ret(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

no_ret returns an expression that halts execution

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

The expression noreturn

Return type:

ExpressionIndex

nop(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

nop no operation, this instruction does nothing

Parameters:

loc (ILSourceLocation) – Location of expression

Returns:

The no operation expression

Return type:

ExpressionIndex

not_expr(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

not_expr bitwise inversion of expression value of size size

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to bitwise invert

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression not.<size>(value)

Return type:

ExpressionIndex

or_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

or_expr bitwise or’s expression a and expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression or.<size>(a, b)

Return type:

ExpressionIndex

replace_expr(original: HighLevelILInstruction | ExpressionIndex | InstructionIndex, new: HighLevelILInstruction | ExpressionIndex | InstructionIndex) → None[source]

replace_expr allows modification of HLIL expressions

Parameters:

  • original (ExpressionIndex) – the ExpressionIndex to replace (may also be an expression index)

  • new (ExpressionIndex) – the ExpressionIndex to add to the current HighLevelILFunction (may also be an expression index)

Return type:

None

ret(sources: List[ExpressionIndex], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

ret returns an expression which jumps (branches) to the calling function, returning a result specified by the expressions in sources.

Parameters:

  • sources (List[ExpressionIndex]) – list of returned expressions

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression return sources...

Return type:

ExpressionIndex

rotate_left(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_left bitwise rotates left expression a by expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rol.<size>(a, b)

Return type:

ExpressionIndex

rotate_left_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_left_carry bitwise rotates left expression a by expression b with carry from carry returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carried value expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rlc.<size>(a, b, carry)

Return type:

ExpressionIndex

rotate_right(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_right bitwise rotates right expression a by expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression ror.<size>(a, b)

Return type:

ExpressionIndex

rotate_right_carry(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

rotate_right_carry bitwise rotates right expression a by expression b with carry from carry returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carried value expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression rrc.<size>(a, b, carry)

Return type:

ExpressionIndex

round_to_int(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

round_to_int rounds a floating point value to the nearest integer

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to round to the nearest integer

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression roundint.<size>(value)

Return type:

ExpressionIndex

set_current_address(value: int, arch: Architecture | None = None) → None[source]
Parameters:
Return type:

None

set_expr_attributes(expr: HighLevelILInstruction | ExpressionIndex | InstructionIndex, value: Set[ILInstructionAttribute] | List[ILInstructionAttribute])[source]

set_expr_attributes allows modification of instruction attributes but ONLY during lifting.

Warning

This function should ONLY be called as a part of a lifter. It will otherwise not do anything useful as there’s no way to trigger re-analysis of IL levels at this time.

Parameters:

  • expr (ExpressionIndex) – the ExpressionIndex to replace (may also be an expression index)

  • value (set(ILInstructionAttribute)) – the set of attributes to place on the instruction

Return type:

None

set_expr_type(expr_index: int, expr_type: str | Type | TypeBuilder) → None[source]

Set type of expression

This API is only meant for workflows or for debugging purposes, since the changes they make are not persistent and get lost after a database save and reload. To make persistent changes to the analysis, one should use other APIs to, for example, change the type of variables. The analysis will then propagate the type of the variable and update the type of related expressions.

Parameters:

  • expr_index (int) – index of the expression to set

  • StringOrType – new type of the expression

  • expr_type (str | Type | TypeBuilder) –

Return type:

None

shift_left(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

shift_left left shifts expression a by expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression lsl.<size>(a, b)

Return type:

ExpressionIndex

sign_extend(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sign_extend two’s complement sign-extends the expression in value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to sign extend

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sx.<size>(value)

Return type:

ExpressionIndex

split(size: int, hi: ExpressionIndex, lo: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

var_split combines expressions hi and lo of size size into an expression of size 2*size

Parameters:

  • size (int) – the size of each expression in bytes

  • hi (ExpressionIndex) – the expression holding high part of value

  • lo (ExpressionIndex) – the expression holding low part of value

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression hi:lo

Return type:

ExpressionIndex

struct_field(size: int, src: ExpressionIndex, offset: int, member_index: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

struct_field returns the structure field at offset offset and index member_index from expression src of size size

Parameters:

  • size (int) – the size of the field in bytes

  • src (ExpressionIndex) – the expression being read

  • offset (int) – offset of field in the structure

  • member_index (int) – index of field in the structure

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression src:offset.size

Return type:

ExpressionIndex

sub(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sub subtracts expression a to expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sub.<size>(a, b)

Return type:

ExpressionIndex

sub_borrow(size: int, a: ExpressionIndex, b: ExpressionIndex, carry: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

sub_borrow subtracts expression a to expression b with borrow from carry returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • carry (ExpressionIndex) – Carried value expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression sbb.<size>(a, b, carry)

Return type:

ExpressionIndex

switch(condition: ExpressionIndex, default_expr: ExpressionIndex, cases: List[ExpressionIndex], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

switch a switch expression with a condition, cases, and default case

Parameters:

  • condition (ExpressionIndex) – expression for the switch condition

  • default_expr (ExpressionIndex) – expression for the default branch

  • cases (List[ExpressionIndex]) – list of expressions for the switch cases

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression switch (condition) { cases...: ... default: default_expr }

Return type:

ExpressionIndex

system_call(params: List[ExpressionIndex], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

system_call returns an expression which performs a system call with the parameters defined in params

Parameters:

  • params (List[ExpressionIndex]) – parameter variables

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression syscall(dest, params...)

Return type:

ExpressionIndex

tailcall(dest: ExpressionIndex, params: List[ExpressionIndex], loc: ILSourceLocation | None = None) → ExpressionIndex[source]

tailcall returns an expression which tailcalls the function in the expression dest with the parameters defined in params

Parameters:

  • dest (ExpressionIndex) – the expression to call

  • params (List[ExpressionIndex]) – parameter variables

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression tailcall(dest, params...)

Return type:

ExpressionIndex

test_bit(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

test_bit returns an expression of size size that tells whether expression a has its bit with an index of the expression b is set

Parameters:

  • size (int) – size in bytes

  • a (ExpressionIndex) – an expression to be tested

  • b (ExpressionIndex) – an expression for the index of the big

  • loc (ILSourceLocation) – location of returned expression

Returns:

the result expression.

Return type:

ExpressionIndex

trap(value: int, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

trap returns a processor trap (interrupt) expression of the given integer value.

Parameters:

  • value (int) – trap (interrupt) number

  • loc (ILSourceLocation) – location of returned expression

Returns:

a trap expression.

Return type:

ExpressionIndex

traverse(cb: Callable[[HighLevelILInstruction, Any], Any], *args: Any, **kwargs: Any) → Iterator[Any][source]

traverse iterates through all the instructions in the HighLevelILFunction and calls the callback function for each instruction and sub-instruction. See the Developer Docs for more examples.

Parameters:

  • cb (Callable[[HighLevelILInstruction, Any], Any]) – The callback function to call for each node in the HighLevelILInstruction

  • args (Any) – Custom user-defined arguments

  • kwargs (Any) – Custom user-defined keyword arguments

  • cb –

Returns:

An iterator of the results of the callback function

Return type:

Iterator[Any]

Example:
>>> # find all calls to memcpy where the third parameter is not a constant
>>> def find_non_constant_memcpy(i, target) -> HighLevelILInstruction:
...     match i:
...             case Localcall(dest=Constant(constant=c), params=[_, _, p]) if c == target and not isinstance(p, Constant):
...                     return i
>>> target_address = bv.get_symbol_by_raw_name('_memcpy').address
>>> for result in current_il_function.traverse(find_non_constant_memcpy, target_address):
...     print(f"Found suspicious memcpy: {repr(i)}")
undefined(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

undefined returns the undefined expression. This should be used for instructions which perform functions but aren’t important for dataflow or partial emulation purposes.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

the undefined expression.

Return type:

ExpressionIndex

unimplemented(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

unimplemented returns the unimplemented expression. This should be used for all instructions which aren’t implemented.

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

the unimplemented expression.

Return type:

ExpressionIndex

unimplemented_memory_ref(size: int, addr: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

unimplemented_memory_ref a memory reference to expression addr of size size with unimplemented operation.

Parameters:

  • size (int) – size in bytes of the memory reference

  • addr (ExpressionIndex) – expression to reference memory

  • loc (ILSourceLocation) – location of returned expression

Returns:

the unimplemented memory reference expression.

Return type:

ExpressionIndex

unreachable(loc: ILSourceLocation | None = None) → ExpressionIndex[source]

unreachable returns an expression that is unreachable and should be omitted during analysis

Parameters:

loc (ILSourceLocation) – location of returned expression

Returns:

The expression unreachable

Return type:

ExpressionIndex

var(size: int, src: Variable, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

var returns the variable src of size size

Parameters:

  • size (int) – the size of the variable in bytes

  • src (Variable) – the variable being read

  • loc (ILSourceLocation) – location of returned expression

Returns:

An expression for the given variable

Return type:

ExpressionIndex

var_declare(var: Variable, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

var_declare declare a variable in the current scope

Parameters:
Returns:

The expression var (no assignment or anything)

Return type:

ExpressionIndex

var_init(size: int, dest: Variable, src: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

var_init declare and assign a variable in the current scope of size size

Parameters:

  • size (int) – size of the variable

  • dest (Variable) – location of variable being declared

  • src (ExpressionIndex) – value being assigned to the variable

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression dest = src

Return type:

ExpressionIndex

visit(cb: Callable[[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str, HighLevelILInstruction | None], bool]) → bool[source]

Iterates over all the instructions in the function and calls the callback function for each instruction and each sub-instruction.

Parameters:

cb (HighLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use HighLevelILFunction.traverse instead.

visit_all(cb: Callable[[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str, HighLevelILInstruction | None], bool]) → bool[source]

Iterates over all the instructions in the function and calls the callback function for each instruction and their operands.

Parameters:

cb (HighLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use HighLevelILFunction.traverse instead.

visit_operands(cb: Callable[[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str, HighLevelILInstruction | None], bool]) → bool[source]
Iterates over all the instructions in the function and calls the callback function for each operand and

the operands of each sub-instruction.

Parameters:

cb (HighLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

Returns:

True if all instructions were visited, False if the callback function returned False.

Return type:

bool

Deprecated since version 4.0.4907: Use HighLevelILFunction.traverse instead.

while_expr(condition: ExpressionIndex, loop_expr: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

while_expr a while-loop expression with a condition and loop body.

Parameters:

  • condition (ExpressionIndex) – expression for the loop condition

  • loop_expr (ExpressionIndex) – expression for the loop body

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression while (condition) { loop_expr }

Return type:

ExpressionIndex

xor_expr(size: int, a: ExpressionIndex, b: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

xor_expr xor’s expression a and expression b returning an expression of size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • a (ExpressionIndex) – LHS expression

  • b (ExpressionIndex) – RHS expression

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression xor.<size>(a, b)

Return type:

ExpressionIndex

zero_extend(size: int, value: ExpressionIndex, loc: ILSourceLocation | None = None) → ExpressionIndex[source]

zero_extend zero-extends the expression in value to size bytes

Parameters:

  • size (int) – the size of the result in bytes

  • value (ExpressionIndex) – the expression to zero extend

  • loc (ILSourceLocation) – location of returned expression

Returns:

The expression zx.<size>(value)

Return type:

ExpressionIndex

property aliased_vars: List[Variable]

This returns a list of Variables that are taken reference to and used elsewhere. You may also wish to consider HighLevelIlFunction.vars and HighLevelIlFunction.source_function.parameter_vars

property arch: Architecture
property basic_blocks: HighLevelILBasicBlockList
property current_address: int

Current IL Address (read/write)

property il_form: FunctionGraphType
property instructions: Generator[HighLevelILInstruction, None, None]

A generator of hlil instructions of the current function

property medium_level_il: MediumLevelILFunction | None

Medium level IL for this function

property mlil: MediumLevelILFunction | None

Alias for medium_level_il

property non_ssa_form: HighLevelILFunction | None

High level IL in non-SSA (default) form (read-only)

property root: HighLevelILInstruction | None

Root of the abstract syntax tree

property source_function: Function
property ssa_form: HighLevelILFunction

High level IL in SSA form (read-only)

property ssa_vars: List[SSAVariable]

This gets just the HLIL SSA variables - you may be interested in the union of HighLevelIlFunction.source_function.parameter_vars and HighLevelIlFunction.aliased_vars for all the variables used in the function

property vars: List[Variable] | List[SSAVariable]

This gets just the HLIL variables - you may be interested in the union of HighLevelIlFunction.source_function.parameter_vars and HighLevelIlFunction.aliased_vars as well for all the variables used in the function

property view: BinaryView
class HighLevelILGoto(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Terminal

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property target: GotoLabel
class HighLevelILIf(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, ControlFlow

Parameters:
property condition: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property false: HighLevelILInstruction
property true: HighLevelILInstruction
class HighLevelILImport(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Constant

Parameters:
property constant: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILInstruction(function: HighLevelILFunction, expr_index: ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: InstructionIndex)[source]

Bases: BaseILInstruction

class HighLevelILInstruction High Level Intermediate Language Instructions form an abstract syntax tree of the code. Control flow structures are present as high level constructs in the HLIL tree.

Parameters:
classmethod create(func: HighLevelILFunction, expr_index: ExpressionIndex, as_ast: bool = True, instr_index: InstructionIndex | None = None) → HighLevelILInstruction[source]
Parameters:

  • func (HighLevelILFunction) –

  • expr_index (ExpressionIndex) –

  • as_ast (bool) –

  • instr_index (InstructionIndex | None) –

Return type:

HighLevelILInstruction

get_constant_data(operand_index1: int, operand_index2: int) → ConstantData[source]
Parameters:

  • operand_index1 (int) –

  • operand_index2 (int) –

Return type:

ConstantData

get_constraint(operand_index: int) → PossibleValueSet[source]
Parameters:

operand_index (int) –

Return type:

PossibleValueSet

get_expr(operand_index: int) → HighLevelILInstruction[source]
Parameters:

operand_index (int) –

Return type:

HighLevelILInstruction

get_expr_list(operand_index1: int, operand_index2: int) → List[HighLevelILInstruction][source]
Parameters:

  • operand_index1 (int) –

  • operand_index2 (int) –

Return type:

List[HighLevelILInstruction]

get_float(operand_index: int) → float[source]
Parameters:

operand_index (int) –

Return type:

float

get_int(operand_index: int) → int[source]
Parameters:

operand_index (int) –

Return type:

int

get_int_list(operand_index: int) → List[int][source]
Parameters:

operand_index (int) –

Return type:

List[int]

get_intrinsic(operand_index: int) → ILIntrinsic[source]
Parameters:

operand_index (int) –

Return type:

ILIntrinsic

get_label(operand_index: int) → GotoLabel[source]
Parameters:

operand_index (int) –

Return type:

GotoLabel

get_lines(settings: DisassemblySettings | None = None) → Generator[DisassemblyTextLine, None, None][source]

Gets HLIL text lines with optional settings

Parameters:

settings (DisassemblySettings | None) –

Return type:

Generator[DisassemblyTextLine, None, None]

get_member_index(operand_index: int) → int | None[source]
Parameters:

operand_index (int) –

Return type:

int | None

get_possible_values(options: List[DataFlowQueryOption] | None = None) → PossibleValueSet[source]
Parameters:

options (List[DataFlowQueryOption] | None) –

Return type:

PossibleValueSet

get_ssa_var_version(var: Variable) → int[source]
Parameters:

var (Variable) –

Return type:

int

get_var(operand_index: int) → Variable[source]
Parameters:

operand_index (int) –

Return type:

Variable

get_var_ssa(operand_index1: int, operand_index2: int) → SSAVariable[source]
Parameters:

  • operand_index1 (int) –

  • operand_index2 (int) –

Return type:

SSAVariable

get_var_ssa_dest_and_src(operand_index1: int, operand_index2: int) → SSAVariable[source]
Parameters:

  • operand_index1 (int) –

  • operand_index2 (int) –

Return type:

SSAVariable

get_var_ssa_list(operand_index1: int, _: int) → List[SSAVariable][source]
Parameters:

  • operand_index1 (int) –

  • _ (int) –

Return type:

List[SSAVariable]

static show_hlil_hierarchy()[source]

Opens a new tab showing the HLIL hierarchy which includes classes which can easily be used with isinstance to match multiple types of IL instructions.

traverse(cb: Callable[[HighLevelILInstruction, Any], Any], *args: Any, shallow: bool = True, **kwargs: Any) → Iterator[Any][source]

traverse is a generator that allows you to traverse the HLIL AST in a depth-first manner. It will yield the result of the callback function for each node in the AST. Arguments can be passed to the callback function using args and kwargs. See the Developer Docs for more examples.

Parameters:

  • cb (Callable[[HighLevelILInstruction, Any], Any]) – The callback function to call for each node in the HighLevelILInstruction

  • args (Any) – Custom user-defined arguments

  • shallow (bool) – Whether traversal occurs on block instructions

  • kwargs (Any) – Custom user-defined keyword arguments

  • cb –

Returns:

An iterator of the results of the callback function

Return type:

Iterator[Any]

Example:
>>> def get_constant_less_than_value(inst: HighLevelILInstruction, value: int) -> int:
...     if isinstance(inst, Constant) and inst.constant < value:
...             return inst.constant
>>>
>>> for result in inst.traverse(get_constant_less_than_value, 10):
...     print(f"Found a constant {result} < 10 in {repr(inst)}")
Example:
>>> def get_import_data_var_with_name(inst: HighLevelILInstruction, name: str) -> Optional['DataVariable']:
...     if isinstance(inst, HighLevelILImport):
...                     if bv.get_symbol_at(inst.constant).name == name:
...                     return bv.get_data_var_at(inst.constant)
>>>
>>> for result in inst.traverse(get_import_data_var_with_name, "__cxa_finalize", shallow=False):
...     print(f"Found import at {result} in {repr(inst)}")
visit(cb: Callable[[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str, HighLevelILInstruction | None], bool], name: str = 'root', parent: HighLevelILInstruction | None = None) → bool[source]

Visits all HighLevelILInstructions in the operands of this instruction and any sub-instructions. In the callback you provide, you likely only need to interact with the second argument (see the example below).

Parameters:

  • cb (HighLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (HighLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Example:
>>> def visitor(_a, inst, _c, _d) -> bool:
>>>     if isinstance(inst, Constant):
>>>         print(f"Found constant: {inst.constant}")
>>>         return False # Stop recursion (once we find a constant, don't recurse in to any sub-instructions (which there won't actually be any...))
>>>     # Otherwise, keep recursing the subexpressions of this instruction; if no return value is provided, it'll keep descending
>>>
>>> # Finds all constants used in the program
>>> for inst in bv.hlil_instructions:
>>>     inst.visit(visitor)
Return type:

bool

Deprecated since version 4.0.4907: Use HighLevelILInstruction.traverse instead.

visit_all(cb: Callable[[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str, HighLevelILInstruction | None], bool], name: str = 'root', parent: HighLevelILInstruction | None = None) → bool[source]

Visits all operands of this instruction and all operands of any sub-instructions. Using pre-order traversal.

Parameters:

  • cb (HighLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (HighLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Return type:

bool

Deprecated since version 4.0.4907: Use HighLevelILInstruction.traverse instead.

visit_operands(cb: Callable[[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str, HighLevelILInstruction | None], bool], name: str = 'root', parent: HighLevelILInstruction | None = None) → bool[source]

Visits all leaf operands of this instruction and any sub-instructions.

Parameters:

  • cb (HighLevelILVisitorCallback) – Callback function that takes the name of the operand, the operand, operand type, and parent instruction

  • name (str) –

  • parent (HighLevelILInstruction | None) –

Returns:

True if all instructions were visited, False if the callback returned False

Return type:

bool

Deprecated since version 4.0.4907: Use HighLevelILInstruction.traverse instead.

ILOperations: ClassVar[Mapping[HighLevelILOperation, List[Tuple[str, str]]]] = {HighLevelILOperation.HLIL_NOP: [], HighLevelILOperation.HLIL_BLOCK: [('body', 'expr_list')], HighLevelILOperation.HLIL_IF: [('condition', 'expr'), ('true', 'expr'), ('false', 'expr')], HighLevelILOperation.HLIL_WHILE: [('condition', 'expr'), ('body', 'expr')], HighLevelILOperation.HLIL_DO_WHILE: [('body', 'expr'), ('condition', 'expr')], HighLevelILOperation.HLIL_FOR: [('init', 'expr'), ('condition', 'expr'), ('update', 'expr'), ('body', 'expr')], HighLevelILOperation.HLIL_SWITCH: [('condition', 'expr'), ('default', 'expr'), ('cases', 'expr_list')], HighLevelILOperation.HLIL_CASE: [('values', 'expr_list'), ('body', 'expr')], HighLevelILOperation.HLIL_BREAK: [], HighLevelILOperation.HLIL_CONTINUE: [], HighLevelILOperation.HLIL_JUMP: [('dest', 'expr')], HighLevelILOperation.HLIL_RET: [('src', 'expr_list')], HighLevelILOperation.HLIL_NORET: [], HighLevelILOperation.HLIL_GOTO: [('target', 'label')], HighLevelILOperation.HLIL_LABEL: [('target', 'label')], HighLevelILOperation.HLIL_VAR_DECLARE: [('var', 'var')], HighLevelILOperation.HLIL_VAR_INIT: [('dest', 'var'), ('src', 'expr')], HighLevelILOperation.HLIL_ASSIGN: [('dest', 'expr'), ('src', 'expr')], HighLevelILOperation.HLIL_ASSIGN_UNPACK: [('dest', 'expr_list'), ('src', 'expr')], HighLevelILOperation.HLIL_VAR: [('var', 'var')], HighLevelILOperation.HLIL_STRUCT_FIELD: [('src', 'expr'), ('offset', 'int'), ('member_index', 'member_index')], HighLevelILOperation.HLIL_ARRAY_INDEX: [('src', 'expr'), ('index', 'expr')], HighLevelILOperation.HLIL_SPLIT: [('high', 'expr'), ('low', 'expr')], HighLevelILOperation.HLIL_DEREF: [('src', 'expr')], HighLevelILOperation.HLIL_DEREF_FIELD: [('src', 'expr'), ('offset', 'int'), ('member_index', 'member_index')], HighLevelILOperation.HLIL_ADDRESS_OF: [('src', 'expr')], HighLevelILOperation.HLIL_CONST: [('constant', 'int')], HighLevelILOperation.HLIL_CONST_DATA: [('constant_data', 'constant_data')], HighLevelILOperation.HLIL_CONST_PTR: [('constant', 'int')], HighLevelILOperation.HLIL_EXTERN_PTR: [('constant', 'int'), ('offset', 'int')], HighLevelILOperation.HLIL_FLOAT_CONST: [('constant', 'float')], HighLevelILOperation.HLIL_IMPORT: [('constant', 'int')], HighLevelILOperation.HLIL_ADD: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_ADC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], HighLevelILOperation.HLIL_SUB: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_SBB: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], HighLevelILOperation.HLIL_AND: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_OR: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_XOR: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_LSL: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_LSR: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_ASR: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_ROL: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_RLC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], HighLevelILOperation.HLIL_ROR: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_RRC: [('left', 'expr'), ('right', 'expr'), ('carry', 'expr')], HighLevelILOperation.HLIL_MUL: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_MULU_DP: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_MULS_DP: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_DIVU: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_DIVU_DP: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_DIVS: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_DIVS_DP: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_MODU: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_MODU_DP: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_MODS: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_MODS_DP: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_NEG: [('src', 'expr')], HighLevelILOperation.HLIL_NOT: [('src', 'expr')], HighLevelILOperation.HLIL_SX: [('src', 'expr')], HighLevelILOperation.HLIL_ZX: [('src', 'expr')], HighLevelILOperation.HLIL_LOW_PART: [('src', 'expr')], HighLevelILOperation.HLIL_CALL: [('dest', 'expr'), ('params', 'expr_list')], HighLevelILOperation.HLIL_CMP_E: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_NE: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_SLT: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_ULT: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_SLE: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_ULE: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_SGE: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_UGE: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_SGT: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_CMP_UGT: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_TEST_BIT: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_BOOL_TO_INT: [('src', 'expr')], HighLevelILOperation.HLIL_ADD_OVERFLOW: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_SYSCALL: [('params', 'expr_list')], HighLevelILOperation.HLIL_TAILCALL: [('dest', 'expr'), ('params', 'expr_list')], HighLevelILOperation.HLIL_INTRINSIC: [('intrinsic', 'intrinsic'), ('params', 'expr_list')], HighLevelILOperation.HLIL_BP: [], HighLevelILOperation.HLIL_TRAP: [('vector', 'int')], HighLevelILOperation.HLIL_UNDEF: [], HighLevelILOperation.HLIL_UNIMPL: [], HighLevelILOperation.HLIL_UNIMPL_MEM: [('src', 'expr')], HighLevelILOperation.HLIL_FADD: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FSUB: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FMUL: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FDIV: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FSQRT: [('src', 'expr')], HighLevelILOperation.HLIL_FNEG: [('src', 'expr')], HighLevelILOperation.HLIL_FABS: [('src', 'expr')], HighLevelILOperation.HLIL_FLOAT_TO_INT: [('src', 'expr')], HighLevelILOperation.HLIL_INT_TO_FLOAT: [('src', 'expr')], HighLevelILOperation.HLIL_FLOAT_CONV: [('src', 'expr')], HighLevelILOperation.HLIL_ROUND_TO_INT: [('src', 'expr')], HighLevelILOperation.HLIL_FLOOR: [('src', 'expr')], HighLevelILOperation.HLIL_CEIL: [('src', 'expr')], HighLevelILOperation.HLIL_FTRUNC: [('src', 'expr')], HighLevelILOperation.HLIL_FCMP_E: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FCMP_NE: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FCMP_LT: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FCMP_LE: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FCMP_GE: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FCMP_GT: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FCMP_O: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_FCMP_UO: [('left', 'expr'), ('right', 'expr')], HighLevelILOperation.HLIL_UNREACHABLE: [], HighLevelILOperation.HLIL_WHILE_SSA: [('condition_phi', 'expr'), ('condition', 'expr'), ('body', 'expr')], HighLevelILOperation.HLIL_DO_WHILE_SSA: [('body', 'expr'), ('condition_phi', 'expr'), ('condition', 'expr')], HighLevelILOperation.HLIL_FOR_SSA: [('init', 'expr'), ('condition_phi', 'expr'), ('condition', 'expr'), ('update', 'expr'), ('body', 'expr')], HighLevelILOperation.HLIL_VAR_INIT_SSA: [('dest', 'var_ssa'), ('src', 'expr')], HighLevelILOperation.HLIL_ASSIGN_MEM_SSA: [('dest', 'expr'), ('dest_memory', 'int'), ('src', 'expr'), ('src_memory', 'int')], HighLevelILOperation.HLIL_ASSIGN_UNPACK_MEM_SSA: [('dest', 'expr_list'), ('dest_memory', 'int'), ('src', 'expr'), ('src_memory', 'int')], HighLevelILOperation.HLIL_VAR_SSA: [('var', 'var_ssa')], HighLevelILOperation.HLIL_ARRAY_INDEX_SSA: [('src', 'expr'), ('src_memory', 'int'), ('index', 'expr')], HighLevelILOperation.HLIL_DEREF_SSA: [('src', 'expr'), ('src_memory', 'int')], HighLevelILOperation.HLIL_DEREF_FIELD_SSA: [('src', 'expr'), ('src_memory', 'int'), ('offset', 'int'), ('member_index', 'member_index')], HighLevelILOperation.HLIL_CALL_SSA: [('dest', 'expr'), ('params', 'expr_list'), ('dest_memory', 'int'), ('src_memory', 'int')], HighLevelILOperation.HLIL_SYSCALL_SSA: [('params', 'expr_list'), ('dest_memory', 'int'), ('src_memory', 'int')], HighLevelILOperation.HLIL_INTRINSIC_SSA: [('intrinsic', 'intrinsic'), ('params', 'expr_list'), ('dest_memory', 'int'), ('src_memory', 'int')], HighLevelILOperation.HLIL_VAR_PHI: [('dest', 'var_ssa'), ('src', 'var_ssa_list')], HighLevelILOperation.HLIL_MEM_PHI: [('dest', 'int'), ('src', 'int_list')]}
property address: int
as_ast: bool
property ast: HighLevelILInstruction

This expression with full AST printing (read-only)

property attributes: Set[ILInstructionAttribute]

The set of optional attributes placed on the instruction

core_instr: CoreHighLevelILInstruction
property core_operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

expr_index: ExpressionIndex
property expr_type: Type | None

Type of expression

function: HighLevelILFunction
property has_side_effects: bool
property il_basic_block: HighLevelILBasicBlock | None

IL basic block object containing this expression (read-only) (only available on finalized functions). Returns None for HLIL_BLOCK expressions as these can contain multiple basic blocks.

property instr: HighLevelILInstruction

The statement that this expression belongs to (read-only)

instr_index: InstructionIndex
property instruction_operands: List[HighLevelILInstruction]
property lines: Generator[DisassemblyTextLine, None, None]

HLIL text lines (read-only)

property llil: LowLevelILInstruction | None

Alias for low_level_il

property llils: List[ExpressionIndex]
property low_level_il: LowLevelILInstruction | None

Low level IL form of this expression

property medium_level_il: MediumLevelILInstruction | None

Medium level IL form of this expression

property mlil: MediumLevelILInstruction | None

Alias for medium_level_il

property mlils: List[MediumLevelILInstruction] | None
property non_ast: HighLevelILInstruction

This expression without full AST printing (read-only)

property non_ssa_form: HighLevelILInstruction | None

Non-SSA form of expression (read-only)

property operands: List[HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer]

Operands for the instruction

Consider using more specific APIs for src, dest, params, etc where appropriate.

property operation: HighLevelILOperation
property parent: HighLevelILInstruction | None
property possible_values: PossibleValueSet

Possible values of expression using path-sensitive static data flow analysis (read-only)

property postfix_operands: List[HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer | HighLevelILOperationAndSize]

All operands in the expression tree in postfix order

property prefix_operands: List[HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer | HighLevelILOperationAndSize]

All operands in the expression tree in prefix order

property raw_operands: Tuple[ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex, ExpressionIndex]

Raw operand expression indices as specified by the core structure (read-only)

property size: int
property source_location: ILSourceLocation
property source_operand: ExpressionIndex
property ssa_form: HighLevelILInstruction

SSA form of expression (read-only)

property ssa_memory_version: int

Version of active memory contents in SSA form for this instruction

property tokens: List[InstructionTextToken]

HLIL tokens taken from the HLIL text lines (read-only) – does not include newlines or indentation, use lines for that information

property value: RegisterValue

Value of expression if constant or a known value (read-only)

property vars: List[SSAVariable | Variable]

Non-unique list of variables read by instruction

property vars_address_taken: List[SSAVariable | Variable]

Non-unique list of variables whose address is taken by instruction

Note

This property has some nuance to it, so use carefully. This property will return only those variable which directly have their address taken such as &var_4 or &var_8.d but not those which are involved in an address calculation such as &(var_4 + 0) or &var_4[0] even though they may be functionally equivalent.

property vars_read: List[SSAVariable | Variable]

Non-unique list of variables whose value is read by this instruction

property vars_written: List[SSAVariable | Variable]

List of variables value is written by this instruction

class HighLevelILIntToFloat(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILIntrinsic(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Intrinsic

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property intrinsic: ILIntrinsic
property params: List[HighLevelILInstruction]
class HighLevelILIntrinsicSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSA

Parameters:
property dest_memory: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property intrinsic: ILIntrinsic
property params: List[HighLevelILInstruction]
property src_memory: int
class HighLevelILJump(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Terminal

Parameters:
property dest: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILLabel(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property target: GotoLabel
class HighLevelILLowPart(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, Arithmetic

Parameters:
class HighLevelILLsl(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILLsr(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILMemPhi(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Memory, Phi

Parameters:
property dest: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: List[int]
class HighLevelILMods(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Signed

Parameters:
class HighLevelILModsDp(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Signed, DoublePrecision

Parameters:
class HighLevelILModu(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILModuDp(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, DoublePrecision

Parameters:
class HighLevelILMul(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILMulsDp(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: Signed, HighLevelILBinaryBase, DoublePrecision

Parameters:
class HighLevelILMuluDp(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, DoublePrecision

Parameters:
class HighLevelILNeg(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, Arithmetic

Parameters:
class HighLevelILNop(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
class HighLevelILNoret(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Terminal

Parameters:
class HighLevelILNot(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, Arithmetic

Parameters:
class HighLevelILOperationAndSize(operation: HighLevelILOperation, size: int)[source]

Bases: object

Parameters:
operation: HighLevelILOperation
size: int
class HighLevelILOr(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILRet(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Return

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: List[HighLevelILInstruction]
class HighLevelILRlc(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILCarryBase

Parameters:
class HighLevelILRol(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILRor(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILCarryBase

Parameters:
class HighLevelILRoundToInt(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, FloatingPoint

Parameters:
class HighLevelILRrc(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILCarryBase

Parameters:
class HighLevelILSbb(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILCarryBase

Parameters:
class HighLevelILSplit(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property high: HighLevelILInstruction
property low: HighLevelILInstruction
class HighLevelILStructField(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property member_index: int | None
property offset: int
property src: HighLevelILInstruction
class HighLevelILSub(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILSwitch(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, ControlFlow

Parameters:
property cases: List[HighLevelILInstruction]
property condition: HighLevelILInstruction
property default: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILSx(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, Arithmetic

Parameters:
class HighLevelILSyscall(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Syscall

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property params: List[HighLevelILInstruction]
class HighLevelILSyscallSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Syscall, SSA

Parameters:
property dest_memory: int
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property params: List[HighLevelILInstruction]
property src_memory: int
class HighLevelILTailcall(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Tailcall

Parameters:
property dest: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property params: List[HighLevelILInstruction]
class HighLevelILTestBit(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILComparisonBase

Parameters:
class HighLevelILTrap(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Terminal

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property vector: int
class HighLevelILUnaryBase(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, UnaryOperation

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: HighLevelILInstruction
class HighLevelILUndef(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Terminal

Parameters:
class HighLevelILUnimpl(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
class HighLevelILUnimplMem(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, Memory

Parameters:
class HighLevelILUnreachable(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Terminal

Parameters:
class HighLevelILVar(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, VariableInstruction

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property var: Variable
class HighLevelILVarDeclare(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property var: Variable
class HighLevelILVarInit(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SetVar

Parameters:
property dest: Variable
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: HighLevelILInstruction
property vars_written: List[SSAVariable | Variable]

List of variables value is written by this instruction

class HighLevelILVarInitSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SetVar, SSA

Parameters:
property dest: SSAVariable
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: HighLevelILInstruction
property vars_written: List[SSAVariable | Variable]

List of variables value is written by this instruction

class HighLevelILVarPhi(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Phi, SetVar

Parameters:
property dest: SSAVariable
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property src: List[SSAVariable]
property vars_written: List[SSAVariable | Variable]

List of variables value is written by this instruction

class HighLevelILVarSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, SSAVariableInstruction

Parameters:
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

property var: SSAVariable
class HighLevelILWhile(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Loop

Parameters:
property body: HighLevelILInstruction
property condition: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILWhileSsa(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILInstruction, Loop, SSA

Parameters:
property body: HighLevelILInstruction
property condition: HighLevelILInstruction
property condition_phi: HighLevelILInstruction
property detailed_operands: List[Tuple[str, HighLevelILInstruction | ILIntrinsic | Variable | SSAVariable | List[int] | List[Variable] | List[SSAVariable] | List[HighLevelILInstruction] | int | None | float | GotoLabel | ConstantData | DataBuffer, str]]

Returns a list of tuples containing the name of the operand, the operand, and the type of the operand. Useful for iterating over all operands of an instruction and sub-instructions.

class HighLevelILXor(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILBinaryBase, Arithmetic

Parameters:
class HighLevelILZx(function: 'HighLevelILFunction', expr_index: binaryninja.highlevelil.ExpressionIndex, core_instr: CoreHighLevelILInstruction, as_ast: bool, instr_index: binaryninja.highlevelil.InstructionIndex)[source]

Bases: HighLevelILUnaryBase, Arithmetic

Parameters:
class VariableReferenceType(value)[source]

Bases: Enum

An enumeration.

AddressTaken = 2
Read = 0
Written = 1