Bases: object

__init__(start: int, end: int) → None¶

Parameters:

• start (int)

• end (int)

Return type:

None

end: int¶

start: int¶

Bases: CoreVariable

class ArchitectureVariable is a wrapper around CoreVariable that is bound to an architecture (for register/flag naming) but not a function. This is typically used in calling conventions for specifying value locations. Calling conventions can be used outside functions to resolve type information, so only an architecture is required.

__init__(arch: Architecture, source_type: VariableSourceType, index: int, storage: int)[source]¶

Parameters:

• arch (Architecture)

• source_type (VariableSourceType)

• index (int)

• storage (int)

classmethod flag(arch: Architecture, flag: str | int)[source]¶

Parameters:

• arch (Architecture)

• flag (str | int)

classmethod from_BNVariable(arch: Architecture, var: BNVariable)[source]¶

Parameters:

• arch (Architecture)

• var (BNVariable)

classmethod from_core_variable(arch: Architecture, var: CoreVariable)[source]¶

Parameters:

• arch (Architecture)

• var (CoreVariable)

classmethod from_identifier(arch: Architecture, identifier: int)[source]¶

Parameters:

• arch (Architecture)

• identifier (int)

classmethod reg(arch: Architecture, reg: str | int)[source]¶

Parameters:

• arch (Architecture)

• reg (str | int)

classmethod stack_offset(arch: Architecture, offset: int)[source]¶

Parameters:

• arch (Architecture)

• offset (int)

property arch: Architecture¶

property name: str¶

Bases: RegisterValue

__init__(value: int, offset: int, type: RegisterValueType = RegisterValueType.UndeterminedValue, confidence: int = 255, size: int = 0, function: _function.Function = None) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

• function (_function.Function)

Return type:

None

property data: DataBuffer¶

property data_and_builtin: Tuple[DataBuffer, BuiltinType]¶

function: _function.Function = None¶

Bases: RegisterValue

__init__(value: int, offset: int, type: RegisterValueType = RegisterValueType.UndeterminedValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

Bases: RegisterValue

__init__(value: int, offset: int = 0, type: RegisterValueType = RegisterValueType.ConstantPointerValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

offset: int = 0¶

type: RegisterValueType = 3¶

Bases: object

__init__(value: int, size: int, pointer: bool, intermediate: bool) → None¶

Parameters:

• value (int)

• size (int)

• pointer (bool)

• intermediate (bool)

Return type:

None

intermediate: bool¶

pointer: bool¶

size: int¶

value: int¶

Bases: RegisterValue

__init__(value: int, offset: int = 0, type: RegisterValueType = RegisterValueType.ConstantValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

offset: int = 0¶

type: RegisterValueType = 2¶

Bases: object

class CoreVariable is the base class for other variable types, such as VariableNameAndType and Variable

Variables:

• index – Internal identifier

• storage – If this variable is a stack variable (source_type == VariableSourceType.StackVariableSourceType), then the storage location is the offset onto the stack that contains the first byte of this variable. Otherwise it’s used as an internal identifier.

__init__(_source_type: int, index: int, storage: int) → None¶

Parameters:

• _source_type (int)

• index (int)

• storage (int)

Return type:

None

classmethod flag(flag: int)[source]¶

Parameters:

flag (int)

classmethod from_BNVariable(var: BNVariable)[source]¶

Parameters:

var (BNVariable)

classmethod from_identifier(identifier)[source]¶

classmethod reg(reg: int)[source]¶

Parameters:

reg (int)

classmethod stack_offset(offset: int)[source]¶

Parameters:

offset (int)

to_BNVariable()[source]¶

property identifier: int¶

A UID for a variable within a function.

index: int¶

property source_type: VariableSourceType¶

Whether this variable was created based off of an underlying register, stack location, or flag.

storage: int¶

Bases: RegisterValue

__init__(value: int = 0, offset: int = 0, type: RegisterValueType = RegisterValueType.EntryValue, confidence: int = 255, size: int = 0, reg: RegisterName | None = None) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

• reg (RegisterName | None)

Return type:

None

offset: int = 0¶

reg: binaryninja.architecture.RegisterName | None = None¶

type: RegisterValueType = 1¶

value: int = 0¶

Bases: RegisterValue

__init__(value: int, offset: int, type: RegisterValueType = RegisterValueType.ExternalPointerValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

type: RegisterValueType = 4¶

Bases: RegisterValue

__init__(value: int, offset: int = 0, type: RegisterValueType = RegisterValueType.ImportedAddressValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

offset: int = 0¶

type: RegisterValueType = 7¶

Bases: object

__init__(source_arch: Architecture, source_addr: int, dest_arch: Architecture, dest_addr: int, auto_defined: bool) → None¶

Parameters:

• source_arch (Architecture)

• source_addr (int)

• dest_arch (Architecture)

• dest_addr (int)

• auto_defined (bool)

Return type:

None

auto_defined: bool¶

dest_addr: int¶

dest_arch: Architecture¶

source_addr: int¶

source_arch: Architecture¶

Bases: object

__init__(from_values: List[int], to_value: int, type: RegisterValueType = RegisterValueType.LookupTableValue) → None¶

Parameters:

• from_values (List[int])

• to_value (int)

• type (RegisterValueType)

Return type:

None

from_values: List[int]¶

to_value: int¶

type: RegisterValueType = 12¶

Bases: object

__init__(location_list: List[ValueLocation], confidence: int = 255, func: Function | None = None)[source]¶

Parameters:

• location_list (List[ValueLocation])

• confidence (int)

• func (Function | None)

with_confidence(confidence: int) → ParameterLocations[source]¶

Parameters:

confidence (int)

Return type:

ParameterLocations

property confidence: int¶

property function: Function | None¶

property locations: List[ValueLocation]¶

Bases: RegisterValue

__init__(value: int, offset: int = 0, type: RegisterValueType = RegisterValueType.ParameterPointerValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

offset: int = 0¶

type: RegisterValueType = 9¶

Bases: object

__init__(var_list: List[Variable], confidence: int = 255, func: Function | None = None)[source]¶

Parameters:

• var_list (List[Variable])

• confidence (int)

• func (Function | None)

with_confidence(confidence: int) → ParameterVariables[source]¶

Parameters:

confidence (int)

Return type:

ParameterVariables

property confidence: int¶

property function: Function | None¶

property vars: List[Variable]¶

Bases: object

class PossibleValueSet PossibleValueSet is used to define possible values that a variable can take. It contains methods to instantiate different value sets such as Constant, Signed/Unsigned Ranges, etc.

__init__(arch: Architecture | None = None, value: BNPossibleValueSet | None = None)[source]¶

Parameters:

• arch (Architecture | None)

• value (BNPossibleValueSet | None)

add(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Add two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

and_(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform bitwise AND of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

arith_shift_right(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform arithmetic right shift of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

static constant(value: int) → PossibleValueSet[source]¶

Create a constant valued PossibleValueSet object.

Parameters:

value (int) – Integer value of the constant

Return type:

PossibleValueSet

static constant_ptr(value: int) → PossibleValueSet[source]¶

Create constant pointer valued PossibleValueSet object.

Parameters:

value (int) – Integer value of the constant pointer

Return type:

PossibleValueSet

static in_set_of_values(values: Iterable[int]) → PossibleValueSet[source]¶

Create a PossibleValueSet object for a value in a set of values.

Parameters:

values (Iterable[int]) – Iterable of integer values

Return type:

PossibleValueSet

intersection(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Compute the intersection of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

logical_shift_right(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform logical right shift of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

static lookup_table_value(lookup_table: List[LookupTableEntry], mapping: Dict[int, int]) → PossibleValueSet[source]¶

Create a PossibleValueSet object for a value which is a member of a lookup table.

Parameters:

• lookup_table (list(LookupTableEntry)) – List of table entries

• mapping (Dict[int, int]) – Mapping used for resolution

• mapping

Return type:

PossibleValueSet

multiply(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Multiply two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

negate(size: int) → PossibleValueSet[source]¶

Negate a PossibleValueSet.

Parameters:

size (int)

Return type:

PossibleValueSet

not_(size: int) → PossibleValueSet[source]¶

Perform bitwise NOT of a PossibleValueSet.

Parameters:

size (int)

Return type:

PossibleValueSet

static not_in_set_of_values(values: Iterable[int]) → PossibleValueSet[source]¶

Create a PossibleValueSet object for a value NOT in a set of values.

Parameters:

values (Iterable[int]) – Iterable of integer values

Return type:

PossibleValueSet

or_(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform bitwise OR of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

static parameter_pointer(idx: int, offset: int) → PossibleValueSet[source]¶

Create a PossibleValueSet object for a pointer to a parameter when the parameter is stored at an unknown location in memory. This is typically used for calling conventions that pass in a pointer to the storage location for parameters (usually larger than can be held in a register).

Parameters:

• idx (int) – Index of the parameter

• offset (int) – Integer value of the offset

Return type:

PossibleValueSet

static result_pointer(offset: int) → PossibleValueSet[source]¶

Create a PossibleValueSet object for a pointer to the return value when the return value is stored at an unknown location in memory. This is typically used for calling conventions that pass in a pointer to the storage location for the return value.

Parameters:

offset (int) – Integer value of the offset

Return type:

PossibleValueSet

rotate_left(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform left rotation of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

rotate_right(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform right rotation of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

shift_left(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform left shift of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

signed_divide(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform signed division of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

signed_mod(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform signed modulo of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

static signed_range_value(ranges: List[ValueRange]) → PossibleValueSet[source]¶

Create a PossibleValueSet object for a signed range of values.

Parameters:

ranges (list(ValueRange)) – List of ValueRanges

Return type:

PossibleValueSet

Example:

>>> v_1 = ValueRange(-5, -1, 1)
>>> v_2 = ValueRange(7, 10, 1)
>>> val = PossibleValueSet.signed_range_value([v_1, v_2])
<signed ranges: [<range: -0x5 to -0x1>, <range: 0x7 to 0xa>]>

static stack_frame_offset(offset: int) → PossibleValueSet[source]¶

Create a PossibleValueSet object for a stack frame offset.

Parameters:

offset (int) – Integer value of the offset

Return type:

PossibleValueSet

subtract(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Subtract two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

static undetermined() → PossibleValueSet[source]¶

Create a PossibleValueSet object of type UndeterminedValue.

Returns:

PossibleValueSet object of type UndeterminedValue

Return type:

PossibleValueSet

union(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Compute the union of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

unsigned_divide(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform unsigned division of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

unsigned_mod(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform unsigned modulo of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

static unsigned_range_value(ranges: List[ValueRange]) → PossibleValueSet[source]¶

Create a PossibleValueSet object for a unsigned signed range of values.

Parameters:

ranges (list(ValueRange)) – List of ValueRanges

Return type:

PossibleValueSet

Example:

>>> v_1 = ValueRange(0, 5, 1)
>>> v_2 = ValueRange(7, 10, 1)
>>> val = PossibleValueSet.unsigned_range_value([v_1, v_2])
<unsigned ranges: [<range: 0x0 to 0x5>, <range: 0x7 to 0xa>]>

xor(other: PossibleValueSet, size: int) → PossibleValueSet[source]¶

Perform bitwise XOR of two PossibleValueSets.

Parameters:

• other (PossibleValueSet)

• size (int)

Return type:

PossibleValueSet

property count: int¶

property mapping: Dict[int, int]¶

property offset: int¶

property ranges: List[ValueRange]¶

property reg: RegisterName¶

property size: int¶

property table: List[LookupTableEntry]¶

property type: RegisterValueType¶

property value: int¶

property values: Set[int]¶

Bases: object

__init__(value: int, offset: int, type: RegisterValueType = RegisterValueType.UndeterminedValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

classmethod from_BNRegisterValue(reg_value: BNRegisterValue | BNRegisterValueWithConfidence, arch: Architecture | None = None) → RegisterValue[source]¶

Parameters:

• reg_value (BNRegisterValue | BNRegisterValueWithConfidence)

• arch (Architecture | None)

Return type:

RegisterValue

classmethod to_BNRegisterValue(reg_value: RegisterValue) → BNRegisterValue[source]¶

Parameters:

reg_value (RegisterValue)

Return type:

BNRegisterValue

confidence: int = 255¶

offset: int¶

size: int = 0¶

type: RegisterValueType = 0¶

value: int¶

Bases: RegisterValue

__init__(value: int, offset: int = 0, type: RegisterValueType = RegisterValueType.ResultPointerValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

offset: int = 0¶

type: RegisterValueType = 8¶

Bases: RegisterValue

__init__(value: int, offset: int = 0, type: RegisterValueType = RegisterValueType.ReturnAddressValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

offset: int = 0¶

type: RegisterValueType = 6¶

Bases: RegisterValue

__init__(value: int, offset: int = 0, type: RegisterValueType = RegisterValueType.StackFrameOffset, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

offset: int = 0¶

type: RegisterValueType = 5¶

Bases: object

__init__(_source_operand: int | None, type: Type, name: str, var: Variable, referenced_offset: int, size: int) → None¶

Parameters:

• _source_operand (int | None)

• type (Type)

• name (str)

• var (Variable)

• referenced_offset (int)

• size (int)

Return type:

None

name: str¶

referenced_offset: int¶

size: int¶

property source_operand¶

type: Type¶

var: Variable¶

Bases: RegisterValue

__init__(value: int = 0, offset: int = 0, type: RegisterValueType = RegisterValueType.UndeterminedValue, confidence: int = 255, size: int = 0) → None¶

Parameters:

• value (int)

• offset (int)

• type (RegisterValueType)

• confidence (int)

• size (int)

Return type:

None

offset: int = 0¶

type: RegisterValueType = 0¶

value: int = 0¶

Bases: object

__init__(start: int, end: int, step: int) → None¶

Parameters:

• start (int)

• end (int)

• step (int)

Return type:

None

end: int¶

start: int¶

step: int¶

Bases: CoreVariable

class Variable represents variables in Binary Ninja. Variables are resolved in medium level IL, so variables objects are only valid for MLIL and above.

__init__(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, source_type: VariableSourceType, index: int, storage: int)[source]¶

Parameters:

• func (Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction)

• source_type (VariableSourceType)

• index (int)

• storage (int)

classmethod from_BNVariable(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, var: BNVariable)[source]¶

Parameters:

• func (Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction)

• var (BNVariable)

classmethod from_core_variable(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, var: CoreVariable)[source]¶

Parameters:

• func (Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction)

• var (CoreVariable)

classmethod from_identifier(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, identifier: int)[source]¶

Parameters:

• func (Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction)

• identifier (int)

classmethod from_variable_name_and_type(func: Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction, var: VariableNameAndType)[source]¶

Parameters:

• func (Function | LowLevelILFunction | MediumLevelILFunction | HighLevelILFunction)

• var (VariableNameAndType)

set_name_and_type_async(name: str | None, new_type: Type) → None[source]¶

set_name_and_type_async provides a way to asynchronously set both the name and type of a variable. This method should be used when speed is of concern.

Parameters:

• name (str | None)

• new_type (Type)

Return type:

None

set_name_async(name: str | None) → None[source]¶

set_name_async provides a way to asynchronously set the name of a variable. This method should be used when speed is of concern.

Parameters:

name (str | None)

Return type:

None

set_type_async(new_type: Type) → None[source]¶

set_type_async provides a way to asynchronously set the type of a variable. This method should be used when speed is of concern.

Parameters:

new_type (Type)

Return type:

None

property core_variable: CoreVariable¶

Retrieve the underlying CoreVariable class

property dead_store_elimination: DeadStoreElimination¶

returns the dead store elimination setting for this variable

property function: Function¶

returns the source Function object which this variable belongs to

property il_function: function.ILFunctionType¶

returns the IL Function object which this variable belongs to

property is_parameter_variable: bool¶

returns whether this variable is a function parameter

property last_seen_name: str¶

Name of the variable, or the name most recently assigned if the variable has since been removed (read-only).

property name: str¶

Name of the variable, Settings this property is slow because it ensures that analysis has been updated. If you are renaming many variables, use set_name_async, then call update_analysis when complete.

property offset_to_next_variable: int | None¶

returns number of bytes to the next variable on the stack

property ssa_versions: Generator[int, None, None]¶

Returns the SSA versions associated with this variable. Doesn’t return anything for aliased variables.

property type: Type | None¶

property var_name_and_type: VariableNameAndType¶

Convert to VariableNameAndType

Bases: CoreVariable

class VariableNameAndType is a lightweight wrapper around a variable and its name, useful for shuttling between APIs that require them both. While Variable has Variable.name and Variable.type fields, those require additional core calls each time you fetch them.

Variables:

• name – The variable’s name

• type – The variable’s type

__init__(_source_type: int, index: int, storage: int, name: str, type: Type) → None¶

Parameters:

• _source_type (int)

• index (int)

• storage (int)

• name (str)

• type (Type)

Return type:

None

classmethod from_core_variable(var, name, type)[source]¶

classmethod from_identifier(identifier, name, type)[source]¶

name: str¶

type: Type¶