architecture module¶
binaryninja.architecture.Architecture () |
class Architecture is the parent class for all CPU architectures. Subclasses of Architecture implement assembly, |
binaryninja.architecture.ArchitectureHook (...) |
|
binaryninja.architecture.CoreArchitecture (handle) |
|
binaryninja.architecture.ReferenceSource (...) |
|
binaryninja.architecture.range (*args) |
A Python2 and Python3 Compatible Range Generator |
binaryninja.architecture.with_metaclass (...) |
Create a base class with a metaclass. |
-
class
binaryninja.architecture.
Architecture
[source]¶ Bases:
object
class Architecture
is the parent class for all CPU architectures. Subclasses of Architecture implement assembly, disassembly, IL lifting, and patching.class Architecture
has a metaclass with the additional methodsregister
, and supports iteration:>>> #List the architectures >>> list(Architecture) [<arch: aarch64>, <arch: armv7>, <arch: armv7eb>, <arch: mipsel32>, <arch: mips32>, <arch: powerpc>, <arch: x86>, <arch: x86_64>] >>> #Register a new Architecture >>> class MyArch(Architecture): ... name = "MyArch" ... >>> MyArch.register() >>> list(Architecture) [<arch: aarch64>, <arch: armv7>, <arch: armv7eb>, <arch: mipsel32>, <arch: mips32>, <arch: powerpc>, <arch: x86>, <arch: x86_64>, <arch: MyArch>] >>>
For the purposes of this documentation the variable
arch
will be used in the following context>>> from binaryninja import * >>> arch = Architecture['x86']
-
address_size
= 8¶
-
always_branch
(data, addr)[source]¶ always_branch
reads the instruction(s) indata
at virtual addressaddr
and returns a string of bytes of the same length which always branches.Note
Architecture subclasses should implement this method.
Parameters: Returns: string containing len(data) which always branches to the same location as the provided instruction
Return type: Example: >>> bytes = arch.always_branch(arch.assemble("je 10")[0], 0) >>> arch.get_instruction_text(bytes, 0) (['nop '], 1L) >>> arch.get_instruction_text(bytes[1:], 0) (['jmp ', '0x9'], 5L) >>>
-
assemble
(code, addr=0)[source]¶ assemble
converts the string of assembly instructionscode
loaded at virtual addressaddr
to the byte representation of those instructions.Note
Architecture subclasses should implement this method.
Architecture plugins can override this method to provide assembler functionality. This can be done by simply shelling out to an assembler like yasm or llvm-mc, since this method isn’t performance sensitive.
Note
It is important that the assembler used accepts a syntax identical to the one emitted by the disassembler. This will prevent confusing the user.
Parameters: Returns: the bytes for the assembled instructions or error string
Return type: (a tuple of instructions and empty string) or (or None and error string)
Example: >>> arch.assemble("je 10") ('\x0f\x84\x04\x00\x00\x00', '') >>>
-
calling_conventions
¶ Dict of CallingConvention objects (read-only)
-
convert_to_nop
(data, addr)[source]¶ convert_to_nop
reads the instruction(s) indata
at virtual addressaddr
and returns a string of nop instructions of the same length as data.Note
Architecture subclasses should implement this method.
Parameters: Returns: string containing len(data) worth of no-operation instructions
Return type: Example: >>> arch.convert_to_nop("\x00\x00", 0) '\x90\x90' >>>
-
default_int_size
= 4¶
-
endianness
= <Endianness.LittleEndian: 0>¶
-
flag_conditions_for_semantic_flag_group
= {}¶
-
flag_roles
= {}¶
-
flag_write_types
= []¶
-
flags
= []¶
-
flags_required_for_flag_condition
= {}¶
-
flags_required_for_semantic_flag_group
= {}¶
-
flags_written_by_flag_write_type
= {}¶
-
full_width_regs
¶ List of full width register strings (read-only)
-
get_default_flag_condition_low_level_il
(cond, sem_class, il)[source]¶ Parameters: - cond (LowLevelILFlagCondition) –
- il (LowLevelILFunction) –
- sem_class (str) –
Return type:
-
get_default_flag_write_low_level_il
(op, size, role, operands, il)[source]¶ Parameters: - op (LowLevelILOperation) –
- size (int) –
- role (FlagRole) –
- or int) operands (list(str) – a list of either items that are either string register names or constant integer values
- il (LowLevelILFunction) –
Return type: LowLevelILExpr index
-
get_flag_by_name
(flag)[source]¶ get_flag_by_name
get flag name for flag index.Parameters: flag (int) – flag index Returns: flag name for flag index Return type: str
-
get_flag_condition_low_level_il
(cond, sem_class, il)[source]¶ Parameters: - cond (LowLevelILFlagCondition) – Flag condition to be computed
- sem_class (str) – Semantic class to be used (None for default semantics)
- il (LowLevelILFunction) – LowLevelILFunction object to append LowLevelILExpr objects to
Return type:
-
get_flag_name
(flag)[source]¶ get_flag_name
gets a flag name from a flag number.Parameters: reg (int) – register number Returns: the corresponding register string Return type: str
-
get_flag_role
(flag, sem_class=None)[source]¶ get_flag_role
gets the role of a given flag.Parameters: Returns: flag role
Return type:
-
get_flag_write_low_level_il
(op, size, write_type, flag, operands, il)[source]¶ Parameters: - op (LowLevelILOperation) –
- size (int) –
- write_type (str) –
- or int) operands (list(str) – a list of either items that are either string register names or constant integer values
- il (LowLevelILFunction) –
Return type:
-
get_flag_write_type_by_name
(write_type)[source]¶ get_flag_write_type_by_name
gets the flag write type name for the flage write type.Parameters: write_type (int) – flag write type Returns: flag write type Return type: str
-
get_flag_write_type_name
(write_type)[source]¶ get_flag_write_type_name
gets the flag write type name for the given flag.Parameters: write_type (int) – flag Returns: flag write type name Return type: str
-
get_instruction_info
(data, addr)[source]¶ get_instruction_info
returns an InstructionInfo object for the instruction at the given virtual addressaddr
with datadata
.Note
Architecture subclasses should implement this method.
Note
The instruction info object should always set the InstructionInfo.length to the instruction length, and the branches of the proper types shoulde be added if the instruction is a branch.
If the instruction is a branch instruction architecture plugins should add a branch of the proper type:
BranchType Description UnconditionalBranch Branch will always be taken FalseBranch False branch condition TrueBranch True branch condition CallDestination Branch is a call instruction (Branch with Link) FunctionReturn Branch returns from a function SystemCall System call instruction IndirectBranch Branch destination is a memory address or register UnresolvedBranch Branch destination is an unknown address Parameters: Returns: the InstructionInfo for the current instruction
Return type:
-
get_instruction_low_level_il
(data, addr, il)[source]¶ get_instruction_low_level_il
appends LowLevelILExpr objects toil
for the instruction at the given virtual addressaddr
with datadata
.This is used to analyze arbitrary data at an address, if you are working with an existing binary, you likely want to be using
Function.get_low_level_il_at
.Note
Architecture subclasses should implement this method.
Parameters: - data (str) – max_instruction_length bytes from the binary at virtual address
addr
- addr (int) – virtual address of bytes in
data
- il (LowLevelILFunction) – The function the current instruction belongs to
Returns: the length of the current instruction
Return type: - data (str) – max_instruction_length bytes from the binary at virtual address
-
get_instruction_text
(data, addr)[source]¶ get_instruction_text
returns a list of InstructionTextToken objects for the instruction at the given virtual addressaddr
with datadata
.Note
Architecture subclasses should implement this method.
Parameters: Returns: an InstructionTextToken list for the current instruction
Return type: list(InstructionTextToken)
-
get_intrinsic_name
(intrinsic)[source]¶ get_intrinsic_name
gets an intrinsic name from an intrinsic number.Parameters: intrinsic (int) – intrinsic number Returns: the corresponding intrinsic string Return type: str
-
get_low_level_il_from_bytes
(data, addr)[source]¶ get_low_level_il_from_bytes
converts the instruction in bytes toil
at the given virtual addressParameters: Returns: the instruction
Return type: Example: >>> arch.get_low_level_il_from_bytes('ëþ', 0x40DEAD) <il: jump(0x40dead)> >>>
-
get_modified_regs_on_write
(reg)[source]¶ get_modified_regs_on_write
returns a list of register names that are modified whenreg
is written.Parameters: reg (str) – string register name Returns: list of register names Return type: list(str)
-
get_reg_name
(reg)[source]¶ get_reg_name
gets a register name from a register number.Parameters: reg (int) – register number Returns: the corresponding register string Return type: str
-
get_reg_stack_name
(reg_stack)[source]¶ get_reg_stack_name
gets a register stack name from a register stack number.Parameters: reg_stack (int) – register stack number Returns: the corresponding register string Return type: str
-
get_semantic_flag_class_by_name
(sem_class)[source]¶ get_semantic_flag_class_by_name
gets the semantic flag class index by name.Parameters: sem_class (int) – semantic flag class Returns: semantic flag class index Return type: str
-
get_semantic_flag_class_name
(class_index)[source]¶ get_semantic_flag_class_name
gets the name of a semantic flag class from the index.Parameters: _index (int) – class_index Returns: the name of the semantic flag class Return type: str
-
get_semantic_flag_group_by_name
(sem_group)[source]¶ get_semantic_flag_group_by_name
gets the semantic flag group index by name.Parameters: sem_group (int) – semantic flag group Returns: semantic flag group index Return type: str
-
get_semantic_flag_group_low_level_il
(sem_group, il)[source]¶ Parameters: - sem_group (str) –
- il (LowLevelILFunction) –
Return type:
-
get_semantic_flag_group_name
(group_index)[source]¶ get_semantic_flag_group_name
gets the name of a semantic flag group from the index.Parameters: group_index (int) – group_index Returns: the name of the semantic flag group Return type: str
-
get_view_type_constant
(type_name, const_name, default_value=0)[source]¶ get_view_type_constant
retrieves the view type constant for the given type_name and const_name.Parameters: Returns: The BinaryView type constant or the default_value if not found
Return type: Example: >>> ELF_RELOC_COPY = 5 >>> arch.set_view_type_constant("ELF", "R_COPY", ELF_RELOC_COPY) >>> arch.get_view_type_constant("ELF", "R_COPY") 5L >>> arch.get_view_type_constant("ELF", "NOT_HERE", 100) 100L
-
global_regs
= []¶
-
instr_alignment
= 1¶
-
intrinsics
= {}¶
-
invert_branch
(data, addr)[source]¶ invert_branch
reads the instruction(s) indata
at virtual addressaddr
and returns a string of bytes of the same length which inverts the branch of provided instruction.Note
Architecture subclasses should implement this method.
Parameters: Returns: string containing len(data) which always branches to the same location as the provided instruction
Return type: Example: >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("je 10")[0], 0), 0) (['jne ', '0xa'], 6L) >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("jo 10")[0], 0), 0) (['jno ', '0xa'], 6L) >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("jge 10")[0], 0), 0) (['jl ', '0xa'], 6L) >>>
-
is_always_branch_patch_available
(data, addr)[source]¶ is_always_branch_patch_available
determines if the instructiondata
ataddr
can be made to always branch.Note
Architecture subclasses should implement this method.
Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_always_branch_patch_available(arch.assemble("je 10")[0], 0) True >>> arch.is_always_branch_patch_available(arch.assemble("nop")[0], 0) False >>>
-
is_invert_branch_patch_available
(data, addr)[source]¶ is_always_branch_patch_available
determines if the instructiondata
ataddr
can be inverted.Note
Architecture subclasses should implement this method.
Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_invert_branch_patch_available(arch.assemble("je 10")[0], 0) True >>> arch.is_invert_branch_patch_available(arch.assemble("nop")[0], 0) False >>>
-
is_never_branch_patch_available
(data, addr)[source]¶ is_never_branch_patch_available
determines if the instructiondata
ataddr
can be made to never branch.Note
Architecture subclasses should implement this method.
Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_never_branch_patch_available(arch.assemble("je 10")[0], 0) True >>> arch.is_never_branch_patch_available(arch.assemble("nop")[0], 0) False >>>
-
is_skip_and_return_value_patch_available
(data, addr)[source]¶ is_skip_and_return_value_patch_available
determines if the instructiondata
ataddr
is a call-like instruction that can be made into an instruction returns a value.Note
Architecture subclasses should implement this method.
Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_skip_and_return_value_patch_available(arch.assemble("call 0")[0], 0) True >>> arch.is_skip_and_return_value_patch_available(arch.assemble("jmp eax")[0], 0) False >>>
-
is_skip_and_return_zero_patch_available
(data, addr)[source]¶ is_skip_and_return_zero_patch_available
determines if the instructiondata
ataddr
is a call-like instruction that can be made into an instruction returns zero.Note
Architecture subclasses should implement this method.
Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("call 0")[0], 0) True >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("call eax")[0], 0) True >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("jmp eax")[0], 0) False >>>
-
is_view_type_constant_defined
(type_name, const_name)[source]¶ Parameters: Return type: Example: >>> arch.set_view_type_constant("ELF", "R_COPY", ELF_RELOC_COPY) >>> arch.is_view_type_constant_defined("ELF", "R_COPY") True >>> arch.is_view_type_constant_defined("ELF", "NOT_THERE") False >>>
-
link_reg
= None¶
-
list
= [<arch: aarch64>, <arch: armv7>, <arch: thumb2>, <arch: armv7eb>, <arch: thumb2eb>, <arch: mipsel32>, <arch: mips32>, <arch: ppc>, <arch: ppc_le>, <arch: x86>, <arch: x86_64>]¶
-
max_instr_length
= 16¶
-
name
= None¶
-
next_address
= 0¶
-
opcode_display_length
= 8¶
-
perform_always_branch
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
always_branch
.Parameters: Returns: The bytes of the replacement unconditional branch instruction
Return type:
-
perform_assemble
(code, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
assemble
.Parameters: Returns: the bytes for the assembled instructions or error string
Return type: (a tuple of instructions and empty string) or (or None and error string)
-
perform_convert_to_nop
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
convert_to_nop
.Parameters: Returns: nop sequence of same length as
data
or NoneReturn type: str or None
-
perform_get_associated_arch_by_address
(addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_associated_arch_by_address
.
-
perform_get_flag_condition_low_level_il
(cond, sem_class, il)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_flag_condition_low_level_il
.Parameters: - cond (LowLevelILFlagCondition) – Flag condition to be computed
- sem_class (str) – Semantic class to be used (None for default semantics)
- il (LowLevelILFunction) – LowLevelILFunction object to append LowLevelILExpr objects to
Return type:
-
perform_get_flag_role
(flag, sem_class)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_flag_role
.
-
perform_get_flag_write_low_level_il
(op, size, write_type, flag, operands, il)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_flag_write_low_level_il
.Parameters: - op (LowLevelILOperation) –
- size (int) –
- write_type (int) –
- flag (int) –
- list(int_or_str) –
- il (LowLevelILFunction) –
Return type:
-
perform_get_flags_required_for_flag_condition
(cond, sem_class)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_flags_required_for_flag_condition
.
-
perform_get_instruction_info
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_instruction_info
.Parameters: Returns: a
InstructionInfo
object containing the length and branche types for the given instructionReturn type:
-
perform_get_instruction_low_level_il
(data, addr, il)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_instruction_low_level_il
.Parameters: - data (str) – bytes to be interpreted as low-level IL instructions
- addr (int) – virtual address of start of
data
- il (LowLevelILFunction) – LowLevelILFunction object to append LowLevelILExpr objects to
Return type: length of bytes read on success, None on failure
-
perform_get_instruction_text
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_instruction_text
.Parameters: Returns: a tuple of list(InstructionTextToken) and length of instruction decoded
Return type: tuple(list(InstructionTextToken), int)
-
perform_get_semantic_flag_group_low_level_il
(sem_group, il)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
get_semantic_flag_group_low_level_il
.Parameters: - sem_group (str) – Semantic group to be computed
- il (LowLevelILFunction) – LowLevelILFunction object to append LowLevelILExpr objects to
Return type:
-
perform_invert_branch
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
invert_branch
.Parameters: Returns: The bytes of the replacement unconditional branch instruction
Return type:
-
perform_is_always_branch_patch_available
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
is_always_branch_patch_available
.Parameters: Returns: True if the instruction can be patched, False otherwise
Return type:
-
perform_is_invert_branch_patch_available
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
is_invert_branch_patch_available
.Parameters: addr (int) – the virtual address of the instruction to be patched Returns: True if the instruction can be patched, False otherwise Return type: bool
-
perform_is_never_branch_patch_available
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
is_never_branch_patch_available
.Note
Architecture subclasses should implement this method.
Warning
This method should never be called directly.
Parameters: Returns: True if the instruction can be patched, False otherwise
Return type:
-
perform_is_skip_and_return_value_patch_available
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
is_skip_and_return_value_patch_available
.Parameters: Returns: True if the instruction can be patched, False otherwise
Return type:
-
perform_is_skip_and_return_zero_patch_available
(data, addr)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
is_skip_and_return_zero_patch_available
.Parameters: Returns: True if the instruction can be patched, False otherwise
Return type:
-
perform_skip_and_return_value
(data, addr, value)[source]¶ Deprecated method provided for compatibility. Architecture plugins should override
skip_and_return_value
.Parameters: Returns: The bytes of the replacement unconditional branch instruction
Return type:
-
reg_stacks
= {}¶
-
register_calling_convention
(cc)[source]¶ register_calling_convention
registers a new calling convention for the Architecture.Parameters: cc (CallingConvention) – CallingConvention object to be registered Return type: None
-
regs
= {}¶
-
semantic_class_for_flag_write_type
= {}¶
-
semantic_flag_classes
= []¶
-
semantic_flag_groups
= []¶
-
set_view_type_constant
(type_name, const_name, value)[source]¶ set_view_type_constant
creates a new binaryview type constant.Parameters: Return type: Example: >>> ELF_RELOC_COPY = 5 >>> arch.set_view_type_constant("ELF", "R_COPY", ELF_RELOC_COPY) >>>
-
skip_and_return_value
(data, addr, value)[source]¶ skip_and_return_value
reads the instruction(s) indata
at virtual addressaddr
and returns a string of bytes of the same length which doesn’t call and instead return a value.Note
Architecture subclasses should implement this method.
Parameters: Returns: string containing len(data) which always branches to the same location as the provided instruction
Return type: Example: >>> arch.get_instruction_text(arch.skip_and_return_value(arch.assemble("call 10")[0], 0, 0), 0) (['mov ', 'eax', ', ', '0x0'], 5L) >>>
-
stack_pointer
= None¶
-
standalone_platform
¶ Architecture standalone platform (read-only)
-
-
class
binaryninja.architecture.
CoreArchitecture
(handle)[source]¶ Bases:
binaryninja.architecture.Architecture
-
always_branch
(data, addr)[source]¶ always_branch
reads the instruction(s) indata
at virtual addressaddr
and returns a string of bytes of the same length which always branches.Parameters: Returns: string containing len(data) which always branches to the same location as the provided instruction
Return type: Example: >>> bytes = arch.always_branch(arch.assemble("je 10")[0], 0) >>> arch.get_instruction_text(bytes, 0) (['nop '], 1L) >>> arch.get_instruction_text(bytes[1:], 0) (['jmp ', '0x9'], 5L) >>>
-
assemble
(code, addr=0)[source]¶ assemble
converts the string of assembly instructionscode
loaded at virtual addressaddr
to the byte representation of those instructions.Parameters: Returns: the bytes for the assembled instructions
Return type: Python3 - a ‘bytes’ object; Python2 - a ‘str’
Example: >>> arch.assemble("je 10") ('\x0f\x84\x04\x00\x00\x00', '') >>>
-
convert_to_nop
(data, addr)[source]¶ convert_to_nop
reads the instruction(s) indata
at virtual addressaddr
and returns a string of nop instructions of the same length as data.Parameters: Returns: string containing len(data) worth of no-operation instructions
Return type: Example: >>> arch.convert_to_nop("\x00\x00", 0) '\x90\x90' >>>
-
get_flag_condition_low_level_il
(cond, sem_class, il)[source]¶ Parameters: - cond (LowLevelILFlagCondition) – Flag condition to be computed
- sem_class (str) – Semantic class to be used (None for default semantics)
- il (LowLevelILFunction) – LowLevelILFunction object to append LowLevelILExpr objects to
Return type:
-
get_flag_role
(flag, sem_class=None)[source]¶ get_flag_role
gets the role of a given flag.Parameters: Returns: flag role
Return type:
-
get_flag_write_low_level_il
(op, size, write_type, flag, operands, il)[source]¶ Parameters: - op (LowLevelILOperation) –
- size (int) –
- write_type (str) –
- or int) operands (list(str) – a list of either items that are either string register names or constant integer values
- il (LowLevelILFunction) –
Return type:
-
get_instruction_info
(data, addr)[source]¶ get_instruction_info
returns an InstructionInfo object for the instruction at the given virtual addressaddr
with datadata
.Note
The instruction info object should always set the InstructionInfo.length to the instruction length, and the branches of the proper types shoulde be added if the instruction is a branch.
Parameters: Returns: the InstructionInfo for the current instruction
Return type:
-
get_instruction_low_level_il
(data, addr, il)[source]¶ get_instruction_low_level_il
appends LowLevelILExpr objects toil
for the instruction at the given virtual addressaddr
with datadata
.This is used to analyze arbitrary data at an address, if you are working with an existing binary, you likely want to be using
Function.get_low_level_il_at
.Parameters: - data (str) – max_instruction_length bytes from the binary at virtual address
addr
- addr (int) – virtual address of bytes in
data
- il (LowLevelILFunction) – The function the current instruction belongs to
Returns: the length of the current instruction
Return type: - data (str) – max_instruction_length bytes from the binary at virtual address
-
get_instruction_text
(data, addr)[source]¶ get_instruction_text
returns a list of InstructionTextToken objects for the instruction at the given virtual addressaddr
with datadata
.Parameters: Returns: an InstructionTextToken list for the current instruction
Return type: list(InstructionTextToken)
-
get_semantic_flag_group_low_level_il
(sem_group, il)[source]¶ Parameters: - sem_group (str) –
- il (LowLevelILFunction) –
Return type:
-
invert_branch
(data, addr)[source]¶ invert_branch
reads the instruction(s) indata
at virtual addressaddr
and returns a string of bytes of the same length which inverts the branch of provided instruction.Parameters: Returns: string containing len(data) which always branches to the same location as the provided instruction
Return type: Example: >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("je 10")[0], 0), 0) (['jne ', '0xa'], 6L) >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("jo 10")[0], 0), 0) (['jno ', '0xa'], 6L) >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("jge 10")[0], 0), 0) (['jl ', '0xa'], 6L) >>>
-
is_always_branch_patch_available
(data, addr)[source]¶ is_always_branch_patch_available
determines if the instructiondata
ataddr
can be made to always branch.Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_always_branch_patch_available(arch.assemble("je 10")[0], 0) True >>> arch.is_always_branch_patch_available(arch.assemble("nop")[0], 0) False >>>
-
is_invert_branch_patch_available
(data, addr)[source]¶ is_always_branch_patch_available
determines if the instructiondata
ataddr
can be inverted.Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_invert_branch_patch_available(arch.assemble("je 10")[0], 0) True >>> arch.is_invert_branch_patch_available(arch.assemble("nop")[0], 0) False >>>
-
is_never_branch_patch_available
(data, addr)[source]¶ is_never_branch_patch_available
determines if the instructiondata
ataddr
can be made to never branch.Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_never_branch_patch_available(arch.assemble("je 10")[0], 0) True >>> arch.is_never_branch_patch_available(arch.assemble("nop")[0], 0) False >>>
-
is_skip_and_return_value_patch_available
(data, addr)[source]¶ is_skip_and_return_value_patch_available
determines if the instructiondata
ataddr
is a call-like instruction that can be made into an instruction returns a value.Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_skip_and_return_value_patch_available(arch.assemble("call 0")[0], 0) True >>> arch.is_skip_and_return_value_patch_available(arch.assemble("jmp eax")[0], 0) False >>>
-
is_skip_and_return_zero_patch_available
(data, addr)[source]¶ is_skip_and_return_zero_patch_available
determines if the instructiondata
ataddr
is a call-like instruction that can be made into an instruction returns zero.Parameters: Returns: True if the instruction can be patched, False otherwise
Return type: Example: >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("call 0")[0], 0) True >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("call eax")[0], 0) True >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("jmp eax")[0], 0) False >>>
-
skip_and_return_value
(data, addr, value)[source]¶ skip_and_return_value
reads the instruction(s) indata
at virtual addressaddr
and returns a string of bytes of the same length which doesn’t call and instead return a value.Parameters: Returns: string containing len(data) which always branches to the same location as the provided instruction
Return type: Example: >>> arch.get_instruction_text(arch.skip_and_return_value(arch.assemble("call 10")[0], 0, 0), 0) (['mov ', 'eax', ', ', '0x0'], 5L) >>>
-