binaryninja.lowlevelil.LowLevelILFunction¶

class LowLevelILFunction(arch=None, handle=None, source_func=None)[source]¶

class LowLevelILFunction contains the list of LowLevelILExpr objects that make up a binaryninja.function. LowLevelILExpr objects can be added to the LowLevelILFunction by calling append and passing the result of the various class methods which return LowLevelILExpr objects.

LowLevelILFlagCondition values used as parameters in the flag_condition method.

LowLevelILFlagCondition Operator Description

LLFC_E == Equal

LLFC_NE != Not equal

LLFC_SLT s< Signed less than

LLFC_ULT u< Unsigned less than

LLFC_SLE s<= Signed less than or equal

LLFC_ULE u<= Unsigned less than or equal

LLFC_SGE s>= Signed greater than or equal

LLFC_UGE u>= Unsigned greater than or equal

LLFC_SGT s> Signed greater than

LLFC_UGT u> Unsigned greater than

LLFC_NEG

Negative

LLFC_POS

Positive

LLFC_O overflow Overflow

LLFC_NO !overflow No overflow

__init__(arch=None, handle=None, source_func=None)[source]¶: x.__init__(…) initializes x; see help(type(x)) for signature

Methods

`__init__`([arch, handle, source_func])	x.__init__(…) initializes x; see help(type(x)) for signature
`add`(size, a, b[, flags])	`add` adds expression `a` to expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`add_carry`(size, a, b, carry[, flags])	`add_carry` adds with carry expression `a` to expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`add_label_for_address`(arch, addr)	`add_label_for_address` adds a low-level IL label for the given architecture `arch` at the given virtual address `addr`
`add_label_list`(labels)	`add_label_list` returns a label list expression for the given list of LowLevelILLabel objects.
`add_operand_list`(operands)	`add_operand_list` returns an operand list expression for the given list of integer operands.
`and_expr`(size, a, b[, flags])	`and_expr` bitwise and’s expression `a` and expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`append`(expr)	`append` adds the LowLevelILExpr `expr` to the current LowLevelILFunction.
`arith_shift_right`(size, a, b[, flags])	`arith_shift_right` shifts arithmatic right expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`breakpoint`()	`breakpoint` returns a processor breakpoint expression.
`call`(dest)	`call` returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression `dest`
`call_stack_adjust`(dest, stack_adjust)	`call_stack_adjust` returns an expression which first pushes the address of the next instruction onto the stack then jumps (branches) to the expression `dest`.
`ceil`(size, value[, flags])	`ceil` rounds a floating point value to an integer towards positive infinity
`clear_indirect_branches`()
`compare_equal`(size, a, b)	`compare_equal` returns comparison expression of size `size` checking if expression `a` is equal to expression `b`
`compare_not_equal`(size, a, b)	`compare_not_equal` returns comparison expression of size `size` checking if expression `a` is not equal to expression `b`
`compare_signed_greater_equal`(size, a, b)	`compare_signed_greater_equal` returns comparison expression of size `size` checking if expression `a` is signed greater than or equal to expression `b`
`compare_signed_greater_than`(size, a, b)	`compare_signed_greater_than` returns comparison expression of size `size` checking if expression `a` is signed greater than or equal to expression `b`
`compare_signed_less_equal`(size, a, b)	`compare_signed_less_equal` returns comparison expression of size `size` checking if expression `a` is signed less than or equal to expression `b`
`compare_signed_less_than`(size, a, b)	`compare_signed_less_than` returns comparison expression of size `size` checking if expression `a` is signed less than expression `b`
`compare_unsigned_greater_equal`(size, a, b)	`compare_unsigned_greater_equal` returns comparison expression of size `size` checking if expression `a` is unsigned greater than or equal to expression `b`
`compare_unsigned_greater_than`(size, a, b)	`compare_unsigned_greater_than` returns comparison expression of size `size` checking if expression `a` is unsigned greater than or equal to expression `b`
`compare_unsigned_less_equal`(size, a, b)	`compare_unsigned_less_equal` returns comparison expression of size `size` checking if expression `a` is unsigned less than or equal to expression `b`
`compare_unsigned_less_than`(size, a, b)	`compare_unsigned_less_than` returns comparison expression of size `size` checking if expression `a` is unsigned less than expression `b`
`const`(size, value)	`const` returns an expression for the constant integer `value` with size `size`
`const_pointer`(size, value)	`const_pointer` returns an expression for the constant pointer `value` with size `size`
`create_graph`([settings])
`div_double_prec_signed`(size, a, b[, flags])	`div_double_prec_signed` signed double precision divide using expression `a` as a single double precision register by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`div_double_prec_unsigned`(size, a, b[, flags])	`div_double_prec_unsigned` unsigned double precision divide using expression `a` as a single double precision register by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`div_signed`(size, a, b[, flags])	`div_signed` signed divide expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`div_unsigned`(size, a, b[, flags])	`div_unsigned` unsigned divide expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`expr`(operation[, a, b, c, d, size, flags])
`finalize`()	`finalize` ends the function and computes the list of basic blocks.
`flag`(reg)	`flag` returns a flag expression for the given flag name.
`flag_bit`(size, reg, bit)	`flag_bit` sets the flag named `reg` and size `size` to the constant integer value `bit`
`flag_condition`(cond[, sem_class])	`flag_condition` returns a flag_condition expression for the given LowLevelILFlagCondition
`flag_group`(sem_group)	`flag_group` returns a flag_group expression for the given semantic flag group
`float_abs`(size, value[, flags])	`float_abs` returns absolute value of floating point expression `value` of size `size` potentially setting flags
`float_add`(size, a, b[, flags])	`float_add` adds floating point expression `a` to expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`float_compare_equal`(size, a, b)	`float_compare_equal` returns floating point comparison expression of size `size` checking if expression `a` is equal to expression `b`
`float_compare_greater_equal`(size, a, b)	`float_compare_greater_equal` returns floating point comparison expression of size `size` checking if expression `a` is greater than or equal to expression `b`
`float_compare_greater_than`(size, a, b)	`float_compare_greater_than` returns floating point comparison expression of size `size` checking if expression `a` is greater than or equal to expression `b`
`float_compare_less_equal`(size, a, b)	`float_compare_less_equal` returns floating point comparison expression of size `size` checking if expression `a` is less than or equal to expression `b`
`float_compare_less_than`(size, a, b)	`float_compare_less_than` returns floating point comparison expression of size `size` checking if expression `a` is less than to expression `b`
`float_compare_not_equal`(size, a, b)	`float_compare_not_equal` returns floating point comparison expression of size `size` checking if expression `a` is not equal to expression `b`
`float_compare_unordered`(size, a, b)	`float_compare_unordered` returns floating point comparison expression of size `size` checking if expression `a` is unordered relative to expression `b`
`float_const_double`(value)	`float_const_double` returns an expression for the double precision floating point value `value`
`float_const_raw`(size, value)	`float_const_raw` returns an expression for the constant raw binary floating point value `value` with size `size`
`float_const_single`(value)	`float_const_single` returns an expression for the single precision floating point value `value`
`float_convert`(size, value[, flags])	`int_to_float` converts floating point value of expression `value` to size `size` potentially setting flags
`float_div`(size, a, b[, flags])	`float_div` divides floating point expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`float_mult`(size, a, b[, flags])	`float_mult` multiplies floating point expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`float_neg`(size, value[, flags])	`float_neg` returns sign negation of floating point expression `value` of size `size` potentially setting flags
`float_sqrt`(size, value[, flags])	`float_sqrt` returns square root of floating point expression `value` of size `size` potentially setting flags
`float_sub`(size, a, b[, flags])	`float_sub` subtracts floating point expression `b` from expression `a` potentially setting flags `flags` and returning an expression of `size` bytes.
`float_to_int`(size, value[, flags])	`float_to_int` returns integer value of floating point expression `value` of size `size` potentially setting flags
`float_trunc`(size, value[, flags])	`float_trunc` rounds a floating point value to an integer towards zero
`floor`(size, value[, flags])	`floor` rounds a floating point value to an integer towards negative infinity
`get_instruction_start`(addr[, arch])
`get_label_for_address`(arch, addr)	`get_label_for_address` returns the LowLevelILLabel for the given Architecture `arch` and IL address `addr`.
`get_mapped_medium_level_il_expr_index`(expr)
`get_mapped_medium_level_il_instruction_index`(instr)
`get_medium_level_il_expr_index`(expr)
`get_medium_level_il_instruction_index`(instr)
`get_non_ssa_instruction_index`(instr)
`get_ssa_flag_definition`(flag_ssa)
`get_ssa_flag_uses`(flag_ssa)
`get_ssa_flag_value`(flag_ssa)
`get_ssa_instruction_index`(instr)
`get_ssa_memory_definition`(index)
`get_ssa_memory_uses`(index)
`get_ssa_reg_definition`(reg_ssa)
`get_ssa_reg_uses`(reg_ssa)
`get_ssa_reg_value`(reg_ssa)
`goto`(label)	`goto` returns a goto expression which jumps to the provided LowLevelILLabel.
`if_expr`(operand, t, f)	`if_expr` returns the `if` expression which depending on condition `operand` jumps to the LowLevelILLabel `t` when the condition expression `operand` is non-zero and `f` when it’s zero.
`int_to_float`(size, value[, flags])	`int_to_float` returns floating point value of integer expression `value` of size `size` potentially setting flags
`intrinsic`(outputs, intrinsic, params[, flags])	`intrinsic` return an intrinsic expression.
`jump`(dest)	`jump` returns an expression which jumps (branches) to the expression `dest`
`load`(size, addr)	`load` Reads `size` bytes from the expression `addr`
`logical_shift_right`(size, a, b[, flags])	`logical_shift_right` shifts logically right expression `a` by expression `b` potentially setting flags flags``and returning an expression of ``size bytes.
`low_part`(size, value[, flags])	`low_part` truncates `value` to `size` bytes
`mark_label`(label)	`mark_label` assigns a LowLevelILLabel to the current IL address.
`mod_double_prec_signed`(size, a, b[, flags])	`mod_double_prec_signed` signed double precision modulus using expression `a` as a single double precision register by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`mod_double_prec_unsigned`(size, a, b[, flags])	`mod_double_prec_unsigned` unsigned double precision modulus using expression `a` as a single double precision register by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`mod_signed`(size, a, b[, flags])	`mod_signed` signed modulus expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`mod_unsigned`(size, a, b[, flags])	`mod_unsigned` unsigned modulus expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`mult`(size, a, b[, flags])	`mult` multiplies expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`mult_double_prec_signed`(size, a, b[, flags])	`mult_double_prec_signed` multiplies signed with double precision expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`mult_double_prec_unsigned`(size, a, b[, flags])	`mult_double_prec_unsigned` multiplies unsigned with double precision expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`neg_expr`(size, value[, flags])	`neg_expr` two’s complement sign negation of expression `value` of size `size` potentially setting flags
`no_ret`()	`no_ret` returns an expression halts disassembly
`nop`()	`nop` no operation, this instruction does nothing
`not_expr`(size, value[, flags])	`not_expr` bitwise inverse of expression `value` of size `size` potentially setting flags
`operand`(n, expr)	`operand` sets the operand number of the expression `expr` and passes back `expr` without modification.
`or_expr`(size, a, b[, flags])	`or_expr` bitwise or’s expression `a` and expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`pop`(size)	`pop` reads `size` bytes from the stack, adjusting the stack by `size`.
`push`(size, value)	`push` writes `size` bytes from expression `value` to the stack, adjusting the stack by `size`.
`reg`(size, reg)	`reg` returns a register of size `size` with name `reg`
`reg_split`(size, hi, lo)	`reg_split` combines registers of size `size` with names `hi` and `lo`
`reg_stack_pop`(size, reg_stack)	`reg_stack_pop` returns the top entry of size `size` in register stack with name `reg_stack`, and removes the entry from the stack
`reg_stack_push`(size, reg_stack, value[, flags])	`reg_stack_push` pushes the expression `value` of size `size` onto the top of the register stack `reg_stack`
`reg_stack_top_relative`(size, reg_stack, entry)	`reg_stack_top_relative` returns a register stack entry of size `size` at top-relative location `entry` in register stack with name `reg_stack`
`reloc_pointer`(size, value)	`reloc_pointer` returns an expression for the constant relocated pointer `value` with size `size`
`ret`(dest)	`ret` returns an expression which jumps (branches) to the expression `dest`.
`rotate_left`(size, a, b[, flags])	`rotate_left` bitwise rotates left expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`rotate_left_carry`(size, a, b, carry[, flags])	`rotate_left_carry` bitwise rotates left with carry expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`rotate_right`(size, a, b[, flags])	`rotate_right` bitwise rotates right expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`rotate_right_carry`(size, a, b, carry[, flags])	`rotate_right_carry` bitwise rotates right with carry expression `a` by expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`round_to_int`(size, value[, flags])	`round_to_int` rounds a floating point value to the nearest integer
`set_current_address`(value[, arch])
`set_flag`(flag, value)	`set_flag` sets the flag `flag` to the LowLevelILExpr `value`
`set_indirect_branches`(branches)
`set_reg`(size, reg, value[, flags])	`set_reg` sets the register `reg` of size `size` to the expression `value`
`set_reg_split`(size, hi, lo, value[, flags])	`set_reg_split` uses `hi` and `lo` as a single extended register setting `hi:lo` to the expression `value`.
`set_reg_stack_top_relative`(size, reg_stack, …)	`set_reg_stack_top_relative` sets the top-relative entry `entry` of size `size` in register stack `reg_stack` to the expression `value`
`shift_left`(size, a, b[, flags])	`shift_left` subtracts with borrow expression `b` from expression `a` potentially setting flags `flags` and returning an expression of `size` bytes.
`sign_extend`(size, value[, flags])	`sign_extend` two’s complement sign-extends the expression in `value` to `size` bytes
`store`(size, addr, value[, flags])	`store` Writes `size` bytes to expression `addr` read from expression `value`
`sub`(size, a, b[, flags])	`sub` subtracts expression `b` from expression `a` potentially setting flags `flags` and returning an expression of `size` bytes.
`sub_borrow`(size, a, b, carry[, flags])	`sub_borrow` subtracts with borrow expression `b` from expression `a` potentially setting flags `flags` and returning an expression of `size` bytes.
`system_call`()	`system_call` return a system call expression.
`tailcall`(dest)	`tailcall` returns an expression which jumps (branches) to the expression `dest`
`test_bit`(size, a, b)
`trap`(value)	`trap` returns a processor trap (interrupt) expression of the given integer `value`.
`undefined`()	`undefined` returns the undefined expression.
`unimplemented`()	`unimplemented` returns the unimplemented expression.
`unimplemented_memory_ref`(size, addr)	`unimplemented_memory_ref` a memory reference to expression `addr` of size `size` with unimplemented operation.
`xor_expr`(size, a, b[, flags])	`xor_expr` xor’s expression `a` with expression `b` potentially setting flags `flags` and returning an expression of `size` bytes.
`zero_extend`(size, value[, flags])	`zero_extend` zero-extends the expression in `value` to `size` bytes

Attributes

`basic_blocks`	list of LowLevelILBasicBlock objects (read-only)
`current_address`	Current IL Address (read/write)
`instructions`	A generator of llil instructions of the current llil function
`mapped_medium_level_il`	Medium level IL with mappings between low level IL and medium level IL.
`medium_level_il`	Medium level IL for this low level IL.
`non_ssa_form`	Low level IL in non-SSA (default) form (read-only)
`ssa_form`	Low level IL in SSA form (read-only)
`temp_flag_count`	Number of temporary flags (read-only)
`temp_reg_count`	Number of temporary registers (read-only)