Skip to main content

Documentation Index

Fetch the complete documentation index at: https://vulhunt-docs.binarly.io/llms.txt

Use this file to discover all available pages before exploring further.

The scope:functions allows to write VulHunt rules targeting specific functions in the binary.
ParameterDescriptionTypeRequired
targetFunction(s) to identify in the binarystring, AddressValue, or FunctionQueryYes
withLua function to execute for each matching functionfun(project: ProjectHandle, context: FunctionContext)Yes

​
Syntax

scope:functions{
    target = <target>,
    with = <function>
}

​
Reference

​
target

The target argument specifies the function(s) to identify in the binary. It accepts a string (function name), an AddressValue (function address), or a FunctionQuery for pattern matching (note: the all field is not allowed in this context).
named can also be used as an alias for target when a string is passed

​
with

The with argument specifies the Lua function to execute for each matching function.

​
Example

scopes = scope:functions{
  target = "target_function",
  with = function(project, context)
    -- Function-level analysis logic goes here
  end
}

-- Target by symbol pattern (regex)
scopes = scope:functions{
  target = {matching = "ssh_scp_", kind = "symbol"},
  with = function(project, context)
    -- Matches all functions with names matching the regex
  end
}

-- Target by byte pattern
scopes = scope:functions{
  target = {matching = "415455534881EC2004000064488B04", kind = "bytes"},
  with = function(project, context)
    -- Matches functions containing the byte sequence
  end
}