Functions Scope - VulHunt rules

The scope:functions allows to write VulHunt rules targeting specific functions in the binary.

Parameter	Description	Type	Required
`target`	Function(s) to identify in the binary	`string`, `AddressValue`, or `FunctionQuery`	Yes
`with`	Lua function to execute for each matching function	`fun(project: ProjectHandle, context: FunctionContext)`	Yes

Syntax

scope:functions {
  target = <target>,
  with = <function>,
}

Reference

target

The target argument specifies the function(s) to identify in the binary. It accepts a string (function name), an AddressValue (function address), or a FunctionQuery for pattern matching (note: the all field is not allowed in this context).

named can also be used as an alias for target when a string is passed

with

The with argument specifies the Lua function to execute for each matching function.

Example

scopes = scope:functions {
  target = "target_function",
  with = function(project, context)
    -- Function-level analysis logic goes here
  end,
}

-- Target by symbol pattern (regex)
scopes = scope:functions {
  target = { matching = "ssh_scp_", kind = "symbol" },
  with = function(project, context)
    -- Matches all functions with names matching the regex
  end,
}

-- Target by byte pattern
scopes = scope:functions {
  target = { matching = "415455534881EC2004000064488B04", kind = "bytes" },
  with = function(project, context)
    -- Matches functions containing the byte sequence
  end,
}