> ## Documentation Index
> Fetch the complete documentation index at: https://vulhunt-docs.binarly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Functions Scope

The *scope:functions* allows to write VulHunt rules targeting specific functions in the binary.

| Parameter | Description                                        | Type                                                                                                                              | Required |
| :-------- | :------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------- | :------: |
| `target`  | Function(s) to identify in the binary              | `string`, [`AddressValue`](/vulhunt-reference/types/address-value), or [`FunctionQuery`](/vulhunt-reference/types/function-query) |    Yes   |
| `with`    | Lua function to execute for each matching function | `fun(project: ProjectHandle, context: FunctionContext)`                                                                           |    Yes   |

### Syntax

```lua theme={null}
scope:functions{
    target = <target>,
    with = <function>
}
```

### Reference

#### target

The *target* argument specifies the function(s) to identify in the binary. It accepts a `string` (function name), an [`AddressValue`](/vulhunt-reference/types/address-value) (function address), or a [`FunctionQuery`](/vulhunt-reference/types/function-query) for pattern matching (note: the `all` field is not allowed in this context).

<Note>
  `named` can also be used as an alias for `target` when a `string` is passed
</Note>

#### with

The *with* argument specifies the Lua function to execute for each matching function.

#### Example

```lua theme={null}
scopes = scope:functions{
  target = "target_function",
  with = function(project, context)
    -- Function-level analysis logic goes here
  end
}

-- Target by symbol pattern (regex)
scopes = scope:functions{
  target = {matching = "ssh_scp_", kind = "symbol"},
  with = function(project, context)
    -- Matches all functions with names matching the regex
  end
}

-- Target by byte pattern
scopes = scope:functions{
  target = {matching = "415455534881EC2004000064488B04", kind = "bytes"},
  with = function(project, context)
    -- Matches functions containing the byte sequence
  end
}
```