Skip to main content

Documentation Index

Fetch the complete documentation index at: https://vulhunt-docs.binarly.io/llms.txt

Use this file to discover all available pages before exploring further.

The Evidence object provides structured evidence supporting a vulnerability finding. It maps code locations to annotations, allowing VulHunt rules to attach detailed context to findings.

​
Fields

FieldDescriptionType
functionsMaps a function address to an array of annotation objects. The address selects the function to show{[AddressValue]: Annotation}

​
Syntax

evidence = {
  functions = {
    [<AddressValue>] = <Array of Annotation>
  },
}

​
Reference

​
functions

A table mapping a function address (AddressValue) to an array of annotation objects (Annotation). The address determines the function to decompile and show, while annotations like annotate:at and annotate:prototype point to locations that should be annotated in the decompiled code.

​
Example

evidence = {
    functions = {
        [context.caller.address] = {
            annotate:prototype "int foo(char *arg1, struct bar* arg2);",
            annotate:at{
                location = context.caller.call_address,
                message = "The function `foo` calls `baz`..."
            }
        }
    }
}