> ## Documentation Index
> Fetch the complete documentation index at: https://vulhunt-docs.binarly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# CallsFromQuery

The `CallsFromQuery` object provides flexible options for selecting the functions to enumerate calls from in VulHunt rules. It supports querying by address, function name, or pattern matching.

### Fields

| Field            | Type                                                     | Description                                                                             |
| :--------------- | :------------------------------------------------------- | :-------------------------------------------------------------------------------------- |
| `address`        | [`AddressValue`](/vulhunt-reference/types/address-value) | Address of the target function to find calls from                                       |
| `named`          | `string`                                                 | Name of the target function to find calls from                                          |
| `kind`           | `string`                                                 | Pattern type: `"symbol"` for regex on function names, or `"bytes"` for hex byte pattern |
| `matching`       | `string`                                                 | Pattern to match (required when using pattern matching)                                 |
| `jumps_as_calls` | `boolean`                                                | When true, treats jump instructions as function calls                                   |

### Reference

#### address

The *address* field specifies the address of the target function to find calls from. Cannot be used together with `named` or pattern matching fields.

#### named

The *named* field specifies the name of the target function to find calls from. Cannot be used together with `address` or pattern matching fields. Names may be specified with an optional `imp.` prefix, which is used internally to disambiguate symbols with the same name referring to an imported and local function. The imported function will have the `imp.` prefix, while the local function will not. The matching engine will take care to follow a user's intent and find all viable matches of either variant.

#### kind

The *kind* field specifies the type of pattern matching:

* `"symbol"`: Matches function names using regular expressions. This is the default value.
* `"bytes"`: Matches functions containing the specified byte sequence.

#### matching

The *matching* field specifies the pattern to match. The interpretation depends on the `kind` field:

* For `kind = "symbol"`: A regular expression pattern to match against function names.
* For `kind = "bytes"`: A hexadecimal byte sequence to find in function code.

#### jumps\_as\_calls

The *jumps\_as\_calls* field is a boolean flag that treats jump instructions as function calls. This is useful for analyzing tail calls and indirect jumps.

### Example

```lua theme={null}
-- Enumerate the calls performed from a function by name (simple string)
local results = project:callees_matching({from = "process_request"})

-- Enumerate calls from every function matching a symbol pattern
local results = project:callees_matching({
  from = {
    matching = "^handle_",
    kind = "symbol",
    jumps_as_calls = true
  }
})
```