Skip to main content
The CallsMatchingParam object defines the parameters used to search for and annotate function calls in a binary. It is used with methods like ProjectHandle:calls_matching to filter and analyze call sites based on function names, predicates, and dataflow annotations.

​
Fields

FieldDescriptionType
toFunction(s) to identify in the binarystring, AddressValue, or CallsToQuery
wherePredicate function to filter function callsfun(caller: FunctionContext)
usingLua expression specifying parameter annotations for the dataflow engineLua expression
debugEnables debug logs for the matching processboolean

​
Reference

​
to

The function(s) to identify in the binary. It can be a string (function name), an AddressValue (function address), or a CallsToQuery with pattern matching options.

​
where

A Lua function used to filter function calls. Receives a FunctionContext object and should return true for calls to include.

​
using

A Lua expression specifying how to annotate parameters and callees for dataflow analysis.
  • parameters assigns annotations to the parameters of the function being analyzed. . For example: parameters = {var:named "src", var:named "dst"}
  • callees assigns annotations to parameters and return values of functions called within the analyzed function. For example callees = { FunctionName = {output = ..., inputs = {...}} }
Do not use the same annotation name multiple times.

​
debug

If set to true, enables debug logging for the matching process.

​
Example

The following example finds all calls to memcpy in functions named target that also call malloc. It annotates parameters and callees for dataflow tracking. 
local call_sites = project:calls_matching({
  to = "memcpy",
  where = function(caller)
    return caller:named "target" and caller:has_call "malloc"
  end,
  using = {
    parameters = {var:named "name", var:named "value"},
    callees = {
      ["malloc"] = {output = var:named "env", inputs = {_}},
      ["strlen"] = {output = var:named "len", inputs = {_}}
    }
  }
})