DecompiledFunction

The DecompiledFunction object represents the result of decompiling a function from the binary. It provides methods for printing the decompiled code and running syntax (Weggli-compatible) queries on the decompiled code.

Methods

Method	Description	Parameters	Return Type
`query`	Queries the decompiled code using a string or query table	`string` or `QueryTable`	`SyntaxMatchResult`

QueryTable

Field	Description	Type
`engine`	Defines the engine to use (currently only “syntax” is available)	`string`
`raw`	If true, the query will be used as-is; otherwise, it will be wrapped in `{{}}`	`boolean`
`unique`	Enforces that captured variables must refer to different nodes, ensuring no two placeholders match the same code element	`boolean`
`regexes`	A table of regular expressions to match (or exclude) variable names or values, enabling flexible constraints on captured elements	`string[]`
`query`	The query to execute	`string`

Reference

query

Queries the decompiled code using either a string or a QueryTable.

If a string is provided, it is interpreted as a syntax query.
If a QueryTable is provided, it must contain the fields described in the QueryTable above. The engine field is optional; omitting it defaults to the syntax engine.

Only the syntax engine is currently supported; specifying any other value results in a runtime error. Returns a SyntaxMatchResult object containing the query results.

Example

-- Match calls to free
decomp = project:decompile("target_function")
local matches = decomp:query("free($ptr)")

-- Match calls to memcpy-like functions
-- where the size argument is NOT a constant
decomp = project:decompile("vulnerable_function")
local matches = decomp:query{
    engine = 'syntax',
    raw = true,
    query = [[ $FN($DST, $SRC, $SIZE); ]],
    regexes = {
        "$FN=memcpy|memmove|strncpy",   -- function name must match one of these
        "$SIZE!=^[0-9]+$",              -- size must NOT be a plain numeric constant
    }
}

-- Print the matches
for _, m in ipairs(matches) do
    print(m)
end

Conventions

VulHunt Rules

Scopes

Types

Standard Library

Methods

QueryTable

Reference

query

Example

​Methods

​QueryTable

​Reference

​query

​Example

Methods

QueryTable

Reference

query

Example