> ## Documentation Index > Fetch the complete documentation index at: https://vulhunt-docs.binarly.io/llms.txt > Use this file to discover all available pages before exploring further. # FunctionContext The `FunctionContext` object provides access to information and utilities related to a specific function in the binary. It is used in VulHunt rules to inspect function properties, search for patterns, and analyze function calls. ### Fields | Field | Description | Type | | :------------ | :---------------------------------------------------------------------------------- | :------------------------------------------------------- | | `name` | Function name | `string` | | `address` | Function address | [`AddressValue`](/vulhunt-reference/types/address-value) | | `total_bytes` | Function length in bytes, calculated as the sum of the sizes of all its code blocks | `number` | ### Methods | Method | Description | Parameters | Return Type | | :-------------- | :----------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------- | | `calls` | Returns a table of addresses for calls to the specified function(s) | `string`, [`AddressValue`](/vulhunt-reference/types/address-value), or [`CallsToQuery`](/vulhunt-reference/types/calls-to-query) | [`AddressValue[]`](/vulhunt-reference/types/address-value) | | `has_call` | Returns true if the function contains a call to the specified function(s) | `string`, [`AddressValue`](/vulhunt-reference/types/address-value), or [`CallsToQuery`](/vulhunt-reference/types/calls-to-query) | `boolean` | | `has_reference` | Returns true if the function contains a cross-reference to the specified address | [`AddressValue`](/vulhunt-reference/types/address-value) | `boolean` | | `named` | Returns true if the function name matches the provided name | `string` | `boolean` | | `find` | Searches for a pattern in the function's code | [`PatternMatcher`](/vulhunt-reference/types/pattern-matcher) | [`AddressValue`](/vulhunt-reference/types/address-value) | | `matches` | Returns true if the function's code matches the given pattern | [`PatternMatcher`](/vulhunt-reference/types/pattern-matcher) | `boolean` | | `blocks` | Returns every basic block in the function as IR terms | — | [`IRTerm[]`](/vulhunt-reference/types/ir-term) | | `prototype` | Returns the inferred prototype for the function entry when available | — | [`IRTerm`](/vulhunt-reference/types/ir-term) | | `is_reachable` | Returns true if execution can flow from the first address to the second address | ([`AddressValue`](/vulhunt-reference/types/address-value), [`AddressValue`](/vulhunt-reference/types/address-value)) | `boolean` | | `dominates` | Returns true if the first address is in a block that dominates the block containing the second address | ([`AddressValue`](/vulhunt-reference/types/address-value), [`AddressValue`](/vulhunt-reference/types/address-value)) | `boolean` | | `precedes` | Returns true if the first address can reach the second and the second does not dominate the first | ([`AddressValue`](/vulhunt-reference/types/address-value), [`AddressValue`](/vulhunt-reference/types/address-value)) | `boolean` | ### Reference #### name The *name* field contains the name of the function. #### address The *address* field contains the address of the function in the binary. #### total\_bytes The *total\_bytes* field returns the function length in bytes, calculated as the sum of the sizes of all its code blocks. #### calls The *calls* method returns a table of addresses where the current function calls the specified function(s). Accepts a string (function name), [`AddressValue`](/vulhunt-reference/types/address-value) (function address), or [`CallsToQuery`](/vulhunt-reference/types/calls-to-query) for pattern matching. Returns an empty table when the specified function is not found. #### has\_call The *has\_call* method returns true if the function contains a call to the specified function(s). Accepts a string (function name), [`AddressValue`](/vulhunt-reference/types/address-value) (function address), or [`CallsToQuery`](/vulhunt-reference/types/calls-to-query) for pattern matching. #### has\_reference The *has\_reference* method returns true if the function contains a cross-reference to the specified address. Accepts an [`AddressValue`](/vulhunt-reference/types/address-value). #### named The *named* method returns true if the function name matches the provided name. #### find The *find* method searches for a pattern in the function's code and returns the address of the match, if found. #### matches The *matches* method returns true if the function's code matches the given pattern. #### blocks The *blocks* method returns every basic block in the function as [`IRTerm`](/vulhunt-reference/types/ir-term) objects. Each item can be traversed to inspect instructions, operands, or metadata. #### prototype The *prototype* method returns the inferred prototype as an [`IRTerm`](/vulhunt-reference/types/ir-term) for the function entry if one is available, otherwise `nil`. #### is\_reachable The *is\_reachable* method takes two [`AddressValue`](/vulhunt-reference/types/address-value) objects and reports whether execution can flow from the first address to the second inside the current function. #### dominates The *dominates* method returns true when the basic block that contains the first [`AddressValue`](/vulhunt-reference/types/address-value) dominates the block that contains the second address. #### precedes The *precedes* method returns true when the first address can reach the second and the second does not dominate the first, allowing you to assert ordering without full dominance math. ### Example ```lua theme={null} -- Detect a missing bounds check: target_function calls memcpy -- but the length argument may not be validated by a prior strlen call. scopes = scope:functions{ named = "target_function", with = function(project, context) -- Only proceed if the function calls memcpy if not context:has_call("memcpy") then return end local memcpy_calls = context:calls("memcpy") local strlen_calls = context:calls("strlen") -- For each memcpy call site, check whether a strlen call -- precedes it. If not, the length may be unchecked. for _, memcpy_addr in ipairs(memcpy_calls) do local has_prior_check = false for _, strlen_addr in ipairs(strlen_calls) do if context:precedes(strlen_addr, memcpy_addr) then has_prior_check = true break end end if not has_prior_check then -- Return a finding return result:high{...} end end -- Search for a known byte pattern in the function body local pattern = PatternMatcher.new("55 .. 89 E5 48") if context:matches(pattern) then local match_addr = context:find(pattern) end -- Walk the basic blocks of the function for _, block in ipairs(context:blocks()) do -- Each block is an IRTerm that can be inspected further end end } ```