Skip to main content
The FunctionQuery object provides advanced pattern matching capabilities for querying functions in VulHunt rules. It enables regex-based symbol matching and byte pattern matching.

Fields

Reference

kind

The kind field specifies the type of pattern matching:
  • "symbol": Matches function names using regular expressions. This is the default value.
  • "bytes": Matches functions containing the specified byte sequence.

matching

The matching field specifies the pattern to match. The interpretation depends on the kind field:
  • For kind = "symbol": A regular expression pattern to match against function names.
  • For kind = "bytes": A hexadecimal byte sequence to find in function code.

all

The all field is a boolean flag that controls result quantity:
  • false: Returns only the first match. This is the default value.
  • true: Returns all matching functions.

Example