Skip to main content
The OperandInfo object provides information about a function argument or return value at a call site, including annotations, origins, and values before and after the call.

​
Fields

FieldDescriptionType
nameOperand namestring
indexOperand indexnumber
pre_call_annotationAnnotation before the function callstring
post_call_annotationAnnotation after the function callstring
annotationSame as pre_call_annotationstring
pre_call_originOperand origin before the callOperandOrigin
post_call_originOperand origin after the callOperandOrigin
originSame as pre_call_originOperandOrigin
pre_call_stringString value before the callstring
post_call_stringString value after the callstring
stringSame as pre_call_stringstring
pre_call_constantOperand constant before the callBitVec
post_call_constantOperand constant after the callBitVec
constantSame as pre_call_constantBitVec

​
Methods

MethodDescriptionParametersReturn Type
is_const_pre_callReturns true if the operand yields a constant value before the call—boolean
is_const_post_callReturns true if the operand yields a constant value after the call—boolean
is_constSame as is_const_pre_call—boolean
is_unk_pre_callReturns true if the operand value is unknown before the call—boolean
is_unk_post_callReturns true if the operand value is unknown after the call—boolean
is_unkSame as is_unk_pre_call—boolean
pre_call_bytesReturns bytes at the address pointed by the operand before the callnumbernumber[]
post_call_bytesReturns bytes at the address pointed by the operand after the callnumbernumber[]
bytesSame as pre_call_bytesnumbernumber[]

​
Reference

​
name

The name of the operand.

​
index

The index of the operand in the parameter list.

​
pre_call_annotation / post_call_annotation / annotation

The annotation assigned to the operand before or after the call.
annotation is equivalent to pre_call_annotation.

​
pre_call_origin / post_call_origin / origin

The origin of the operand before or after the call.
origin is equivalent to pre_call_origin.

​
pre_call_string / post_call_string / string

The string value of the operand before or after the call. string is equivalent to pre_call_string.

​
is_const_pre_call / is_const_post_call / is_const

Returns true if the operand yields a constant value before or after the call. is_const is equivalent to is_const_pre_call.

​
is_unk_pre_call / is_unk_post_call / is_unk

Returns true if the operand value is unknown before or after the call. is_unk is equivalent to is_unk_pre_call.

​
pre_call_constant / post_call_constant / constant

The constant value of the operand before or after the call, returned as a BitVec. Returns nil if the operand does not resolve to a constant. constant is equivalent to pre_call_constant.

​
pre_call_bytes / post_call_bytes / bytes

Returns bytes at the address pointed by the operand before or after the call, returned as a table of numbers. bytes is equivalent to pre_call_bytes. These methods accept an optional limit parameter (defaults to 256) to limit the number of bytes returned.

​
Example

scopes = scope:calls{
  to = "strcpy",
  using = {parameters = {_, var:named "input"}},
  with = function(project, context)
    local src = context.inputs[1]  -- OperandInfo for the first argument
    if src:is_const() then
      print("Source is a constant string:", src.string)
    elseif src.annotation == "input" then
      print("Source is tainted with 'input'")
    end
  end
}