TheDocumentation Index
Fetch the complete documentation index at: https://vulhunt-docs.binarly.io/llms.txt
Use this file to discover all available pages before exploring further.
ProjectHandle object provides access to several project-level methods in VulHunt rules.
It allows to enumerate functions, search for patterns, decompile code, and more.
Fields
| Field | Type | Description |
|---|---|---|
architecture | string | Architecture of the analyzed binary |
Methods
| Method | Description | Parameters | Return Type |
|---|---|---|---|
size_of | Returns the size of the given type | string | number |
lookup_prototype | Returns the function prototype for the given name | string | IRTerm |
lookup_type | Returns the type definition for the given name | string | IRTerm |
register_name | Returns the register name for a variable term | IRTerm | string |
resolve_type | Expands a type term, resolving aliases | IRTerm | IRTerm |
decompile | Decompiles one or more functions | string, AddressValue, or FunctionQuery | DecompiledFunction or DecompiledFunction[] |
functions | Returns one or more functions | string, AddressValue, FunctionQuery, or none | FunctionContext or FunctionContext[] |
functions_where | Returns a table of functions matching the given predicate function | fun(context: FunctionContext) | FunctionContext[] |
calls_matching | Returns the table of calls matching the predicates | CallsMatchingParam | CallsMatchingTable[] |
search_bytes | Returns true if the set of bytes is found in the binary, false otherwise | string | boolean |
search_string | Returns true if the string is found in the binary, false otherwise | [string, string (Kind)] | boolean |
search_code | Returns a SearchCodeResult if the code is found | [string, string (Location)] | SearchCodeResult |
search_guid | Returns true if the GUID is found, false otherwise | [string (UUID), string (Name)] | boolean |
search_nvram | Returns true if the NVRAM variable is found, false otherwise | [string (Service), string (Name), string (UUID)] | boolean |
search_ppi | Returns true if the PPI is found, false otherwise | [string (Service), string (Name), string (UUID)] | boolean |
search_protocol | Returns true if the Protocol is found, false otherwise | [string (Service), string (Name), string (UUID)] | boolean |
Reference
architecture
The architecture field contains the architecture of the analyzed binary in the triplet format (e.g.,"AARCH64:LE:64", "X86:LE:64").
size_of
Returns the size in bytes of the given type name.lookup_prototype
Looks up a function prototype by name in the type database.lookup_type
Looks up a type by name in the type database.register_name
Returns the architecture register name for a variable that refers to a register. Accepts anIRTerm with kind VAR. Returns nil if the variable is not a register.
resolve_type
Expands a type term by resolving aliases and typedefs.decompile
Decompiles one or more functions based on a string (function name),AddressValue (function address), or FunctionQuery object.
Returns DecompiledFunction or DecompiledFunction[] when using FunctionQuery with all=true.
decompile requires enabling the decompiler feature via the extension API.functions
Returns one or more functions based on a string (function name),AddressValue (function address), FunctionQuery object, or no input to return all functions.
Returns FunctionContext or FunctionContext[] when using FunctionQuery with all=true.
functions_where
ReturnsFunctionContext[] based on the Lua function given as predicate.
calls_matching
Returns a table of calls matching the provided predicates.search_bytes
Returnstrue if the specified byte sequence is found in the binary, false otherwise. Takes a hex pattern string as argument.
search_string
Returnstrue if the specified string is found in the binary, false otherwise. Takes a string value and an optional encoding kind as arguments.
The kind parameter specifies the string encoding, valid values are:
asciiutf8utf16utf16-leutf16leutf16-beutf16be
search_code
Returns aSearchCodeResult if the specified code is found in the binary. Takes a hex pattern string and an optional location string as arguments. The loc parameter is only available on UEFI platforms; valid values are:
sw_smi_handlerschild_sw_smi_handlers
search_guid
Returnstrue if the binary references the specified GUID, false otherwise. Takes the GUID and its symbolic name as arguments. (UEFI only)
search_nvram
Returnstrue if the binary accesses the specified NVRAM variable, false otherwise. Takes the runtime service used to access it (e.g., GetVariable, SetVariable), the variable name, and the vendor GUID as arguments. (UEFI only)
search_ppi
Returnstrue if the binary uses the specified PPI (PEIM-to-PEIM Interface), false otherwise. Takes the PEI service used to locate it (e.g., LocatePpi), the PPI name, and its GUID as arguments. (UEFI only)
search_protocol
Returnstrue if the binary uses the specified UEFI protocol, false otherwise. Takes the boot service used to locate it (e.g., LocateProtocol, HandleProtocol), the protocol name, and its GUID as arguments. (UEFI only)
Example
ProjectHandle: