Skip to content

Instantly share code, notes, and snippets.

@alexander-hanel
Last active August 24, 2022 19:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save alexander-hanel/982b66bade6e32f9259b9b7f55aea322 to your computer and use it in GitHub Desktop.
Save alexander-hanel/982b66bade6e32f9259b9b7f55aea322 to your computer and use it in GitHub Desktop.
Explore Binary Ninja's Python API
import logging
logging.basicConfig()
logging.getLogger().setLevel(logging.DEBUG)
file_name = ""
try:
import binaryninja
logging.debug("BinaryNinja has been imported")
except ModuleNotFoundError:
logging.critical("BinaryNinja module is not installed.")
exit()
with binaryninja.open_view(file_name) as bv:
print("bv.address_comments, %s" % (bv.address_comments))
print("bv.address_size, %s" % (bv.address_size))
print("bv.allocated_ranges, %s" % (bv.allocated_ranges))
print("bv.analysis_changed, %s" % (bv.analysis_changed))
print("bv.analysis_info, %s" % (bv.analysis_changed))
print("bv.analysis_progress, %s" % (bv.analysis_progress))
print("bv.arch %s " % (bv.arch))
print("bv.available_view_types %s" % (bv.available_view_types))
print("bv.basic_blocks, type: Generator")
for cc, gg in enumerate(bv.basic_blocks):
print("\tbasic block:", gg)
print ("\tbasic block instances:", [tt for tt in dir(gg) if "__" not in tt])
if cc == 3:
break
print("bv.data_tags, %s" % (bv.data_tags))
print("bv.data_vars, %s" % (bv.data_vars))
print("bv.end, %s" % (bv.end))
print("bv.endianness, %s" % (bv.endianness))
print("bv.entry_function, %s" % (bv.entry_function))
print("bv.entry_point, %s" % (bv.entry_point))
print("bv.executable, %s" % (bv.executable))
# print("dir(bv.file), %s ") % (dir(bv.file))
# print("bv.file.filename, %s" % (bv.file.filename))
print("bv.functions, %s" % (bv.functions))
for cc, gg in enumerate(bv.functions):
print("\tfunctions:", gg)
print ("\tfunctions instance:", [tt for tt in dir(gg) if "__" not in tt])
if cc == 3:
break
print("bv.global_pointer_value, %s" % (bv.global_pointer_value))
print("bv.has_data_variables, %s" % (bv.has_data_variables))
print("bv.has_database, %s" % (bv.has_database))
print("bv.has_functions, %s" % (bv.has_functions))
print("bv.has_symbols, %s" % (bv.has_symbols))
print("bv.hlil_basic_blocks, %s" % (bv.hlil_basic_blocks))
print("v.hlil_basic_blocks, %s" % (bv.hlil_basic_blocks))
print("bv.hlil_instructions, %s" % (bv.hlil_instructions))
print("bv.instructions, %s" % (bv.instructions))
print("bv.linear_disassembly, %s" % (bv.linear_disassembly))
for cc, gg in enumerate(bv.linear_disassembly):
print("\tlinear_disassembly:", gg)
print ("\tlinear_disassembly instance:", [tt for tt in dir(gg) if "__" not in tt])
if cc == 3:
break
print("bv.llil_basic_blocks, %s" % (bv.llil_basic_blocks))
for cc, gg in enumerate(bv.llil_basic_blocks):
print("\tllil_basic_blocks:", gg)
print ("\tllil_basic_blocks instance:", [tt for tt in dir(gg) if "__" not in tt])
if cc == 3:
break
print("bv.llil_instructions, %s" % (bv.llil_basic_blocks))
for cc, gg in enumerate(bv.llil_basic_blocks):
print("\tllil_basic_blocks:", gg)
print ("\tllil_basic_blocks instance:", [tt for tt in dir(gg) if "__" not in tt])
if cc == 3:
break
print("bv.long_name, %s" % (bv.long_name))
print("bv.llil_instructions, %s" % (bv.llil_instructions))
for cc, gg in enumerate(bv.llil_instructions):
print("\tllil_instructions:", gg)
print ("\tllil_instructions instance:", [tt for tt in dir(gg) if "__" not in tt])
if cc == 3:
break
print("bv.long_name, %s" % (bv.long_name))
print("bv.max_function_size_for_analysis, %s" % (bv.max_function_size_for_analysis))
print("bv.mlil_basic_blocks, %s" % (bv.mlil_basic_blocks))
for cc, gg in enumerate(bv.mlil_basic_blocks):
print("\tmlil_basic_blocks:", gg)
print ("\tmlil_basic_blocks instance:", [tt for tt in dir(gg) if "__" not in tt])
if cc == 3:
break
print("bv.mlil_instructions, %s" % (bv.mlil_instructions))
for cc, gg in enumerate(bv.llil_basic_blocks):
print("\tmlil_instructions:", gg)
print ("\tmlil_instructions instance:", [tt for tt in dir(gg) if "__" not in tt])
if cc == 3:
break
print("bv.modified), %s" % (bv.modified))
print("bv.name, %s" % (bv.name))
print("bv.namespaces, %s" % (bv.namespaces))
print("bv.new_auto_function_analysis_suppressed, %s" % (bv.new_auto_function_analysis_suppressed))
# print("bv.next_address, %s" % (bv.next_address))
# print("bv.notifications, %s" % (bv.notifications))
print("bv.offset, %s" % (bv.offset))
print("bv.parameters_for_analysis, %s" % (bv.parameters_for_analysis))
print("bv.parent_view, %s" % (bv.parent_view))
print("bv.platform, %s" % (bv.platform))
print("bv.registered_view_type, %s" % (bv.registered_view_type))
print("bv.relocatable, %s" % (bv.relocatable))
print("bv.relocation_ranges, %s" % (bv.relocation_ranges))
print("bv.saved, %s" % (bv.saved))
print("bv.sections, %s" % (bv.sections))
print("v.segments), %s" % (bv.segments))
print("bv.session_data, %s" % (bv.session_data))
print("bv.start, 0x%x" % (bv.start))
print("bv.strings, %s" % (bv.strings))
print("bv.symbols, %s" % (bv.symbols))
print("bv.tag_types, %s" % (bv.tag_types))
print("bv.type_libraries, %s" % (bv.type_libraries))
print("bv.type_names, %s" % (bv.type_names))
print("bv.types, %s" % (bv.types))
print("bv.view_type, %s" % (bv.view_type))
@alexander-hanel
Copy link
Author

Output

DEBUG:root:BinaryNinja has been imported
bv.address_comments, {}
bv.address_size, 4
bv.allocated_ranges, [<0x400000-0x400200>, <0x401000-0x4014c5>, <0x402000-0x40229c>]
bv.analysis_changed, False
bv.analysis_info, False
bv.analysis_progress, Idle
bv.arch x86 
bv.available_view_types []
bv.basic_blocks, type: Generator
	basic block: <block: x86@0x401000-0x401005>
	basic block instances: ['_arch', '_buildStartCache', '_create_instance', '_func', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	basic block: <block: x86@0x40100f-0x40101a>
	basic block instances: ['_arch', '_buildStartCache', '_create_instance', '_func', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	basic block: <block: x86@0x40104c-0x401059>
	basic block instances: ['_arch', '_buildStartCache', '_create_instance', '_func', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	basic block: <block: x86@0x40101a-0x40101f>
	basic block instances: ['_arch', '_buildStartCache', '_create_instance', '_func', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
bv.data_tags, []
bv.data_vars, {4194304: <var 0x400000: struct DOS_Header>, 4194368: <var 0x400040: void>, 4194432: <var 0x400080: struct COFF_Header>, 4194456: <var 0x400098: struct PE32_Optional_Header>, 4194680: <var 0x400178: struct Section_Header[0x2]>, 4198415: <var 0x40100f: void>, 4198450: <var 0x401032: void>, 4198486: <var 0x401056: void>, 4198967: <var 0x401237: void>, 4198995: <var 0x401253: void>, 4202496: <var 0x402000: struct Import_Directory_Table[0x4]>, 4202576: <var 0x402050: char[0xd]>, 4202590: <var 0x40205e: char[0xb]>, 4202602: <var 0x40206a: char[0xc]>, 4202616: <var 0x402078: uint32_t>, 4202620: <var 0x40207c: uint32_t>, 4202624: <var 0x402080: uint32_t>, 4202628: <var 0x402084: uint32_t>, 4202632: <var 0x402088: uint32_t>, 4202636: <var 0x40208c: uint32_t>, 4202640: <var 0x402090: uint32_t>, 4202644: <var 0x402094: uint32_t>, 4202648: <var 0x402098: uint32_t>, 4202652: <var 0x40209c: uint32_t>, 4202656: <var 0x4020a0: uint32_t>, 4202660: <var 0x4020a4: uint32_t>, 4202664: <var 0x4020a8: uint32_t>, 4202668: <var 0x4020ac: uint32_t>, 4202672: <var 0x4020b0: uint32_t>, 4202676: <var 0x4020b4: uint32_t>, 4202680: <var 0x4020b8: uint32_t>, 4202684: <var 0x4020bc: uint32_t>, 4202688: <var 0x4020c0: BOOL (__stdcall* const)(HANDLE hObject)>, 4202692: <var 0x4020c4: HANDLE (__stdcall* const)(enum CREATE_TOOLHELP_SNAPSHOT_FLAGS dwFlags, uint32_t th32ProcessID)>, 4202696: <var 0x4020c8: void (__stdcall* const)(uint32_t uExitCode) __noreturn>, 4202700: <var 0x4020cc: uint32_t (__stdcall* const)()>, 4202704: <var 0x4020d0: HINSTANCE (__stdcall* const)(PSTR lpModuleName)>, 4202708: <var 0x4020d4: FARPROC (__stdcall* const)(HINSTANCE hModule, PSTR lpProcName)>, 4202712: <var 0x4020d8: HINSTANCE (__stdcall* const)(PSTR lpLibFileName)>, 4202716: <var 0x4020dc: HANDLE (__stdcall* const)(enum PROCESS_ACCESS_RIGHTS dwDesiredAccess, BOOL bInheritHandle, uint32_t dwProcessId)>, 4202720: <var 0x4020e0: BOOL (__stdcall* const)(HANDLE hSnapshot, struct PROCESSENTRY32* lppe)>, 4202724: <var 0x4020e4: BOOL (__stdcall* const)(HANDLE hSnapshot, struct PROCESSENTRY32* lppe)>, 4202728: <var 0x4020e8: int32_t (* const)()>, 4202732: <var 0x4020ec: void (__stdcall* const)(uint32_t dwMilliseconds)>, 4202736: <var 0x4020f0: void* (__stdcall* const)(void* lpAddress, uint32_t* dwSize, enum VIRTUAL_ALLOCATION_TYPE flAllocationType, enum PAGE_PROTECTION_FLAGS flProtect)>, 4202740: <var 0x4020f4: PSTR (__stdcall* const)(PSTR lpString1, PSTR lpString2)>, 4202744: <var 0x4020f8: int32_t (__stdcall* const)(PSTR lpString1, PSTR lpString2)>, 4202748: <var 0x4020fc: PSTR (__stdcall* const)(PSTR lpString1, PSTR lpString2)>, 4202752: <var 0x402100: int32_t (__stdcall* const)(PSTR lpString)>, 4202760: <var 0x402108: uint16_t>, 4202762: <var 0x40210a: char[0xc]>, 4202774: <var 0x402116: uint16_t>, 4202776: <var 0x402118: char[0x19]>, 4202802: <var 0x402132: uint16_t>, 4202804: <var 0x402134: char[0xc]>, 4202816: <var 0x402140: uint16_t>, 4202818: <var 0x402142: char[0x14]>, 4202838: <var 0x402156: uint16_t>, 4202840: <var 0x402158: char[0x11]>, 4202858: <var 0x40216a: uint16_t>, 4202860: <var 0x40216c: char[0xf]>, 4202876: <var 0x40217c: uint16_t>, 4202878: <var 0x40217e: char[0xd]>, 4202892: <var 0x40218c: uint16_t>, 4202894: <var 0x40218e: char[0xc]>, 4202906: <var 0x40219a: uint16_t>, 4202908: <var 0x40219c: char[0xf]>, 4202924: <var 0x4021ac: uint16_t>, 4202926: <var 0x4021ae: char[0xe]>, 4202940: <var 0x4021bc: uint16_t>, 4202942: <var 0x4021be: char[0xe]>, 4202956: <var 0x4021cc: uint16_t>, 4202958: <var 0x4021ce: char[0x6]>, 4202964: <var 0x4021d4: uint16_t>, 4202966: <var 0x4021d6: char[0xd]>, 4202980: <var 0x4021e4: uint16_t>, 4202982: <var 0x4021e6: char[0x9]>, 4202992: <var 0x4021f0: uint16_t>, 4202994: <var 0x4021f2: char[0xa]>, 4203004: <var 0x4021fc: uint16_t>, 4203006: <var 0x4021fe: char[0x9]>, 4203016: <var 0x402208: uint16_t>, 4203018: <var 0x40220a: char[0x9]>, 4203028: <var 0x402214: uint32_t>, 4203032: <var 0x402218: uint32_t>, 4203036: <var 0x40221c: enum MESSAGEBOX_RESULT (__stdcall* const)(HWND hWnd, PSTR lpText, PSTR lpCaption, enum MESSAGEBOX_STYLE uType)>, 4203044: <var 0x402224: uint16_t>, 4203046: <var 0x402226: char[0xc]>, 4203060: <var 0x402234: uint32_t>, 4203064: <var 0x402238: uint32_t>, 4203068: <var 0x40223c: uint32_t>, 4203072: <var 0x402240: uint32_t>, 4203076: <var 0x402244: uint32_t>, 4203080: <var 0x402248: uint32_t>, 4203084: <var 0x40224c: int32_t (* const)()>, 4203088: <var 0x402250: int32_t (* const)()>, 4203092: <var 0x402254: int32_t (* const)()>, 4203096: <var 0x402258: int32_t (* const)()>, 4203100: <var 0x40225c: int32_t (* const)()>, 4203108: <var 0x402264: uint16_t>, 4203110: <var 0x402266: char[0xb]>, 4203122: <var 0x402272: uint16_t>, 4203124: <var 0x402274: char[0xc]>, 4203136: <var 0x402280: uint16_t>, 4203138: <var 0x402282: char[0x8]>, 4203146: <var 0x40228a: uint16_t>, 4203148: <var 0x40228c: char[0x5]>, 4203154: <var 0x402292: uint16_t>, 4203156: <var 0x402294: char[0x7]>}
bv.end, 4203164
bv.endianness, Endianness.LittleEndian
bv.entry_function, int32_t _start() __noreturn
bv.entry_point, 4198400
bv.executable, True
bv.functions, <binaryninja.binaryview.FunctionList object at 0x7fa4e90ccfa0>
	functions: int32_t _start() __noreturn
	functions instance: ['_advanced_analysis_requests', '_arch', '_associated_data', '_basic_block_list', '_instantiate_block', '_platform', '_unregister', '_view', 'add_auto_address_tag', 'add_auto_function_tag', 'add_user_address_tag', 'add_user_code_ref', 'add_user_function_tag', 'add_user_type_field_ref', 'add_user_type_ref', 'address_ranges', 'address_tags', 'analysis_performance_info', 'analysis_skip_override', 'analysis_skip_reason', 'analysis_skipped', 'apply_auto_discovered_type', 'apply_imported_types', 'arch', 'auto', 'auto_address_tags', 'auto_function_tags', 'basic_blocks', 'call_sites', 'callee_addresses', 'callees', 'callers', 'calling_convention', 'can_return', 'clear_all_user_var_values', 'clear_user_var_value', 'clobbered_regs', 'comment', 'comments', 'core_var_stack_layout', 'core_vars', 'create_auto_address_tag', 'create_auto_function_tag', 'create_auto_stack_var', 'create_auto_tag', 'create_auto_var', 'create_graph', 'create_tag', 'create_user_address_tag', 'create_user_function_tag', 'create_user_stack_var', 'create_user_tag', 'create_user_var', 'delete_auto_stack_var', 'delete_user_stack_var', 'delete_user_var', 'explicitly_defined_type', 'function_tags', 'function_type', 'get_address_tags_at', 'get_address_tags_in_range', 'get_address_tags_of_type', 'get_all_user_var_values', 'get_auto_address_tags_at', 'get_auto_address_tags_in_range', 'get_auto_address_tags_of_type', 'get_auto_function_tags_of_type', 'get_basic_block_at', 'get_block_annotations', 'get_call_reg_stack_adjustment', 'get_call_reg_stack_adjustment_for_reg_stack', 'get_call_stack_adjustment', 'get_call_type_adjustment', 'get_comment_at', 'get_constants_referenced_by', 'get_constants_referenced_by_address_if_available', 'get_flags_read_by_lifted_il_instruction', 'get_flags_written_by_lifted_il_instruction', 'get_function_tags_of_type', 'get_hlil_var_refs', 'get_hlil_var_refs_from', 'get_indirect_branches_at', 'get_instr_highlight', 'get_instruction_containing_address', 'get_int_display_type', 'get_lifted_il_at', 'get_lifted_il_flag_definitions_for_use', 'get_lifted_il_flag_uses_for_definition', 'get_lifted_ils_at', 'get_llil_at', 'get_llils_at', 'get_low_level_il_at', 'get_low_level_il_exits_at', 'get_mlil_var_refs', 'get_mlil_var_refs_from', 'get_parameter_at', 'get_parameter_at_low_level_il_instruction', 'get_reg_value_after', 'get_reg_value_at', 'get_reg_value_at_exit', 'get_regs_read_by', 'get_regs_written_by', 'get_stack_contents_after', 'get_stack_contents_at', 'get_stack_var_at_frame_offset', 'get_stack_vars_referenced_by', 'get_stack_vars_referenced_by_address_if_available', 'get_type_tokens', 'get_user_address_tags_at', 'get_user_address_tags_in_range', 'get_user_address_tags_of_type', 'get_user_function_tags_of_type', 'global_pointer_value', 'handle', 'has_unresolved_indirect_branches', 'has_user_annotations', 'has_variable_arguments', 'high_level_il', 'highest_address', 'hlil', 'hlil_if_available', 'indirect_branches', 'instructions', 'is_call_instruction', 'is_var_user_defined', 'lifted_il', 'lifted_il_if_available', 'llil', 'llil_basic_blocks', 'llil_if_available', 'llil_instructions', 'low_level_il', 'lowest_address', 'mapped_medium_level_il', 'mark_caller_updates_required', 'mark_recent_use', 'mark_updates_required', 'medium_level_il', 'mlil', 'mlil_basic_blocks', 'mlil_if_available', 'mlil_instructions', 'mmlil', 'mmlil_if_available', 'name', 'needs_update', 'parameter_vars', 'platform', 'reanalyze', 'reg_stack_adjustments', 'release_advanced_analysis_data', 'remove_auto_address_tag', 'remove_auto_address_tags_of_type', 'remove_auto_function_tag', 'remove_auto_function_tags_of_type', 'remove_user_address_tag', 'remove_user_address_tags_of_type', 'remove_user_code_ref', 'remove_user_function_tag', 'remove_user_function_tags_of_type', 'remove_user_type_field_ref', 'remove_user_type_ref', 'request_advanced_analysis_data', 'request_debug_report', 'return_regs', 'return_type', 'session_data', 'set_auto_call_reg_stack_adjustment', 'set_auto_call_reg_stack_adjustment_for_reg_stack', 'set_auto_call_stack_adjustment', 'set_auto_calling_convention', 'set_auto_can_return', 'set_auto_clobbered_regs', 'set_auto_has_variable_arguments', 'set_auto_indirect_branches', 'set_auto_instr_highlight', 'set_auto_parameter_vars', 'set_auto_reg_stack_adjustments', 'set_auto_return_regs', 'set_auto_return_type', 'set_auto_stack_adjustment', 'set_auto_type', 'set_call_reg_stack_adjustment', 'set_call_reg_stack_adjustment_for_reg_stack', 'set_call_stack_adjustment', 'set_call_type_adjustment', 'set_comment', 'set_comment_at', 'set_default_session_data', 'set_int_display_type', 'set_user_indirect_branches', 'set_user_instr_highlight', 'set_user_type', 'set_user_var_value', 'stack_adjustment', 'stack_layout', 'start', 'symbol', 'too_large', 'total_bytes', 'type_tokens', 'unresolved_indirect_branches', 'unresolved_stack_adjustment_graph', 'user_address_tags', 'user_function_tags', 'vars', 'view', 'workflow']
	functions: int32_t sub_40100f() __noreturn
	functions instance: ['_advanced_analysis_requests', '_arch', '_associated_data', '_basic_block_list', '_instantiate_block', '_platform', '_unregister', '_view', 'add_auto_address_tag', 'add_auto_function_tag', 'add_user_address_tag', 'add_user_code_ref', 'add_user_function_tag', 'add_user_type_field_ref', 'add_user_type_ref', 'address_ranges', 'address_tags', 'analysis_performance_info', 'analysis_skip_override', 'analysis_skip_reason', 'analysis_skipped', 'apply_auto_discovered_type', 'apply_imported_types', 'arch', 'auto', 'auto_address_tags', 'auto_function_tags', 'basic_blocks', 'call_sites', 'callee_addresses', 'callees', 'callers', 'calling_convention', 'can_return', 'clear_all_user_var_values', 'clear_user_var_value', 'clobbered_regs', 'comment', 'comments', 'core_var_stack_layout', 'core_vars', 'create_auto_address_tag', 'create_auto_function_tag', 'create_auto_stack_var', 'create_auto_tag', 'create_auto_var', 'create_graph', 'create_tag', 'create_user_address_tag', 'create_user_function_tag', 'create_user_stack_var', 'create_user_tag', 'create_user_var', 'delete_auto_stack_var', 'delete_user_stack_var', 'delete_user_var', 'explicitly_defined_type', 'function_tags', 'function_type', 'get_address_tags_at', 'get_address_tags_in_range', 'get_address_tags_of_type', 'get_all_user_var_values', 'get_auto_address_tags_at', 'get_auto_address_tags_in_range', 'get_auto_address_tags_of_type', 'get_auto_function_tags_of_type', 'get_basic_block_at', 'get_block_annotations', 'get_call_reg_stack_adjustment', 'get_call_reg_stack_adjustment_for_reg_stack', 'get_call_stack_adjustment', 'get_call_type_adjustment', 'get_comment_at', 'get_constants_referenced_by', 'get_constants_referenced_by_address_if_available', 'get_flags_read_by_lifted_il_instruction', 'get_flags_written_by_lifted_il_instruction', 'get_function_tags_of_type', 'get_hlil_var_refs', 'get_hlil_var_refs_from', 'get_indirect_branches_at', 'get_instr_highlight', 'get_instruction_containing_address', 'get_int_display_type', 'get_lifted_il_at', 'get_lifted_il_flag_definitions_for_use', 'get_lifted_il_flag_uses_for_definition', 'get_lifted_ils_at', 'get_llil_at', 'get_llils_at', 'get_low_level_il_at', 'get_low_level_il_exits_at', 'get_mlil_var_refs', 'get_mlil_var_refs_from', 'get_parameter_at', 'get_parameter_at_low_level_il_instruction', 'get_reg_value_after', 'get_reg_value_at', 'get_reg_value_at_exit', 'get_regs_read_by', 'get_regs_written_by', 'get_stack_contents_after', 'get_stack_contents_at', 'get_stack_var_at_frame_offset', 'get_stack_vars_referenced_by', 'get_stack_vars_referenced_by_address_if_available', 'get_type_tokens', 'get_user_address_tags_at', 'get_user_address_tags_in_range', 'get_user_address_tags_of_type', 'get_user_function_tags_of_type', 'global_pointer_value', 'handle', 'has_unresolved_indirect_branches', 'has_user_annotations', 'has_variable_arguments', 'high_level_il', 'highest_address', 'hlil', 'hlil_if_available', 'indirect_branches', 'instructions', 'is_call_instruction', 'is_var_user_defined', 'lifted_il', 'lifted_il_if_available', 'llil', 'llil_basic_blocks', 'llil_if_available', 'llil_instructions', 'low_level_il', 'lowest_address', 'mapped_medium_level_il', 'mark_caller_updates_required', 'mark_recent_use', 'mark_updates_required', 'medium_level_il', 'mlil', 'mlil_basic_blocks', 'mlil_if_available', 'mlil_instructions', 'mmlil', 'mmlil_if_available', 'name', 'needs_update', 'parameter_vars', 'platform', 'reanalyze', 'reg_stack_adjustments', 'release_advanced_analysis_data', 'remove_auto_address_tag', 'remove_auto_address_tags_of_type', 'remove_auto_function_tag', 'remove_auto_function_tags_of_type', 'remove_user_address_tag', 'remove_user_address_tags_of_type', 'remove_user_code_ref', 'remove_user_function_tag', 'remove_user_function_tags_of_type', 'remove_user_type_field_ref', 'remove_user_type_ref', 'request_advanced_analysis_data', 'request_debug_report', 'return_regs', 'return_type', 'session_data', 'set_auto_call_reg_stack_adjustment', 'set_auto_call_reg_stack_adjustment_for_reg_stack', 'set_auto_call_stack_adjustment', 'set_auto_calling_convention', 'set_auto_can_return', 'set_auto_clobbered_regs', 'set_auto_has_variable_arguments', 'set_auto_indirect_branches', 'set_auto_instr_highlight', 'set_auto_parameter_vars', 'set_auto_reg_stack_adjustments', 'set_auto_return_regs', 'set_auto_return_type', 'set_auto_stack_adjustment', 'set_auto_type', 'set_call_reg_stack_adjustment', 'set_call_reg_stack_adjustment_for_reg_stack', 'set_call_stack_adjustment', 'set_call_type_adjustment', 'set_comment', 'set_comment_at', 'set_default_session_data', 'set_int_display_type', 'set_user_indirect_branches', 'set_user_instr_highlight', 'set_user_type', 'set_user_var_value', 'stack_adjustment', 'stack_layout', 'start', 'symbol', 'too_large', 'total_bytes', 'type_tokens', 'unresolved_indirect_branches', 'unresolved_stack_adjustment_graph', 'user_address_tags', 'user_function_tags', 'vars', 'view', 'workflow']
	functions: int32_t __convention("regparm") sub_401032(HINSTANCE arg1) __noreturn
	functions instance: ['_advanced_analysis_requests', '_arch', '_associated_data', '_basic_block_list', '_instantiate_block', '_platform', '_unregister', '_view', 'add_auto_address_tag', 'add_auto_function_tag', 'add_user_address_tag', 'add_user_code_ref', 'add_user_function_tag', 'add_user_type_field_ref', 'add_user_type_ref', 'address_ranges', 'address_tags', 'analysis_performance_info', 'analysis_skip_override', 'analysis_skip_reason', 'analysis_skipped', 'apply_auto_discovered_type', 'apply_imported_types', 'arch', 'auto', 'auto_address_tags', 'auto_function_tags', 'basic_blocks', 'call_sites', 'callee_addresses', 'callees', 'callers', 'calling_convention', 'can_return', 'clear_all_user_var_values', 'clear_user_var_value', 'clobbered_regs', 'comment', 'comments', 'core_var_stack_layout', 'core_vars', 'create_auto_address_tag', 'create_auto_function_tag', 'create_auto_stack_var', 'create_auto_tag', 'create_auto_var', 'create_graph', 'create_tag', 'create_user_address_tag', 'create_user_function_tag', 'create_user_stack_var', 'create_user_tag', 'create_user_var', 'delete_auto_stack_var', 'delete_user_stack_var', 'delete_user_var', 'explicitly_defined_type', 'function_tags', 'function_type', 'get_address_tags_at', 'get_address_tags_in_range', 'get_address_tags_of_type', 'get_all_user_var_values', 'get_auto_address_tags_at', 'get_auto_address_tags_in_range', 'get_auto_address_tags_of_type', 'get_auto_function_tags_of_type', 'get_basic_block_at', 'get_block_annotations', 'get_call_reg_stack_adjustment', 'get_call_reg_stack_adjustment_for_reg_stack', 'get_call_stack_adjustment', 'get_call_type_adjustment', 'get_comment_at', 'get_constants_referenced_by', 'get_constants_referenced_by_address_if_available', 'get_flags_read_by_lifted_il_instruction', 'get_flags_written_by_lifted_il_instruction', 'get_function_tags_of_type', 'get_hlil_var_refs', 'get_hlil_var_refs_from', 'get_indirect_branches_at', 'get_instr_highlight', 'get_instruction_containing_address', 'get_int_display_type', 'get_lifted_il_at', 'get_lifted_il_flag_definitions_for_use', 'get_lifted_il_flag_uses_for_definition', 'get_lifted_ils_at', 'get_llil_at', 'get_llils_at', 'get_low_level_il_at', 'get_low_level_il_exits_at', 'get_mlil_var_refs', 'get_mlil_var_refs_from', 'get_parameter_at', 'get_parameter_at_low_level_il_instruction', 'get_reg_value_after', 'get_reg_value_at', 'get_reg_value_at_exit', 'get_regs_read_by', 'get_regs_written_by', 'get_stack_contents_after', 'get_stack_contents_at', 'get_stack_var_at_frame_offset', 'get_stack_vars_referenced_by', 'get_stack_vars_referenced_by_address_if_available', 'get_type_tokens', 'get_user_address_tags_at', 'get_user_address_tags_in_range', 'get_user_address_tags_of_type', 'get_user_function_tags_of_type', 'global_pointer_value', 'handle', 'has_unresolved_indirect_branches', 'has_user_annotations', 'has_variable_arguments', 'high_level_il', 'highest_address', 'hlil', 'hlil_if_available', 'indirect_branches', 'instructions', 'is_call_instruction', 'is_var_user_defined', 'lifted_il', 'lifted_il_if_available', 'llil', 'llil_basic_blocks', 'llil_if_available', 'llil_instructions', 'low_level_il', 'lowest_address', 'mapped_medium_level_il', 'mark_caller_updates_required', 'mark_recent_use', 'mark_updates_required', 'medium_level_il', 'mlil', 'mlil_basic_blocks', 'mlil_if_available', 'mlil_instructions', 'mmlil', 'mmlil_if_available', 'name', 'needs_update', 'parameter_vars', 'platform', 'reanalyze', 'reg_stack_adjustments', 'release_advanced_analysis_data', 'remove_auto_address_tag', 'remove_auto_address_tags_of_type', 'remove_auto_function_tag', 'remove_auto_function_tags_of_type', 'remove_user_address_tag', 'remove_user_address_tags_of_type', 'remove_user_code_ref', 'remove_user_function_tag', 'remove_user_function_tags_of_type', 'remove_user_type_field_ref', 'remove_user_type_ref', 'request_advanced_analysis_data', 'request_debug_report', 'return_regs', 'return_type', 'session_data', 'set_auto_call_reg_stack_adjustment', 'set_auto_call_reg_stack_adjustment_for_reg_stack', 'set_auto_call_stack_adjustment', 'set_auto_calling_convention', 'set_auto_can_return', 'set_auto_clobbered_regs', 'set_auto_has_variable_arguments', 'set_auto_indirect_branches', 'set_auto_instr_highlight', 'set_auto_parameter_vars', 'set_auto_reg_stack_adjustments', 'set_auto_return_regs', 'set_auto_return_type', 'set_auto_stack_adjustment', 'set_auto_type', 'set_call_reg_stack_adjustment', 'set_call_reg_stack_adjustment_for_reg_stack', 'set_call_stack_adjustment', 'set_call_type_adjustment', 'set_comment', 'set_comment_at', 'set_default_session_data', 'set_int_display_type', 'set_user_indirect_branches', 'set_user_instr_highlight', 'set_user_type', 'set_user_var_value', 'stack_adjustment', 'stack_layout', 'start', 'symbol', 'too_large', 'total_bytes', 'type_tokens', 'unresolved_indirect_branches', 'unresolved_stack_adjustment_graph', 'user_address_tags', 'user_function_tags', 'vars', 'view', 'workflow']
	functions: int32_t __convention("regparm") sub_401237(PSTR arg1, void* arg2 @ esi) __noreturn
	functions instance: ['_advanced_analysis_requests', '_arch', '_associated_data', '_basic_block_list', '_instantiate_block', '_platform', '_unregister', '_view', 'add_auto_address_tag', 'add_auto_function_tag', 'add_user_address_tag', 'add_user_code_ref', 'add_user_function_tag', 'add_user_type_field_ref', 'add_user_type_ref', 'address_ranges', 'address_tags', 'analysis_performance_info', 'analysis_skip_override', 'analysis_skip_reason', 'analysis_skipped', 'apply_auto_discovered_type', 'apply_imported_types', 'arch', 'auto', 'auto_address_tags', 'auto_function_tags', 'basic_blocks', 'call_sites', 'callee_addresses', 'callees', 'callers', 'calling_convention', 'can_return', 'clear_all_user_var_values', 'clear_user_var_value', 'clobbered_regs', 'comment', 'comments', 'core_var_stack_layout', 'core_vars', 'create_auto_address_tag', 'create_auto_function_tag', 'create_auto_stack_var', 'create_auto_tag', 'create_auto_var', 'create_graph', 'create_tag', 'create_user_address_tag', 'create_user_function_tag', 'create_user_stack_var', 'create_user_tag', 'create_user_var', 'delete_auto_stack_var', 'delete_user_stack_var', 'delete_user_var', 'explicitly_defined_type', 'function_tags', 'function_type', 'get_address_tags_at', 'get_address_tags_in_range', 'get_address_tags_of_type', 'get_all_user_var_values', 'get_auto_address_tags_at', 'get_auto_address_tags_in_range', 'get_auto_address_tags_of_type', 'get_auto_function_tags_of_type', 'get_basic_block_at', 'get_block_annotations', 'get_call_reg_stack_adjustment', 'get_call_reg_stack_adjustment_for_reg_stack', 'get_call_stack_adjustment', 'get_call_type_adjustment', 'get_comment_at', 'get_constants_referenced_by', 'get_constants_referenced_by_address_if_available', 'get_flags_read_by_lifted_il_instruction', 'get_flags_written_by_lifted_il_instruction', 'get_function_tags_of_type', 'get_hlil_var_refs', 'get_hlil_var_refs_from', 'get_indirect_branches_at', 'get_instr_highlight', 'get_instruction_containing_address', 'get_int_display_type', 'get_lifted_il_at', 'get_lifted_il_flag_definitions_for_use', 'get_lifted_il_flag_uses_for_definition', 'get_lifted_ils_at', 'get_llil_at', 'get_llils_at', 'get_low_level_il_at', 'get_low_level_il_exits_at', 'get_mlil_var_refs', 'get_mlil_var_refs_from', 'get_parameter_at', 'get_parameter_at_low_level_il_instruction', 'get_reg_value_after', 'get_reg_value_at', 'get_reg_value_at_exit', 'get_regs_read_by', 'get_regs_written_by', 'get_stack_contents_after', 'get_stack_contents_at', 'get_stack_var_at_frame_offset', 'get_stack_vars_referenced_by', 'get_stack_vars_referenced_by_address_if_available', 'get_type_tokens', 'get_user_address_tags_at', 'get_user_address_tags_in_range', 'get_user_address_tags_of_type', 'get_user_function_tags_of_type', 'global_pointer_value', 'handle', 'has_unresolved_indirect_branches', 'has_user_annotations', 'has_variable_arguments', 'high_level_il', 'highest_address', 'hlil', 'hlil_if_available', 'indirect_branches', 'instructions', 'is_call_instruction', 'is_var_user_defined', 'lifted_il', 'lifted_il_if_available', 'llil', 'llil_basic_blocks', 'llil_if_available', 'llil_instructions', 'low_level_il', 'lowest_address', 'mapped_medium_level_il', 'mark_caller_updates_required', 'mark_recent_use', 'mark_updates_required', 'medium_level_il', 'mlil', 'mlil_basic_blocks', 'mlil_if_available', 'mlil_instructions', 'mmlil', 'mmlil_if_available', 'name', 'needs_update', 'parameter_vars', 'platform', 'reanalyze', 'reg_stack_adjustments', 'release_advanced_analysis_data', 'remove_auto_address_tag', 'remove_auto_address_tags_of_type', 'remove_auto_function_tag', 'remove_auto_function_tags_of_type', 'remove_user_address_tag', 'remove_user_address_tags_of_type', 'remove_user_code_ref', 'remove_user_function_tag', 'remove_user_function_tags_of_type', 'remove_user_type_field_ref', 'remove_user_type_ref', 'request_advanced_analysis_data', 'request_debug_report', 'return_regs', 'return_type', 'session_data', 'set_auto_call_reg_stack_adjustment', 'set_auto_call_reg_stack_adjustment_for_reg_stack', 'set_auto_call_stack_adjustment', 'set_auto_calling_convention', 'set_auto_can_return', 'set_auto_clobbered_regs', 'set_auto_has_variable_arguments', 'set_auto_indirect_branches', 'set_auto_instr_highlight', 'set_auto_parameter_vars', 'set_auto_reg_stack_adjustments', 'set_auto_return_regs', 'set_auto_return_type', 'set_auto_stack_adjustment', 'set_auto_type', 'set_call_reg_stack_adjustment', 'set_call_reg_stack_adjustment_for_reg_stack', 'set_call_stack_adjustment', 'set_call_type_adjustment', 'set_comment', 'set_comment_at', 'set_default_session_data', 'set_int_display_type', 'set_user_indirect_branches', 'set_user_instr_highlight', 'set_user_type', 'set_user_var_value', 'stack_adjustment', 'stack_layout', 'start', 'symbol', 'too_large', 'total_bytes', 'type_tokens', 'unresolved_indirect_branches', 'unresolved_stack_adjustment_graph', 'user_address_tags', 'user_function_tags', 'vars', 'view', 'workflow']
bv.global_pointer_value, <const ptr 0x0>
bv.has_data_variables, True
bv.has_database, False
bv.has_functions, True
bv.has_symbols, True
bv.hlil_basic_blocks, <generator object BinaryView.hlil_basic_blocks at 0x7fa4e90d3040>
v.hlil_basic_blocks, <generator object BinaryView.hlil_basic_blocks at 0x7fa4e90d3040>
bv.hlil_instructions, <generator object BinaryView.hlil_instructions at 0x7fa4e90d3040>
bv.instructions, <generator object BinaryView.instructions at 0x7fa4e90cf040>
bv.linear_disassembly, <generator object BinaryView.get_linear_disassembly.<locals>.LinearDisassemblyIterator.__iter__ at 0x7fa4e90cf270>
	linear_disassembly: /*
	linear_disassembly instance: ['block', 'contents', 'function', 'type']
	linear_disassembly: Type: PE
	linear_disassembly instance: ['block', 'contents', 'function', 'type']
	linear_disassembly: Platform: windows-x86
	linear_disassembly instance: ['block', 'contents', 'function', 'type']
	linear_disassembly: Architecture: x86
	linear_disassembly instance: ['block', 'contents', 'function', 'type']
bv.llil_basic_blocks, <generator object BinaryView.llil_basic_blocks at 0x7fa4e90cf430>
	llil_basic_blocks: <llil block: x86@0-2>
	llil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	llil_basic_blocks: <llil block: x86@0-2>
	llil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	llil_basic_blocks: <llil block: x86@2-7>
	llil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	llil_basic_blocks: <llil block: x86@7-9>
	llil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
bv.llil_instructions, <generator object BinaryView.llil_basic_blocks at 0x7fa4e90cf430>
	llil_basic_blocks: <llil block: x86@0-2>
	llil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	llil_basic_blocks: <llil block: x86@0-2>
	llil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	llil_basic_blocks: <llil block: x86@2-7>
	llil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	llil_basic_blocks: <llil block: x86@7-9>
	llil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
bv.long_name, None
bv.llil_instructions, <generator object BinaryView.llil_instructions at 0x7fa4e90cf430>
	llil_instructions: call(0x40100f)
	llil_instructions instance: ['ILOperations', '_get_cond', '_get_expr', '_get_expr_list', '_get_flag', '_get_flag_ssa', '_get_flag_ssa_list', '_get_float', '_get_int', '_get_int_list', '_get_intrinsic', '_get_reg', '_get_reg_or_flag_list', '_get_reg_or_flag_ssa_list', '_get_reg_ssa', '_get_reg_ssa_list', '_get_reg_stack', '_get_reg_stack_adjust', '_get_reg_stack_ssa', '_get_reg_stack_ssa_list', '_get_sem_class', '_get_sem_group', '_get_target_map', '_make_options_array', 'add_subgraph', 'address', 'create', 'dest', 'expr_index', 'flags', 'function', 'get_flag_value', 'get_flag_value_after', 'get_possible_flag_values', 'get_possible_flag_values_after', 'get_possible_reg_values', 'get_possible_reg_values_after', 'get_possible_stack_contents', 'get_possible_stack_contents_after', 'get_possible_values', 'get_reg_value', 'get_reg_value_after', 'get_stack_contents', 'get_stack_contents_after', 'high_level_il', 'hlil', 'hlils', 'il_basic_block', 'instr', 'instr_index', 'mapped_medium_level_il', 'medium_level_il', 'mlil', 'mlils', 'mmlil', 'non_ssa_form', 'operands', 'operation', 'possible_values', 'postfix_operands', 'prefix_operands', 'prepend_parent', 'show_hierarchy_graph', 'show_llil_hierarchy', 'size', 'source_operand', 'ssa_form', 'tokens', 'value']
	llil_instructions: noreturn
	llil_instructions instance: ['ILOperations', '_get_cond', '_get_expr', '_get_expr_list', '_get_flag', '_get_flag_ssa', '_get_flag_ssa_list', '_get_float', '_get_int', '_get_int_list', '_get_intrinsic', '_get_reg', '_get_reg_or_flag_list', '_get_reg_or_flag_ssa_list', '_get_reg_ssa', '_get_reg_ssa_list', '_get_reg_stack', '_get_reg_stack_adjust', '_get_reg_stack_ssa', '_get_reg_stack_ssa_list', '_get_sem_class', '_get_sem_group', '_get_target_map', '_make_options_array', 'add_subgraph', 'address', 'create', 'expr_index', 'flags', 'function', 'get_flag_value', 'get_flag_value_after', 'get_possible_flag_values', 'get_possible_flag_values_after', 'get_possible_reg_values', 'get_possible_reg_values_after', 'get_possible_stack_contents', 'get_possible_stack_contents_after', 'get_possible_values', 'get_reg_value', 'get_reg_value_after', 'get_stack_contents', 'get_stack_contents_after', 'high_level_il', 'hlil', 'hlils', 'il_basic_block', 'instr', 'instr_index', 'mapped_medium_level_il', 'medium_level_il', 'mlil', 'mlils', 'mmlil', 'non_ssa_form', 'operands', 'operation', 'possible_values', 'postfix_operands', 'prefix_operands', 'prepend_parent', 'show_hierarchy_graph', 'show_llil_hierarchy', 'size', 'source_operand', 'ssa_form', 'tokens', 'value']
	llil_instructions: call([0x4020d8].d), esp += 4
	llil_instructions instance: ['ILOperations', '_get_cond', '_get_expr', '_get_expr_list', '_get_flag', '_get_flag_ssa', '_get_flag_ssa_list', '_get_float', '_get_int', '_get_int_list', '_get_intrinsic', '_get_reg', '_get_reg_or_flag_list', '_get_reg_or_flag_ssa_list', '_get_reg_ssa', '_get_reg_ssa_list', '_get_reg_stack', '_get_reg_stack_adjust', '_get_reg_stack_ssa', '_get_reg_stack_ssa_list', '_get_sem_class', '_get_sem_group', '_get_target_map', '_make_options_array', 'add_subgraph', 'address', 'create', 'dest', 'expr_index', 'flags', 'function', 'get_flag_value', 'get_flag_value_after', 'get_possible_flag_values', 'get_possible_flag_values_after', 'get_possible_reg_values', 'get_possible_reg_values_after', 'get_possible_stack_contents', 'get_possible_stack_contents_after', 'get_possible_values', 'get_reg_value', 'get_reg_value_after', 'get_stack_contents', 'get_stack_contents_after', 'high_level_il', 'hlil', 'hlils', 'il_basic_block', 'instr', 'instr_index', 'mapped_medium_level_il', 'medium_level_il', 'mlil', 'mlils', 'mmlil', 'non_ssa_form', 'operands', 'operation', 'possible_values', 'postfix_operands', 'prefix_operands', 'prepend_parent', 'reg_stack_adjustments', 'show_hierarchy_graph', 'show_llil_hierarchy', 'size', 'source_operand', 'ssa_form', 'stack_adjustment', 'tokens', 'value']
	llil_instructions: if (eax == 0) then 2 @ 0x40104c else 7 @ 0x40101a
	llil_instructions instance: ['ILOperations', '_get_cond', '_get_expr', '_get_expr_list', '_get_flag', '_get_flag_ssa', '_get_flag_ssa_list', '_get_float', '_get_int', '_get_int_list', '_get_intrinsic', '_get_reg', '_get_reg_or_flag_list', '_get_reg_or_flag_ssa_list', '_get_reg_ssa', '_get_reg_ssa_list', '_get_reg_stack', '_get_reg_stack_adjust', '_get_reg_stack_ssa', '_get_reg_stack_ssa_list', '_get_sem_class', '_get_sem_group', '_get_target_map', '_make_options_array', 'add_subgraph', 'address', 'condition', 'create', 'expr_index', 'false', 'flags', 'function', 'get_flag_value', 'get_flag_value_after', 'get_possible_flag_values', 'get_possible_flag_values_after', 'get_possible_reg_values', 'get_possible_reg_values_after', 'get_possible_stack_contents', 'get_possible_stack_contents_after', 'get_possible_values', 'get_reg_value', 'get_reg_value_after', 'get_stack_contents', 'get_stack_contents_after', 'high_level_il', 'hlil', 'hlils', 'il_basic_block', 'instr', 'instr_index', 'mapped_medium_level_il', 'medium_level_il', 'mlil', 'mlils', 'mmlil', 'non_ssa_form', 'operands', 'operation', 'possible_values', 'postfix_operands', 'prefix_operands', 'prepend_parent', 'show_hierarchy_graph', 'show_llil_hierarchy', 'size', 'source_operand', 'ssa_form', 'tokens', 'true', 'value']
bv.long_name, None
bv.max_function_size_for_analysis, 65536
bv.mlil_basic_blocks, <generator object BinaryView.mlil_basic_blocks at 0x7fa4e90cf430>
	mlil_basic_blocks: <mlil block: x86@0-2>
	mlil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	mlil_basic_blocks: <mlil block: x86@0-2>
	mlil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	mlil_basic_blocks: <mlil block: x86@2-4>
	mlil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	mlil_basic_blocks: <mlil block: x86@4-6>
	mlil_basic_blocks instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
bv.mlil_instructions, <generator object BinaryView.mlil_instructions at 0x7fa4e90cf430>
	mlil_instructions: <llil block: x86@0-2>
	mlil_instructions instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	mlil_instructions: <llil block: x86@0-2>
	mlil_instructions instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	mlil_instructions: <llil block: x86@2-7>
	mlil_instructions instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
	mlil_instructions: <llil block: x86@7-9>
	mlil_instructions instance: ['_arch', '_buildStartCache', '_create_instance', '_func', '_il_function', '_instLengths', '_instStarts', '_make_blocks', '_make_edges', '_view', 'annotations', 'arch', 'can_exit', 'disassembly_text', 'dominance_frontier', 'dominator_tree_children', 'dominators', 'end', 'function', 'get_disassembly_text', 'get_instruction_containing_address', 'get_iterated_dominance_frontier', 'handle', 'has_invalid_instructions', 'has_undetermined_outgoing_edges', 'highlight', 'il_function', 'immediate_dominator', 'immediate_post_dominator', 'incoming_edges', 'index', 'instruction_count', 'is_high_level_il', 'is_il', 'is_low_level_il', 'is_medium_level_il', 'length', 'mark_recent_use', 'outgoing_edges', 'post_dominance_frontier', 'post_dominator_tree_children', 'post_dominators', 'set_auto_highlight', 'set_user_highlight', 'source_block', 'start', 'strict_dominators', 'view']
bv.modified), False
bv.name, None
bv.namespaces, ['BNEXTERNALNAMESPACE', 'BNINTERNALNAMESPACE', 'kernel32', 'user32', 'wsock32']
bv.new_auto_function_analysis_suppressed, False
bv.offset, 0
bv.parameters_for_analysis, <binaryninja._binaryninjacore.BNAnalysisParameters object at 0x7fa4e90d80c0>
bv.parent_view, <BinaryView: '7edfbf1b9568594f52f29d3b35c2d09e10919943f235bf4f928c0b8e4c128c55', len 0xc00>
bv.platform, windows-x86
bv.registered_view_type, None
bv.relocatable, False
bv.relocation_ranges, []
bv.saved, True
bv.sections, {'.api': <section .api: 0x402000-0x40229c>, '.code': <section .code: 0x401000-0x4014c5>}
v.segments), [<segment: 0x400000-0x400200, r-->, <segment: 0x401000-0x4014c5, r-x>, <segment: 0x402000-0x40229c, rw->]
bv.session_data, {}
bv.start, 0x400000
bv.strings, [<AsciiString: 0x40004d, len 0x2b>, <AsciiString: 0x400178, len 0x5>, <AsciiString: 0x40019f, len 0x5>, <AsciiString: 0x401005, len 0x9>, <AsciiString: 0x40101f, len 0x12>, <AsciiString: 0x401070, len 0x4>, <AsciiString: 0x4011c4, len 0x4>, <AsciiString: 0x40121a, len 0x4>, <AsciiString: 0x401413, len 0x4>, <AsciiString: 0x40146c, len 0x4>, <AsciiString: 0x4014b6, len 0x4>, <AsciiString: 0x402050, len 0xc>, <AsciiString: 0x40205e, len 0xa>, <AsciiString: 0x40206a, len 0xb>, <AsciiString: 0x40210a, len 0xb>, <AsciiString: 0x402118, len 0x18>, <AsciiString: 0x402134, len 0xb>, <AsciiString: 0x402142, len 0x13>, <AsciiString: 0x402158, len 0x10>, <AsciiString: 0x40216c, len 0xe>, <AsciiString: 0x40217e, len 0xc>, <AsciiString: 0x40218e, len 0xb>, <AsciiString: 0x40219c, len 0xe>, <AsciiString: 0x4021ae, len 0xd>, <AsciiString: 0x4021be, len 0xd>, <AsciiString: 0x4021ce, len 0x5>, <AsciiString: 0x4021d6, len 0xc>, <AsciiString: 0x4021e6, len 0x8>, <AsciiString: 0x4021f2, len 0x9>, <AsciiString: 0x4021fe, len 0x8>, <AsciiString: 0x40220a, len 0x8>, <AsciiString: 0x402226, len 0xb>, <AsciiString: 0x402266, len 0xa>, <AsciiString: 0x402274, len 0xb>, <AsciiString: 0x402282, len 0x7>, <AsciiString: 0x40228c, len 0x4>, <AsciiString: 0x402294, len 0x6>]
bv.symbols, <SymbolMapping 102 symbols: {'__dos_header': [<DataSymbol: "__dos_header" @ 0x400000>], '__dos_stub': [<DataSymbol: "__dos_stub" @ 0x400040>], '__coff_header': [<DataSymbol: "__coff_header" @ 0x400080>], '__pe32_optional_header': [<DataSymbol: "__pe32_optional_header" @ 0x400098>], '__section_headers': [<DataSymbol: "__section_headers" @ 0x400178>], '_start': [<FunctionSymbol: "_start" @ 0x401000>], '__import_directory_entries': [<DataSymbol: "__import_directory_entries" @ 0x402000>], '__import_dll_name(kernel32)': [<DataSymbol: "__import_dll_name(kernel32)" @ 0x402050>], '__import_dll_name(user32)': [<DataSymbol: "__import_dll_name(user32)" @ 0x40205e>], '__import_dll_name(wsock32)': [<DataSymbol: "__import_dll_name(wsock32)" @ 0x40206a>], '__import_lookup_table_0(kernel32:CloseHandle)': [<DataSymbol: "__import_lookup_table_0(kernel32:CloseHandle)" @ 0x402078>], '__import_lookup_table_0(kernel32:CreateToolhelp32Snapshot)': [<DataSymbol: "__import_lookup_table_0(kernel32:CreateToolhelp32Snapshot)" @ 0x40207c>], '__import_lookup_table_0(kernel32:ExitProcess)': [<DataSymbol: "__import_lookup_table_0(kernel32:ExitProcess)" @ 0x402080>], '__import_lookup_table_0(kernel32:GetCurrentProcessId)': [<DataSymbol: "__import_lookup_table_0(kernel32:GetCurrentProcessId)" @ 0x402084>], '__import_lookup_table_0(kernel32:GetModuleHandleA)': [<DataSymbol: "__import_lookup_table_0(kernel32:GetModuleHandleA)" @ 0x402088>], '__import_lookup_table_0(kernel32:GetProcAddress)': [<DataSymbol: "__import_lookup_table_0(kernel32:GetProcAddress)" @ 0x40208c>], '__import_lookup_table_0(kernel32:LoadLibraryA)': [<DataSymbol: "__import_lookup_table_0(kernel32:LoadLibraryA)" @ 0x402090>], '__import_lookup_table_0(kernel32:OpenProcess)': [<DataSymbol: "__import_lookup_table_0(kernel32:OpenProcess)" @ 0x402094>], '__import_lookup_table_0(kernel32:Process32First)': [<DataSymbol: "__import_lookup_table_0(kernel32:Process32First)" @ 0x402098>], '__import_lookup_table_0(kernel32:Process32Next)': [<DataSymbol: "__import_lookup_table_0(kernel32:Process32Next)" @ 0x40209c>], '__import_lookup_table_0(kernel32:RtlZeroMemory)': [<DataSymbol: "__import_lookup_table_0(kernel32:RtlZeroMemory)" @ 0x4020a0>], '__import_lookup_table_0(kernel32:Sleep)': [<DataSymbol: "__import_lookup_table_0(kernel32:Sleep)" @ 0x4020a4>], '__import_lookup_table_0(kernel32:VirtualAlloc)': [<DataSymbol: "__import_lookup_table_0(kernel32:VirtualAlloc)" @ 0x4020a8>], '__import_lookup_table_0(kernel32:lstrcatA)': [<DataSymbol: "__import_lookup_table_0(kernel32:lstrcatA)" @ 0x4020ac>], '__import_lookup_table_0(kernel32:lstrcmpiA)': [<DataSymbol: "__import_lookup_table_0(kernel32:lstrcmpiA)" @ 0x4020b0>], '__import_lookup_table_0(kernel32:lstrcpyA)': [<DataSymbol: "__import_lookup_table_0(kernel32:lstrcpyA)" @ 0x4020b4>], '__import_lookup_table_0(kernel32:lstrlenA)': [<DataSymbol: "__import_lookup_table_0(kernel32:lstrlenA)" @ 0x4020b8>], 'CloseHandle': [<ImportAddressSymbol: "CloseHandle" @ 0x4020c0>], 'CreateToolhelp32Snapshot': [<ImportAddressSymbol: "CreateToolhelp32Snapshot" @ 0x4020c4>], 'ExitProcess': [<ImportAddressSymbol: "ExitProcess" @ 0x4020c8>], 'GetCurrentProcessId': [<ImportAddressSymbol: "GetCurrentProcessId" @ 0x4020cc>], 'GetModuleHandleA': [<ImportAddressSymbol: "GetModuleHandleA" @ 0x4020d0>], 'GetProcAddress': [<ImportAddressSymbol: "GetProcAddress" @ 0x4020d4>], 'LoadLibraryA': [<ImportAddressSymbol: "LoadLibraryA" @ 0x4020d8>], 'OpenProcess': [<ImportAddressSymbol: "OpenProcess" @ 0x4020dc>], 'Process32First': [<ImportAddressSymbol: "Process32First" @ 0x4020e0>], 'Process32Next': [<ImportAddressSymbol: "Process32Next" @ 0x4020e4>], 'RtlZeroMemory': [<ImportAddressSymbol: "RtlZeroMemory" @ 0x4020e8>], 'Sleep': [<ImportAddressSymbol: "Sleep" @ 0x4020ec>], 'VirtualAlloc': [<ImportAddressSymbol: "VirtualAlloc" @ 0x4020f0>], 'lstrcatA': [<ImportAddressSymbol: "lstrcatA" @ 0x4020f4>], 'lstrcmpiA': [<ImportAddressSymbol: "lstrcmpiA" @ 0x4020f8>], 'lstrcpyA': [<ImportAddressSymbol: "lstrcpyA" @ 0x4020fc>], 'lstrlenA': [<ImportAddressSymbol: "lstrlenA" @ 0x402100>], '__export_name_ptr_table_0(kernel32:CloseHandle)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:CloseHandle)" @ 0x402108>], '__import_name_0(kernel32:CloseHandle)': [<DataSymbol: "__import_name_0(kernel32:CloseHandle)" @ 0x40210a>], '__export_name_ptr_table_0(kernel32:CreateToolhelp32Snapshot)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:CreateToolhelp32Snapshot)" @ 0x402116>], '__import_name_0(kernel32:CreateToolhelp32Snapshot)': [<DataSymbol: "__import_name_0(kernel32:CreateToolhelp32Snapshot)" @ 0x402118>], '__export_name_ptr_table_0(kernel32:ExitProcess)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:ExitProcess)" @ 0x402132>], '__import_name_0(kernel32:ExitProcess)': [<DataSymbol: "__import_name_0(kernel32:ExitProcess)" @ 0x402134>], '__export_name_ptr_table_0(kernel32:GetCurrentProcessId)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:GetCurrentProcessId)" @ 0x402140>], '__import_name_0(kernel32:GetCurrentProcessId)': [<DataSymbol: "__import_name_0(kernel32:GetCurrentProcessId)" @ 0x402142>], '__export_name_ptr_table_0(kernel32:GetModuleHandleA)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:GetModuleHandleA)" @ 0x402156>], '__import_name_0(kernel32:GetModuleHandleA)': [<DataSymbol: "__import_name_0(kernel32:GetModuleHandleA)" @ 0x402158>], '__export_name_ptr_table_0(kernel32:GetProcAddress)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:GetProcAddress)" @ 0x40216a>], '__import_name_0(kernel32:GetProcAddress)': [<DataSymbol: "__import_name_0(kernel32:GetProcAddress)" @ 0x40216c>], '__export_name_ptr_table_0(kernel32:LoadLibraryA)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:LoadLibraryA)" @ 0x40217c>], '__import_name_0(kernel32:LoadLibraryA)': [<DataSymbol: "__import_name_0(kernel32:LoadLibraryA)" @ 0x40217e>], '__export_name_ptr_table_0(kernel32:OpenProcess)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:OpenProcess)" @ 0x40218c>], '__import_name_0(kernel32:OpenProcess)': [<DataSymbol: "__import_name_0(kernel32:OpenProcess)" @ 0x40218e>], '__export_name_ptr_table_0(kernel32:Process32First)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:Process32First)" @ 0x40219a>], '__import_name_0(kernel32:Process32First)': [<DataSymbol: "__import_name_0(kernel32:Process32First)" @ 0x40219c>], '__export_name_ptr_table_0(kernel32:Process32Next)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:Process32Next)" @ 0x4021ac>], '__import_name_0(kernel32:Process32Next)': [<DataSymbol: "__import_name_0(kernel32:Process32Next)" @ 0x4021ae>], '__export_name_ptr_table_0(kernel32:RtlZeroMemory)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:RtlZeroMemory)" @ 0x4021bc>], '__import_name_0(kernel32:RtlZeroMemory)': [<DataSymbol: "__import_name_0(kernel32:RtlZeroMemory)" @ 0x4021be>], '__export_name_ptr_table_0(kernel32:Sleep)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:Sleep)" @ 0x4021cc>], '__import_name_0(kernel32:Sleep)': [<DataSymbol: "__import_name_0(kernel32:Sleep)" @ 0x4021ce>], '__export_name_ptr_table_0(kernel32:VirtualAlloc)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:VirtualAlloc)" @ 0x4021d4>], '__import_name_0(kernel32:VirtualAlloc)': [<DataSymbol: "__import_name_0(kernel32:VirtualAlloc)" @ 0x4021d6>], '__export_name_ptr_table_0(kernel32:lstrcatA)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:lstrcatA)" @ 0x4021e4>], '__import_name_0(kernel32:lstrcatA)': [<DataSymbol: "__import_name_0(kernel32:lstrcatA)" @ 0x4021e6>], '__export_name_ptr_table_0(kernel32:lstrcmpiA)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:lstrcmpiA)" @ 0x4021f0>], '__import_name_0(kernel32:lstrcmpiA)': [<DataSymbol: "__import_name_0(kernel32:lstrcmpiA)" @ 0x4021f2>], '__export_name_ptr_table_0(kernel32:lstrcpyA)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:lstrcpyA)" @ 0x4021fc>], '__import_name_0(kernel32:lstrcpyA)': [<DataSymbol: "__import_name_0(kernel32:lstrcpyA)" @ 0x4021fe>], '__export_name_ptr_table_0(kernel32:lstrlenA)': [<DataSymbol: "__export_name_ptr_table_0(kernel32:lstrlenA)" @ 0x402208>], '__import_name_0(kernel32:lstrlenA)': [<DataSymbol: "__import_name_0(kernel32:lstrlenA)" @ 0x40220a>], '__import_lookup_table_1(user32:MessageBoxA)': [<DataSymbol: "__import_lookup_table_1(user32:MessageBoxA)" @ 0x402214>], 'MessageBoxA': [<ImportAddressSymbol: "MessageBoxA" @ 0x40221c>], '__export_name_ptr_table_1(user32:MessageBoxA)': [<DataSymbol: "__export_name_ptr_table_1(user32:MessageBoxA)" @ 0x402224>], '__import_name_1(user32:MessageBoxA)': [<DataSymbol: "__import_name_1(user32:MessageBoxA)" @ 0x402226>], '__import_lookup_table_2(wsock32:WSAStartup)': [<DataSymbol: "__import_lookup_table_2(wsock32:WSAStartup)" @ 0x402234>], '__import_lookup_table_2(wsock32:closesocket)': [<DataSymbol: "__import_lookup_table_2(wsock32:closesocket)" @ 0x402238>], '__import_lookup_table_2(wsock32:connect)': [<DataSymbol: "__import_lookup_table_2(wsock32:connect)" @ 0x40223c>], '__import_lookup_table_2(wsock32:send)': [<DataSymbol: "__import_lookup_table_2(wsock32:send)" @ 0x402240>], '__import_lookup_table_2(wsock32:socket)': [<DataSymbol: "__import_lookup_table_2(wsock32:socket)" @ 0x402244>], 'WSAStartup': [<ImportAddressSymbol: "WSAStartup" @ 0x40224c>], 'closesocket': [<ImportAddressSymbol: "closesocket" @ 0x402250>], 'connect': [<ImportAddressSymbol: "connect" @ 0x402254>], 'send': [<ImportAddressSymbol: "send" @ 0x402258>], 'socket': [<ImportAddressSymbol: "socket" @ 0x40225c>], '__export_name_ptr_table_2(wsock32:WSAStartup)': [<DataSymbol: "__export_name_ptr_table_2(wsock32:WSAStartup)" @ 0x402264>], '__import_name_2(wsock32:WSAStartup)': [<DataSymbol: "__import_name_2(wsock32:WSAStartup)" @ 0x402266>], '__export_name_ptr_table_2(wsock32:closesocket)': [<DataSymbol: "__export_name_ptr_table_2(wsock32:closesocket)" @ 0x402272>], '__import_name_2(wsock32:closesocket)': [<DataSymbol: "__import_name_2(wsock32:closesocket)" @ 0x402274>], '__export_name_ptr_table_2(wsock32:connect)': [<DataSymbol: "__export_name_ptr_table_2(wsock32:connect)" @ 0x402280>], '__import_name_2(wsock32:connect)': [<DataSymbol: "__import_name_2(wsock32:connect)" @ 0x402282>], '__export_name_ptr_table_2(wsock32:send)': [<DataSymbol: "__export_name_ptr_table_2(wsock32:send)" @ 0x40228a>], '__import_name_2(wsock32:send)': [<DataSymbol: "__import_name_2(wsock32:send)" @ 0x40228c>], '__export_name_ptr_table_2(wsock32:socket)': [<DataSymbol: "__export_name_ptr_table_2(wsock32:socket)" @ 0x402292>], '__import_name_2(wsock32:socket)': [<DataSymbol: "__import_name_2(wsock32:socket)" @ 0x402294>]}>
bv.tag_types, {'Bookmarks': <tag type Bookmarks: πŸ”–>, 'Bugs': <tag type Bugs: πŸ›>, 'Crashes': <tag type Crashes: πŸ›‘>, 'Important': <tag type Important: ❗️>, 'Library': <tag type Library: πŸ“š>, 'Needs Analysis': <tag type Needs Analysis: ❓>, 'Unresolved Stack Adjustment': <tag type Unresolved Stack Adjustment: ❓>, 'Unresolved Indirect Control Flow': <tag type Unresolved Indirect Control Flow: ❓>, 'Unresolved Stack Pointer Value': <tag type Unresolved Stack Pointer Value: ❓️>, 'Invalid Instruction': <tag type Invalid Instruction: 🚫>, 'Could not Generate Flag IL': <tag type Could not Generate Flag IL: 🚫>, 'Unimplemented Instruction (LLIL)': <tag type Unimplemented Instruction (LLIL): 🚫>, 'Unimplemented Instruction (MLIL)': <tag type Unimplemented Instruction (MLIL): 🚫>, 'Unimplemented Instruction (HLIL)': <tag type Unimplemented Instruction (HLIL): 🚫>, 'Non-code Branch': <tag type Non-code Branch: ⚠️>, 'Function too Large': <tag type Function too Large: ⚠️>, 'Function Exceeded Max Analysis Time': <tag type Function Exceeded Max Analysis Time: ⚠️>, 'Jump to Unhandled Relocation': <tag type Jump to Unhandled Relocation: ⚠️>, 'Jump to Malformed Target': <tag type Jump to Malformed Target: ⚠️>}
bv.type_libraries, [<typelib 'user32.dll':x86>, <typelib 'kernel32.dll':x86>, <typelib 'win32common':x86>]
bv.type_names, ['BOOL', 'CHAR', 'COFF_Header', 'CREATE_TOOLHELP_SNAPSHOT_FLAGS', 'DOS_Header', 'DWORD_PTR', 'FARPROC', 'HANDLE', 'HINSTANCE', 'HWND', 'Import_Directory_Table', 'LONG_PTR', 'MESSAGEBOX_RESULT', 'MESSAGEBOX_STYLE', 'PAGE_PROTECTION_FLAGS', 'PE32_Optional_Header', 'PE_Data_Directory_Entry', 'PROCESSENTRY32', 'PROCESS_ACCESS_RIGHTS', 'PSTR', 'SIZE_T', 'Section_Header', 'UINT_PTR', 'ULONG_PTR', 'VIRTUAL_ALLOCATION_TYPE', '_HMODULE', '_HRESULT', '_RPC_STATUS', 'coff_characteristics', 'coff_machine', 'pe_dll_characteristics', 'pe_magic', 'pe_section_flags', 'pe_subsystem']
bv.types, <TypeMapping 34 symbols: {'BOOL': <type: immutable:IntegerTypeClass 'int32_t'>, 'CHAR': <type: immutable:IntegerTypeClass 'uint8_t'>, 'COFF_Header': <type: immutable:StructureTypeClass 'struct COFF_Header'>, 'CREATE_TOOLHELP_SNAPSHOT_FLAGS': <type: immutable:EnumerationTypeClass 'enum CREATE_TOOLHELP_SNAPSHOT_FLAGS'>, 'DOS_Header': <type: immutable:StructureTypeClass 'struct DOS_Header'>, 'DWORD_PTR': <type: immutable:IntegerTypeClass 'uint32_t'>, 'FARPROC': <type: immutable:PointerTypeClass 'int32_t* (*)()'>, 'HANDLE': <type: immutable:PointerTypeClass 'int32_t*'>, 'HINSTANCE': <type: immutable:PointerTypeClass 'int32_t*'>, 'HWND': <type: immutable:PointerTypeClass 'int32_t*'>, 'Import_Directory_Table': <type: immutable:StructureTypeClass 'struct Import_Directory_Table'>, 'LONG_PTR': <type: immutable:IntegerTypeClass 'int32_t'>, 'MESSAGEBOX_RESULT': <type: immutable:EnumerationTypeClass 'enum MESSAGEBOX_RESULT'>, 'MESSAGEBOX_STYLE': <type: immutable:EnumerationTypeClass 'enum MESSAGEBOX_STYLE'>, 'PAGE_PROTECTION_FLAGS': <type: immutable:EnumerationTypeClass 'enum PAGE_PROTECTION_FLAGS'>, 'PE32_Optional_Header': <type: immutable:StructureTypeClass 'struct PE32_Optional_Header'>, 'PE_Data_Directory_Entry': <type: immutable:StructureTypeClass 'struct PE_Data_Directory_Entry'>, 'PROCESSENTRY32': <type: immutable:StructureTypeClass 'struct PROCESSENTRY32'>, 'PROCESS_ACCESS_RIGHTS': <type: immutable:EnumerationTypeClass 'enum PROCESS_ACCESS_RIGHTS'>, 'PSTR': <type: immutable:PointerTypeClass 'uint8_t*'>, 'SIZE_T': <type: immutable:IntegerTypeClass 'uint32_t'>, 'Section_Header': <type: immutable:StructureTypeClass 'struct Section_Header'>, 'UINT_PTR': <type: immutable:IntegerTypeClass 'uint32_t'>, 'ULONG_PTR': <type: immutable:IntegerTypeClass 'uint32_t'>, 'VIRTUAL_ALLOCATION_TYPE': <type: immutable:EnumerationTypeClass 'enum VIRTUAL_ALLOCATION_TYPE'>, '_HMODULE': <type: immutable:PointerTypeClass 'void*'>, '_HRESULT': <type: immutable:IntegerTypeClass 'int32_t'>, '_RPC_STATUS': <type: immutable:IntegerTypeClass 'int32_t'>, 'coff_characteristics': <type: immutable:EnumerationTypeClass 'enum coff_characteristics'>, 'coff_machine': <type: immutable:EnumerationTypeClass 'enum coff_machine'>, 'pe_dll_characteristics': <type: immutable:EnumerationTypeClass 'enum pe_dll_characteristics'>, 'pe_magic': <type: immutable:EnumerationTypeClass 'enum pe_magic'>, 'pe_section_flags': <type: immutable:EnumerationTypeClass 'enum pe_section_flags'>, 'pe_subsystem': <type: immutable:EnumerationTypeClass 'enum pe_subsystem'>}>
bv.view_type, PE

@alexander-hanel
Copy link
Author

References

Access SSA

>>> xxx = bv.get_function_at(plat=bv.platform, addr=here)
>>> xxx.mlil.ssa_form
<mlil func: x86_64@0x140008870>

@alexander-hanel
Copy link
Author

Basic Blocks

for block in current_function.basic_blocks:
       print("%d -> 0x%x" % (block.index+1, block.start))

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment