Skip to content

Instantly share code, notes, and snippets.

@jershmagersh
Last active February 24, 2024 23:48
Show Gist options
  • Save jershmagersh/fa29bd56160ec0689e991ccabe793b5c to your computer and use it in GitHub Desktop.
Save jershmagersh/fa29bd56160ec0689e991ccabe793b5c to your computer and use it in GitHub Desktop.

How can I recursively get a highlevelil.HighLevelILCall from a nested set of operands? 👤

🤖 To recursively get a HighLevelILCall from a nested set of operands in a High-Level Intermediate Language (HLIL) instruction, you can define a recursive function that traverses the operands of each instruction. If an operand is itself an instruction (which is common in HLIL, where operands can be complex expressions), the function recursively examines it until it finds an instruction of type HighLevelILCall. Here's how you could implement such a function:

import binaryninja
from binaryninja.highlevelil import HighLevelILInstruction, HighLevelILOperation

def find_hlil_call_recursively(instr):
   # Base case: If the instruction is a call, return it
   if instr.operation == HighLevelILOperation.HLIL_CALL:
       return instr
   # If the instruction has operands, recursively search within them
   if hasattr(instr, 'operands'):
       for operand in instr.operands:
           if isinstance(operand, HighLevelILInstruction):
               result = find_hlil_call_recursively(operand)
               if result is not None:
                   return result
   # If no call is found in this instruction or its operands
   return None

# Example usage:
# Assuming 'instr' is a HighLevelILInstruction that may contain nested operands
call_instr = find_hlil_call_recursively(instr)
if call_instr is not None:
   print(f"Found a call instruction: {call_instr}")
else:
   print("No call instruction found in the nested operands.")

This function, find_hlil_call_recursively, takes an HighLevelILInstruction as input and checks if it is a call instruction. If not, it looks through the instruction's operands (if any) for nested HighLevelILInstruction instances and recursively searches them for a call instruction. The process continues until a call instruction is found or all nested operands have been examined.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment