Skip to content

Instantly share code, notes, and snippets.

@withzombies
Created October 27, 2016 14:49
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save withzombies/c75a36986dd95969ecfecfda785e4e9b to your computer and use it in GitHub Desktop.
Save withzombies/c75a36986dd95969ecfecfda785e4e9b to your computer and use it in GitHub Desktop.
>>> import binaryninja
>>> bv = binaryninja.BinaryViewType["Mach-O"].open("/bin/ls")
>>> bv.update_analysis_and_wait()
>>> t = bv.parse_type_string("int (*lol)(int one, void* two, size_t three)")
>>> t
(<type: int32_t (*)(int32_t one, void* two, uint64_t three)>, 'lol')
>>> ti = t[0]
>>> dir(ti)
['__class__', '__del__', '__delattr__', '__dict__', '__doc__', '__format__', '__getattribute__', '__hash__', '__init__', '__module__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', '__weakref__', 'alignment', 'array', 'bool', 'calling_convention', 'can_return', 'const', 'count', 'element_type', 'enumeration', 'enumeration_type', 'float', 'function', 'get_string_after_name', 'get_string_before_name', 'handle', 'has_variable_arguments', 'int', 'modified', 'parameters', 'pointer', 'return_value', 'signed', 'structure', 'structure_type', 'target', 'type_class', 'unknown_type', 'void', 'width']
>>> ti.return_value
<type: int32_t ( )(int32_t one, void* two, uint64_t three)>
>>> ti.element_type
<type: int32_t ( )(int32_t one, void* two, uint64_t three)>
>>> ti.type_class
'PointerTypeClass'
>>> ti.return_value
<type: int32_t ( )(int32_t one, void* two, uint64_t three)>
>>> tip = ti.return_value
>>> tip.type_class
'FunctionTypeClass'
>>> tip.parameters
[(<type: int32_t>, 'one'), (<type: void*>, 'two'), (<type: uint64_t>, 'three')]
>>>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment