Adds MediumLevelILFunction.aliased_vars, HighLevelILFunction.aliased_vars, and the respective C and C++ functions; Addressed the API side of #2662

5 files changed, 86 insertions, 8 deletions

diff --git a/binaryninjaapi.h b/binaryninjaapi.h
index ff157886..2d567bba 100644
--- a/binaryninjaapi.h
+++ b/binaryninjaapi.h
@@ -3546,7 +3546,9 @@ __attribute__ ((format (printf, 1, 2)))
 
 		std::map<Variable, VariableNameAndType> GetVariables();
 		std::set<Variable> GetMediumLevelILVariables();
+		std::set<Variable> GetMediumLevelILAliasedVariables();
 		std::set<Variable> GetHighLevelILVariables();
+		std::set<Variable> GetHighLevelILAliasedVariables();
 
 		void CreateAutoVariable(const Variable& var, const Confidence<Ref<Type>>& type, const std::string& name,
 			bool ignoreDisjointUses = false);
diff --git a/binaryninjacore.h b/binaryninjacore.h
index ec9951c9..6b95c459 100644
--- a/binaryninjacore.h
+++ b/binaryninjacore.h
@@ -4461,6 +4461,7 @@ __attribute__ ((format (printf, 1, 2)))
 		const BNVariable* var, size_t version);
 
 	BINARYNINJACOREAPI BNVariable* BNGetMediumLevelILVariables(BNMediumLevelILFunction* func, size_t * count);
+	BINARYNINJACOREAPI BNVariable* BNGetMediumLevelILAliasedVariables(BNMediumLevelILFunction* func, size_t* count);
 	BINARYNINJACOREAPI size_t* BNGetMediumLevelILVariableSSAVersions(BNMediumLevelILFunction* func, const BNVariable* var, size_t * count);
 
 	BINARYNINJACOREAPI size_t* BNGetMediumLevelILVariableDefinitions(BNMediumLevelILFunction* func,
@@ -4593,6 +4594,7 @@ __attribute__ ((format (printf, 1, 2)))
 		const BNVariable* var, const size_t instr);
 
 	BINARYNINJACOREAPI BNVariable* BNGetHighLevelILVariables(BNHighLevelILFunction* func, size_t* count);
+	BINARYNINJACOREAPI BNVariable* BNGetHighLevelILAliasedVariables(BNHighLevelILFunction* func, size_t* count);
 	BINARYNINJACOREAPI size_t* BNGetHighLevelILVariableSSAVersions(BNHighLevelILFunction* func, const BNVariable* var, size_t * count);
 
 	BINARYNINJACOREAPI size_t* BNGetHighLevelILVariableDefinitions(BNHighLevelILFunction* func,
diff --git a/function.cpp b/function.cpp
index 45061a96..20c978ac 100644
--- a/function.cpp
+++ b/function.cpp
@@ -1123,8 +1123,26 @@ set<Variable> Function::GetMediumLevelILVariables()
 	BNVariable* vars = BNGetMediumLevelILVariables(mlil->GetObject(), &count);
 
 	set<Variable> result;
-	for (size_t i = 0; i < count; i++)
-	        result.insert({vars[i]});
+	for (size_t i = 0; i < count; ++i)
+		result.emplace(vars[i]);
+
+	BNFreeVariableList(vars);
+	return result;
+}
+
+
+set<Variable> Function::GetMediumLevelILAliasedVariables()
+{
+	Ref<MediumLevelILFunction> mlil = this->GetMediumLevelIL();
+	if (!mlil)
+		return {};
+
+	size_t count;
+	BNVariable* vars = BNGetMediumLevelILAliasedVariables(mlil->GetObject(), &count);
+
+	set<Variable> result;
+	for (size_t i = 0; i < count; ++i)
+		result.emplace(vars[i]);
 
 	BNFreeVariableList(vars);
 	return result;
@@ -1141,8 +1159,26 @@ set<Variable> Function::GetHighLevelILVariables()
 	BNVariable* vars = BNGetHighLevelILVariables(hlil->GetObject(), &count);
 
 	set<Variable> result;
-	for (size_t i = 0; i < count; i++)
-	        result.insert({vars[i]});
+	for (size_t i = 0; i < count; ++i)
+		result.emplace(vars[i]);
+
+	BNFreeVariableList(vars);
+	return result;
+}
+
+
+set<Variable> Function::GetHighLevelILAliasedVariables()
+{
+	Ref<HighLevelILFunction> hlil = this->GetHighLevelIL();
+	if (!hlil)
+		return {};
+
+	size_t count;
+	BNVariable* vars = BNGetHighLevelILAliasedVariables(hlil->GetObject(), &count);
+
+	set<Variable> result;
+	for (size_t i = 0; i < count; ++i)
+		result.emplace(vars[i]);
 
 	BNFreeVariableList(vars);
 	return result;
diff --git a/python/highlevelil.py b/python/highlevelil.py
index a09da6f2..575fe025 100644
--- a/python/highlevelil.py
+++ b/python/highlevelil.py
@@ -2374,7 +2374,7 @@ class HighLevelILFunction:
 
 	@property
 	def vars(self) -> List["variable.Variable"]:
-		"""This gets just the HLIL variables - you may be interested in the union of `HighLevelIlFunction.source_function.param_vars` for all the variables used in the function"""
+		"""This gets just the HLIL variables - you may be interested in the union of `HighLevelIlFunction.source_function.param_vars` and `HighLevelIlFunction.aliased_vars` as well for all the variables used in the function"""
 		if self.source_function is None:
 			return []
 
@@ -2392,8 +2392,27 @@ class HighLevelILFunction:
 		return []
 
 	@property
+	def aliased_vars(self) -> List["variable.Variable"]:
+		"""This returns a list of Variables that are taken reference to and used elsewhere.  You may also wish to consider `HighLevelIlFunction.vars` and `HighLevelIlFunction.source_function.param_vars`"""
+		if self.source_function is None:
+			return []
+
+		if self.il_form in [FunctionGraphType.HighLevelILFunctionGraph, FunctionGraphType.HighLevelILSSAFormFunctionGraph]:
+			count = ctypes.c_ulonglong()
+			core_variables = core.BNGetHighLevelILAliasedVariables(self.handle, count)
+			assert core_variables is not None, "core.BNGetHighLevelILAliasedVariables returned None"
+			try:
+				result = []
+				for var_i in range(count.value):
+					result.append(variable.Variable(self, core_variables[var_i].type, core_variables[var_i].index, core_variables[var_i].storage))
+				return result
+			finally:
+				core.BNFreeVariableList(core_variables)
+		return []
+
+	@property
 	def ssa_vars(self) -> List["mediumlevelil.SSAVariable"]:
-		"""This gets just the HLIL SSA variables - you may be interested in the union of `HighLevelIlFunction.source_function.param_vars` for all the variables used in the function"""
+		"""This gets just the HLIL SSA variables - you may be interested in the union of `HighLevelIlFunction.source_function.param_vars` and `HighLevelIlFunction.aliased_vars` for all the variables used in the function"""
 		if self.source_function is None:
 			return []
 
diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py
index 8f079bfe..0474fcea 100644
--- a/python/mediumlevelil.py
+++ b/python/mediumlevelil.py
@@ -3019,7 +3019,7 @@ class MediumLevelILFunction:
 
 	@property
 	def vars(self) -> List['variable.Variable']:
-		"""This gets just the MLIL variables - you may be interested in the union of `MediumLevelIlFunction.source_function.param_vars` for all the variables used in the function"""
+		"""This gets just the MLIL variables - you may be interested in the union of `MediumLevelIlFunction.aliased_vars` and `MediumLevelIlFunction.source_function.param_vars` for all the variables used in the function"""
 		if self.source_function is None:
 			return []
 
@@ -3037,8 +3037,27 @@ class MediumLevelILFunction:
 		return []
 
 	@property
+	def aliased_vars(self) -> List["variable.Variable"]:
+		"""This returns a list of Variables that are taken reference to and used elsewhere.  You may also wish to consider `MediumLevelIlFunction.vars` and `MediumLevelIlFunction.source_function.param_vars`"""
+		if self.source_function is None:
+			return []
+
+		if self.il_form in [FunctionGraphType.MediumLevelILFunctionGraph, FunctionGraphType.MediumLevelILSSAFormFunctionGraph]:
+			count = ctypes.c_ulonglong()
+			core_variables = core.BNGetMediumLevelILAliasedVariables(self.handle, count)
+			assert core_variables is not None, "core.BNGetMediumLevelILAliasedVariables returned None"
+			try:
+				result = []
+				for var_i in range(count.value):
+					result.append(variable.Variable(self, core_variables[var_i].type, core_variables[var_i].index, core_variables[var_i].storage))
+				return result
+			finally:
+				core.BNFreeVariableList(core_variables)
+		return []
+
+	@property
 	def ssa_vars(self) -> List[SSAVariable]:
-		"""This gets just the MLIL SSA variables - you may be interested in the union of `MediumLevelIlFunction.source_function.param_vars` for all the variables used in the function"""
+		"""This gets just the MLIL SSA variables - you may be interested in the union of `MediumLevelIlFunction.aliased_vars` and `MediumLevelIlFunction.source_function.param_vars` for all the variables used in the function"""
 		if self.source_function is None:
 			return []