Function: Added `BNGetFunctionILVariables()` / `get_il_vars()` method

3 files changed, 39 insertions, 0 deletions

diff --git a/binaryninjacore.h b/binaryninjacore.h
index 826d94cd..4587f1f9 100644
--- a/binaryninjacore.h
+++ b/binaryninjacore.h
@@ -3483,6 +3483,7 @@ __attribute__ ((format (printf, 1, 2)))
 	BINARYNINJACOREAPI void BNFreeVariableNameAndType(BNVariableNameAndType* var);
 
 	BINARYNINJACOREAPI BNVariableNameAndType* BNGetFunctionVariables(BNFunction* func, size_t* count);
+	BINARYNINJACOREAPI BNVariable* BNGetFunctionILVariables(BNFunction* func, BNFunctionGraphType ilType, size_t* count);
 	BINARYNINJACOREAPI void BNCreateAutoVariable(BNFunction* func, const BNVariable* var, BNTypeWithConfidence* type,
 		const char* name, bool ignoreDisjointUses);
 	BINARYNINJACOREAPI void BNCreateUserVariable(BNFunction* func, const BNVariable* var, BNTypeWithConfidence* type,
diff --git a/python/function.py b/python/function.py
index 0ec6142d..b350046f 100644
--- a/python/function.py
+++ b/python/function.py
@@ -25,6 +25,7 @@ import traceback
 import ctypes
 import numbers
 import string
+from typing import List
 
 # Binary Ninja components
 import binaryninja
@@ -1934,6 +1935,23 @@ class Function(object):
 		core.BNFreeVariableNameAndTypeList(v, count.value)
 		return result
 
+	def get_il_vars(self, il_type: FunctionGraphType) -> List[Variable]:
+		"""
+		Get a (read-only) list of the variables used in the given IL. Only
+		accepts ``MediumLevelILFunctionGraph`` or ``HighLevelILFunctionGraph``
+		for ``il_type``, otherwise nothing will be returned.
+		"""
+
+		count = ctypes.c_ulonglong()
+		v = core.BNGetFunctionILVariables(self.handle, il_type, count)
+
+		result = []
+		for i in range(0, count.value):
+			result.append(Variable(self, v[i].type, v[i].index, v[i].storage))
+
+		core.BNFreeVariableList(v, count.value)
+		return result
+
 	@property
 	def indirect_branches(self):
 		"""List of indirect branches (read-only)"""
diff --git a/suite/testcommon.py b/suite/testcommon.py
index 6941f8b3..a70ec09f 100644
--- a/suite/testcommon.py
+++ b/suite/testcommon.py
@@ -1302,6 +1302,26 @@ class VerifyBuilder(Builder):
         finally:
             self.delete_package("helloworld")
 
+    def test_get_il_vars(self):
+        file_name = self.unpackage_file("helloworld")
+        try:
+            with binja.BinaryViewType.get_view_of_file(file_name) as bv:
+                main_func = bv.get_functions_by_name("main")[0]
+
+                mlil_vars = main_func.get_il_vars(FunctionGraphType.MediumLevelILFunctionGraph)
+                mlil_vars = list(map(lambda v: v.name, mlil_vars))
+                mlil_vars.sort()
+
+                hlil_vars = main_func.get_il_vars(FunctionGraphType.HighLevelILFunctionGraph)
+                hlil_vars = list(map(lambda v: v.name, hlil_vars))
+                hlil_vars.sort()
+
+                assert mlil_vars == ['argc', 'argv', 'envp', 'r0', 'r3', 'var_10', 'var_c']
+                assert hlil_vars == ['argc', 'argv', 'envp']
+                return True
+        finally:
+            self.delete_package("helloworld")
+
     def test_verify_BNDB_round_trip(self):
         """Binary Ninja Database output doesn't match its input"""
         # This will test Binja's ability to save and restore databases