Map expressions to SSA form and add API to query expression value

4 files changed, 50 insertions, 3 deletions

diff --git a/binaryninjaapi.h b/binaryninjaapi.h
index 9e8ce4c4..58ea890e 100644
--- a/binaryninjaapi.h
+++ b/binaryninjaapi.h
@@ -2165,6 +2165,8 @@ namespace BinaryNinja
 		Ref<LowLevelILFunction> GetNonSSAForm() const;
 		size_t GetSSAInstructionIndex(size_t instr) const;
 		size_t GetNonSSAInstructionIndex(size_t instr) const;
+		size_t GetSSAExprIndex(size_t instr) const;
+		size_t GetNonSSAExprIndex(size_t instr) const;
 
 		size_t GetSSARegisterDefinition(uint32_t reg, size_t idx) const;
 		size_t GetSSAFlagDefinition(uint32_t flag, size_t idx) const;
@@ -2176,6 +2178,8 @@ namespace BinaryNinja
 		RegisterValue GetSSARegisterValue(uint32_t reg, size_t idx);
 		RegisterValue GetSSAFlagValue(uint32_t flag, size_t idx);
 		RegisterValue GetSSAStackContents(size_t memoryIndex, int64_t offset, size_t size);
+
+		RegisterValue GetExprValue(size_t expr);
 	};
 
 	class FunctionRecognizer
diff --git a/binaryninjacore.h b/binaryninjacore.h
index 8536d56e..89302c64 100644
--- a/binaryninjacore.h
+++ b/binaryninjacore.h
@@ -2022,6 +2022,8 @@ extern "C"
 	BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILNonSSAForm(BNLowLevelILFunction* func);
 	BINARYNINJACOREAPI size_t BNGetLowLevelILSSAInstructionIndex(BNLowLevelILFunction* func, size_t instr);
 	BINARYNINJACOREAPI size_t BNGetLowLevelILNonSSAInstructionIndex(BNLowLevelILFunction* func, size_t instr);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILSSAExprIndex(BNLowLevelILFunction* func, size_t expr);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILNonSSAExprIndex(BNLowLevelILFunction* func, size_t expr);
 
 	BINARYNINJACOREAPI size_t BNGetLowLevelILSSARegisterDefinition(BNLowLevelILFunction* func, uint32_t reg, size_t idx);
 	BINARYNINJACOREAPI size_t BNGetLowLevelILSSAFlagDefinition(BNLowLevelILFunction* func, uint32_t reg, size_t idx);
@@ -2039,6 +2041,8 @@ extern "C"
 	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSAStackContents(BNLowLevelILFunction* func,
 		size_t memoryIndex, int64_t offset, size_t size);
 
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILExprValue(BNLowLevelILFunction* func, size_t expr);
+
 	// Types
 	BINARYNINJACOREAPI BNType* BNCreateVoidType(void);
 	BINARYNINJACOREAPI BNType* BNCreateBoolType(void);
diff --git a/lowlevelil.cpp b/lowlevelil.cpp
index 999e35ee..fecde9c8 100644
--- a/lowlevelil.cpp
+++ b/lowlevelil.cpp
@@ -671,7 +671,7 @@ Ref<LowLevelILFunction> LowLevelILFunction::GetNonSSAForm() const
 
 size_t LowLevelILFunction::GetSSAInstructionIndex(size_t instr) const
 {
-	return BNGetLowLevelILNonSSAInstructionIndex(m_object, instr);
+	return BNGetLowLevelILSSAInstructionIndex(m_object, instr);
 }
 
 
@@ -681,6 +681,18 @@ size_t LowLevelILFunction::GetNonSSAInstructionIndex(size_t instr) const
 }
 
 
+size_t LowLevelILFunction::GetSSAExprIndex(size_t expr) const
+{
+	return BNGetLowLevelILSSAExprIndex(m_object, expr);
+}
+
+
+size_t LowLevelILFunction::GetNonSSAExprIndex(size_t expr) const
+{
+	return BNGetLowLevelILNonSSAExprIndex(m_object, expr);
+}
+
+
 size_t LowLevelILFunction::GetSSARegisterDefinition(uint32_t reg, size_t idx) const
 {
 	return BNGetLowLevelILSSARegisterDefinition(m_object, reg, idx);
@@ -760,3 +772,10 @@ RegisterValue LowLevelILFunction::GetSSAStackContents(size_t memoryIndex, int64_
 	BNRegisterValue value = BNGetLowLevelILSSAStackContents(m_object, memoryIndex, offset, size);
 	return RegisterValue::FromAPIObject(value);
 }
+
+
+RegisterValue LowLevelILFunction::GetExprValue(size_t expr)
+{
+	BNRegisterValue value = BNGetLowLevelILExprValue(m_object, expr);
+	return RegisterValue::FromAPIObject(value);
+}
diff --git a/python/lowlevelil.py b/python/lowlevelil.py
index 6c664cb4..6ed179c2 100644
--- a/python/lowlevelil.py
+++ b/python/lowlevelil.py
@@ -53,7 +53,7 @@ class LowLevelILInstruction(object):
 		LowLevelILOperation.LLIL_PUSH: [("src", "expr")],
 		LowLevelILOperation.LLIL_POP: [],
 		LowLevelILOperation.LLIL_REG: [("src", "reg")],
-		LowLevelILOperation.LLIL_CONST: [("value", "int")],
+		LowLevelILOperation.LLIL_CONST: [("constant", "int")],
 		LowLevelILOperation.LLIL_FLAG: [("src", "flag")],
 		LowLevelILOperation.LLIL_FLAG_BIT: [("src", "flag"), ("bit", "int")],
 		LowLevelILOperation.LLIL_ADD: [("left", "expr"), ("right", "expr")],
@@ -107,7 +107,7 @@ class LowLevelILInstruction(object):
 		LowLevelILOperation.LLIL_BOOL_TO_INT: [("src", "expr")],
 		LowLevelILOperation.LLIL_SYSCALL: [],
 		LowLevelILOperation.LLIL_BP: [],
-		LowLevelILOperation.LLIL_TRAP: [("value", "int")],
+		LowLevelILOperation.LLIL_TRAP: [("vector", "int")],
 		LowLevelILOperation.LLIL_UNDEF: [],
 		LowLevelILOperation.LLIL_UNIMPL: [],
 		LowLevelILOperation.LLIL_UNIMPL_MEM: [("src", "expr")],
@@ -237,6 +237,26 @@ class LowLevelILInstruction(object):
 		core.BNFreeInstructionText(tokens, count.value)
 		return result
 
+	@property
+	def ssa_form(self):
+		"""SSA form of expression (read-only)"""
+		return LowLevelILInstruction(self.function.ssa_form,
+			core.BNGetLowLevelILSSAExprIndex(self.function.handle, self.expr_index))
+
+	@property
+	def non_ssa_form(self):
+		"""Non-SSA form of expression (read-only)"""
+		return LowLevelILInstruction(self.function.non_ssa_form,
+			core.BNGetLowLevelILNonSSAExprIndex(self.function.handle, self.expr_index))
+
+	@property
+	def value(self):
+		"""Value of expression using static data flow analysis (read-only)"""
+		value = core.BNGetLowLevelILExprValue(self.function.handle, self.expr_index)
+		result = function.RegisterValue(self.function.arch, value)
+		core.BNFreeRegisterValue(value)
+		return result
+
 	def __setattr__(self, name, value):
 		try:
 			object.__setattr__(self, name, value)