Merge branch 'mlil' into dev

1 files changed, 398 insertions, 43 deletions

diff --git a/binaryninjacore.h b/binaryninjacore.h
index 0b2375ef..7e9a034f 100644
--- a/binaryninjacore.h
+++ b/binaryninjacore.h
@@ -66,6 +66,8 @@
 
 #define BN_INVALID_OPERAND          0xffffffff
 
+#define BN_INVALID_EXPR             ((size_t)-1)
+
 #define BN_DEFAULT_MIN_STRING_LENGTH 4
 #define BN_MAX_STRING_LENGTH         128
 
@@ -87,6 +89,9 @@
 #define LLVM_SVCS_RM_PIC 1
 #define LLVM_SVCS_RM_DYNAMIC_NO_PIC 2
 
+#define BN_MAX_VARIABLE_OFFSET       0x7fffffffffLL
+#define BN_MAX_VARIABLE_INDEX        0xfffff
+
 #ifdef __cplusplus
 extern "C"
 {
@@ -116,6 +121,7 @@ extern "C"
 	struct BNSymbol;
 	struct BNTemporaryFile;
 	struct BNLowLevelILFunction;
+	struct BNMediumLevelILFunction;
 	struct BNType;
 	struct BNStructure;
 	struct BNNamedTypeReference;
@@ -211,7 +217,7 @@ extern "C"
 		// not be used directly by the architecture plugins
 		CodeSymbolToken = 64,
 		DataSymbolToken = 65,
-		StackVariableToken = 66,
+		LocalVariableToken = 66,
 		ImportToken = 67,
 		AddressDisplayToken = 68
 	};
@@ -219,7 +225,7 @@ extern "C"
 	enum BNInstructionTextTokenContext
 	{
 		NoTokenContext = 0,
-		StackVariableTokenContext = 1,
+		LocalVariableTokenContext = 1,
 		DataVariableTokenContext = 2,
 		FunctionReturnTokenContext = 3,
 		ArgumentTokenContext = 4
@@ -235,8 +241,8 @@ extern "C"
 		FunctionHeaderStartLineType,
 		FunctionHeaderEndLineType,
 		FunctionContinuationLineType,
-		StackVariableLineType,
-		StackVariableListEndLineType,
+		LocalVariableLineType,
+		LocalVariableListEndLineType,
 		FunctionEndLineType,
 		NoteStartLineType,
 		NoteLineType,
@@ -267,17 +273,17 @@ extern "C"
 	enum BNLowLevelILOperation
 	{
 		LLIL_NOP,
-		LLIL_SET_REG,
-		LLIL_SET_REG_SPLIT,
-		LLIL_SET_FLAG,
-		LLIL_LOAD,
-		LLIL_STORE,
-		LLIL_PUSH,
-		LLIL_POP,
-		LLIL_REG,
+		LLIL_SET_REG, // Not valid in SSA form (see LLIL_SET_REG_SSA)
+		LLIL_SET_REG_SPLIT, // Not valid in SSA form (see LLIL_SET_REG_SPLIT_SSA)
+		LLIL_SET_FLAG, // Not valid in SSA form (see LLIL_SET_FLAG_SSA)
+		LLIL_LOAD, // Not valid in SSA form (see LLIL_LOAD_SSA)
+		LLIL_STORE, // Not valid in SSA form (see LLIL_STORE_SSA)
+		LLIL_PUSH, // Not valid in SSA form (expanded)
+		LLIL_POP, // Not valid in SSA form (expanded)
+		LLIL_REG, // Not valid in SSA form (see LLIL_REG_SSA)
 		LLIL_CONST,
-		LLIL_FLAG,
-		LLIL_FLAG_BIT,
+		LLIL_FLAG, // Not valid in SSA form (see LLIL_FLAG_SSA)
+		LLIL_FLAG_BIT, // Not valid in SSA form (see LLIL_FLAG_BIT_SSA)
 		LLIL_ADD,
 		LLIL_ADC,
 		LLIL_SUB,
@@ -314,7 +320,7 @@ extern "C"
 		LLIL_NORET,
 		LLIL_IF,
 		LLIL_GOTO,
-		LLIL_FLAG_COND,
+		LLIL_FLAG_COND, // Valid only in Lifted IL
 		LLIL_CMP_E,
 		LLIL_CMP_NE,
 		LLIL_CMP_SLT,
@@ -332,7 +338,28 @@ extern "C"
 		LLIL_TRAP,
 		LLIL_UNDEF,
 		LLIL_UNIMPL,
-		LLIL_UNIMPL_MEM
+		LLIL_UNIMPL_MEM,
+
+		// The following instructions are only used in SSA form
+		LLIL_SET_REG_SSA,
+		LLIL_SET_REG_SSA_PARTIAL,
+		LLIL_SET_REG_SPLIT_SSA,
+		LLIL_REG_SPLIT_DEST_SSA, // Only valid within an LLIL_SET_REG_SPLIT_SSA instruction
+		LLIL_REG_SSA,
+		LLIL_REG_SSA_PARTIAL,
+		LLIL_SET_FLAG_SSA,
+		LLIL_FLAG_SSA,
+		LLIL_FLAG_BIT_SSA,
+		LLIL_CALL_SSA,
+		LLIL_SYSCALL_SSA,
+		LLIL_CALL_PARAM_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
+		LLIL_CALL_STACK_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
+		LLIL_CALL_OUTPUT_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
+		LLIL_LOAD_SSA,
+		LLIL_STORE_SSA,
+		LLIL_REG_PHI,
+		LLIL_FLAG_PHI,
+		LLIL_MEM_PHI
 	};
 
 	enum BNLowLevelILFlagCondition
@@ -370,7 +397,12 @@ extern "C"
 	{
 		NormalFunctionGraph = 0,
 		LowLevelILFunctionGraph = 1,
-		LiftedILFunctionGraph = 2
+		LiftedILFunctionGraph = 2,
+		LowLevelILSSAFormFunctionGraph = 3,
+		MediumLevelILFunctionGraph = 4,
+		MediumLevelILSSAFormFunctionGraph = 5,
+		MappedMediumLevelILFunctionGraph = 6,
+		MappedMediumLevelILSSAFormFunctionGraph = 7
 	};
 
 	enum BNDisassemblyOption
@@ -383,8 +415,7 @@ extern "C"
 		GroupLinearDisassemblyFunctions = 64,
 
 		// Debugging options
-		ShowBasicBlockRegisterState = 128,
-		ShowFlagUsage = 129
+		ShowFlagUsage = 128
 	};
 
 	enum BNTypeClass
@@ -601,16 +632,18 @@ extern "C"
 
 	enum BNRegisterValueType
 	{
+		UndeterminedValue,
 		EntryValue,
-		OffsetFromEntryValue,
 		ConstantValue,
 		StackFrameOffset,
-		UndeterminedValue,
-		OffsetFromUndeterminedValue,
+		ReturnAddressValue,
+
+		// The following are only valid in BNPossibleValueSet
 		SignedRangeValue,
 		UnsignedRangeValue,
 		LookupTableValue,
-		ComparisonResultValue
+		InSetOfValues,
+		NotInSetOfValues
 	};
 
 	enum BNPluginOrigin
@@ -644,10 +677,22 @@ extern "C"
 	struct BNRegisterValue
 	{
 		BNRegisterValueType state;
-		uint32_t reg; // For EntryValue and OffsetFromEntryValue, the original input register
-		int64_t value; // Offset for OffsetFromEntryValue, StackFrameOffset or RangeValue, value of register for ConstantValue
-		uint64_t rangeStart, rangeEnd, rangeStep; // Range of register, inclusive
-		BNLookupTableEntry* table; // Number of entries in rangeEnd
+		int64_t value;
+	};
+
+	struct BNValueRange
+	{
+		uint64_t start, end, step;
+	};
+
+	struct BNPossibleValueSet
+	{
+		BNRegisterValueType state;
+		int64_t value;
+		BNValueRange* ranges;
+		int64_t* valueSet;
+		BNLookupTableEntry* table;
+		size_t count;
 	};
 
 	struct BNRegisterOrConstant
@@ -664,6 +709,129 @@ extern "C"
 		bool autoDiscovered;
 	};
 
+	enum BNMediumLevelILOperation
+	{
+		MLIL_NOP,
+		MLIL_SET_VAR, // Not valid in SSA form (see MLIL_SET_VAR_SSA)
+		MLIL_SET_VAR_FIELD, // Not valid in SSA form (see MLIL_SET_VAR_FIELD)
+		MLIL_SET_VAR_SPLIT, // Not valid in SSA form (see MLIL_SET_VAR_SPLIT_SSA)
+		MLIL_LOAD, // Not valid in SSA form (see MLIL_LOAD_SSA)
+		MLIL_STORE, // Not valid in SSA form (see MLIL_STORE_SSA)
+		MLIL_VAR, // Not valid in SSA form (see MLIL_VAR_SSA)
+		MLIL_VAR_FIELD, // Not valid in SSA form (see MLIL_VAR_SSA_FIELD)
+		MLIL_ADDRESS_OF,
+		MLIL_ADDRESS_OF_FIELD,
+		MLIL_CONST,
+		MLIL_ADD,
+		MLIL_ADC,
+		MLIL_SUB,
+		MLIL_SBB,
+		MLIL_AND,
+		MLIL_OR,
+		MLIL_XOR,
+		MLIL_LSL,
+		MLIL_LSR,
+		MLIL_ASR,
+		MLIL_ROL,
+		MLIL_RLC,
+		MLIL_ROR,
+		MLIL_RRC,
+		MLIL_MUL,
+		MLIL_MULU_DP,
+		MLIL_MULS_DP,
+		MLIL_DIVU,
+		MLIL_DIVU_DP,
+		MLIL_DIVS,
+		MLIL_DIVS_DP,
+		MLIL_MODU,
+		MLIL_MODU_DP,
+		MLIL_MODS,
+		MLIL_MODS_DP,
+		MLIL_NEG,
+		MLIL_NOT,
+		MLIL_SX,
+		MLIL_ZX,
+		MLIL_JUMP,
+		MLIL_JUMP_TO,
+		MLIL_CALL, // Not valid in SSA form (see MLIL_CALL_SSA)
+		MLIL_CALL_UNTYPED, // Not valid in SSA form (see MLIL_CALL_UNTYPED_SSA)
+		MLIL_CALL_OUTPUT, // Only valid within MLIL_CALL or MLIL_SYSCALL family instructions
+		MLIL_CALL_PARAM, // Only valid within MLIL_CALL or MLIL_SYSCALL family instructions
+		MLIL_RET, // Not valid in SSA form (see MLIL_RET_SSA)
+		MLIL_NORET,
+		MLIL_IF,
+		MLIL_GOTO,
+		MLIL_CMP_E,
+		MLIL_CMP_NE,
+		MLIL_CMP_SLT,
+		MLIL_CMP_ULT,
+		MLIL_CMP_SLE,
+		MLIL_CMP_ULE,
+		MLIL_CMP_SGE,
+		MLIL_CMP_UGE,
+		MLIL_CMP_SGT,
+		MLIL_CMP_UGT,
+		MLIL_TEST_BIT,
+		MLIL_BOOL_TO_INT,
+		MLIL_SYSCALL, // Not valid in SSA form (see MLIL_SYSCALL_SSA)
+		MLIL_SYSCALL_UNTYPED, // Not valid in SSA form (see MLIL_SYSCALL_UNTYPED_SSA)
+		MLIL_BP,
+		MLIL_TRAP,
+		MLIL_UNDEF,
+		MLIL_UNIMPL,
+		MLIL_UNIMPL_MEM,
+
+		// The following instructions are only used in SSA form
+		MLIL_SET_VAR_SSA,
+		MLIL_SET_VAR_SSA_FIELD,
+		MLIL_SET_VAR_SPLIT_SSA,
+		MLIL_SET_VAR_ALIASED,
+		MLIL_SET_VAR_ALIASED_FIELD,
+		MLIL_VAR_SSA,
+		MLIL_VAR_SSA_FIELD,
+		MLIL_VAR_ALIASED,
+		MLIL_VAR_ALIASED_FIELD,
+		MLIL_CALL_SSA,
+		MLIL_CALL_UNTYPED_SSA,
+		MLIL_SYSCALL_SSA,
+		MLIL_SYSCALL_UNTYPED_SSA,
+		MLIL_CALL_PARAM_SSA, // Only valid within the MLIL_CALL_SSA, MLIL_SYSCALL_SSA family instructions
+		MLIL_CALL_OUTPUT_SSA, // Only valid within the MLIL_CALL_SSA or MLIL_SYSCALL_SSA family instructions
+		MLIL_LOAD_SSA,
+		MLIL_STORE_SSA,
+		MLIL_VAR_PHI,
+		MLIL_MEM_PHI
+	};
+
+	struct BNMediumLevelILInstruction
+	{
+		BNMediumLevelILOperation operation;
+		size_t size;
+		uint64_t operands[5];
+		uint64_t address;
+	};
+
+	struct BNMediumLevelILLabel
+	{
+		bool resolved;
+		size_t ref;
+		size_t operand;
+	};
+
+	enum BNVariableSourceType
+	{
+		StackVariableSourceType,
+		RegisterVariableSourceType,
+		FlagVariableSourceType
+	};
+
+	struct BNVariable
+	{
+		BNVariableSourceType type;
+		uint32_t index;
+		int64_t storage;
+	};
+
 	// Callbacks
 	struct BNLogListener
 	{
@@ -1013,11 +1181,11 @@ extern "C"
 		uint32_t (*getFloatReturnValueRegister)(void* ctxt);
 	};
 
-	struct BNStackVariable
+	struct BNVariableNameAndType
 	{
+		BNVariable var;
 		BNType* type;
 		char* name;
-		int64_t offset;
 		bool autoDefined;
 	};
 
@@ -1026,7 +1194,7 @@ extern "C"
 		uint32_t sourceOperand;
 		BNType* type;
 		char* name;
-		int64_t startingOffset;
+		uint64_t varIdentifier;
 		int64_t referencedOffset;
 	};
 
@@ -1275,6 +1443,19 @@ extern "C"
 		BNType* type;
 	};
 
+	enum BNILBranchDependence
+	{
+		NotBranchDependent,
+		TrueBranchDependent,
+		FalseBranchDependent
+	};
+
+	struct BNILBranchInstructionAndDependence
+	{
+		size_t branch;
+		BNILBranchDependence dependence;
+	};
+
 	BINARYNINJACOREAPI char* BNAllocString(const char* contents);
 	BINARYNINJACOREAPI void BNFreeString(char* str);
 	BINARYNINJACOREAPI void BNFreeStringList(char** strs, size_t count);
@@ -1731,26 +1912,21 @@ extern "C"
 	BINARYNINJACOREAPI size_t BNGetLowLevelILForInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr);
 	BINARYNINJACOREAPI size_t* BNGetLowLevelILExitsForInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr,
 	                                                              size_t* count);
-	BINARYNINJACOREAPI void BNFreeLowLevelILInstructionList(size_t* list);
+	BINARYNINJACOREAPI void BNFreeILInstructionList(size_t* list);
+	BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetFunctionMediumLevelIL(BNFunction* func);
 	BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAtInstruction(BNFunction* func, BNArchitecture* arch,
 		uint64_t addr, uint32_t reg);
 	BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAfterInstruction(BNFunction* func, BNArchitecture* arch,
 		uint64_t addr, uint32_t reg);
-	BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAtLowLevelILInstruction(BNFunction* func, size_t i, uint32_t reg);
-	BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAfterLowLevelILInstruction(BNFunction* func, size_t i, uint32_t reg);
 	BINARYNINJACOREAPI BNRegisterValue BNGetStackContentsAtInstruction(BNFunction* func, BNArchitecture* arch,
 		uint64_t addr, int64_t offset, size_t size);
 	BINARYNINJACOREAPI BNRegisterValue BNGetStackContentsAfterInstruction(BNFunction* func, BNArchitecture* arch,
 		uint64_t addr, int64_t offset, size_t size);
-	BINARYNINJACOREAPI BNRegisterValue BNGetStackContentsAtLowLevelILInstruction(BNFunction* func, size_t i,
-		int64_t offset, size_t size);
-	BINARYNINJACOREAPI BNRegisterValue BNGetStackContentsAfterLowLevelILInstruction(BNFunction* func, size_t i,
-		int64_t offset, size_t size);
 	BINARYNINJACOREAPI BNRegisterValue BNGetParameterValueAtInstruction(BNFunction* func, BNArchitecture* arch,
 		uint64_t addr, BNType* functionType, size_t i);
 	BINARYNINJACOREAPI BNRegisterValue BNGetParameterValueAtLowLevelILInstruction(BNFunction* func, size_t instr,
 		BNType* functionType, size_t i);
-	BINARYNINJACOREAPI void BNFreeRegisterValue(BNRegisterValue* value);
+	BINARYNINJACOREAPI void BNFreePossibleValueSet(BNPossibleValueSet* value);
 	BINARYNINJACOREAPI uint32_t* BNGetRegistersReadByInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr,
 	                                                             size_t* count);
 	BINARYNINJACOREAPI uint32_t* BNGetRegistersWrittenByInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr,
@@ -1811,14 +1987,27 @@ extern "C"
 	                                                          uint64_t len, size_t* count);
 	BINARYNINJACOREAPI void BNFreeStringReferenceList(BNStringReference* strings);
 
-	BINARYNINJACOREAPI BNStackVariable* BNGetStackLayout(BNFunction* func, size_t* count);
-	BINARYNINJACOREAPI void BNFreeStackLayout(BNStackVariable* vars, size_t count);
+	BINARYNINJACOREAPI BNVariableNameAndType* BNGetStackLayout(BNFunction* func, size_t* count);
+	BINARYNINJACOREAPI void BNFreeVariableList(BNVariableNameAndType* vars, size_t count);
 	BINARYNINJACOREAPI void BNCreateAutoStackVariable(BNFunction* func, int64_t offset, BNType* type, const char* name);
 	BINARYNINJACOREAPI void BNCreateUserStackVariable(BNFunction* func, int64_t offset, BNType* type, const char* name);
 	BINARYNINJACOREAPI void BNDeleteAutoStackVariable(BNFunction* func, int64_t offset);
 	BINARYNINJACOREAPI void BNDeleteUserStackVariable(BNFunction* func, int64_t offset);
-	BINARYNINJACOREAPI bool BNGetStackVariableAtFrameOffset(BNFunction* func, int64_t offset, BNStackVariable* var);
-	BINARYNINJACOREAPI void BNFreeStackVariable(BNStackVariable* var);
+	BINARYNINJACOREAPI bool BNGetStackVariableAtFrameOffset(BNFunction* func, BNArchitecture* arch, uint64_t addr,
+		int64_t offset, BNVariableNameAndType* var);
+	BINARYNINJACOREAPI void BNFreeVariableNameAndType(BNVariableNameAndType* var);
+
+	BINARYNINJACOREAPI BNVariableNameAndType* BNGetFunctionVariables(BNFunction* func, size_t* count);
+	BINARYNINJACOREAPI void BNCreateAutoVariable(BNFunction* func, const BNVariable* var, BNType* type,
+		const char* name, bool ignoreDisjointUses);
+	BINARYNINJACOREAPI void BNCreateUserVariable(BNFunction* func, const BNVariable* var, BNType* type,
+		const char* name, bool ignoreDisjointUses);
+	BINARYNINJACOREAPI void BNDeleteAutoVariable(BNFunction* func, const BNVariable* var);
+	BINARYNINJACOREAPI void BNDeleteUserVariable(BNFunction* func, const BNVariable* var);
+	BINARYNINJACOREAPI BNType* BNGetVariableType(BNFunction* func, const BNVariable* var);
+	BINARYNINJACOREAPI char* BNGetVariableName(BNFunction* func, const BNVariable* var);
+	BINARYNINJACOREAPI uint64_t BNToVariableIdentifier(const BNVariable* var);
+	BINARYNINJACOREAPI BNVariable BNFromVariableIdentifier(uint64_t id);
 
 	BINARYNINJACOREAPI void BNSetAutoIndirectBranches(BNFunction* func, BNArchitecture* sourceArch, uint64_t source,
 	                                                  BNArchitectureAndAddress* branches, size_t count);
@@ -2010,7 +2199,10 @@ extern "C"
 	BINARYNINJACOREAPI BNLowLevelILFunction* BNNewLowLevelILFunctionReference(BNLowLevelILFunction* func);
 	BINARYNINJACOREAPI void BNFreeLowLevelILFunction(BNLowLevelILFunction* func);
 	BINARYNINJACOREAPI uint64_t BNLowLevelILGetCurrentAddress(BNLowLevelILFunction* func);
-	BINARYNINJACOREAPI void BNLowLevelILSetCurrentAddress(BNLowLevelILFunction* func, uint64_t addr);
+	BINARYNINJACOREAPI void BNLowLevelILSetCurrentAddress(BNLowLevelILFunction* func,
+		BNArchitecture* arch, uint64_t addr);
+	BINARYNINJACOREAPI size_t BNLowLevelILGetInstructionStart(BNLowLevelILFunction* func,
+		BNArchitecture* arch, uint64_t addr);
 	BINARYNINJACOREAPI void BNLowLevelILClearIndirectBranches(BNLowLevelILFunction* func);
 	BINARYNINJACOREAPI void BNLowLevelILSetIndirectBranches(BNLowLevelILFunction* func, BNArchitectureAndAddress* branches,
 	                                                        size_t count);
@@ -2033,6 +2225,7 @@ extern "C"
 	BINARYNINJACOREAPI BNLowLevelILInstruction BNGetLowLevelILByIndex(BNLowLevelILFunction* func, size_t i);
 	BINARYNINJACOREAPI size_t BNGetLowLevelILIndexForInstruction(BNLowLevelILFunction* func, size_t i);
 	BINARYNINJACOREAPI size_t BNGetLowLevelILInstructionCount(BNLowLevelILFunction* func);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILExprCount(BNLowLevelILFunction* func);
 
 	BINARYNINJACOREAPI void BNAddLowLevelILLabelForAddress(BNLowLevelILFunction* func, BNArchitecture* arch, uint64_t addr);
 	BINARYNINJACOREAPI BNLowLevelILLabel* BNGetLowLevelILLabelForAddress(BNLowLevelILFunction* func,
@@ -2048,6 +2241,168 @@ extern "C"
 
 	BINARYNINJACOREAPI BNBasicBlock** BNGetLowLevelILBasicBlockList(BNLowLevelILFunction* func, size_t* count);
 
+	BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILSSAForm(BNLowLevelILFunction* func);
+	BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILNonSSAForm(BNLowLevelILFunction* func);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILSSAInstructionIndex(BNLowLevelILFunction* func, size_t instr);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILNonSSAInstructionIndex(BNLowLevelILFunction* func, size_t instr);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILSSAExprIndex(BNLowLevelILFunction* func, size_t expr);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILNonSSAExprIndex(BNLowLevelILFunction* func, size_t expr);
+
+	BINARYNINJACOREAPI size_t BNGetLowLevelILSSARegisterDefinition(BNLowLevelILFunction* func, uint32_t reg, size_t idx);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILSSAFlagDefinition(BNLowLevelILFunction* func, uint32_t reg, size_t idx);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILSSAMemoryDefinition(BNLowLevelILFunction* func, size_t idx);
+	BINARYNINJACOREAPI size_t* BNGetLowLevelILSSARegisterUses(BNLowLevelILFunction* func, uint32_t reg, size_t idx,
+		size_t* count);
+	BINARYNINJACOREAPI size_t* BNGetLowLevelILSSAFlagUses(BNLowLevelILFunction* func, uint32_t reg, size_t idx,
+		size_t* count);
+	BINARYNINJACOREAPI size_t* BNGetLowLevelILSSAMemoryUses(BNLowLevelILFunction* func, size_t idx, size_t* count);
+
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSARegisterValue(BNLowLevelILFunction* func,
+		uint32_t reg, size_t idx);
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSAFlagValue(BNLowLevelILFunction* func,
+		uint32_t flag, size_t idx);
+
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILExprValue(BNLowLevelILFunction* func, size_t expr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleExprValues(BNLowLevelILFunction* func, size_t expr);
+
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILRegisterValueAtInstruction(BNLowLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILRegisterValueAfterInstruction(BNLowLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleRegisterValuesAtInstruction(BNLowLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleRegisterValuesAfterInstruction(BNLowLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILFlagValueAtInstruction(BNLowLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILFlagValueAfterInstruction(BNLowLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleFlagValuesAtInstruction(BNLowLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleFlagValuesAfterInstruction(BNLowLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILStackContentsAtInstruction(BNLowLevelILFunction* func,
+		int64_t offset, size_t len, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILStackContentsAfterInstruction(BNLowLevelILFunction* func,
+		int64_t offset, size_t len, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleStackContentsAtInstruction(BNLowLevelILFunction* func,
+		int64_t offset, size_t len, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleStackContentsAfterInstruction(BNLowLevelILFunction* func,
+		int64_t offset, size_t len, size_t instr);
+
+	BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMediumLevelILForLowLevelIL(BNLowLevelILFunction* func);
+	BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMappedMediumLevelIL(BNLowLevelILFunction* func);
+	BINARYNINJACOREAPI size_t BNGetMappedMediumLevelILInstructionIndex(BNLowLevelILFunction* func, size_t instr);
+	BINARYNINJACOREAPI size_t BNGetMappedMediumLevelILExprIndex(BNLowLevelILFunction* func, size_t expr);
+
+	// Medium-level IL
+	BINARYNINJACOREAPI BNMediumLevelILFunction* BNCreateMediumLevelILFunction(BNArchitecture* arch, BNFunction* func);
+	BINARYNINJACOREAPI BNMediumLevelILFunction* BNNewMediumLevelILFunctionReference(BNMediumLevelILFunction* func);
+	BINARYNINJACOREAPI void BNFreeMediumLevelILFunction(BNMediumLevelILFunction* func);
+	BINARYNINJACOREAPI uint64_t BNMediumLevelILGetCurrentAddress(BNMediumLevelILFunction* func);
+	BINARYNINJACOREAPI void BNMediumLevelILSetCurrentAddress(BNMediumLevelILFunction* func,
+		BNArchitecture* arch, uint64_t addr);
+	BINARYNINJACOREAPI size_t BNMediumLevelILGetInstructionStart(BNMediumLevelILFunction* func,
+		BNArchitecture* arch, uint64_t addr);
+	BINARYNINJACOREAPI size_t BNMediumLevelILAddExpr(BNMediumLevelILFunction* func, BNMediumLevelILOperation operation,
+		size_t size, uint64_t a, uint64_t b, uint64_t c, uint64_t d, uint64_t e);
+	BINARYNINJACOREAPI size_t BNMediumLevelILAddInstruction(BNMediumLevelILFunction* func, size_t expr);
+	BINARYNINJACOREAPI size_t BNMediumLevelILGoto(BNMediumLevelILFunction* func, BNMediumLevelILLabel* label);
+	BINARYNINJACOREAPI size_t BNMediumLevelILIf(BNMediumLevelILFunction* func, uint64_t op,
+		BNMediumLevelILLabel* t, BNMediumLevelILLabel* f);
+	BINARYNINJACOREAPI void BNMediumLevelILInitLabel(BNMediumLevelILLabel* label);
+	BINARYNINJACOREAPI void BNMediumLevelILMarkLabel(BNMediumLevelILFunction* func, BNMediumLevelILLabel* label);
+	BINARYNINJACOREAPI void BNFinalizeMediumLevelILFunction(BNMediumLevelILFunction* func);
+
+	BINARYNINJACOREAPI size_t BNMediumLevelILAddLabelList(BNMediumLevelILFunction* func,
+		BNMediumLevelILLabel** labels, size_t count);
+	BINARYNINJACOREAPI size_t BNMediumLevelILAddOperandList(BNMediumLevelILFunction* func,
+		uint64_t* operands, size_t count);
+	BINARYNINJACOREAPI uint64_t* BNMediumLevelILGetOperandList(BNMediumLevelILFunction* func, size_t expr,
+		size_t operand, size_t* count);
+	BINARYNINJACOREAPI void BNMediumLevelILFreeOperandList(uint64_t* operands);
+
+	BINARYNINJACOREAPI BNMediumLevelILInstruction BNGetMediumLevelILByIndex(BNMediumLevelILFunction* func, size_t i);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILIndexForInstruction(BNMediumLevelILFunction* func, size_t i);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILInstructionForExpr(BNMediumLevelILFunction* func, size_t expr);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILInstructionCount(BNMediumLevelILFunction* func);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILExprCount(BNMediumLevelILFunction* func);
+
+	BINARYNINJACOREAPI bool BNGetMediumLevelILExprText(BNMediumLevelILFunction* func, BNArchitecture* arch, size_t i,
+		BNInstructionTextToken** tokens, size_t* count);
+	BINARYNINJACOREAPI bool BNGetMediumLevelILInstructionText(BNMediumLevelILFunction* il, BNFunction* func,
+		BNArchitecture* arch, size_t i, BNInstructionTextToken** tokens, size_t* count);
+
+	BINARYNINJACOREAPI BNBasicBlock** BNGetMediumLevelILBasicBlockList(BNMediumLevelILFunction* func, size_t* count);
+
+	BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMediumLevelILSSAForm(BNMediumLevelILFunction* func);
+	BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMediumLevelILNonSSAForm(BNMediumLevelILFunction* func);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAInstructionIndex(BNMediumLevelILFunction* func, size_t instr);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILNonSSAInstructionIndex(BNMediumLevelILFunction* func, size_t instr);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAExprIndex(BNMediumLevelILFunction* func, size_t expr);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILNonSSAExprIndex(BNMediumLevelILFunction* func, size_t expr);
+
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAVarDefinition(BNMediumLevelILFunction* func,
+		const BNVariable* var, size_t idx);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAMemoryDefinition(BNMediumLevelILFunction* func, size_t idx);
+	BINARYNINJACOREAPI size_t* BNGetMediumLevelILSSAVarUses(BNMediumLevelILFunction* func, const BNVariable* var,
+		size_t idx, size_t* count);
+	BINARYNINJACOREAPI size_t* BNGetMediumLevelILSSAMemoryUses(BNMediumLevelILFunction* func,
+		size_t idx, size_t* count);
+
+	BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILSSAVarValue(BNMediumLevelILFunction* func,
+		const BNVariable* var, size_t idx);
+	BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILExprValue(BNMediumLevelILFunction* func, size_t expr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleSSAVarValues(BNMediumLevelILFunction* func,
+		const BNVariable* var, size_t idx, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleExprValues(BNMediumLevelILFunction* func, size_t expr);
+
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAVarIndexAtILInstruction(BNMediumLevelILFunction* func,
+		const BNVariable* var, size_t instr);
+	BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAMemoryIndexAtILInstruction(BNMediumLevelILFunction* func,
+		size_t instr);
+	BINARYNINJACOREAPI BNVariable BNGetMediumLevelILVariableForRegisterAtInstruction(BNMediumLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNVariable BNGetMediumLevelILVariableForFlagAtInstruction(BNMediumLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNVariable BNGetMediumLevelILVariableForStackLocationAtInstruction(BNMediumLevelILFunction* func,
+		int64_t offset, size_t instr);
+
+	BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILRegisterValueAtInstruction(BNMediumLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILRegisterValueAfterInstruction(BNMediumLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleRegisterValuesAtInstruction(BNMediumLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(BNMediumLevelILFunction* func,
+		uint32_t reg, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILFlagValueAtInstruction(BNMediumLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILFlagValueAfterInstruction(BNMediumLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleFlagValuesAtInstruction(BNMediumLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleFlagValuesAfterInstruction(BNMediumLevelILFunction* func,
+		uint32_t flag, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILStackContentsAtInstruction(BNMediumLevelILFunction* func,
+		int64_t offset, size_t len, size_t instr);
+	BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILStackContentsAfterInstruction(BNMediumLevelILFunction* func,
+		int64_t offset, size_t len, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleStackContentsAtInstruction(BNMediumLevelILFunction* func,
+		int64_t offset, size_t len, size_t instr);
+	BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleStackContentsAfterInstruction(BNMediumLevelILFunction* func,
+		int64_t offset, size_t len, size_t instr);
+
+	BINARYNINJACOREAPI BNILBranchDependence BNGetMediumLevelILBranchDependence(BNMediumLevelILFunction* func,
+		size_t curInstr, size_t branchInstr);
+	BINARYNINJACOREAPI BNILBranchInstructionAndDependence* BNGetAllMediumLevelILBranchDependence(
+		BNMediumLevelILFunction* func, size_t instr, size_t* count);
+	BINARYNINJACOREAPI void BNFreeILBranchDependenceList(BNILBranchInstructionAndDependence* branches);
+
+	BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILForMediumLevelIL(BNMediumLevelILFunction* func);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILInstructionIndex(BNMediumLevelILFunction* func, size_t instr);
+	BINARYNINJACOREAPI size_t BNGetLowLevelILExprIndex(BNMediumLevelILFunction* func, size_t expr);
+
 	// Types
 	BINARYNINJACOREAPI BNType* BNCreateVoidType(void);
 	BINARYNINJACOREAPI BNType* BNCreateBoolType(void);