normalize format syntax on LLIL and MLIL documentation and add many missing operations

2 files changed, 267 insertions, 211 deletions

diff --git a/docs/dev/bnil-llil.md b/docs/dev/bnil-llil.md
index 130af246..89d505ef 100644
--- a/docs/dev/bnil-llil.md
+++ b/docs/dev/bnil-llil.md
@@ -1,6 +1,6 @@
 # Binary Ninja Intermediate Language Series, Part 1: Low Level IL
 
-Make sure to checkout the [BNIL overview](bnil-overview.md) first if you haven't already. Or feel free to skip to [part 2](bnil-mlil.md) which covers MLIL. This developer guide is intended to cover some of the mechanics of the LLIL to distinguish it from the other ILs in the BNIL family. 
+Make sure to checkout the [BNIL overview](bnil-overview.md) first if you haven't already. Or feel free to skip to [part 2](bnil-mlil.md) which covers MLIL. This developer guide is intended to cover some of the mechanics of the LLIL to distinguish it from the other ILs in the BNIL family.
 
 If you've already read the introduction, let's get right into the details of LLIL!
 
@@ -10,7 +10,7 @@ The Lifted IL is very similar to the LLIL and is primarily of interest for Archi
 
 ## Introduction by example
 
-Since doing is the easiest way to learn let's start with a simple example binary and step through analyzing it using the python console. 
+Since doing is the easiest way to learn let's start with a simple example binary and step through analyzing it using the python console.
 
 ![Low Level IL Option >](../img/llil_option.png)
 
@@ -26,7 +26,7 @@ Next, enter the following in the console:
 >>> for block in current_function.low_level_il:
 ... 	for instr in block:
 ... 		print instr.address, instr.instr_index, instr
-... 
+...
 4196422 0 push(rbp)
 4196423 1 rbp = rsp {var_8}
 4196426 2 rsp = rsp - 0x110
@@ -34,7 +34,7 @@ Next, enter the following in the console:
 ...
 ```
 
-This will print out all the LLIL instructions in the current function. How does this code work? 
+This will print out all the LLIL instructions in the current function. How does this code work?
 
 First we use the global magic variable `current_function` which gives us the python object [`function.Function`](http://api.binary.ninja/function.Function.html) for whatever function is currently selected in the UI. The variable is only usable from the python console, and shouldn't be used for headless plugins. In a script you can either use the function that was passed in if you [registered your plugin](https://api.binary.ninja/binaryninja.plugin-module.html#binaryninja.plugin.PluginCommand.register_for_function) to handle functions, or you can compute the function based on [a specific address](https://api.binary.ninja/binaryninja.binaryview-module.html?highlight=get_functions_at#binaryninja.binaryview.BinaryView.get_functions_at), or maybe even just iterate over all the functions in a BinaryView (`for func in bv.functions:`).
 
@@ -59,7 +59,7 @@ Now that we've established how to access LLIL Functions, Blocks, and Instruction
 
 ```
 eax = eax + ecx * 4
-``` 
+```
 
 The tree for such an instruction would look like:
 
@@ -80,7 +80,7 @@ Now let's get back to the examples. First let's pick an instruction to work with
 >>> instr = current_function.low_level_il[2]
 >>> instr
 <il: rsp = rsp - 0x110>
-``` 
+```
 
 For the above instruction, we have a few operations we can perform:
 
@@ -142,7 +142,7 @@ Now with some knowledge of the `LowLevelIL` class let's try to do something with
 ...  for instr in block:
 ...   if instr.operation == LowLevelILOperation.LLIL_SET_REG and instr.dest.name == 'rdx':
 ...    print instr.address, instr.instr_index, instr
-... 
+...
 4196490 14 rdx = [rax].q
 4196500 16 rdx = [rax + 8].q
 4196511 18 rdx = [rax + 0x10].q
@@ -161,20 +161,20 @@ Going into gross detail on all the instructions is out of scope of this article,
 
 When parsing an instruction tree the terminals are registers, constants and flags. This provide the basis from which all instructions are built.
 
-* **`LLIL_REG`** - A register, terminal
-* **`LLIL_CONST`** - A constant integer value, terminal
-* **`LLIL_SET_REG`** - Sets a register to the results of the IL operation in `src` attribute.
-* **`LLIL_SET_REG_SPLIT`** - Uses a pair of registers as one double sized register, setting both registers at once.
-* **`LLIL_SET_FLAG`** - Sets the specified flag to the IL operation in `src` attribute.
+* `LLIL_REG` - A register, terminal
+* `LLIL_CONST` - A constant integer value, terminal
+* `LLIL_SET_REG` - Sets a register to the results of the IL operation in `src` attribute.
+* `LLIL_SET_REG_SPLIT` - Uses a pair of registers as one double sized register, setting both registers at once.
+* `LLIL_SET_FLAG` - Sets the specified flag to the IL operation in `src` attribute.
 
 ### Memory Load & Store
 
 Reading and writing memory is accomplished through the following instructions.
 
-* **`LLIL_LOAD`** - Load a value from memory.
-* **`LLIL_STORE`** - Store a value to memory.
-* **`LLIL_PUSH`** - Store value to stack; adjusting stack pointer by sizeof(value) after the store.
-* **`LLIL_POP`** - Load value from stack; adjusting stack pointer by sizeof(value) after the store.
+* `LLIL_LOAD` - Load a value from memory.
+* `LLIL_STORE` - Store a value to memory.
+* `LLIL_PUSH` - Store value to stack; adjusting stack pointer by sizeof(value) after the store.
+* `LLIL_POP` - Load value from stack; adjusting stack pointer by sizeof(value) after the store.
 
 
 ### Control Flow & Conditionals
@@ -194,28 +194,28 @@ To translate this instruction to IL we have to first create true and false label
 0 @ 00000002 if (eax == 0) then 1 else 3
 1 @ 00000002 eax = ebx
 2 @ 00000002 goto 3
-``` 
+```
 
-As you can see from the above code, labels are really just used internally and aren't explicitly marked. In addition to `if` and `goto`, the `jump_to` IL instruction is the only other instruction that operates on labels.  The rest of the IL control flow instructions operate on addresses rather than labels, much like actual assembly language instructions. Note that an architecture plugin author should not be emitting `jump_to` IL instructions as those are generated by the analysis automatically. 
+As you can see from the above code, labels are really just used internally and aren't explicitly marked. In addition to `if` and `goto`, the `jump_to` IL instruction is the only other instruction that operates on labels.  The rest of the IL control flow instructions operate on addresses rather than labels, much like actual assembly language instructions. Note that an architecture plugin author should not be emitting `jump_to` IL instructions as those are generated by the analysis automatically.
 
-* **`LLIL_JUMP`** - Branch execution to the result of the IL operation.
-* **`LLIL_JUMP_TO`** - Jump table construct, contains an expression and list of possible targets.
-* **`LLIL_CALL`** - Branch execution to the result of the IL operation.
-* **`LLIL_RET`** - Return execution to the caller.
-* **`LLIL_NORET`** - Instruction emitted automatically after syscall or call instruction which cause the program to terminate.
-* **`LLIL_IF`** - `If` provides conditional execution. If condition is true execution branches to the true label and false label otherwise.
-* **`LLIL_GOTO`** - `Goto` is used to branch to an IL label, this is different than jump since jump can only jump to addresses.
-* **`LLIL_FLAG_COND`** - Returns the flag condition expression for the specified flag condition.
-* **`LLIL_CMP_E`** - equality
-* **`LLIL_CMP_NE`** - not equal
-* **`LLIL_CMP_SLT`** - signed less than
-* **`LLIL_CMP_ULT`** - unsigned less than
-* **`LLIL_CMP_SLE`** - signed less than or equal
-* **`LLIL_CMP_ULE`** - unsigned less than or equal
-* **`LLIL_CMP_SGE`** - signed greater than or equal
-* **`LLIL_CMP_UGE`** - unsigned greater than or equal
-* **`LLIL_CMP_SGT`** - signed greater than
-* **`LLIL_CMP_UGT`** - unsigned greater than
+* `LLIL_JUMP` - Branch execution to the result of the IL operation.
+* `LLIL_JUMP_TO` - Jump table construct, contains an expression and list of possible targets.
+* `LLIL_CALL` - Branch execution to the result of the IL operation.
+* `LLIL_RET` - Return execution to the caller.
+* `LLIL_NORET` - Instruction emitted automatically after syscall or call instruction which cause the program to terminate.
+* `LLIL_IF` - `If` provides conditional execution. If condition is true execution branches to the true label and false label otherwise.
+* `LLIL_GOTO` - `Goto` is used to branch to an IL label, this is different than jump since jump can only jump to addresses.
+* `LLIL_FLAG_COND` - Returns the flag condition expression for the specified flag condition.
+* `LLIL_CMP_E` - equality
+* `LLIL_CMP_NE` - not equal
+* `LLIL_CMP_SLT` - signed less than
+* `LLIL_CMP_ULT` - unsigned less than
+* `LLIL_CMP_SLE` - signed less than or equal
+* `LLIL_CMP_ULE` - unsigned less than or equal
+* `LLIL_CMP_SGE` - signed greater than or equal
+* `LLIL_CMP_UGE` - unsigned greater than or equal
+* `LLIL_CMP_SGT` - signed greater than
+* `LLIL_CMP_UGT` - unsigned greater than
 
 
 ### The Arithmetic & Logical Instructions
@@ -224,45 +224,92 @@ LLIL implements the most common arithmetic as well as a host of more complicated
 
 The double precision instruction multiply, divide, modulus instructions are particularly helpful for instruction sets like x86 whose output/input can be double the size of the input/output.
 
-* **`LLIL_ADD`** - Add
-* **`LLIL_ADC`** - Add with carry
-* **`LLIL_SUB`** - Subtract
-* **`LLIL_SBB`** - Subtract with borrow
-* **`LLIL_AND`** - Bitwise and
-* **`LLIL_OR`** - Bitwise or
-* **`LLIL_XOR`** - Exclusive or
-* **`LLIL_LSL`** - Logical shift left
-* **`LLIL_LSR`** - Logical shift right
-* **`LLIL_ASR`** - Arithmetic shift right
-* **`LLIL_ROL`** - Rotate left
-* **`LLIL_RLC`** - Rotate left with carry
-* **`LLIL_ROR`** - Rotate right
-* **`LLIL_RRC`** - Rotate right with carry
-* **`LLIL_MUL`** - Multiply single precision
-* **`LLIL_MULU_DP`** - Unsigned multiply double precision 
-* **`LLIL_MULS_DP`** - Signed multiply double precision
-* **`LLIL_DIVU`** - Unsigned divide single precision
-* **`LLIL_DIVU_DP`** - Unsigned divide double precision
-* **`LLIL_DIVS`** - Signed divide single precision
-* **`LLIL_DIVS_DP`** - Signed divide double precision
-* **`LLIL_MODU`** - Unsigned modulus single precision
-* **`LLIL_MODU_DP`** - Unsigned modulus double precision
-* **`LLIL_MODS`** - Signed modulus single precision
-* **`LLIL_MODS_DP`** - Signed modulus double precision
-* **`LLIL_NEG`** - Sign negation
-* **`LLIL_NOT`** - Bitwise complement
+* `LLIL_ADD` - Add
+* `LLIL_ADC` - Add with carry
+* `LLIL_SUB` - Subtract
+* `LLIL_SBB` - Subtract with borrow
+* `LLIL_AND` - Bitwise and
+* `LLIL_OR` - Bitwise or
+* `LLIL_XOR` - Exclusive or
+* `LLIL_LSL` - Logical shift left
+* `LLIL_LSR` - Logical shift right
+* `LLIL_ASR` - Arithmetic shift right
+* `LLIL_ROL` - Rotate left
+* `LLIL_RLC` - Rotate left with carry
+* `LLIL_ROR` - Rotate right
+* `LLIL_RRC` - Rotate right with carry
+* `LLIL_MUL` - Multiply single precision
+* `LLIL_MULU_DP` - Unsigned multiply double precision
+* `LLIL_MULS_DP` - Signed multiply double precision
+* `LLIL_DIVU` - Unsigned divide single precision
+* `LLIL_DIVU_DP` - Unsigned divide double precision
+* `LLIL_DIVS` - Signed divide single precision
+* `LLIL_DIVS_DP` - Signed divide double precision
+* `LLIL_MODU` - Unsigned modulus single precision
+* `LLIL_MODU_DP` - Unsigned modulus double precision
+* `LLIL_MODS` - Signed modulus single precision
+* `LLIL_MODS_DP` - Signed modulus double precision
+* `LLIL_NEG` - Sign negation
+* `LLIL_NOT` - Bitwise complement
+
+### Floating Point Operations
+* `LLIL_FLOAT_CONST` - Floating point constant value
+* `LLIL_FADD` - Floating point add
+* `LLIL_FSUB` - Floating point subtraction
+* `LLIL_FMUL` - Floating point multiplication
+* `LLIL_FDIV` - Floating point division
+* `LLIL_FSQRT` - Floating point square root
+* `LLIL_FNEG` - Floating point negate
+* `LLIL_FABS` - Floating point absolute value
+* `LLIL_FLOAT_TO_INT` - Floating point convert a floating point to an integer
+* `LLIL_INT_TO_FLOAT` - Floating point convert an integer to a floating point
+* `LLIL_FLOAT_CONV` - 
+* `LLIL_ROUND_TO_INT` - Rounds to the nearest integer
+* `LLIL_FLOOR` - Returns the floor of a floating point value
+* `LLIL_CEILING` - Returns the ceiling of a floating point value
+* `LLIL_FTRUNC` - Computes the floating point truncation of the IEEE754 number in `src`
+
+### Floating Point Conditionals
+
+These are identical to their native counterparts but are lifted separately so that the operations can impact different flags. See "Control FLow & Conditionals" above.
+
+* `LLIL_FCMP_E ` - 
+* `LLIL_FCMP_NE ` - 
+* `LLIL_FCMP_LT ` - 
+* `LLIL_FCMP_LE ` - 
+* `LLIL_FCMP_GE ` - 
+* `LLIL_FCMP_GT ` - 
+* `LLIL_FCMP_O ` - 
+* `LLIL_FCMP_UO ` - 
 
 ### Special instructions
 
 The rest of the instructions are pretty much self-explanatory to anyone with familiarity with assembly languages.
 
-* **`LLIL_NOP`** - No operation
-* **`LLIL_SX`** - Sign extend
-* **`LLIL_ZX`** - Zero extend
-* **`LLIL_SYSCALL`** - System call instruction
-* **`LLIL_BP`** - Breakpoint instruction
-* **`LLIL_TRAP`** - Trap instruction
-* **`LLIL_UNDEF`** - Undefined instruction
-* **`LLIL_UNIMPL`** - Unimplemented instruction
-* **`LLIL_UNIMPL_MEM`** - Unimplemented memory access instruction
+* `LLIL_BP` - Breakpoint instruction
+* `LLIL_EXTERN_PTR` - A synthesized (fake) pointer to something which doesn't exist within the memory space of the current binary
+* `LLIL_INTRINSIC ` - Intrinsics are operations with `output` and `params` and an `intrinsic` where the exact behavior is not modelled but the dataflow system can be improved by annotating the inputs and outputs. An example intrinsic would CPU AES instructions where the exact behavior is not modelled, but the inputs and outputs are.
+* `LLIL_INTRINSIC_SSA ` - 
+* `LLIL_NOP` - No operation
+* `LLIL_SX` - Sign extend
+* `LLIL_SYSCALL` - System call instruction
+* `LLIL_TRAP` - Trap instruction
+* `LLIL_UNDEF` - Undefined instruction
+* `LLIL_UNIMPL` - Unimplemented instruction
+* `LLIL_UNIMPL_MEM` - Unimplemented memory access instruction
+* `LLIL_ZX` - Zero extend
+
+### Currently Undocumented
 
+* `LLIL_FLAG ` - 
+* `LLIL_LOW_PART ` - 
+* `LLIL_FLAG_BIT ` - 
+* `LLIL_FLAG_GROUP ` - 
+* `LLIL_TAILCALL ` - 
+* `LLIL_BOOL_TO_INT ` - 
+* `LLIL_TEST_BIT ` - 
+* `LLIL_FLAG_SSA ` - 
+* `LLIL_TAILCALL_SSA ` - 
+* `LLIL_FLAG_BIT_SSA ` - 
+* `LLIL_FLAG_PHI ` - 
+* `LLIL_MEM_PHI ` - 
\ No newline at end of file
diff --git a/docs/dev/bnil-mlil.md b/docs/dev/bnil-mlil.md
index 3d268321..b0cc6694 100644
--- a/docs/dev/bnil-mlil.md
+++ b/docs/dev/bnil-mlil.md
@@ -1,6 +1,6 @@
 # Binary Ninja Intermediate Language Series, Part 2: Medium Level IL
 
-The Medium Level Intermediate Language (MLIL) is the second major representation in the Binary Ninja Intermediate Language (BNIL) family of intermediate languages. Much like [LLIL](./bnil-llil.md) this representation is tree based and has many of the same instructions. This representation is distinct in a few key ways. 
+The Medium Level Intermediate Language (MLIL) is the second major representation in the Binary Ninja Intermediate Language (BNIL) family of intermediate languages. Much like [LLIL](./bnil-llil.md) this representation is tree based and has many of the same instructions. This representation is distinct in a few key ways.
 
 ![BNIL-MLIL Selected](../img/BNIL-mlil.png)
 
@@ -23,7 +23,7 @@ In the rest of this article we will explore the variable object, the type object
 
 ## The Variable Object
 
-First, it's important to understand what we mean when we talk about a MLIL variable. Continuing from our example above we can get a [`Variable`](https://api.binary.ninja/binaryninja.function.Variable.html) object. 
+First, it's important to understand what we mean when we talk about a MLIL variable. Continuing from our example above we can get a [`Variable`](https://api.binary.ninja/binaryninja.function.Variable.html) object.
 
 ```
 >>> inst.output
@@ -37,9 +37,9 @@ Variables in MLIL have a very specific meaning, that is not completely obvious a
 
 So let's look at the properties available on a [`Variable`](https://api.binary.ninja/binaryninja.function.Variable.html) object.
 
-### ``source_type``
+### `source_type`
 
-The ``source_type`` represents the storage location type and can be one of the following :
+The `source_type` represents the storage location type and can be one of the following :
 
 ```
 enum VariableSourceType
@@ -56,9 +56,9 @@ enum VariableSourceType
 <VariableSourceType.RegisterVariableSourceType: 1>
 ```
 
-### ``storage``
+### `storage`
 
-The ``storage`` property changes meaning depending on the [`VariableSourceType`](https://api.binary.ninja/binaryninja.enums.VariableSourceType.html). When a variable is of type ``RegisterVariableSourceType``, its ``storage`` property represents the index into the register list for the given architecture. If the ``source_type`` is ``StackVariableSourceType``, its ``storage`` property represents the stack offset of the variable.
+The `storage` property changes meaning depending on the [`VariableSourceType`](https://api.binary.ninja/binaryninja.enums.VariableSourceType.html). When a variable is of type `RegisterVariableSourceType`, its `storage` property represents the index into the register list for the given architecture. If the `source_type` is `StackVariableSourceType`, its `storage` property represents the stack offset of the variable.
 
 ```
 >>> var
@@ -75,14 +75,14 @@ The ``storage`` property changes meaning depending on the [`VariableSourceType`]
 '-0x260'
 ```
 
-Given the above information it might now be intuitive how variable names are constructed. First we determine the ``source_type`` of the variable. If it's a ``RegisterVariableSourceType`` we just use the register's name directly. If it’s  a ``StackVariableSourceType`` then we use ``var_`` + ``hex(-storage)``. Finally, we append a count each time that that storage location is reused.
+Given the above information it might now be intuitive how variable names are constructed. First we determine the `source_type` of the variable. If it's a `RegisterVariableSourceType` we just use the register's name directly. If it’s  a `StackVariableSourceType` then we use `var_` + `hex(-storage)`. Finally, we append a count each time that that storage location is reused.
 
-### ``index``
-The ``index`` is an identifier chosen to be unique across different analysis passes. 
+### `index`
+The `index` is an identifier chosen to be unique across different analysis passes.
 
-### ``type``
+### `type`
 
-The ``type`` property returns the ``Type`` object associated with the variable:
+The `type` property returns the `Type` object associated with the variable:
 
 ```
 >>> var.type
@@ -94,7 +94,7 @@ Type objects are described in detail in the next section.
 
 ## The Type Object
 
-Type objects are very similar to standard C types. A Type object's type can be determined through the object’s ``type_class`` property. Valid types are in the [`TypeClass`](https://api.binary.ninja/binaryninja.enums.TypeClass.html) enumeration:
+Type objects are very similar to standard C types. A Type object's type can be determined through the object’s `type_class` property. Valid types are in the [`TypeClass`](https://api.binary.ninja/binaryninja.enums.TypeClass.html) enumeration:
 
 ```
 enum TypeClass
@@ -115,7 +115,7 @@ enum TypeClass
 };
 ```
 
-Type objects all contain a ``confidence`` property; this is currently only used for type inference, but can also be used by users implementing their own analyses. Below is a reference for each of the type objects and their unique properties.
+Type objects all contain a `confidence` property; this is currently only used for type inference, but can also be used by users implementing their own analyses. Below is a reference for each of the type objects and their unique properties.
 
 ### VoidTypeClass
 
@@ -145,7 +145,7 @@ enum IntegerDisplayType
 	FloatDisplayType,
 	DoubleDisplayType
 };
-``` 
+``
 
 ### FloatTypeClass
 
@@ -154,7 +154,7 @@ The float type is a IEEE 754 variable precision type, and can represent floating
 
 ### WideCharTypeClass
 
-The wide character holds a unicode character constant whose interpretation can change depending on the ``analysis.unicode`` group of settings.
+The wide character holds a unicode character constant whose interpretation can change depending on the `analysis.unicode` group of settings.
 
 ### VarArgsTypeClass
 
@@ -169,38 +169,38 @@ A value type is simply a constant value. It is used mainly in demangling for typ
 
 The function type describes the return type, parameter list, and calling convention of a [function](https://api.binary.ninja/binaryninja.function.Function.html), among many other properties.
 
-* ``can_return`` - boolean value indicating if the function can return
-* ``calling_convention`` - the calling convention this function uses
-* ``const`` - boolean value indicating if this a const function
-* ``has_variable_arguments`` - boolean value indicating if this function is variadic
-* ``parameters`` - contains a list of ``Type`` objects
-* ``platform`` - the ``Platform`` object associated with this function
-* ``return_value`` - the return type of this function
-* ``stack_adjustment`` - the size in bytes of the stack adjustment that this function makes
+* `can_return` - boolean value indicating if the function can return
+* `calling_convention` - the calling convention this function uses
+* `const` - boolean value indicating if this a const function
+* `has_variable_arguments` - boolean value indicating if this function is variadic
+* `parameters` - contains a list of `Type` objects
+* `platform` - the `Platform` object associated with this function
+* `return_value` - the return type of this function
+* `stack_adjustment` - the size in bytes of the stack adjustment that this function makes
 
 ### PointerTypeClass
 
-A pointer type simply describes a pointer and what it points to in the ``target``/``element_type`` property.
+A pointer type simply describes a pointer and what it points to in the `target`/`element_type` property.
 
 ### ArrayTypeClass
 
 Array types function similarly to pointer types however the array type knows how large the object that it points to is:
 
-* ``target``/``element_type`` - the type of element this array is constructed of
-* ``count`` - the count of array elements
-* ``width`` - the size of the array (count * target.width)
+* `target`/`element_type` - the type of element this array is constructed of
+* `count` - the count of array elements
+* `width` - the size of the array (count * target.width)
 
 ### EnumerationTypeClass
 
-``Enumeration`` types function much the same way they do in C, providing a mapping between a name and corresponding constant. The object itself contains a ``members`` property and a list of [`EnumerationMember`](https://api.binary.ninja/binaryninja.types.EnumerationMember.html) objects each containing a name and value.
+`Enumeration` types function much the same way they do in C, providing a mapping between a name and corresponding constant. The object itself contains a `members` property and a list of [`EnumerationMember`](https://api.binary.ninja/binaryninja.types.EnumerationMember.html) objects each containing a name and value.
 
 ### StructureTypeClass
 
-Structure types are simple in principle but are complicated by the need for them to be referenced by a ``NamedTypeReference`` for them to be useful. Structures come in 3 different flavors: ``struct``, ``class``, and ``union``. While the first two simply differ in name, in unions all members overlap. ``Structure`` objects contain a list of StructureMembers. StructureMember objects contain a ``name``, ``offset``, and ``type``. Structures can be packed or aligned, accessible by the ``packed`` property.
+Structure types are simple in principle but are complicated by the need for them to be referenced by a `NamedTypeReference` for them to be useful. Structures come in 3 different flavors: `struct`, `class`, and `union`. While the first two simply differ in name, in unions all members overlap. `Structure` objects contain a list of StructureMembers. StructureMember objects contain a `name`, `offset`, and `type`. Structures can be packed or aligned, accessible by the `packed` property.
 
 ### NamedTypeReferenceClass
 
-NamedTypeReference types are symbolic references to other types. They function much like a C ``typedef`` (i.e. Name X corresponds to type Y). The NamedTypeReference has a ``type_class`` property describing what sort of type it is pointing at.
+NamedTypeReference types are symbolic references to other types. They function much like a C `typedef` (i.e. Name X corresponds to type Y). The NamedTypeReference has a `type_class` property describing what sort of type it is pointing at.
 
 ```
 enum NamedTypeReferenceClass
@@ -214,7 +214,7 @@ enum NamedTypeReferenceClass
 };
 ```
 
-Most of the above should be self-explanatory except for the ``UnknownNamedTypeClass`` which is used in the name demangler, as the mangler doesn't disambiguate between named Enumerations and named Structures. NamedTypeReference objects also have a UUID ``type_id``.
+Most of the above should be self-explanatory except for the `UnknownNamedTypeClass` which is used in the name demangler, as the mangler doesn't disambiguate between named Enumerations and named Structures. NamedTypeReference objects also have a UUID `type_id`.
 
 ## The Instruction Set
 
@@ -227,29 +227,29 @@ The instruction set is made up of [`MediumLevelILInstruction`](https://api.binar
 <class 'binaryninja.mediumlevelil.MediumLevelILInstruction'>
 ```
 
-``current_mlil`` is mapped to whatever function is currently being viewed and is not generally available to those writing plugins, as your plugin could be headless. The bracket operators tell the API to get the MLIL instruction at index 8 for the current function.
+`current_mlil` is mapped to whatever function is currently being viewed and is not generally available to those writing plugins, as your plugin could be headless. The bracket operators tell the API to get the MLIL instruction at index 8 for the current function.
 
-There are a number of properties that can be queried on the [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil.MediumLevelILInstruction.html) object, and the validity of these properties changes depending on what the current operation is. If we look at the ``operation`` of ``inst`` we can see it is a ``MLIL_CALL`` instruction.
+There are a number of properties that can be queried on the [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil.MediumLevelILInstruction.html) object, and the validity of these properties changes depending on what the current operation is. If we look at the `operation` of `inst` we can see it is a `MLIL_CALL` instruction.
 
 ```
 >>> inst.operation
 <MediumLevelILOperation.MLIL_CALL: 51>
 ```
 
-From the code in [`mediumlevelil.py`](https://github.com/Vector35/binaryninja-api/blob/dev/python/mediumlevelil.py#L175) we can see that the ``MLIL_CALL`` operation has three properties in addition to the operations available to all ``MediumLevelILInstruction`` objects
+From the code in [`mediumlevelil.py`](https://github.com/Vector35/binaryninja-api/blob/dev/python/mediumlevelil.py#L175) we can see that the `MLIL_CALL` operation has three properties in addition to the operations available to all `MediumLevelILInstruction` objects
 
 ```
 MediumLevelILOperation.MLIL_CALL: [("output", "var_list"), ("dest", "expr"), ("params", "expr_list")],
 ```
 
-Thus we can query the call's ``output`` which is a list of variables:
+Thus we can query the call's `output` which is a list of variables:
 
 ```
 >>> inst.output
 [<var int64_t rax>]
 ```
 
-The call's ``dest`` (destination expression) which in this case is a ``MLIL_CONST_PTR``:
+The call's `dest` (destination expression) which in this case is a `MLIL_CONST_PTR`:
 
 ```
 >>> inst.dest
@@ -262,7 +262,7 @@ The call's ``dest`` (destination expression) which in this case is a ``MLIL_CONS
 '0x402cb0'
 ```
 
-The parameter list can be accessed through the ``params`` property:
+The parameter list can be accessed through the `params` property:
 
 ```
 >>> inst.params
@@ -275,120 +275,129 @@ The parameter list can be accessed through the ``params`` property:
 
 ### Control Flow
 
-* ``MLIL_JUMP`` - Branch to the ``dest`` expression's address
-* ``MLIL_JUMP_TO`` - A jump table dispatch instruction. Uses the ``dest`` expression to calculate the MLIL instruction target ``targets`` to branch to
-* ``MLIL_CALL`` - Branch to the ``dest`` expression function, saving the return address, with the list of parameters ``params`` and returning the list of return values ``output``
-* ``MLIL_CALL_UNTYPED`` - This is a call instruction where stack resolution could not be determined, and thus a list of parameters and return values do not exist
-* ``MLIL_CALL_OUTPUT`` - This expression holds a set of return values ``dest`` from a call
-* ``MLIL_CALL_PARAM`` - This expression holds the set of parameters ``src`` for a call instruction
-* ``MLIL_RET`` - Return to the calling function.
-* ``MLIL_RET_HINT`` - Indirect jump to ``dest`` expression (only used in internal analysis passes.)
-* ``MLIL_NORET`` - This instruction will never be executed, the instruction before it is a call that doesn't return
-* ``MLIL_IF`` - Branch to the ``true``/``false`` MLIL instruction identifier depending on the result of the ``condition`` expression
-* ``MLIL_GOTO`` - Branch to the ``dest`` expression id
-* ``MLIL_TAILCALL`` - This instruction calls the expression ``dest`` using ``params`` as input and ``output`` for return values
-* ``MLIL_SYSCALL`` - Make a system/service call with parameters ``params`` and output ``output``
-* ``MLIL_SYSCALL_UNTYPED`` - Makes a system/service call, but an exact set of parameters couldn't be determined.
+* `MLIL_JUMP` - Branch to the `dest` expression's address
+* `MLIL_JUMP_TO` - A jump table dispatch instruction. Uses the `dest` expression to calculate the MLIL instruction target `targets` to branch to
+* `MLIL_CALL` - Branch to the `dest` expression function, saving the return address, with the list of parameters `params` and returning the list of return values `output`
+* `MLIL_CALL_UNTYPED` - This is a call instruction where stack resolution could not be determined, and thus a list of parameters and return values do not exist
+* `MLIL_CALL_OUTPUT` - This expression holds a set of return values `dest` from a call
+* `MLIL_CALL_PARAM` - This expression holds the set of parameters `src` for a call instruction
+* `MLIL_RET` - Return to the calling function.
+* `MLIL_RET_HINT` - Indirect jump to `dest` expression (only used in internal analysis passes.)
+* `MLIL_NORET` - This instruction will never be executed, the instruction before it is a call that doesn't return
+* `MLIL_IF` - Branch to the `true`/`false` MLIL instruction identifier depending on the result of the `condition` expression
+* `MLIL_GOTO` - Branch to the `dest` expression id
+* `MLIL_TAILCALL` - This instruction calls the expression `dest` using `params` as input and `output` for return values
+* `MLIL_TAILCALL_UNTYPED ` - A tailcall where the stack stack resolution could not be determined and thus a list of parameters and return values do not exist
+* `MLIL_SYSCALL` - Make a system/service call with parameters `params` and output `output`
+* `MLIL_SYSCALL_UNTYPED` - Makes a system/service call, but an exact set of parameters couldn't be determined.
 
 ### Variable Reads and Writes
 
-* ``MLIL_SET_VAR`` - Sets a variable ``dest`` to the result of an expression ``src``
-* ``MLIL_SET_VAR_FIELD`` - Sets variable ``dest`` at ``offset`` to the ``src`` expression
-* ``MLIL_SET_VAR_SPLIT`` - Sets a pair of variables ``high``:``low`` to the result of the ``src`` expression
-* ``MLIL_LOAD`` - Read ``size`` bytes from the memory address ``src``
-* ``MLIL_LOAD_STRUCT`` - Read from the struct offset at ``src`` + ``offset``
-* ``MLIL_STORE`` - Stores ``size`` bytes into ``dest`` from ``src``
-* ``MLIL_STORE_STRUCT`` - Stores ``size`` bytes into struct offset ``dest`` + ``offset`` from ``src``
-* ``MLIL_VAR`` - A variable expression ``src``
-* ``MLIL_VAR_FIELD`` - A variable and offset expression ``src``, ``offset``
-* ``MLIL_VAR_SPLIT`` - A split pair of variables ``high``:``low`` which can be used a single expression
-* ``MLIL_ADDRESS_OF`` - The address of variable ``src``
-* ``MLIL_ADDRESS_OF_FIELD`` - The address and ``offset`` of the variable ``src``
-* ``MLIL_CONST`` - A constant integral value ``constant``
-* ``MLIL_CONST_PTR`` - A constant integral value which is used as a pointer ``constant``
-* ``MLIL_EXTERN_PTR`` - A symbolic pointer ``constant`` + ``offset`` to a symbol that exists outside the binary
-* ``MLIL_FLOAT_CONST`` - A floating point constant ``constant``
-* ``MLIL_IMPORT`` - A ``constant`` integral value representing an imported address
-* ``MLIL_LOW_PART`` - ``size`` bytes from the low end of ``src`` expression
+* `MLIL_SET_VAR` - Sets a variable `dest` to the result of an expression `src`
+* `MLIL_SET_VAR_ALIASED` - Sets a variable `prev` to the result of an expression `src` with the additional information that other variables point to the same variable destination
+* `MLIL_SET_VAR_ALIASED_FIELD` - Sets a field at an `offset` of the variable `prev` with the expression `src` with the additional information that the variable is alised by other variables
+* `MLIL_SET_VAR_FIELD` - Sets variable `dest` at `offset` to the `src` expression
+* `MLIL_SET_VAR_SPLIT` - Sets a pair of variables `high`:`low` to the result of the `src` expression
+* `MLIL_LOAD` - Read `size` bytes from the memory address `src`
+* `MLIL_LOAD_STRUCT` - Read from the struct offset at `src` + `offset`
+* `MLIL_STORE` - Stores `size` bytes into `dest` from `src`
+* `MLIL_STORE_STRUCT` - Stores `size` bytes into struct offset `dest` + `offset` from `src`
+* `MLIL_VAR` - A variable expression `src`
+* `MLIL_VAR_ALIASED` - A variable expression `src` that is known to have other variables pointing to the same destination
+* `MLIL_VAR_ALIASED_FIELD` - 
+* `MLIL_VAR_FIELD` - A variable and offset expression `src`, `offset`
+* `MLIL_VAR_SPLIT` - A split pair of variables `high`:`low` which can be used a single expression
+* `MLIL_VAR_PHI` - A `PHI` represents the combination of several prior versions of a variable when differnet basic blocks coalesce into a single destination and it's unknown which path was taken.
+* `MLIL_MEM_PHI` - A memory `PHI` represents memory modifications that could have occured down different source basic blocks similar to a `VAR_PHI`.
+* `MLIL_ADDRESS_OF` - The address of variable `src`
+* `MLIL_ADDRESS_OF_FIELD` - The address and `offset` of the variable `src`
+* `MLIL_CONST` - A constant integral value `constant`
+* `MLIL_CONST_PTR` - A constant integral value which is used as a pointer `constant`
+* `MLIL_EXTERN_PTR` - A symbolic pointer `constant` + `offset` to a symbol that exists outside the binary
+* `MLIL_FLOAT_CONST` - A floating point constant `constant`
+* `MLIL_IMPORT` - A `constant` integral value representing an imported address
+* `MLIL_LOW_PART` - `size` bytes from the low end of `src` expression
 
 
 ### Arithmetic Operations
 
-* ``MLIL_ADD`` - Adds ``left`` expression to ``right`` expression
-* ``MLIL_ADC`` - Adds with carry the ``left`` expression to the ``right`` expression with carry from the ``carry`` expression
-* ``MLIL_SUB`` - Subtracts the ``right`` expression from the ``left`` expression
-* ``MLIL_SBB`` - Subtraction with borrow the ``right`` expression from the ``left`` expression with carry from the ``carry`` expression
-* ``MLIL_AND`` - Bitwise AND ``left`` expression with the ``right`` expression
-* ``MLIL_OR`` - Bitwise OR ``left`` expression with the ``right`` expression
-* ``MLIL_XOR`` - Bitwise XOR ``left`` expression with the ``right`` expression
-* ``MLIL_LSL`` - Logical shift left the ``left`` expression by the number of bits stored in the ``right`` expression
-* ``MLIL_LSR`` - Logical shift right the ``left`` expression by the number of bits stored in the ``right`` expression
-* ``MLIL_ASR`` - Arithmetic shift right the ``left`` expression by the number of bits stored in the ``right`` expression
-* ``MLIL_ROL`` - Rotate left the ``left`` expression by the number of bits stored in the ``right`` expression
-* ``MLIL_RLC`` - Rotate left with carry the ``left`` expression and the ``carry`` expression by the number of bits stored in the ``right`` expression
-* ``MLIL_ROR`` - Rotate right the ``left`` expression by the number of bits stored in the ``right`` expression
-* ``MLIL_RRC`` - Rotate right with carry the ``left`` expression and the ``carry`` expression by the number of bits stored in the ``right`` expression
-* ``MLIL_MUL`` - Single-precision multiply the ``left`` expression with the ``right`` expression
-* ``MLIL_MULU_DP`` - Double-precision unsigned multiply the ``left`` expression with the ``right`` expression, result expression is twice the size of the input expressions
-* ``MLIL_MULS_DP`` - Double-precision signed multiply the ``left`` expression with the ``right`` expression, result expression is twice the size of the input expressions
-* ``MLIL_DIVU`` - Unsigned single-precision divide ``left`` expression by the ``right`` expression
-* ``MLIL_DIVU_DP`` - Unsigned double-precision divide ``left`` expression by the ``right`` expression
-* ``MLIL_DIVS`` - Signed single-precision divide ``left`` expression by the ``right`` expression
-* ``MLIL_DIVS_DP`` - Signed double-precision divide ``left`` expression by the ``right`` expression
-* ``MLIL_MODU`` - Unsigned single-precision modulus of ``left`` expression by the ``right`` expression
-* ``MLIL_MODU_DP`` - Unsigned double-precision modulus of ``left`` expression by the ``right`` expression
-* ``MLIL_MODS`` - Signed single-precision modulus of ``left`` expression by the ``right`` expression
-* ``MLIL_MODS_DP`` - Signed double-precision modulus of ``left`` expression by the ``right`` expression
-* ``MLIL_NEG`` - Sign inversion of ``src`` expression
-* ``MLIL_NOT`` - Bitwise inversion of ``src`` expression
-* ``MLIL_FADD`` - IEEE754 floating point addition of ``left`` expression with ``right`` expression
-* ``MLIL_FSUB`` - IEEE754 floating point subtraction of ``left`` expression with ``right`` expression
-* ``MLIL_FMUL`` - IEEE754 floating point multiplication of ``left`` expression with ``right`` expression
-* ``MLIL_FDIV`` - IEEE754 floating point division of ``left`` expression with ``right`` expression
-* ``MLIL_FSQRT`` - IEEE754 floating point square root of ``left`` expression with ``right`` expression
-* ``MLIL_FNEG`` - IEEE754 floating point sign negation of ``src`` expression
-* ``MLIL_FABS`` - IEEE754 floating point absolute value of ``src`` expression
-* ``MLIL_FLOAT_TO_INT`` - IEEE754 floating point to integer conversion of ``src`` expression
-* ``MLIL_INT_TO_FLOAT`` - Integer to IEEE754 floating point conversion of ``src`` expression
-* ``MLIL_FLOAT_CONV`` - Convert bytes in ``src`` expression to IEEE754 floating point
-* ``MLIL_ROUND_TO_INT`` - Rounds the IEEE754 floating point number ``src`` expression
-* ``MLIL_FLOOR`` - Computes the floating point floor of the IEEE754 number in ``src``
-* ``MLIL_CEIL`` - Computes the floating point floor of the IEEE754 number in ``src``
-* ``MLIL_FTRUNC`` - Computes the floating point truncation of the IEEE754 number in ``src``
-* ``MLIL_SX`` - Sign extends the ``src`` expression
-* ``MLIL_ZX`` - Zero extends the ``src`` expression
-* ``MLIL_ADD_OVERFLOW`` - Calculates overflow of the addition of ``left`` expression with ``right`` expression
+* `MLIL_ADD` - Adds `left` expression to `right` expression
+* `MLIL_ADC` - Adds with carry the `left` expression to the `right` expression with carry from the `carry` expression
+* `MLIL_SUB` - Subtracts the `right` expression from the `left` expression
+* `MLIL_SBB` - Subtraction with borrow the `right` expression from the `left` expression with carry from the `carry` expression
+* `MLIL_AND` - Bitwise AND `left` expression with the `right` expression
+* `MLIL_OR` - Bitwise OR `left` expression with the `right` expression
+* `MLIL_XOR` - Bitwise XOR `left` expression with the `right` expression
+* `MLIL_LSL` - Logical shift left the `left` expression by the number of bits stored in the `right` expression
+* `MLIL_LSR` - Logical shift right the `left` expression by the number of bits stored in the `right` expression
+* `MLIL_ASR` - Arithmetic shift right the `left` expression by the number of bits stored in the `right` expression
+* `MLIL_ROL` - Rotate left the `left` expression by the number of bits stored in the `right` expression
+* `MLIL_RLC` - Rotate left with carry the `left` expression and the `carry` expression by the number of bits stored in the `right` expression
+* `MLIL_ROR` - Rotate right the `left` expression by the number of bits stored in the `right` expression
+* `MLIL_RRC` - Rotate right with carry the `left` expression and the `carry` expression by the number of bits stored in the `right` expression
+* `MLIL_MUL` - Single-precision multiply the `left` expression with the `right` expression
+* `MLIL_MULU_DP` - Double-precision unsigned multiply the `left` expression with the `right` expression, result expression is twice the size of the input expressions
+* `MLIL_MULS_DP` - Double-precision signed multiply the `left` expression with the `right` expression, result expression is twice the size of the input expressions
+* `MLIL_DIVU` - Unsigned single-precision divide `left` expression by the `right` expression
+* `MLIL_DIVU_DP` - Unsigned double-precision divide `left` expression by the `right` expression
+* `MLIL_DIVS` - Signed single-precision divide `left` expression by the `right` expression
+* `MLIL_DIVS_DP` - Signed double-precision divide `left` expression by the `right` expression
+* `MLIL_MODU` - Unsigned single-precision modulus of `left` expression by the `right` expression
+* `MLIL_MODU_DP` - Unsigned double-precision modulus of `left` expression by the `right` expression
+* `MLIL_MODS` - Signed single-precision modulus of `left` expression by the `right` expression
+* `MLIL_MODS_DP` - Signed double-precision modulus of `left` expression by the `right` expression
+* `MLIL_NEG` - Sign inversion of `src` expression
+* `MLIL_NOT` - Bitwise inversion of `src` expression
+* `MLIL_FADD` - IEEE754 floating point addition of `left` expression with `right` expression
+* `MLIL_FSUB` - IEEE754 floating point subtraction of `left` expression with `right` expression
+* `MLIL_FMUL` - IEEE754 floating point multiplication of `left` expression with `right` expression
+* `MLIL_FDIV` - IEEE754 floating point division of `left` expression with `right` expression
+* `MLIL_FSQRT` - IEEE754 floating point square root of `left` expression with `right` expression
+* `MLIL_FNEG` - IEEE754 floating point sign negation of `src` expression
+* `MLIL_FABS` - IEEE754 floating point absolute value of `src` expression
+* `MLIL_FLOAT_TO_INT` - IEEE754 floating point to integer conversion of `src` expression
+* `MLIL_INT_TO_FLOAT` - Integer to IEEE754 floating point conversion of `src` expression
+* `MLIL_FLOAT_CONV` - Convert bytes in `src` expression to IEEE754 floating point
+* `MLIL_ROUND_TO_INT` - Rounds the IEEE754 floating point number `src` expression
+* `MLIL_FLOOR` - Computes the floating point floor of the IEEE754 number in `src`
+* `MLIL_CEIL` - Computes the floating point floor of the IEEE754 number in `src`
+* `MLIL_FTRUNC` - Computes the floating point truncation of the IEEE754 number in `src`
+* `MLIL_SX` - Sign extends the `src` expression
+* `MLIL_ZX` - Zero extends the `src` expression
+* `MLIL_ADD_OVERFLOW` - Calculates overflow of the addition of `left` expression with `right` expression
+* `MLIL_BOOL_TO_INT` - Converts a bool to an integer
 
 ### Comparison Instructions
 
-* `MLIL_CMP_E` - Compare expression evaluates to true if ``left`` expression is equal to ``right``
-* `MLIL_CMP_NE` - Compare expression evaluates to true if ``left`` expression is not equal to ``right``
-* `MLIL_CMP_SLT` - Compare expression evaluates to true if ``left`` expression is signed less than ``right``
-* `MLIL_CMP_ULT` - Compare expression evaluates to true if ``left`` expression is unsigned less than ``right``
-* `MLIL_CMP_SLE` - Compare expression evaluates to true if ``left`` expression is signed less than or equal to ``right``
-* `MLIL_CMP_ULE` - Compare expression evaluates to true if ``left`` expression is unsigned less than or equal to ``right``
-* `MLIL_CMP_SGE` - Compare expression evaluates to true if ``left`` expression is signed greater than or equal to ``right``
-* `MLIL_CMP_UGE` - Compare expression evaluates to true if ``left`` expression is unsigned greater than or equal to ``right``
-* `MLIL_CMP_SGT` - Compare expression evaluates to true if ``left`` expression is signed greater than ``right``
-* `MLIL_CMP_UGT` - Compare expression evaluates to true if ``left`` expression is unsigned greater than ``right``
-* `MLIL_TEST_BIT` - Test if bit ``right`` in expression ``left`` is set
-* `MLIL_FCMP_E` - Floating point compare expressions - evaluates to true if ``left`` expression is equal to ``right``
-* `MLIL_FCMP_NE` - Floating point compare expressions - evaluates to true if ``left`` expression is not equal to ``right``
-* `MLIL_FCMP_LT` - Floating point compare expressions - evaluates to true if ``left`` expression is less than ``right``
-* `MLIL_FCMP_LE` - Floating point compare expressions - evaluates to true if ``left`` expression is less than or equal to ``right``
-* `MLIL_FCMP_GE` - Floating point compare expressions - evaluates to true if ``left`` expression is greater than or equal to ``right``
-* `MLIL_FCMP_GT` - Floating point compare expressions - evaluates to true if ``left`` expression is greater than ``right``
-* `MLIL_FCMP_O` - Floating point compare expressions - evaluates to true if both ``left`` and ``right`` expressions are ordered (not NaN)
-* `MLIL_FCMP_UO` - Floating point compare expressions - evaluates to true if either ``left`` or ``right`` expression is unordered (NaN)
+* `MLIL_CMP_E` - Compare expression evaluates to true if `left` expression is equal to `right`
+* `MLIL_CMP_NE` - Compare expression evaluates to true if `left` expression is not equal to `right`
+* `MLIL_CMP_SLT` - Compare expression evaluates to true if `left` expression is signed less than `right`
+* `MLIL_CMP_ULT` - Compare expression evaluates to true if `left` expression is unsigned less than `right`
+* `MLIL_CMP_SLE` - Compare expression evaluates to true if `left` expression is signed less than or equal to `right`
+* `MLIL_CMP_ULE` - Compare expression evaluates to true if `left` expression is unsigned less than or equal to `right`
+* `MLIL_CMP_SGE` - Compare expression evaluates to true if `left` expression is signed greater than or equal to `right`
+* `MLIL_CMP_UGE` - Compare expression evaluates to true if `left` expression is unsigned greater than or equal to `right`
+* `MLIL_CMP_SGT` - Compare expression evaluates to true if `left` expression is signed greater than `right`
+* `MLIL_CMP_UGT` - Compare expression evaluates to true if `left` expression is unsigned greater than `right`
+* `MLIL_TEST_BIT` - Test if bit `right` in expression `left` is set
+* `MLIL_FCMP_E` - Floating point compare expressions - evaluates to true if `left` expression is equal to `right`
+* `MLIL_FCMP_NE` - Floating point compare expressions - evaluates to true if `left` expression is not equal to `right`
+* `MLIL_FCMP_LT` - Floating point compare expressions - evaluates to true if `left` expression is less than `right`
+* `MLIL_FCMP_LE` - Floating point compare expressions - evaluates to true if `left` expression is less than or equal to `right`
+* `MLIL_FCMP_GE` - Floating point compare expressions - evaluates to true if `left` expression is greater than or equal to `right`
+* `MLIL_FCMP_GT` - Floating point compare expressions - evaluates to true if `left` expression is greater than `right`
+* `MLIL_FCMP_O` - Floating point compare expressions - evaluates to true if both `left` and `right` expressions are ordered (not NaN)
+* `MLIL_FCMP_UO` - Floating point compare expressions - evaluates to true if either `left` or `right` expression is unordered (NaN)
 
 ### Miscellaneous Instructions
 
-* ``MLIL_BP`` - Breakpoint instruction
-* ``MLIL_TRAP`` - Interrupt/trap instruction with ``vector`` expression
-* ``MLIL_INTRINSIC`` - Intrinsic instruction defined by the architecture
-* ``MLIL_FREE_VAR_SLOT`` - Free the ``dest`` expression from the register stack
-* ``MLIL_UNDEF`` - The expression performs undefined behavior
-* ``MLIL_UNIMPL`` - The expression is not implemented
-* ``MLIL_UNIMPL_MEM`` - The expression is not implemented but does access ``src`` memory
+* `MLIL_NOP` - No operation
+* `MLIL_BP` - Breakpoint instruction
+* `MLIL_TRAP` - Interrupt/trap instruction with `vector` expression
+* `MLIL_INTRINSIC` - Intrinsic instruction defined by the architecture
+* `MLIL_FREE_VAR_SLOT` - Free the `dest` expression from the register stack
+* `MLIL_UNDEF` - The expression performs undefined behavior
+* `MLIL_UNIMPL` - The expression is not implemented
+* `MLIL_UNIMPL_MEM` - The expression is not implemented but does access `src` memory