summaryrefslogtreecommitdiff
path: root/docs/dev/bnil-mlil.md
diff options
context:
space:
mode:
Diffstat (limited to 'docs/dev/bnil-mlil.md')
-rw-r--r--docs/dev/bnil-mlil.md28
1 files changed, 14 insertions, 14 deletions
diff --git a/docs/dev/bnil-mlil.md b/docs/dev/bnil-mlil.md
index 15fb836d..51028131 100644
--- a/docs/dev/bnil-mlil.md
+++ b/docs/dev/bnil-mlil.md
@@ -25,7 +25,7 @@ In the rest of this article we will explore the variable object, the type object
First, it's important to understand what we mean when we talk about a MLIL variable. Continuing from our example above we can get a [`Variable`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.Variable) object.
-```
+```pycon
>>> inst.output
[<var int64_t rax>]
>>> var = inst.output[0]
@@ -41,7 +41,7 @@ So let's look at the properties available on a [`Variable`](https://api.binary.n
The `source_type` represents the storage location type and can be one of the following :
-```
+```c
enum VariableSourceType
{
StackVariableSourceType,
@@ -51,7 +51,7 @@ enum VariableSourceType
```
-```
+```pycon
>>> var.source_type
<VariableSourceType.RegisterVariableSourceType: 1>
```
@@ -60,7 +60,7 @@ enum VariableSourceType
The `storage` property changes meaning depending on the [`VariableSourceType`](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.VariableSourceType). When a variable is of type `RegisterVariableSourceType`, its `storage` property represents the index into the register list for the given architecture. If the `source_type` is `StackVariableSourceType`, its `storage` property represents the stack offset of the variable.
-```
+```pycon
>>> var
<var int64_t rax>
>>> var.source_type
@@ -84,7 +84,7 @@ The `index` is an identifier chosen to be unique across different analysis passe
The `type` property returns the `Type` object associated with the variable:
-```
+```pycon
>>> var.type
<type: int64_t, 0% confidence>
```
@@ -96,7 +96,7 @@ Type objects are described in detail in the next section.
Type objects are very similar to standard C types. A Type object's type can be determined through the object’s `type_class` property. Valid types are in the [`TypeClass`](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.TypeClass) enumeration:
-```
+```c
enum TypeClass
{
VoidTypeClass = 0,
@@ -129,7 +129,7 @@ A boolean type is an integer which has a value of False (0) or True (!0).
An integer type has a sign, a width (in bytes), and a display type. The display type determines how the integer should be displayed; the options are self-explanatory:
-```
+```c
enum IntegerDisplayType
{
DefaultIntegerDisplayType,
@@ -202,7 +202,7 @@ Structure types are simple in principle but are complicated by the need for them
NamedTypeReference types are symbolic references to other types. They function much like a C `typedef` (i.e. Name X corresponds to type Y). The NamedTypeReference has a `type_class` property describing what sort of type it is pointing at.
-```
+```c
enum NamedTypeReferenceClass
{
UnknownNamedTypeClass = 0,
@@ -220,7 +220,7 @@ Most of the above should be self-explanatory except for the `UnknownNamedTypeCla
The instruction set is made up of [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an MLIL instruction:
-```
+```pycon
>>> inst = current_mlil[8]
<il: rax = 0x402cb0("PORT")>
>>> type(inst)
@@ -231,27 +231,27 @@ The instruction set is made up of [`MediumLevelILInstruction`](https://api.binar
There are a number of properties that can be queried on the [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction) object, and the validity of these properties changes depending on what the current operation is. If we look at the `operation` of `inst` we can see it is a `MLIL_CALL` instruction.
-```
+```pycon
>>> inst.operation
<MediumLevelILOperation.MLIL_CALL: 51>
```
From the code in [`mediumlevelil.py`](https://github.com/Vector35/binaryninja-api/blob/dev/python/mediumlevelil.py#L175) we can see that the `MLIL_CALL` operation has three properties in addition to the operations available to all `MediumLevelILInstruction` objects
-```
+```text
MediumLevelILOperation.MLIL_CALL: [("output", "var_list"), ("dest", "expr"), ("params", "expr_list")],
```
Thus, we can query the call's `output` which is a list of variables:
-```
+```pycon
>>> inst.output
[<var int64_t rax>]
```
The call's `dest` (destination expression) which in this case is a `MLIL_CONST_PTR`:
-```
+```pycon
>>> inst.dest
<il: 0x402cb0>
>>> inst.dest.operation
@@ -264,7 +264,7 @@ The call's `dest` (destination expression) which in this case is a `MLIL_CONST_P
The parameter list can be accessed through the `params` property:
-```
+```pycon
>>> inst.params
[<il: "PORT">]
>>> inst.params[0]