1 files changed, 68 insertions, 0 deletions
diff --git a/__init__.py b/__init__.py
new file mode 100644
index 0000000..c0e2126
--- /dev/null
+++ b/__init__.py
@@ -0,0 +1,68 @@
+from binaryninja import *
+from binaryninjaui import UIAction, UIActionHandler, Menu
+from PySide6.QtGui import QKeySequence
+
+
+def main(ctx):
+    from binaryninja.lowlevelil import LowLevelILInstruction, LowLevelILOperation
+    from binaryninja import log_info
+
+    def get_curr_llil_ssa(ctx):
+        """Retrieves the currently selected (UI) IL instruction"""
+        func = ctx.function
+        view = ctx.view
+        if not func:
+            log_info("Not inside a function")
+            return None
+        if view.getILViewType().view_type != FunctionGraphType.LowLevelILSSAFormFunctionGraph:
+            log_info("Function is not in llil ssa mode")
+            return None
+
+        # Get the currently selected instruction (UI)
+        ssa_idx = view.getCurrentILInstructionIndex()
+        if ssa_idx is None:
+            log_info("Failed to retrieve currently selected inst index")
+            return None
+        llil_ssa_func = func.low_level_il.ssa_form
+        inst = llil_ssa_func[ssa_idx]
+        return inst
+
+    def visit(graph, parent_node, expr, ops):
+        """Recursively visit each expression and build graph of the expression tree"""
+        if expr is None:
+            return
+        op = expr.operation
+
+        # Build graph node
+        child_node = FlowGraphNode(graph)
+        child_node.lines = [f"{op.name}"]
+        graph.append(child_node)
+        # If this is the first node in the tree it has no parent
+        if parent_node is not None:
+            parent_node.add_outgoing_edge(BranchType.UnconditionalBranch, child_node)
+
+        # Recurse through children
+        for name, kind in ops[op]:
+            print(f"{kind}: {name}")
+            if kind == "expr":
+                visit(graph, child_node, getattr(expr, name), ops)
+            elif kind == "expr_list":
+                for sub in getattr(expr, name):
+                    visit(graph, child_node, sub, ops)
+
+    il_ops = LowLevelILInstruction.ILOperations
+    inst = get_curr_llil_ssa(ctx)
+    if inst is None:
+        return
+
+    graph = FlowGraph()
+    visit(graph, None, inst, il_ops)
+    # This spawns a new tab with our little graph in it
+    show_graph_report("Expression tree", graph)
+
+
+# Register a keybind for the analysis
+UIAction.registerAction("Graph LLIL SSA AST", QKeySequence("Ctrl + F3"))
+UIActionHandler.globalActions().bindAction("Graph LLIL SSA AST", UIAction(main))
+
+Menu.mainMenu("Plugins").addAction("Analyze Instruction", "Plugins")