HxCItem¶

The HxCItem API is one of the way to represent AST nodes of an Hexrays decompiled function at the level of Bip. This API is the closest of the one provided by IDAPython, however this is not the prefered way to view AST nodes in Bip, CNode for the prefered way and Ast Nodes & Visitors for more general information.

The simplest way to access HxCItem elements is through the usage of the visitorm methods starting with hx_visit_ in HxCFunc

This API is based on the HxCItem abstract class, each AST nodes are represented by a subclass of this object which are determine by its type. For more information of the different type of nodes see AST Node types. The method from_citem() allow to recuperate an object of the correct class (which inherit from HxCItem) for a particular citem_t object from IDA.

HxCItem API¶

class bip.hexrays.HxCItem(citem)¶

Abstract class representing both C expression and C statement as defined by HexRays. This is the most direct API on top of Hexrays. However, in most cases, the CNode equivalent classes can be used: those provide more functionnality and are the recommanded ones.

An object of this class should never be created directly. The HxCItem.from_citem() static method should be used for creating an item of the correct type.

Most of the functionnality provided by this class are inherited from its parent class AbstractCItem and are common with the CNode class.

TYPE_HANDLE = -1¶: Class attribute indicating which type of item this class handles, this is used by from_citem() for determining if this is the good object to instantiate. All abstract class should have a value of -1 for this object, non-abstract class should have a value corresponding to the HxCType they handle.

_create_child(citem)¶

Internal method which allow to create a HxCItem object from a citem_t. This must be used by HxCStmt and HxCExpr for creating their child expression and statement. This method is used for having compatibility with the CNode class.

Internally this function is only a wrapper on from_citem().

Parameters:	citem – A `citem_t` from ida.
Returns:	The equivalent object to the `citem_t` for bip. This will be an object which inherit from `HxCItem` .

static from_citem(citem)¶

Function which convert a citem_t object from ida to one of the child object of HxCItem . This should in particular be used for converting cexpr_t and cinsn_t in their correct object for bip. This function is used as interface with the IDA object.

If no HxCItem child object exist a ValueError exception will be raised.

Note

HxCExpr and HxCStmt should not used this function for creating child item but HxCItem._create_child() for compatibility with the CNode class.

Parameters:	citem – A `citem_t` from ida.
Returns:	The equivalent object to the `citem_t` for bip. This will be an object which inherit from `HxCItem` .

HxCExpr API¶

class bip.hexrays.HxCExpr(cexpr)¶

Abstract class for representing a C Expression as returned by HexRays. This is an abstract class which is used as a wrapper on top of the cexpr_t object.

The equivalent class which inherit from CNode is CNodeExpr, the CNode implementation is advised.

No object of this class should be instanstiated, for getting an expression the function from_citem() should be used.

__init__(cexpr)¶

Constructor for a HxCExpr object.

Parameters:	cexpr – A `cexpr_t` object from ida.

_cexpr = None¶: The cexpr_t object from ida.

__str__()¶: Surcharge for printing a CExpr

ops¶

Function which return the C Expressions child of this expression. This is used only when the expression is recursive.

Returns:	A `list` of object inheriting from `HxCExpr` and child of the current expression.

type¶

Property which return the type (BipType) of this expression.

Returns:	An object which inherit from `BipType` which correspond to the type of this object. Change to this type object will not change the type of this expression.

HxCStmt API¶

class bip.hexrays.HxCStmt(cinsn)¶

Abstract class for representing a C Statement as returned by hexrays. This is an abstract class which is a wrapper on top of the cinsn_t ida object.

The equivalent class which inherit from CNode is CNodeStmt, the CNode implementation is advised.

No object of this class should be instanstiated, for getting an expression the function from_citem() should be used.

A statement can contain one or more child statement and one or more child expression (HxCExpr) object. By convention properties which will return child statement of an object will start with the prefix stmt_ or st_.

__init__(cinsn)¶

Constructor for a HxCStmt object.

Parameters:	cinsn – A `cinsn_t` from ida.

_cinsn = None¶: The cinsn_t object from ida.

__str__()¶: Surcharge for printing a CStmt.

stmt_children¶

Property which return a list of the statements which are children of this statement. This is used only when the statement is recursive, if not this will return an empty list.

Returns:	A list of child statement of this object.
Return type:	Objects which inherit from `HxCStmt` .

expr_children¶

Property which return a list of the expression (HxCExpr) which are children of this statement. This will not return children expression of the statement child of the current object.

Returns:	A list of child expression of this object.
Return type:	Objects which inherit from `HxCExpr` .

Final Expression API¶

class bip.hexrays.HxCExprFinal(cexpr)¶

Abstract class for representing a HxCExpr which does not posess child expression. All the child class must have a value() property which return the value of the expression.

This is used as a parent for:

HxCExprNum
HxCExprFNum
HxCExprStr
HxCExprObj
HxCExprVar
HxCExprHelper
HxCExprInsn
HxCExprType

__str__()¶: Surcharge for printing a HxCExprFinal.

value¶: Property which return the value of a final expression. This is abstract and if not overwritten it will raise a RuntimeError .

class bip.hexrays.HxCExprEmpty(cexpr)¶: Class for representing an empty CExpr (HxCType.COT_EMPTY).

class bip.hexrays.HxCExprNum(cexpr)¶

Class for representing a CExpr containing a Number (HxCType.COT_NUM).

Todo

test

Todo

make an assign function with full access to all the value.

Todo

flags, should make accessible and settable the flags see number_format_t in hexrays.cpp

Todo

make accessible the serial and the type_name from number_format_t .

value¶

Value of the number.

Return int:	the value of this number.

size¶

Original size in bytes of the number.

Return int:	the size in bytes.

class bip.hexrays.HxCExprFNum(cexpr)¶

Class for representing a Floating number (HxCType.COT_FNUM).

Todo

everything, see fnumber_t in hexrays.hpp and ida_hexrays.py

value¶: Todo

not sure if this works at all and probably not what we want anyway.

size¶

Original size in bytes of the number.

Return int:	the size in bytes.

class bip.hexrays.HxCExprStr(cexpr)¶

Class for representing a string (HxCType.COT_STR).

value¶

String value.

Return str:	the value of this string.

class bip.hexrays.HxCExprObj(cexpr)¶

Class for representing an “object” (HxCType.COT_OBJ). An object can be anything with an address including the address of a function, a string …

value¶

Address of the object.

Return int:	the address of the object.

class bip.hexrays.HxCExprVar(cexpr)¶

Class for representing a variable (HxCType.COT_VAR).

Todo

test

Todo

link with variables

value¶

Index in the lvar array.

Return int:	the index in the lvar array.

index¶

Index in the lvar array.

Todo

this should probably directly return the lvar ?

Return int:	the index in the lvar array.

class bip.hexrays.HxCExprHelper(cexpr)¶

Class for representing an helper string (HxCType.COT_HELPER) .

value¶

Value of this helper.

Return str:	the string containing the value of the helper.

class bip.hexrays.HxCExprInsn(cexpr)¶: Class for representing a statement in an expression (HxCType.COT_INSN).

Warning

Do not confound with HxCStmt which is a statement. This is an expression which contain a statement.

class bip.hexrays.HxCExprType(cexpr)¶

Class for representing a type (HxCType.COT_TYPE). This can be used for example as a Sizeof node.

value¶: Return the BipType which is represented by this node. This is equivalent to the type() property.

MemAccess Expression API¶

class bip.hexrays.HxCExprMemAccess(cexpr)¶

Abstract class for representing a HxCExpr corresponding to a memory access. This include access in an array (obj[off], a memory reference (obj.off) or a memory pointer (obj->off).

Provide the properties: obj() and off().

obj¶

Property which return a HxCExpr representing the base memory location.

Returns:	An operand of the expression, an object which inherit from `HxCExpr` .

off¶

Property which return the offset of the memory location.

Returns:	An object which inherit from `HxCExpr` or an integer.

class bip.hexrays.HxCExprIdx(cexpr)¶

Class for representing access to an index in an array (array[index]). The array() is a HxCExpr representing the array and index() is a HxCExpr representing the index which is access.

array¶

Property which return a HxCExpr representing the array element access by this expression.

Returns:	An operand of the expression, an object which inherit from `HxCExpr` .

index¶

Property which return a HxCExpr representing the index of the element access by this expression.

Returns:	An operand of the expression, an object which inherit from `HxCExpr` .

class bip.hexrays.HxCExprMemref(cexpr)¶

Class for representing a memory reference (mem.off). The mem() is a HxCExpr representing the object which is access and off() is an integer representing the memory offset.

mem¶

Property which return a HxCExpr representing the object which is access by this expression.

Returns:	An operand of the expression, an object which inherit from `HxCExpr` .

off¶

Property which return the memory offset which is access by this expression. In practice this should be an offset in a structure or an enum.

Return int:	The memory offset.

class bip.hexrays.HxCExprMemptr(cexpr)¶

Class for representing a memory access using a pointer (ptr->off). The ptr() is a HxCExpr representing the object which is access and off() is an integer representing the memory offset. access_size() provide the size access by this expression.

ptr¶

Property which return a HxCExpr representing the object which is access by this expression.

Returns:	An operand of the expression, an object which inherit from `HxCExpr` .

off¶

Property which return the memory offset which is access by this expression. In practice this should be an offset in a structure or an enum.

Return int:	The memory offset.

access_size¶

Property which return the size which is access by the derefencement of this pointer.

Returns:	An int corresponding to the size acceded.

Unary Operation Expression API¶

class bip.hexrays.HxCExprUnaryOperation(cexpr)¶

Abstract for representing a HxCExpr with a unary operation. This HxCExprUnaryOperation.operand() is also a HxCExpr making it recursive.

operand¶

Property which return the operand of this expression.

Returns:	The operand of the expression, an object which inherit from `HxCExpr` .

class bip.hexrays.HxCExprPtr(cexpr)¶

Class for representing the deref. of a pointer (*operand). This inherit from HxCExprUnaryOperation.

access_size¶

Property which return the size which is access by the derefencement of this pointer.

Returns:	An int corresponding to the size acceded.

class bip.hexrays.HxCExprFneg(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprNeg(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprCast(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprLnot(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprBnot(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprRef(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprPostinc(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprPostdec(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprPreinc(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprPredec(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

class bip.hexrays.HxCExprSizeof(cexpr)¶: See HxCType for description. Inherited from HxCExprUnaryOperation.

Double Operation Expression API¶

class bip.hexrays.HxCExprDoubleOperation(cexpr)¶

Abstract class for representing a HxCExpr with two operands. Those operands are also HxCExpr making them recursive.

first_op¶

Property which return the first operand.

Returns:	The first operand of the expression, an object which inherit from `HxCExpr` .

second_op¶

Property which return the second operand.

Returns:	The second operand of the expression, an object which inherit from `HxCExpr` .

class bip.hexrays.HxCExprComma(cexpr)¶: C Expression for a comma expression. Typically used in conditions by hexrays.

class bip.hexrays.HxCExprLor(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprLand(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprBor(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprXor(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprBand(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprEq(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprNe(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprSge(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprUge(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprSle(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprUle(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprSgt(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprUgt(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprSlt(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprUlt(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprSshr(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprUshr(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprShl(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprAdd(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprSub(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprMul(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprSdiv(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprUdiv(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprSmod(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprUmod(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprFadd(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprFsub(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprFmul(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

class bip.hexrays.HxCExprFdiv(cexpr)¶: See HxCType for description. Inherited from HxCExprDoubleOperation.

Assignment¶

class bip.hexrays.HxCExprAssignment(cexpr)¶

Abstract class for representing a HxCExpr where the left operand is the destination of an assignment. This inherit from HxCExprDoubleOperation and include not only the simple assignment operation but also the one which include another operation such as += (HxCExprAsgadd), ^= (HxCExprAsgxor), …

src¶

Helper property which return the source of the assignment.

This is just a wrapper on top of second_op().

Returns:	The second operand of the expression, an object which inherit from `HxCExpr` .

dst¶

Helper property which return the destination of the assignment.

This is just a wrapper on top of first_op().

Returns:	The first operand of the expression, an object which inherit from `HxCExpr` .

class bip.hexrays.HxCExprAsg(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgbor(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgxor(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgband(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgadd(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgsub(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgmul(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgsshr(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgushr(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgshl(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgsdiv(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgudiv(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgsmod(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

class bip.hexrays.HxCExprAsgumod(cexpr)¶: See HxCType for description. Inherited from HxCExprAssignment (indirectly from HxCExprDoubleOperation).

Other leaf Expressions API¶

class bip.hexrays.HxCExprTernary(cexpr)¶

Class for representing a ternary operation (cond ? expr1 : expr2) (HxCType.COT_TERN).

This class contain 3 operands which are recursive.

cond¶

Property which return the condition of the ternary expression.

Returns:	An object which inherit from `HxCExpr` .

expr1¶

Property which return the first expression of the ternary expression: the one executed if the condition cond() is true.

Returns:	An object which inherit from `HxCExpr` .

expr2¶

Property which return the second expression of the ternary expression: the one executed if the condition cond() is false.

Returns:	An object which inherit from `HxCExpr` .

class bip.hexrays.HxCExprCall(cexpr)¶

Class for representing a call expression. This class also provide function which allow to manipulate the arguments.

Todo

function type (carglist_t.functype)

Todo

args type (carg.formal_type)

Todo

vararg (carg.is_vararg) (variadic number of arguments, like printf)

_carglist¶: Property which return the carglist_t from IDA.

_get_carg(num)¶: Internal function which give access to the argument at position number num. There is no check on the value of num.

type_call¶

Return the type for the function call. This will be the type printed by HexRays for the function. It differs from type() which is the type of result of the node.

Todo

setter

Returns:	An object which inherit from `BipType` which correspond to the call type of this node.

caller¶

Property which return the caller of this expression. The caller is also an expression.

Returns:	An object which inherit from `HxCExpr` .

is_helper¶

Property which return true if this function is a decompiler helper function.

Returns:	A bool indicating if this is a helper function (true) or a “real” call.

number_args¶

Property which return the number of arguments pass to the call expresion.

Return int:	The number of argument to the call expression.

get_arg(num)¶

Function which return one of the argument of the call to a function. Each argument is also an expression.

Parameters:	num (int) – The argument number.
Raises:	ValueError – if `num` is superior to the number of arguments in the call expression.
Returns:	An object which inherit from `HxCExpr` .

args¶

Property which return the args of the call. Those args are also expressions.

Returns:	A list of `HxCExpr` .

args_iter¶: Property which return an iterator on the args of the call. This is similar to args() but with an iterator, and should have more perf.

Final Statement API¶

class bip.hexrays.HxCStmtFinal(cinsn)¶

Abstract class for representing a HxCStmt which does not posess child statements but as a value. All the child must have a value() property which return the value of the statement.

This is used as a parent for:

HxCStmtExpr
HxCStmtGoto
HxCStmtFinal
HxCStmtReturn

The HxCStmtContinue and HxCStmtBreak do not inherit from this class as they do not have a value.

__str__()¶: Surcharge for printing a HxCExprFinal.

value¶: Property which return the value of a final expression. This is abstract and if not overwritten it will raise a RuntimeError .

class bip.hexrays.HxCStmtEmpty(cinsn)¶: Class for representing a statement which is empty.

class bip.hexrays.HxCStmtExpr(cinsn)¶

Class for representing a statement which contain a single expression. In practice this class is used for making the transition between HxCStmt and HxCExpr .

expr¶

Property which return the expression contain in this statement.

Returns:	A child object of `HxCExpr` which represent the expression contain in this statement.

value¶

The expression contain in this statement.

Returns:	A child object of `HxCExpr` which represent the expression contain in this statement.

class bip.hexrays.HxCStmtGoto(cinsn)¶

Class for representing a C goto statement (HxCType.CIT_GOTO).

label¶

Property which return the label number of the goto statement.

Returns:	An integer representing the label number.

value¶: Return the label number see label() .

class bip.hexrays.HxCStmtAsm(cinsn)¶

Class for representing a inline C ASM statement (HxCType.CIT_ASM).

addr_instr¶

Property which return a list of address corresponding to the ASM instruction which are inline.

Returns:	A list of address (integer) representing the address of the inline assembly instruction in the binary.

length¶: Property which return the number of instruction in this ASM statement.

__len__()¶: Return the number of instruction in this ASM statement. Same as length()

value¶

Return a list of BipInstr corresponding to the ASM instructions in this ASM statement.

Returns:	A list of `BipInstr`.

class bip.hexrays.HxCStmtReturn(cinsn)¶

Class for representing a C return statement (HxCType.CIT_RETURN).

ret_val¶

Property which return the expression which is the value return by this return statement.

Returns:	An object which inherits from `HxCExpr` .

value¶: Return the HxCExpr which is return by this statement. See ret_val() .

Loop Statement API¶

class bip.hexrays.HxCStmtLoop(cinsn)¶

Abstract class for representing the different C loop statement (for, while, dowhile). All of those have at least an expression as a condition (cond()) and a statement as body (st_body())

cond¶

Property which return the expression used as a condition for the loop.

Returns:	An object which inherits from `HxCExpr` .

st_body¶

Property which return the statement used as a body for the loop.

Returns:	An object which inherits from `HxCStmt` .

class bip.hexrays.HxCStmtFor(cinsn)¶

Class for representing a C for statement (HxCType.CIT_FOR). This is a recursive statement which have 2 children statement and 2 children expression.

The for of the for is the following:

for (init; cond; step)
    st_body

cond¶

Property which return the expression used as a condition for the for.

Returns:	An object which inherits from `HxCExpr` .

st_body¶

Property which return the statement used as a body for the for.

Returns:	An object which inherits from `HxCStmt` .

init¶

Property which return the expression for the initialization of the for loop.

Returns:	An object which inherits from `HxCExpr` .

step¶

Property which return the expression for the step of the for loop.

Returns:	An object which inherits from `HxCExpr` .

class bip.hexrays.HxCStmtWhile(cinsn)¶

Class for representing a C while statement (HxCType.CIT_WHILE). This is a recursive statement.

cond¶

Property which return the expression used as a condition for the while.

Returns:	An object which inherits from `HxCExpr` .

st_body¶

Property which return the statement used as a body for the while.

Returns:	An object which inherits from `HxCStmt` .

class bip.hexrays.HxCStmtDoWhile(cinsn)¶

Class for representing a C do-while statement (HxCType.CIT_DO). This is a recursive statement.

cond¶

Property which return the expression used as a condition for the do-while.

Returns:	An object which inherits from `HxCExpr` .

st_body¶

Property which return the statement used as a body for the do-while.

Returns:	An object which inherits from `HxCStmt` .

Other leaf Statement API¶

class bip.hexrays.HxCStmtIf(cinsn)¶

Class for representing a C if statement (HxCType.CIT_IF). This is a recursive statement with 2 or 3 child statement depending if a else condition is present.

cond¶

Property which return the expression used as a condition for the if.

Returns:	An object which inherits from `HxCExpr` .

st_then¶

Property which return the statement executed if the condition (cond()) is true.

Returns:	An object which inherits from `HxCStmt` .

has_else¶

Property which indicate if this if statement as an else condtion.

Returns:	True if this statement has an else condition, False otherwise.

st_else¶

Property which return the executed if the condition (cond()) is False.

This property will return None if this condition has no else statement. This can be tested by checking has_else() .

Returns:	An object which inherits from `HxCStmt` .

class bip.hexrays.HxCStmtSwitch(cinsn)¶

Class for representing a C switch statement (HxCType.CIT_SWITCH). This is a recursive statement. This also allow to get the cases value.

A switch statement as the following form:

switch (expr) { // statement expression for the switch
    
    case cases_val[0][0]: // first value for the first case
    case cases_val[0][1]: // second value for the first case
    // ...
        st_cases[0]; //  statement for the first case

    case cases_val[1][0]: // first value for the second case
    // ...
        st_cases[1]; //  statement for the second case

    // ...

    default: // when cases_val[x] is empty
        st_cases[x]; // statement for the default case
    
}

Todo

make something for accessing the default statement.

Todo

this should be accessible as a dict (correspond well to a switch statement).

expr¶

Property which return the expression used as the switch expression.

Returns:	An object which inherits from `HxCExpr` .

max_val¶

Property which return the case maximum value for the switch.

Returns:	An integer which is the maximum case value for the switch.

st_cases¶

Property which return the statement used in the different cases.

Returns:	A list of statements representing the different possible cases of this switch.
Return type:	Objects which inherit from `HxCStmt` .

cases_val¶

Property which return the list of values for each statement. This list is in the same order as the list of statement return by st_cases() .

As each case can have several values for triggering it, this property return a list of list of values.

Returns:	A list of lists of values (int), each list correspond to a different case and contain the values which will make the code enter this path. An empty list means it the default case.

class bip.hexrays.HxCStmtContinue(cinsn)¶: Class for representing a C continue statement (HxCType.CIT_CONTINUE). This is not recursive nor as a value.

class bip.hexrays.HxCStmtBreak(cinsn)¶: Class for representing a C break statement (HxCType.CIT_BREAK). This is not recursive nor as a value.

class bip.hexrays.HxCStmtBlock(cinsn)¶

Class for representing a block statement meaning a list of other statement (HxCType.CIT_BLOCK).

Todo

make this directly accessible as an iterator.

elts¶

Property which return the list of child statement included in this block.

Returns:	The list of child statement of this block.
Return type:	Objects which inherit from `HxCStmt` .

Internal Hexrays Visitor API¶

Implement visitor in top of the hexrays ctree visitor API. Those classes are define only for internal used and should probably be not used directly. Those are accessible through the methods of HxCFunc starting with hx_visit_. Another implementation of visitors exist in Bip which does not rely on the ctree_visitor_t from IDA and which allow to visit on CNode, this is usually the prefered way to visit nodes using Bip. See Visitors in Bip for more information.

class bip.hexrays.hx_visitor._hx_visitor_expr(expr_handler)¶

Inherit from the ctree_visitor_t class and allow to visit all expressions (HxCExpr).

__init__(expr_handler)¶

Creator for the visitor.

Parameters:	expr_handler – A function which take as argument an `HxCExpr` object. This function will be called on all `HxCExpr` part of the function on which it is applied.

visit_expr(i)¶: Handler of the visitor expression. Create the object HxCExpr call the handler.

class bip.hexrays.hx_visitor._hx_visitor_list_expr(expr_list, expr_handler)¶

Inherit from the ctree_visitor_t class and allow to visit expressions which are in a list.

__init__(expr_list, expr_handler)¶

Creator for the visitor.

Parameters:	expr_list – A list of class which inherit from `HxCExpr`, only expression in the list will be visited. expr_handler – A function which take as argument an `HxCExpr` object. This function will be called on all element which are in the `expr_list` .

visit_expr(i)¶: Handler of the visitor expression. Create the object HxCExpr and if it match the expression in the expr_list call the handler.

class bip.hexrays.hx_visitor._hx_visitor_stmt(stmt_handler)¶

Inherit from the ctree_visitor_t class and allow to visit all statements (HxCExpr).

__init__(stmt_handler)¶

Creator for the visitor.

Parameters:	stmt_handler – A function which take as argument an `HxCStmt` object. This function will be called on all `HxCStmt` part of the function on which it is applied.

visit_insn(i)¶: Handler of the visitor statement. Create the object HxCStmt call the handler.

class bip.hexrays.hx_visitor._hx_visitor_list_stmt(stmt_list, stmt_handler)¶

Inherit from the ctree_visitor_t class and allow to visit all statements (HxCExpr).

__init__(stmt_list, stmt_handler)¶

Creator for the visitor.

Parameters:	stmt_list – A list of class which inherit from `HxCStmt`, only statement in the list will be visited. stmt_handler – A function which take as argument an `HxCStmt` object. This function will be called only on `HxCStmt` which are in the `stmt_list`.

visit_insn(i)¶: Handler of the visitor statement. Create the object HxCStmt and if in the list call the handler.

class bip.hexrays.hx_visitor._hx_visitor_all(handler)¶

Inherit from the ctree_visitor_t class and allow to visit all statements (HxCStmt) and expression (HxCExpr).

__init__(handler)¶

Creator for the visitor.

Parameters:	handler – A function which take as argument an `HxCItem` object. This function will be called on all `HxCItem` part of the function on which it is applied.

visit_insn(i)¶: Handler of the visitor statement. Create the HxCItem object and call the handler with it in arguments.

visit_expr(i)¶: Handler of the visitor expression. Create the HxCItem object and call the handler with it in arguments.

class bip.hexrays.hx_visitor._hx_visitor_list_all(item_list, handler)¶

Inherit from the ctree_visitor_t class and allow to visit all statements (HxCExpr).

__init__(item_list, handler)¶

Creator for the visitor.

Parameters:	item_list – A list of class which inherit from `HxCItem`, only item in the list will be visited. handler – A function which take as argument an `HxCItem` object. This function will be called on `HxCItem` which are in the `item_list`.

visit_insn(i)¶: Handler of the visitor statement. Create the HxCItem object and call the handler with it in arguments.

visit_expr(i)¶: Handler of the visitor expression. Create the HxCItem object and call the handler with it in arguments.

HxCItem¶

HxCItem API¶

HxCExpr API¶

HxCStmt API¶

Final Expression API¶

MemAccess Expression API¶

Unary Operation Expression API¶

Double Operation Expression API¶

Assignment¶

Other leaf Expressions API¶

Final Statement API¶

Loop Statement API¶

Other leaf Statement API¶

Internal Hexrays Visitor API¶

Table of Contents

Previous topic

Next topic

This Page