Skip to content

Model

Data structures#

Types reachable from the root:

Inheritors of Type:

Inheritors of TypeDefinition:

Binary#

Data structure representing the whole binary. This is the entry point of the model. It contains the type system (TypeDefinitions), the list of functions (Functions), loading information (Segments), and more.

Fields:

  • Version (uint64_t).

    The input's version, must match revng's schema version

  • Architecture (Architecture).

    The architecture for this binary.

  • EntryPoint (MetaAddress).

    The program entry point, if any.

  • DefaultABI (ABI).

    The default ABI to adopt for analysis purposes.

  • DefaultPrototype (any Type).

    The default function prototype to adopt for functions that do not provide it explicitly.

  • Configuration (Configuration).

    Project-level artifact configuration options

  • Segments (list of Segment).

    Segments represent instructions on what part of the raw binary needs to be loaded at which address.

  • ExtraCodeAddresses (list of MetaAddress).

    A list of addresses known to contain code. rev.ng is usually able to discover all the code by itself by recursively visiting the control-flow graph of functions and the call graph. However, certain pieces of code cannot be identified through these techniques. A prime example are the addresses of catch blocks of C++ exception handlers: no code ever directly jumps there and their address is not stored in jump tables. Their address can only be obtained by interpreting metadata in the ELF.

  • ImportedLibraries (list of string).

    The list of imported libraries identified by their file name. For instance, if the input binary is linked to OpenSSL, this list would should libcrypto.so.1.1.

  • ImportedDynamicFunctions (list of DynamicFunction).

    List of functions imported from dynamic libraries (.so, .dll).

  • Functions (list of Function).

    List of the functions present in the binary.

  • TypeDefinitions (list of any TypeDefinition).

    The set of types used in this binary. It contains struct, union, typedef, enum and function prototypes.

Type#

A type such as an array, a pointer, a primitive or a defined type.

Inheritors: PrimitiveType, PointerType, DefinedType, ArrayType

Referenced by: PointerType.PointeeType, Function.StackFrameType, RawFunctionDefinition.StackArgumentsType, DynamicFunction.Prototype, Binary.DefaultPrototype, Argument.Type, CallSitePrototype.Prototype, UnionField.Type, NamedTypedRegister.Type, StructField.Type, ArrayType.ElementType, TypedefDefinition.UnderlyingType, EnumDefinition.UnderlyingType, Segment.Type, Function.Prototype, CABIFunctionDefinition.ReturnType

PrimitiveType#

A Primitive type defined by its kind (signed, float, etc) and size.

Inherits from: Type

Fields:

  • PrimitiveKind (PrimitiveKind).

    Specifies whether this primitive type is Signed, Float, PointerOrNumber, and so on.

  • Size (uint64_t).

    Specifies the size of this primitive type. As of now, supported sizes include 

    { 1, 2, 4, 8, 16 }
    Note that only floating point primitives (and Generic primitives, whose kind is not known, so they are assumed to be floating point compatible) can also have additional sizes: 
    { 10, 12 }
    Note that 1-byte floating point primitives are not allowed. Note that Void must have size of 0.

PointerType#

A pointer type.

Inherits from: Type

Fields:

  • PointerSize (uint64_t).

    The size of the pointer. As of now, only 4 and 8 byte pointers are supported.

  • PointeeType (any Type).

    The pointee type.

DefinedType#

A reference to a TypeDefinition.

Inherits from: Type

Fields:

  • Definition (reference to TypeDefinition).

    The definition of the type this object represents.

ArrayType#

An array of Types.

Inherits from: Type

Fields:

  • ElementCount (uint64_t).

    The number of elements in this array.

  • ElementType (any Type).

    The type of the elements in this array.

Fields:

  • Kind (TypeKind).

    Specifies which of the children classes this object is upcastable to.

  • IsConst (bool).

    Specifies whether the type this object denotes is const or not.

TypeDefinition#

Base data structure for all the type definitions.

A type definition differs from a Type in the fact that it has an identity. In fact, while two identical instances of Type can be considered to be the same Type, two instances of a TypeDefinition that only differ from their ID are two distinct types.

A type definition can be a struct, a union, a typedef, an enum or a function prototype.

Key: ID, Kind

Inheritors: CABIFunctionDefinition, EnumDefinition, RawFunctionDefinition, TypedefDefinition, StructDefinition, UnionDefinition

Referenced by: DefinedType.Definition

CABIFunctionDefinition#

The function type described through a C-like prototype plus an ABI.

This is an "high level" representation of the prototype of a function. It is expressed as list of arguments composed by an index and a type. No information about the register is embedded. That information is implicit in the ABI this type is associated to.

In contrast, a RawFunctionType is not associated to any ABI and explicitly describes, among other things, what registers are used to pass arguments and return values.

Inherits from: TypeDefinition

Key: ID, Kind

Fields:

  • ABI (ABI).

    The C ABI associated to this function type.

  • ReturnType (any Type).

    The function return type.

  • ReturnValueComment (string).

    A comment that will be emitted as part of this function's definiktion in the \returns ${COMMENT_TEXT} shape.

  • Arguments (list of Argument).

    The list of formal arguments of the function type.

EnumDefinition#

An enum type definition.

Inherits from: TypeDefinition

Key: ID, Kind

Fields:

  • UnderlyingType (any Type).

    The underlying type of the enum. This must only ever be set to a PrimitiveType with either an Unsigned or a Signed kind.

  • Entries (list of EnumEntry).

    The entries of the enum. There can be no two entries associated to the same value.

RawFunctionDefinition#

The function type described by explicitly listing how arguments and return values are passed.

This is a "low level" representation of the prototype of a function. Where the list of registers used to pass arguments and return values is explicitl. For stack arguments, they are collected in a single struct (StackArgumentsType).

In contrast, a CABIFunctionDefinition expresses the function type from a high-level perspective (e.g., a single argument might span multiple registers) and his associated to a well-known ABI. Given an ABI, it is always possible to convert a CABIFunctionDefinition into a RawFunctionDefinition.

Inherits from: TypeDefinition

Key: ID, Kind

Fields:

  • Architecture (Architecture).

    The processor architecture of this function type.

  • Arguments (list of NamedTypedRegister).

    The list of registers used to pass arguments. The registers must belong to the Architecture.

  • ReturnValues (list of NamedTypedRegister).

    The list of registers used to return values. The registers must belong to the Architecture.

  • ReturnValueComment (string).

    A comment that will be emitted as part of this function's definition in the \returns ${COMMENT} shape.

  • PreservedRegisters (list of Register).

    The list of registers preserved by functions using this function type. The registers must belong to Architecture.

  • FinalStackOffset (uint64_t).

    The expected difference between the initial and final value of the stack pointer. For instance, in the x86-64 SystemV ABI, the difference between the initial and final value of the stack pointer is 8. This is due to the fact that ret instruction increase the stack pointer by 8.

  • StackArgumentsType (any Type).

    The type of the struct representing all of the stack arguments.

TypedefDefinition#

A typedef type.

Note, that unlike in C, in our type system two typedefs aliasing the same type are actually distinct types.

Inherits from: TypeDefinition

Key: ID, Kind

Fields:

  • UnderlyingType (any Type).

    The type this typedef is aliasing.

StructDefinition#

A struct type.

Inherits from: TypeDefinition

Key: ID, Kind

Fields:

  • Size (uint64_t).

    The size, in bytes, of the struct.

  • CanContainCode (bool).

    When this field is set to true and this struct is reachable for a segment's root type without traversing pointer, arrays or other qualifiers, the padding of the struct is treated at if it contains code.

  • Fields (list of StructField).

    The list of fields of this struct.

UnionDefinition#

A union type.

Inherits from: TypeDefinition

Key: ID, Kind

Fields:

  • Fields (list of UnionField).

    The list of alternative types in this union.

Fields:

  • ID (uint64_t).

    A unique numeric identifier for this type.

  • Kind (TypeDefinitionKind).

    Specifies which of the children classes this object is upcastable to.

  • Name (string).

    A user-chosen identifier for this type.

  • Comment (string).

    A comment attached to the definition of this type.

EnumEntry#

An entry in an enum.

Key: Value

Referenced by: EnumDefinition.Entries

Fields:

  • Value (uint64_t).

    The value associated to this enum entry. Has to be unique within the enum.

  • Name (string).

    A user-chosen identifier for this enum entry.

  • Comment (string).

    A comment that will be emitted right before the definition of this enum entry.

Relocation#

A relocation, i.e., a directive to write the address of an object (a DynamicFunction or a Segment) at a specific address. Optionally, the address of the object can be modified with a constant offset.

Key: Address, Type

Referenced by: Segment.Relocations, DynamicFunction.Relocations

Fields:

  • Address (MetaAddress).

    Where to write the address of the object.

  • Type (RelocationType).

    How to write the address of the object (e.g., 32-bit vs 64-bit integer).

  • Addend (uint64_t).

    Fixed offset to add when writing the address of the object.

CanonicalRegisterValue#

A Segment can specify a set of canonical values for certain registers. This can be used to represent concepts such as the global pointer, which in certain ABIs, is not set by each function, but it's possible to assume it has a certain value at the entry of the function.

Key: Register

Referenced by: Segment.CanonicalRegisterValues

Fields:

  • Register (Register).

    The register for which to specify the canonical value.

  • Value (uint64_t).

    The canonical value that Register can be assumed to hold upon function entry.

StatementComment#

A comment that can be attached to a statement in the decompiled code if we have a way to uniquely identify said statement.

Key: Index

Referenced by: Function.Comments

Fields:

  • Index (uint64_t).

    The index of the comment.

  • Location (list of MetaAddress).

    The point this comment is attached to, encoded as a set of addresses. When emitted artifact contains a statement with a set of addresses exactly matching the set provided here, the comment is emitted before that statement. If there's no such statement, one is chosen based on how similar its address set is to the address set of the comment. Note that the same comment can be emitted multiple times if there are multiple statements (that do not dominate each other) with the same address set.

  • Body (string).

    The text of the comment.

LocalIdentifier#

The common type for attaching metadata (like names) to function-local identifiers (like variables and labels).

Key: Name

Referenced by: Function.GotoLabels, Function.LocalVariables

Fields:

  • Name (string).

    The user-provided name for this variable or label.

  • Location (list of MetaAddress).

    The set of MetaAddresses of the instructions using this variable (or label).

NamingConfiguration#

Subset of configuration options dedicated to naming rules, mostly (but not exclusively) centered around reserved name prefixes.

Referenced by: Configuration.Naming

Fields:

  • UnnamedSegmentPrefix (string).

    The prefix for a segment without a name. The default value is segment_.

  • UnnamedDynamicFunctionPrefix (string).

    The prefix for a dynamic function with an invalid name. The default value is dynamic_function_.

  • UnnamedFunctionPrefix (string).

    The prefix for a local function without a name. The default value is function_.

  • UnnamedTypeDefinitionPrefix (string).

    The prefix for a type definition without a name. The default value is "". Note that the type kind (like struct, or typedef) is going to be inserted automatically after this prefix.

  • UnnamedEnumEntryPrefix (string).

    The prefix for an enum entry without a name. The default value is enum_entry_.

  • UnnamedStructFieldPrefix (string).

    The prefix for a struct field without a name. The default value is offset_.

  • UnnamedUnionFieldPrefix (string).

    The prefix for a union member without a name. The default value is member_.

  • UnnamedFunctionArgumentPrefix (string).

    The prefix for a cabi function argument without a name. The default value is argument_.

  • UnnamedFunctionRegisterPrefix (string).

    The prefix for a raw function register without a name. The default value is register_.

  • UnnamedLocalVariablePrefix (string).

    The prefix for a local variable without a name. The default value is var_.

  • UnnamedBreakFromLoopVariablePrefix (string).

    The prefix for a local variable without a name. The default value is break_from_loop_.

  • UnnamedGotoLabelPrefix (string).

    The prefix for a goto label without a name. The default value is label_.

  • UndefinedValuePrefix (string).

    The prefix for an undefined value. The default value is undef_.

  • OpaqueCSVValuePrefix (string).

    The prefix for accessing an opaque CSV Value. The default value is undef_.

  • MaximumEnumValuePrefix (string).

    The prefix for the maximum enum value. The default value is enum_max_value_.

  • StackFrameVariableName (string).

    The name of the variable representing stack. The default value is stack.

  • RawStackArgumentName (string).

    The name of the variable representing stack. The default value is stack_arguments.

  • LoopStateVariableName (string).

    The name of the variable representing stack. The default value is loop_state_var.

  • StructPaddingPrefix (string).

    The prefix for a padding struct field. The default value is padding_at_.

  • ArtificialReturnValuePrefix (string).

    The prefix for an artificial raw function return value. The default value is artificial_struct_returned_by_.

  • ReserveNamesStartingWithUnderscore (bool).

    When this is set to true, all the names starting with underscores will have a \ref ReservedNamePrefix prefix attached.

DisassemblyConfiguration#

The subset of configuration options dedicated to the disassembly view.

Referenced by: Configuration.Disassembly

Fields:

  • DisableEmissionOfInstructionAddress (bool).

    When set to true, the addresses of the instructions are not present in the disassembly view. 

    400df8:    fd 7b bd a9    stp x29, x30, [sp, #-0x30]!
400dfc:    fd 03 00 91    mov x29, sp
-----------
^
This part

  • DisableEmissionOfRawBytes (bool).

    When set to true, the raw bytes of the instructions are not present in the disassembly view. 

    400df8:    fd 7b bd a9    stp x29, x30, [sp, #-0x30]!
400dfc:    fd 03 00 91    mov x29, sp
           ---------------
           ^
           This part

  • UseX86ATTSyntax (bool).

    When set to true, ATT syntax is used. true: 

    80491a0:    83 c4 10             addl $0x10, %esp
80491a3:    8b 5d fc             movl -0x4(%ebp), %ebx
80491a6:    c9                   leave
80491a7:    e9 ec fe ff ff       jmp bb_0x8049098
    false (default): 
    80491a0:    83 c4 10             add esp, 0x10
80491a3:    8b 5d fc             mov ebx, dword ptr [ebp - 0x4]
80491a6:    c9                   leave
80491a7:    e9 ec fe ff ff       jmp bb_0x8049098
    Note that this option has no effect on non-x86 binaries.

  • AddressStyle (DisassemblyConfigurationAddressStyle).

    This describes the way labels / addresses should be printed in the disassembly view. See the related enum for further explanation and examples. The default value is Smart.

  • ImmediateStyle (DisassemblyConfigurationImmediateStyle).

    This describes the way immediate values are printed in the disassembly view. See the related enum for further explanation and examples. The default value is CHexadecimal.

  • PrintFullMetaAddress (bool).

    Set this to true to include the full meta-address whenever one is printed. The default value of false omits the address type as long as it matches that of the binary. true: 

    80491a7_Code_x86:    e9 ec fe ff ff       jmp bb_0x8049098_Code_x86
    false (default): 
    80491a7:    e9 ec fe ff ff       jmp bb_0x8049098

  • BasicBlockPrefix (string).

    The prefix attached to the basic block address in the disassembly views. The default value is bb_. my_value_: 

    80491a7:    e9 ec fe ff ff       jmp my_value_0x8049098
    default: 
    80491a7:    e9 ec fe ff ff       jmp bb_0x8049098

Argument#

The argument of a CABIFunctionType.

Key: Index

Referenced by: CABIFunctionDefinition.Arguments

Fields:

  • Index (uint64_t).

    The argument index.

  • Type (any Type).

    The type of the argument.

  • Name (string).

    The name of the argument.

  • Comment (string).

    A comment that will be emitted as part of this function's definition in the \param ${NAME} ${COMMENT} shape.

NamedTypedRegister#

An argument or a return value in a RawFunctionDefinition.

It is basically a pair of a register and a Type.

Key: Location

Referenced by: RawFunctionDefinition.ReturnValues, RawFunctionDefinition.Arguments

Fields:

  • Location (Register).

    The register this argument or return value is created for.

  • Type (any Type).

    The type of this argument or return value.

  • Name (string).

    The name for this argument or return value.

  • Comment (string).

    The comment for this argument or return value.

StructField#

A field of a StructDefinition.

It is composed by the offset of the field and its type.

Key: Offset

Referenced by: StructDefinition.Fields

Fields:

  • Offset (uint64_t).

    The number of bytes in the given struct before this field.

  • Name (string).

    The name of this field.

  • Comment (string).

    The comment that will be emitted before this field's definition.

  • Type (any Type).

    The type of the field.

UnionField#

Specifies one of the possible types a given UnionDefinition can assume.

It is composed by a index and the Type.

Key: Index

Referenced by: UnionDefinition.Fields

Fields:

  • Index (uint64_t).

    A numeric index unique within a given UnionDefinition. Note that indexing is dense, so if a given union has a type with index 4, it must also have types indexed 0-3.

  • Name (string).

    The name of this "field" (union alternative).

  • Comment (string).

    The comment that will be emitted right before the definition of the given "field" (union alternative).

  • Type (any Type).

    The name of this "field" (union alternative).

CallSitePrototype#

Information about the prototype of a specific callsite within a Function.

Key: CallerBlockAddress

Referenced by: Function.CallSitePrototypes

Fields:

  • CallerBlockAddress (MetaAddress).

    Address of the basic block of the call.

  • Prototype (any Type).

    The prototype specific to this call site.

  • IsTailCall (bool).

    Whether this call site is a tail call or not.

  • Attributes (list of FunctionAttribute).

    Attributes for this call site.

DynamicFunction#

A function defined in a dynamic library.

Key: Name

Referenced by: Binary.ImportedDynamicFunctions

Fields:

  • Name (string).

    The name of the symbol for this dynamic function. Currently, this must not contain /s and \ns. This restriction will eventually be lifted, when proper escaping is in place.

  • Comment (string).

    The user-provided comment for this dynamic function.

  • Prototype (any Type).

    The prototype of this dynamic function.

  • Attributes (list of FunctionAttribute).

    The attributes of this dynamic function.

  • Relocations (list of Relocation).

    A list of locations where the address of this dynamic function should be placed.

Segment#

A segment contains the information necessary for rev.ng to load the executable in memory.

Key: StartAddress, VirtualSize

Referenced by: Binary.Segments

Fields:

  • StartAddress (MetaAddress).

    The address at which this segment should be loaded.

  • VirtualSize (uint64_t).

    The size of this segment in memory. If this value is greater than FileSize, the discrepancy is considered to full of 0s.

  • StartOffset (uint64_t).

    Start file offset from which the segment will be loaded.

  • FileSize (uint64_t).

    Number of bytes that will be loaded in memory from the file.

  • IsReadable (bool).

    Is this segment readable?

  • IsWriteable (bool).

    Is this segment writable?

  • IsExecutable (bool).

    Is this segment executable?

  • Name (string).

    The name of the segment.

  • Comment (string).

    The comment to emit right before the global variable that will be created for this segment.

  • CanonicalRegisterValues (list of CanonicalRegisterValue).

    The list of registers that are assumed to have a canonical value set upon an entry into a function contained within this segment.

  • Relocations (list of Relocation).

    A list of locations where the address of this segment should be placed.

  • Type (any Type).

    The struct type associated to this segment. Informally, each field of such a struct is a global variable.

Configuration#

A list of configuration options

Referenced by: Binary.Configuration

Fields:

  • Disassembly (DisassemblyConfiguration).

    The options specific to the disassembly artifact.

  • Naming (NamingConfiguration).

    The options specific to the naming conventions

  • CommentLineWidth (uint64_t).

    Sets a recommended comment line width to improve their readability. The default value is 80. Set to -1 for unlimited line size.

Function#

A function defined within this binary.

Key: Entry

Referenced by: Binary.Functions

Fields:

  • Entry (MetaAddress).

    The address of the entry point. Note: this does not necessarily correspond to the address of the basic block with the lowest address.

  • Name (string).

    The user-provided name for this function.

  • Comment (string).

    The user-provided comment for this function.

  • StackFrameType (any Type).

    The type of the stack frame.

  • Prototype (any Type).

    The prototype of the function.

  • Attributes (list of FunctionAttribute).

    Attributes for every call site.

  • CallSitePrototypes (list of CallSitePrototype).

    Information about specific call sites within this function.

  • ExportedNames (list of string).

    The list of names used to make this function available as a dynamic symbol.

  • Comments (list of StatementComment).

    The list of comments attached to statements (e.g., disassembled instructions or C statements) within the body of this function.

  • LocalVariables (list of LocalIdentifier).

    The list of named local variables within this function's body.

  • GotoLabels (list of LocalIdentifier).

    The list of named goto labels within this function's body.

Enumerations#

PrimitiveKind#

The kind of a primitive type.

Members:

  • Void

    The void type.

  • Generic

    The most generic primitive kind: it can be any of the other primitive kinds, except for Void.

  • PointerOrNumber

    A kind representing either a Number kind or a pointer. This can also be seen as not-a-Float.

  • Number

    A two's complement integer number, either Signed or Unsigned.

  • Unsigned

    An unsigned two's complement integer number.

  • Signed

    An signed two's complement integer number.

  • Float

    A IEEE 754 floating point number.

Referenced by: PrimitiveType.PrimitiveKind

RelocationType#

A enumeration describing how a Relocation should be written at the target address.

Members:

  • WriteAbsoluteAddress32

    Write the absolute address of the object as a 32-bit integer.

  • WriteAbsoluteAddress64

    Write the absolute address of the object as a 64-bit integer.

  • AddAbsoluteAddress32

    Add to the 32-bit integer present at the target location the absolute address of the object.

  • AddAbsoluteAddress64

    Add to the 64-bit integer present at the target location the absolute address of the object.

  • WriteRelativeAddress32

    Write the address of the object as a 32-bit integer, expressed as a relative from the target of the relocation.

  • WriteRelativeAddress64

    Write the address of the object as a 64-bit integer, expressed as a relative from the target of the relocation.

  • AddRelativeAddress32

    Add to the 32-bit integer present at the target location the address of the object, expressed as a relative from the target of the relocation.

  • AddRelativeAddress64

    Add to the 32-bit integer present at the target location the address of the object, expressed as a relative from the target of the relocation.

Referenced by: Relocation.Type

FunctionAttribute#

Attributes for function calls. They can either be applied to specific call sites, or to all the call sites of a specific function.

Members:

  • NoReturn

    The function call does not return.

  • Inline

    The function call must be inlined in the caller.

Referenced by: CallSitePrototype.Attributes, DynamicFunction.Attributes, Function.Attributes

Architecture#

An enum listing all the currently supported architectures.

Members:

  • x86

  • x86_64

  • arm

  • aarch64

  • mips

  • mipsel

  • systemz

Referenced by: RawFunctionDefinition.Architecture, Binary.Architecture

ABI#

An enum listing all the currently supported ABIs.

Members:

  • SystemV_x86_64

    64-bit SystemV ABI for x86 processor architecture (reference).

  • SystemV_x86

    32-bit SystemV ABI for x86 processor architecture (reference).

  • SystemV_x86_regparm_3

    A GCC specific modification of the 32-bit SystemV ABI for x86 processor architecture. It allows three first GPR-sized arguments to be passed using the EAX, EDX, and ECX registers. See the reference for regparm x86 function attribute.

  • SystemV_x86_regparm_2

    A GCC specific modification of the 32-bit SystemV ABI for x86 processor architecture. It allows two first GPR-sized arguments to be passed using the EAX, and ECX registers. See the GCC documentation for regparm x86 function attribute.

  • SystemV_x86_regparm_1

    A GCC specific modification of the 32-bit SystemV ABI for x86 processor architecture. It allows the first GPR-sized argument to be passed using the EAX register. See the GCC documentation for regparm x86 function attribute.

  • Microsoft_x86_64

    64-bit Microsoft ABI for x86 processor architecture (reference).

  • Microsoft_x86_64_vectorcall

    A modification of 64-bit Microsoft ABI for x86 processor architecture (reference). It allows using extra vector registers for passing function arguments.

  • Microsoft_x86_cdecl

    The default 32-bit Microsoft ABI for x86 processor architecture (reference). It was indented to be compatible with SystemV_x86 but there are slight differences.

  • Microsoft_x86_cdecl_gcc

    32-bit Microsoft x86 cdecl abi as implemented in GCC (subtly different from the original).

  • Microsoft_x86_stdcall

    A modification of the 32-bit __cdecl Microsoft ABI for x86 processor architecture (reference). The main difference is the fact that the callee is responsible for stack cleanup instead of the caller.

  • Microsoft_x86_stdcall_gcc

    32-bit Microsoft x86 stdcall abi as implemented in GCC (subtly different from the original).

  • Microsoft_x86_thiscall

    A modification of the 32-bit __stdcall Microsoft ABI for x86 processor architecture (reference). The main difference is the fact that it allows to pass a single (the first) function argument using a register. This ABI is only used for member function call where the first argument is always a this pointer.

  • Microsoft_x86_fastcall

    A modification of the 32-bit __stdcall Microsoft ABI for x86 processor architecture (reference). The main difference is the fact that it allows to pass two first GPR-sized non-aggregate function arguments in registers.

  • Microsoft_x86_fastcall_gcc

    32-bit Microsoft x86 fastcall abi as implemented in GCC (subtly different from the original).

  • Microsoft_x86_vectorcall

    A modification of the 32-bit __fastcall Microsoft ABI for x86 processor architecture (reference). It allows using extra vector registers for passing function arguments.

  • AAPCS64

    Stands for Arm Architecture Procedure Call Standard (64-bit) (reference). The official ABI for AArch64 (ARM64) processor architecture.

  • Microsoft_AAPCS64

    Stands for "Arm Architecture Procedure Call Standard (64-bit)". This represents the version of the ABI used by windows-on-arm. For differences from the original ABI see the reference.

  • Apple_AAPCS64

    Stands for "Arm Architecture Procedure Call Standard (64-bit)". This represents the version of the ABI used by the apple products. For differences from the original ABI see the reference.

  • AAPCS

    Stands for "Arm Architecture Procedure Call Standard" (reference). The official ABI for ARM processor architecture.

  • SystemV_MIPS_o32

    The ABI for MIPS RISC processor architecture (reference).

  • SystemV_MIPSEL_o32

    The ABI for little-endian edition of the MIPS RISC processor architecture (reference).

  • SystemZ_s390x

    The s390x ABI for SystemZ processor architecture (reference).

Referenced by: Binary.DefaultABI, CABIFunctionDefinition.ABI

Register#

An enum containing the list of all the currently supported registers.

Members:

  • eax_x86

  • ebx_x86

  • ecx_x86

  • edx_x86

  • esi_x86

  • edi_x86

  • ebp_x86

  • esp_x86

  • st0_x86

  • xmm0_x86

  • xmm1_x86

  • xmm2_x86

  • xmm3_x86

  • xmm4_x86

  • xmm5_x86

  • xmm6_x86

  • xmm7_x86

  • rax_x86_64

  • rbx_x86_64

  • rcx_x86_64

  • rdx_x86_64

  • rbp_x86_64

  • rsp_x86_64

  • rsi_x86_64

  • rdi_x86_64

  • r8_x86_64

  • r9_x86_64

  • r10_x86_64

  • r11_x86_64

  • r12_x86_64

  • r13_x86_64

  • r14_x86_64

  • r15_x86_64

  • xmm0_x86_64

  • xmm1_x86_64

  • xmm2_x86_64

  • xmm3_x86_64

  • xmm4_x86_64

  • xmm5_x86_64

  • xmm6_x86_64

  • xmm7_x86_64

  • fs_x86_64

  • r0_arm

  • r1_arm

  • r2_arm

  • r3_arm

  • r4_arm

  • r5_arm

  • r6_arm

  • r7_arm

  • r8_arm

  • r9_arm

  • r10_arm

  • r11_arm

  • r12_arm

  • r13_arm

  • r14_arm

  • r15_arm

  • q0_arm

  • q1_arm

  • q2_arm

  • q3_arm

  • q4_arm

  • q5_arm

  • q6_arm

  • q7_arm

  • x0_aarch64

  • x1_aarch64

  • x2_aarch64

  • x3_aarch64

  • x4_aarch64

  • x5_aarch64

  • x6_aarch64

  • x7_aarch64

  • x8_aarch64

  • x9_aarch64

  • x10_aarch64

  • x11_aarch64

  • x12_aarch64

  • x13_aarch64

  • x14_aarch64

  • x15_aarch64

  • x16_aarch64

  • x17_aarch64

  • x18_aarch64

  • x19_aarch64

  • x20_aarch64

  • x21_aarch64

  • x22_aarch64

  • x23_aarch64

  • x24_aarch64

  • x25_aarch64

  • x26_aarch64

  • x27_aarch64

  • x28_aarch64

  • x29_aarch64

  • lr_aarch64

  • sp_aarch64

  • v0_aarch64

  • v1_aarch64

  • v2_aarch64

  • v3_aarch64

  • v4_aarch64

  • v5_aarch64

  • v6_aarch64

  • v7_aarch64

  • v8_aarch64

  • v9_aarch64

  • v10_aarch64

  • v11_aarch64

  • v12_aarch64

  • v13_aarch64

  • v14_aarch64

  • v15_aarch64

  • v16_aarch64

  • v17_aarch64

  • v18_aarch64

  • v19_aarch64

  • v20_aarch64

  • v21_aarch64

  • v22_aarch64

  • v23_aarch64

  • v24_aarch64

  • v25_aarch64

  • v26_aarch64

  • v27_aarch64

  • v28_aarch64

  • v29_aarch64

  • v30_aarch64

  • v31_aarch64

  • v0_mips

  • v1_mips

  • a0_mips

  • a1_mips

  • a2_mips

  • a3_mips

  • s0_mips

  • s1_mips

  • s2_mips

  • s3_mips

  • s4_mips

  • s5_mips

  • s6_mips

  • s7_mips

  • t0_mips

  • t1_mips

  • t2_mips

  • t3_mips

  • t4_mips

  • t5_mips

  • t6_mips

  • t7_mips

  • t8_mips

  • t9_mips

  • gp_mips

  • sp_mips

  • fp_mips

  • ra_mips

  • f0_mips

  • f1_mips

  • f2_mips

  • f3_mips

  • f4_mips

  • f5_mips

  • f6_mips

  • f7_mips

  • f8_mips

  • f9_mips

  • f10_mips

  • f11_mips

  • f12_mips

  • f13_mips

  • f14_mips

  • f15_mips

  • f16_mips

  • f17_mips

  • f18_mips

  • f19_mips

  • f20_mips

  • f21_mips

  • f22_mips

  • f23_mips

  • f24_mips

  • f25_mips

  • f26_mips

  • f27_mips

  • f28_mips

  • f29_mips

  • f30_mips

  • f31_mips

  • r0_systemz

  • r1_systemz

  • r2_systemz

  • r3_systemz

  • r4_systemz

  • r5_systemz

  • r6_systemz

  • r7_systemz

  • r8_systemz

  • r9_systemz

  • r10_systemz

  • r11_systemz

  • r12_systemz

  • r13_systemz

  • r14_systemz

  • r15_systemz

  • f0_systemz

  • f1_systemz

  • f2_systemz

  • f3_systemz

  • f4_systemz

  • f5_systemz

  • f6_systemz

  • f7_systemz

  • f8_systemz

  • f9_systemz

  • f10_systemz

  • f11_systemz

  • f12_systemz

  • f13_systemz

  • f14_systemz

  • f15_systemz

Referenced by: RawFunctionDefinition.PreservedRegisters, CanonicalRegisterValue.Register, NamedTypedRegister.Location

DisassemblyConfigurationImmediateStyle#

An enum listing immediate emission style in the disassembly views.

Members:

  • Decimal

    Print immediate values as decimal, for example 42.

  • CHexadecimal

    Print immediate values as c-style hexadecimal, for example 0x2a.

  • AsmHexadecimal

    Print immediate values as asm-style hexadecimal, for example 02ah.

Referenced by: DisassemblyConfiguration.ImmediateStyle

DisassemblyConfigurationAddressStyle#

An enum listing address (as in label) emission style in the disassembly views.

Members:

  • Smart

    Look for the addresses among basic blocks and functions. When a match is found, replace the addresses with relevant labels. Otherwise, prints an absolute address instead.

  • SmartWithPCRelativeFallback

    Same as Smart, except when unable to single out the target, print a PC-relative address instead.

  • Strict

    Same as Smart, except when unable to single out the target, print an error token.

  • Global

    Convert PC relative addresses into global representation.

  • PCRelative

    Print all the addresses exactly how disassembler emitted them in PC-relative mode.

Referenced by: DisassemblyConfiguration.AddressStyle

TypeDefinitionKind#

The list of child types TypeDefinition can be upcasted to

Members:

  • CABIFunctionDefinition

  • EnumDefinition

  • RawFunctionDefinition

  • TypedefDefinition

  • StructDefinition

  • UnionDefinition

Referenced by: TypeDefinition.Kind

TypeKind#

The list of child types Type can be upcasted to

Members:

  • PrimitiveType

  • PointerType

  • DefinedType

  • ArrayType

Referenced by: Type.Kind