libTriton  version 0.9 build 1502
TritonContext

[python api] All information about the Triton Context class

Description


libTriton offers Python bindings on top of its C++ API which allow you to build analysis in Python as well as in C++.

>>> from triton import TritonContext, ARCH
>>>
>>> ctx1 = TritonContext()
>>> ctx1.setArchitecture(ARCH.X86_64)
>>>
>>> ctx2 = TritonContext(ARCH.AARCH64)

Python API - Methods of the TritonContext class


Methods

  • void addCallback(CALLBACK kind, function cb)
    Adds a callback at specific internal points. Your callback will be called each time the point is reached.
  • void assignSymbolicExpressionToMemory(SymbolicExpression symExpr, MemoryAccess mem)
    Assigns a SymbolicExpression to a MemoryAccess area. Be careful, use this function only if you know what you are doing. The symbolic expression (symExpr) must be aligned to the memory access.
  • void assignSymbolicExpressionToRegister(SymbolicExpression symExpr, Register reg)
    Assigns a SymbolicExpression to a Register. Be careful, use this function only if you know what you are doing. The symbolic expression (symExpr) must be aligned to the targeted size register. The register must be a parent register.
  • bool buildSemantics(Instruction inst)
    Builds the instruction semantics. Returns true if the instruction is supported. You must define an architecture before.
  • void clearCallbacks(void)
    Clears recorded callbacks.
  • void clearModes(void)
    Clears recorded modes.
  • void clearConcreteMemoryValue(MemoryAccess mem)
    Clears concrete values assigned to the memory cells.
  • void clearConcreteMemoryValue(integer addr, integer size)
    Clears concrete values assigned to the memory cells from addr to addr + size.
  • void clearPathConstraints(void)
    Clears the current path predicate.
  • void concretizeAllMemory(void)
    Concretizes all symbolic memory references.
  • void concretizeAllRegister(void)
    Concretizes all symbolic register references.
  • void concretizeMemory(integer addr)
    Concretizes a specific symbolic memory reference.
  • void concretizeMemory(MemoryAccess mem)
    Concretizes a specific symbolic memory reference.
  • void concretizeRegister(Register reg)
    Concretizes a specific symbolic register reference.
  • SymbolicExpression createSymbolicMemoryExpression(Instruction inst, AstNode node, MemoryAccess mem, string comment)
    Returns the new symbolic memory expression and links this expression to the instruction.
  • SymbolicExpression createSymbolicRegisterExpression(Instruction inst, AstNode node, Register reg, string comment)
    Returns the new symbolic register expression and links this expression to the instruction.
  • SymbolicExpression createSymbolicVolatileExpression (Instruction inst, AstNode node, string comment)
    Returns the new symbolic volatile expression and links this expression to the instruction.
  • void disassembly(Instruction inst)
    Disassembles the instruction and sets up operands. You must define an architecture before.
  • [Instruction inst, ...] disassembly(integer addr, integer count)
    Disassembles a concrete memory area from addr and returns a list of at most count disassembled instructions.
  • [Instruction inst, ...] disassembly(integer addr)
    Disassembles a concrete memory area from addr to control flow instruction and returns a list of disassembled instructions.
  • void enableSymbolicEngine(bool flag)
    Enables or disables the symbolic execution engine.
  • void enableTaintEngine(bool flag)
    Enables or disables the taint engine.
  • integer evaluateAstViaZ3(AstNode node)
    Evaluates an AST via Z3 and returns the symbolic value.
  • [Register, ...] getAllRegisters(void)
    Returns the list of all registers. Each item of this list is a Register.
  • ARCH getArchitecture(void)
    Returns the current architecture used.
  • AstContext getAstContext(void)
    Returns the AST context to create and modify nodes.
  • AST_REPRESENTATION getAstRepresentationMode(void)
    Returns the current AST representation mode.
  • bytes getConcreteMemoryAreaValue(integer baseAddr, integer size)
    Returns the concrete value of a memory area.
  • integer getConcreteMemoryValue(integer addr)
    Returns the concrete value of a memory cell.
  • integer getConcreteMemoryValue(MemoryAccess mem)
    Returns the concrete value of memory cells.
  • integer getConcreteRegisterValue(Register reg)
    Returns the concrete value of a register.
  • integer getConcreteVariableValue(SymbolicVariable symVar)
    Returns the concrete value of a symbolic variable.
  • integer getGprBitSize(void)
    Returns the size in bits of the General Purpose Registers.
  • integer getGprSize(void)
    Returns the size in bytes of the General Purpose Registers.
  • AstNode getImmediateAst(Immediate imm)
    Returns the AST corresponding to the Immediate.
  • AstNode getMemoryAst(MemoryAccess mem)
    Returns the AST corresponding to the MemoryAccess with the SSA form.
  • dict getModel(AstNode node, status=False)
    Computes and returns a model as a dictionary of {integer symVarId : SolverModel model} from a symbolic constraint. If status is True, returns a tuple of (dict, SOLVER status).
  • [dict, ...] getModels(AstNode node, integer limit, status=False)
    Computes and returns several models from a symbolic constraint. The limit is the number of models returned. If status is True, returns a tuple of ([dict, ...], SOLVER status).
  • Register getParentRegister(Register reg)
    Returns the parent Register from a Register.
  • [Register, ...] getParentRegisters(void)
    Returns the list of parent registers. Each item of this list is a Register.
  • [PathConstraint, ...] getPathConstraints(void)
    Returns the logical conjunction vector of path constraints as a list of PathConstraint.
  • AstNode getPathPredicate(void)
    Returns the current path predicate as an AST of logical conjunction of each taken branch.
  • integer getPathPredicateSize(void)
    Returns the size of the path predicate (number of constraints).
  • [AstNode, ...] getPredicatesToReachAddress(integer addr)
    Returns path predicates which may reach the targeted address.
  • Register getRegister(REG id)
    Returns the Register class corresponding to a REG id.
  • Register getRegister(string name)
    Returns the Register class corresponding to a string.
  • AstNode getRegisterAst(Register reg)
    Returns the AST corresponding to the Register with the SSA form.
  • SymbolicExpression getSymbolicExpression(integer symExprId)
    Returns the symbolic expression corresponding to an id.
  • dict getSymbolicExpressions(void)
    Returns all symbolic expressions as a dictionary of {integer SymExprId : SymbolicExpression expr}.
  • dict getSymbolicMemory(void)
    Returns the map of symbolic memory as {integer address : SymbolicExpression expr}.
  • SymbolicExpression getSymbolicMemory(integer addr)
    Returns the SymbolicExpression corresponding to a memory address.
  • integer getSymbolicMemoryValue(integer addr)
    Returns the symbolic memory value.
  • integer getSymbolicMemoryValue(MemoryAccess mem)
    Returns the symbolic memory value.
  • dict getSymbolicRegisters(void)
    Returns the map of symbolic registers as {REG reg : SymbolicExpression expr}.
  • SymbolicExpression getSymbolicRegister(Register reg)
    Returns the SymbolicExpression corresponding to the parent register.
  • integer getSymbolicRegisterValue(Register reg)
    Returns the symbolic register value.
  • SymbolicVariable getSymbolicVariable(integer symVarId)
    Returns the symbolic variable corresponding to a symbolic variable id.
  • SymbolicVariable getSymbolicVariable(string symVarName)
    Returns the symbolic variable corresponding to a symbolic variable name.
  • dict getSymbolicVariables(void)
    Returns all symbolic variables as a dictionary of {integer SymVarId : SymbolicVariable var}.
  • [integer, ...] getTaintedMemory(void)
    Returns the list of all tainted addresses.
  • [Register, ...] getTaintedRegisters(void)
    Returns the list of all tainted registers.
  • [SymbolicExpression, ...] getTaintedSymbolicExpressions(void)
    Returns the list of all tainted symbolic expressions.
  • bool isArchitectureValid(void)
    Returns true if the architecture is valid.
  • bool isConcreteMemoryValueDefined(MemoryAccess mem)
    Returns true if memory cells have a defined concrete value.
  • bool isConcreteMemoryValueDefined(integer addr, integer size)
    Returns true if memory cells have a defined concrete value.
  • bool isFlag(Register reg)
    Returns true if the register is a flag.
  • bool isMemorySymbolized(integer addr)
    Returns true if the memory cell expression contains a symbolic variable.
  • bool isMemorySymbolized(MemoryAccess mem)
    Returns true if memory cell expressions contain symbolic variables.
  • bool isMemoryTainted(integer addr)
    Returns true if the address is tainted.
  • bool isMemoryTainted(MemoryAccess mem)
    Returns true if the memory is tainted.
  • bool isModeEnabled(MODE mode)
    Returns true if the mode is enabled.
  • bool isRegister(Register reg)
    Returns true if the register is a register (see also isFlag()).
  • bool isRegisterSymbolized(Register reg)
    Returns true if the register expression contains a symbolic variable.
  • bool isRegisterTainted(Register reg)
    Returns true if the register is tainted.
  • bool isRegisterValid(Register reg)
    Returns true if the register is valid.
  • bool isSat(AstNode node)
    Returns true if an expression is satisfiable.
  • bool isSymbolicEngineEnabled(void)
    Returns true if the symbolic execution engine is enabled.
  • bool isSymbolicExpressionExists(integer symExprId)
    Returns true if the symbolic expression id exists.
  • bool isTaintEngineEnabled(void)
    Returns true if the taint engine is enabled.
  • bool isThumb(void)
    Returns true if execution mode is Thumb (only valid for ARM32).
  • SymbolicExpression newSymbolicExpression(AstNode node, string comment)
    Returns a new symbolic expression. Note that if there are simplification passes recorded, simplifications will be applied.
  • SymbolicVariable newSymbolicVariable(integer varSize, string alias)
    Returns a new symbolic variable.
  • void popPathConstraint(void)
    Pops the last constraints added to the path predicate.
  • void printSlicedExpressions(SymbolicExpression expr, bool assert_=False)
    Prints symbolic expression with used references and symbolic variables in AST representation mode. If assert_ is true, then (assert <expr>).
  • bool processing(Instruction inst)
    Processes an instruction and updates engines according to the instruction semantics. Returns true if the instruction is supported. You must define an architecture before.
  • void pushPathConstraint(AstNode node)
    Pushs constraints to the current path predicate.
  • void removeCallback(CALLBACK kind, function cb)
    Removes a recorded callback.
  • void reset(void)
    Resets everything.
  • void setArchitecture(ARCH arch)
    Initializes an architecture. This function must be called before any call to the rest of the API.
  • void setAstRepresentationMode(AST_REPRESENTATION mode)
    Sets the AST representation mode.
  • void setConcreteMemoryAreaValue(integer baseAddr, [integer,])
    Sets the concrete value of a memory area. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
  • void setConcreteMemoryAreaValue(integer baseAddr, bytes opcodes)
    Sets the concrete value of a memory area. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
  • void setConcreteMemoryValue(integer addr, integer value)
    Sets the concrete value of a memory cell. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
  • void setConcreteMemoryValue(MemoryAccess mem, integer value)
    Sets the concrete value of memory cells. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
  • void setConcreteRegisterValue(Register reg, integer value)
    Sets the concrete value of a register. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
  • void setConcreteVariableValue(SymbolicVariable symVar, integer value)
    Sets the concrete value of a symbolic variable.
  • void setMode(MODE mode, bool flag)
    Enables or disables a specific mode.
  • void setSolverMemoryLimit(integer megabytes)
    Defines a solver memory consumption limit (in megabytes)
  • void setSolverTimeout(integer ms)
    Defines a solver timeout (in milliseconds)
  • bool setTaintMemory(MemoryAccess mem, bool flag)
    Sets the targeted memory as tainted or not. Returns true if the memory is still tainted.
  • bool setTaintRegister(Register reg, bool flag)
    Sets the targeted register as tainted or not. Returns true if the register is still tainted.
  • void setThumb(bool state)
    Sets CPU state to Thumb mode (only valid for ARM32).
  • AstNode simplify(AstNode node, bool z3=False)
    Calls all simplification callbacks recorded and returns a new simplified node. If the z3 flag is set to True, Triton will use z3 to simplify the given node before calling its recorded callbacks.
  • dict sliceExpressions(SymbolicExpression expr)
    Slices expressions from a given one (backward slicing) and returns all symbolic expressions as a dictionary of {integer SymExprId : SymbolicExpression expr}.
  • SymbolicVariable symbolizeExpression(integer symExprId, integer symVarSize, string symVarAlias)
    Converts a symbolic expression to a symbolic variable. symVarSize must be in bits. This function returns the new symbolic variable created.
  • SymbolicVariable symbolizeMemory(MemoryAccess mem, string symVarAlias)
    Converts a symbolic memory expression to a symbolic variable. This function returns the new symbolic variable created.
  • SymbolicVariable symbolizeRegister(Register reg, string symVarAlias)
    Converts a symbolic register expression to a symbolic variable. This function returns the new symbolic variable created.
  • bool taintAssignment(MemoryAccess memDst, Immediate immSrc)
    Taints memDst from immSrc with an assignment - memDst is untained. Returns true if the memDst is still tainted.
  • bool taintAssignment(MemoryAccess memDst, MemoryAccess memSrc)
    Taints memDst from memSrc with an assignment - memDst is tainted if memSrc is tainted, otherwise memDst is untained. Returns true if memDst is tainted.
  • bool taintAssignment(MemoryAccess memDst, Register regSrc)
    Taints memDst from regSrc with an assignment - memDst is tainted if regSrc is tainted, otherwise memDst is untained. Return true if memDst is tainted.
  • bool taintAssignment(Register regDst, Immediate immSrc)
    Taints regDst from immSrc with an assignment - regDst is untained. Returns true if reDst is still tainted.
  • bool taintAssignment(Register regDst, MemoryAccess memSrc)
    Taints regDst from MemSrc with an assignment - regDst is tainted if memSrc is tainted, otherwise regDst is untained. Return true if regDst is tainted.
  • bool taintAssignment(Register regDst, Register regSrc)
    Taints regDst from regSrc with an assignment - regDst is tainted if regSrc is tainted, otherwise regDst is untained. Return true if regDst is tainted.
  • bool taintMemory(integer addr)
    Taints an address. Returns true if the address is tainted.
  • bool taintMemory(MemoryAccess mem)
    Taints a memory. Returns true if the memory is tainted.
  • bool taintRegister(Register reg)
    Taints a register. Returns true if the register is tainted.
  • bool taintUnion(MemoryAccess memDst, Immediate immSrc)
    Taints memDst from immSrc with an union - memDst does not changes. Returns true if memDst is tainted.
  • bool taintUnion(MemoryAccess memDst, MemoryAccess memSrc)
    Taints memDst from memSrc with an union - memDst is tainted if memDst or memSrc are tainted. Returns true if memDst is tainted.
  • bool taintUnion(MemoryAccess memDst, Register regSrc)
    Taints memDst from RegSrc with an union - memDst is tainted if memDst or regSrc are tainted. Returns true if memDst is tainted.
  • bool taintUnion(Register regDst, Immediate immSrc)
    Taints regDst from immSrc with an union - regDst does not changes. Returns true if regDst is tainted.
  • bool taintUnion(Register regDst, MemoryAccess memSrc)
    Taints regDst from memSrc with an union - regDst is tainted if regDst or memSrc are tainted. Returns true if regDst is tainted.
  • bool taintUnion(Register regDst, Register regSrc)
    Taints regDst from regSrc with an union - regDst is tainted if regDst or regSrc are tainted. Returns true if regDst is tainted.
  • bool untaintMemory(integer addr)
    Untaints an address. Returns true if the address is still tainted.
  • bool untaintMemory(MemoryAccess mem)
    Untaints a memory. Returns true if the memory is still tainted.
  • bool untaintRegister(Register reg)
    Untaints a register. Returns true if the register is still tainted.