[python api] All information about the Triton Context class

Description

libTriton offers Python bindings on top of its C++ API which allow you to build analysis in Python as well as in C++.

>>> from triton import TritonContext, ARCH
>>>
>>> ctx1 = TritonContext()
>>> ctx1.setArchitecture(ARCH.X86_64)
>>>
>>> ctx2 = TritonContext(ARCH.AARCH64)

Python API - Methods of the TritonContext class

Methods

void addCallback(CALLBACK kind, function cb)
Adds a callback at specific internal points. Your callback will be called each time the point is reached.
void assignSymbolicExpressionToMemory(SymbolicExpression symExpr, MemoryAccess mem)
Assigns a SymbolicExpression to a MemoryAccess area. Be careful, use this function only if you know what you are doing. The symbolic expression (symExpr) must be aligned to the memory access.
void assignSymbolicExpressionToRegister(SymbolicExpression symExpr, Register reg)
Assigns a SymbolicExpression to a Register. Be careful, use this function only if you know what you are doing. The symbolic expression (symExpr) must be aligned to the targeted size register. The register must be a parent register.
EXCEPTION buildSemantics(Instruction inst)
Builds the instruction semantics. Returns EXCEPTION.NO_FAULT if the instruction is supported.
void clearCallbacks(void)
Clears recorded callbacks.
void clearModes(void)
Clears recorded modes.
void clearConcreteMemoryValue(MemoryAccess mem)
Clears concrete values assigned to the memory cells.
void clearConcreteMemoryValue(integer addr, integer size)
Clears concrete values assigned to the memory cells from addr to addr + size.
void clearPathConstraints(void)
Clears the current path predicate.
void concretizeAllMemory(void)
Concretizes all symbolic memory references.
void concretizeAllRegister(void)
Concretizes all symbolic register references.
void concretizeMemory(integer addr)
Concretizes a specific symbolic memory reference.
void concretizeMemory(MemoryAccess mem)
Concretizes a specific symbolic memory reference.
void concretizeRegister(Register reg)
Concretizes a specific symbolic register reference.
SymbolicExpression createSymbolicMemoryExpression(Instruction inst, AstNode node, MemoryAccess mem, string comment)
Returns the new symbolic memory expression and links this expression to the instruction.
SymbolicExpression createSymbolicRegisterExpression(Instruction inst, AstNode node, Register reg, string comment)
Returns the new symbolic register expression and links this expression to the instruction.
SymbolicExpression createSymbolicVolatileExpression (Instruction inst, AstNode node, string comment)
Returns the new symbolic volatile expression and links this expression to the instruction.
void disassembly(Instruction inst)
Disassembles the instruction and sets up operands.
void disassembly(BasicBlock block, integer addr=0)
Disassembles a basic block with a potential given base address.
[Instruction, ...] disassembly(integer addr, integer count)
Disassembles a concrete memory area from addr and returns a list of at most count disassembled instructions.
BasicBlock disassembly(integer addr)
Disassembles a concrete memory area from addr to control flow instruction and returns a BasicBlock.
integer evaluateAstViaSolver(AstNode node)
Evaluates an AST via the solver and returns the concrete value.
[Register, ...] getAllRegisters(void)
Returns the list of all registers. Each item of this list is a Register.
ARCH getArchitecture(void)
Returns the current architecture used.
AstContext getAstContext(void)
Returns the AST context to create and modify nodes.
AST_REPRESENTATION getAstRepresentationMode(void)
Returns the current AST representation mode.
bytes getConcreteMemoryAreaValue(integer addr, integer size, bool callbacks=True)
Returns the concrete value of a memory area.
integer getConcreteMemoryValue(integer addr, bool callbacks=True)
Returns the concrete value of a memory cell.
integer getConcreteMemoryValue(MemoryAccess mem, bool callbacks=True)
Returns the concrete value of memory cells.
integer getConcreteRegisterValue(Register reg, bool callbacks=True)
Returns the concrete value of a register.
integer getConcreteVariableValue(SymbolicVariable symVar)
Returns the concrete value of a symbolic variable.
integer getGprBitSize(void)
Returns the size in bits of the General Purpose Registers.
integer getGprSize(void)
Returns the size in bytes of the General Purpose Registers.
AstNode getImmediateAst(Immediate imm)
Returns the AST corresponding to the Immediate.
AstNode getMemoryAst(MemoryAccess mem)
Returns the AST corresponding to the MemoryAccess with the SSA form.
dict getModel(AstNode node, bool status=False, integer timeout=0)
Computes and returns a model as a dictionary of {integer symVarId : SolverModel model} from a symbolic constraint. If status is True, returns a tuple of (dict model, SOLVER_STATE status, integer solvingTime).
[dict, ...] getModels(AstNode node, integer limit, bool status=False, integer timeout=0)
Computes and returns several models from a symbolic constraint. The limit is the number of models returned. If status is True, returns a tuple of ([dict model, ...], SOLVER_STATE status, integer solvingTime).
Register getParentRegister(Register reg)
Returns the parent Register from a Register.
[Register, ...] getParentRegisters(void)
Returns the list of parent registers. Each item of this list is a Register.
[PathConstraint, ...] getPathConstraints(void)
Returns the logical conjunction vector of path constraints as a list of PathConstraint.
AstNode getPathPredicate(void)
Returns the current path predicate as an AST of logical conjunction of each taken branch.
integer getPathPredicateSize(void)
Returns the size of the path predicate (number of constraints).
[AstNode, ...] getPredicatesToReachAddress(integer addr)
Returns path predicates which may reach the targeted address.
Register getRegister(REG id)
Returns the Register class corresponding to a REG id.
Register getRegister(string name)
Returns the Register class corresponding to a string.
AstNode getRegisterAst(Register reg)
Returns the AST corresponding to the Register with the SSA form.
SOLVER getSolver(void)
Returns the SMT solver engine currently used.
SymbolicExpression getSymbolicExpression(integer symExprId)
Returns the symbolic expression corresponding to an id.
dict getSymbolicExpressions(void)
Returns all symbolic expressions as a dictionary of {integer SymExprId : SymbolicExpression expr}.
dict getSymbolicMemory(void)
Returns the map of symbolic memory as {integer address : SymbolicExpression expr}.
SymbolicExpression getSymbolicMemory(integer addr)
Returns the SymbolicExpression corresponding to a memory address.
integer getSymbolicMemoryValue(integer addr)
Returns the symbolic memory value.
integer getSymbolicMemoryValue(MemoryAccess mem)
Returns the symbolic memory value.
dict getSymbolicRegisters(void)
Returns the map of symbolic registers as {REG reg : SymbolicExpression expr}.
SymbolicExpression getSymbolicRegister(Register reg)
Returns the SymbolicExpression corresponding to the parent register.
integer getSymbolicRegisterValue(Register reg)
Returns the symbolic register value.
SymbolicVariable getSymbolicVariable(integer symVarId)
Returns the symbolic variable corresponding to a symbolic variable id.
SymbolicVariable getSymbolicVariable(string symVarName)
Returns the symbolic variable corresponding to a symbolic variable name.
dict getSymbolicVariables(void)
Returns all symbolic variables as a dictionary of {integer SymVarId : SymbolicVariable var}.
[integer, ...] getTaintedMemory(void)
Returns the list of all tainted addresses.
[Register, ...] getTaintedRegisters(void)
Returns the list of all tainted registers.
[SymbolicExpression, ...] getTaintedSymbolicExpressions(void)
Returns the list of all tainted symbolic expressions.
bool isArchitectureValid(void)
Returns true if the architecture is valid.
bool isConcreteMemoryValueDefined(MemoryAccess mem)
Returns true if memory cells have a defined concrete value.
bool isConcreteMemoryValueDefined(integer addr, integer size)
Returns true if memory cells have a defined concrete value.
bool isFlag(Register reg)
Returns true if the register is a flag.
bool isMemorySymbolized(integer addr)
Returns true if the memory cell expression contains a symbolic variable.
bool isMemorySymbolized(MemoryAccess mem)
Returns true if memory cell expressions contain symbolic variables.
bool isMemoryTainted(integer addr)
Returns true if the address is tainted.
bool isMemoryTainted(MemoryAccess mem)
Returns true if the memory is tainted.
bool isModeEnabled(MODE mode)
Returns true if the mode is enabled.
bool isRegister(Register reg)
Returns true if the register is a register (see also isFlag()).
bool isRegisterSymbolized(Register reg)
Returns true if the register expression contains a symbolic variable.
bool isRegisterTainted(Register reg)
Returns true if the register is tainted.
bool isRegisterValid(Register reg)
Returns true if the register is valid.
bool isSat(AstNode node)
Returns true if an expression is satisfiable.
bool isSymbolicExpressionExists(integer symExprId)
Returns true if the symbolic expression id exists.
bool isThumb(void)
Returns true if execution mode is Thumb (only valid for ARM32).
string liftToDot(AstNode node)
Lifts an AST and all its references to Dot format.
string liftToDot(SymbolicExpression expr)
Lifts a symbolic expression and all its references to Dot format.
string liftToLLVM(AstNode node, string fname="__triton", bool optimize=False)
Lifts an AST node and all its references to LLVM IR. fname is the name of the LLVM function, by default it's __triton. If optimize is true, perform optimizations (-O3 -Oz).
string liftToLLVM(SymbolicExpression expr, string fname="__triton", bool optimize=False)
Lifts a symbolic expression and all its references to LLVM IR. fname is the name of the LLVM function, by default it's __triton. If optimize is true, perform optimizations (-O3 -Oz).
string liftToPython(SymbolicExpression expr, bool icomment=False)
Lifts a symbolic expression and all its references to Python format. If icomment is true, then print instructions assembly in expression comments.
string liftToSMT(SymbolicExpression expr, bool assert_=False, bool icomment=False)
Lifts a symbolic expression and all its references to SMT format. If assert_ is true, then (assert <expr>). If icomment is true, then print instructions assembly in expression comments.
SymbolicExpression newSymbolicExpression(AstNode node, string comment)
Returns a new symbolic expression. Note that if there are simplification passes recorded, simplifications will be applied.
SymbolicVariable newSymbolicVariable(integer varSize, string alias)
Returns a new symbolic variable.
void popPathConstraint(void)
Pops the last constraints added to the path predicate.
EXCEPTION processing(Instruction inst)
Processes an instruction and updates engines according to the instruction semantics. Returns EXCEPTION.NO_FAULT if the instruction is supported.
EXCEPTION processing(BasicBlock block, integer addr=0)
Processes a basic block with a potential given base address and updates engines according to the instructions semantics.
void pushPathConstraint(AstNode node, string comment="")
Pushs constraints to the current path predicate.
void removeCallback(CALLBACK kind, function cb)
Removes a recorded callback.
void reset(void)
Resets everything.
void setArchitecture(ARCH arch)
Initializes an architecture. This function must be called before any call to the rest of the API.
void setAstRepresentationMode(AST_REPRESENTATION mode)
Sets the AST representation.
void setConcreteMemoryAreaValue(integer addr, [integer,], bool callbacks=True)
Sets the concrete value of a memory area. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
void setConcreteMemoryAreaValue(integer addr, bytes opcodes, bool callbacks=True)
Sets the concrete value of a memory area. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
void setConcreteMemoryValue(integer addr, integer value, bool callbacks=True)
Sets the concrete value of a memory cell. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
void setConcreteMemoryValue(MemoryAccess mem, integer value, bool callbacks=True)
Sets the concrete value of memory cells. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
void setConcreteRegisterValue(Register reg, integer value, bool callbacks=True)
Sets the concrete value of a register. Note that setting a concrete value will probably imply a desynchronization with the symbolic state (if it exists). You should probably use the concretize functions after this.
void setConcreteVariableValue(SymbolicVariable symVar, integer value)
Sets the concrete value of a symbolic variable.
void setMode(MODE mode, bool flag)
Enables or disables a specific mode.
void setSolver(SOLVER solver)
Defines an SMT solver
void setSolverMemoryLimit(integer megabytes)
Defines a solver memory consumption limit (in megabytes)
void setSolverTimeout(integer ms)
Defines a solver timeout (in milliseconds)
bool setTaintMemory(MemoryAccess mem, bool flag)
Sets the targeted memory as tainted or not. Returns true if the memory is still tainted.
bool setTaintRegister(Register reg, bool flag)
Sets the targeted register as tainted or not. Returns true if the register is still tainted.
void setThumb(bool state)
Sets CPU state to Thumb mode (only valid for ARM32).
AstNode simplify(AstNode node, bool solver=False, bool llvm=False)
Calls all simplification callbacks recorded and returns a new simplified node. If the solver flag is set to True, Triton will use the current solver instance to simplify the given node. If llvm is true, we use LLVM to simplify node.
BasicBlock simplify(BasicBlock block, bool padding=False)
Performs a dead store elimination simplification on a given block. If padding is true, keep addresses aligned and padds with NOP instructions.
dict sliceExpressions(SymbolicExpression expr)
Slices expressions from a given one (backward slicing) and returns all symbolic expressions as a dictionary of {integer SymExprId : SymbolicExpression expr}.
SymbolicVariable symbolizeExpression(integer symExprId, integer symVarSize, string symVarAlias)
Converts a symbolic expression to a symbolic variable. symVarSize must be in bits. This function returns the new symbolic variable created.
SymbolicVariable symbolizeMemory(MemoryAccess mem, string symVarAlias)
Converts a symbolic memory expression to a symbolic variable. This function returns the new symbolic variable created.
SymbolicVariable symbolizeRegister(Register reg, string symVarAlias)
Converts a symbolic register expression to a symbolic variable. This function returns the new symbolic variable created.
AstNode synthesize(AstNode node, bool constant=True, bool subexpr=True, bool opaque=False)
Synthesizes a given node. If constant is defined to True, performs a constant synthesis. If opaque is true, perform opaque constant synthesis. If subexpr is defined to True, performs synthesis on sub-expressions.
bool taintAssignment(MemoryAccess memDst, Immediate immSrc)
Taints memDst from immSrc with an assignment - memDst is untained. Returns true if the memDst is still tainted.
bool taintAssignment(MemoryAccess memDst, MemoryAccess memSrc)
Taints memDst from memSrc with an assignment - memDst is tainted if memSrc is tainted, otherwise memDst is untained. Returns true if memDst is tainted.
bool taintAssignment(MemoryAccess memDst, Register regSrc)
Taints memDst from regSrc with an assignment - memDst is tainted if regSrc is tainted, otherwise memDst is untained. Return true if memDst is tainted.
bool taintAssignment(Register regDst, Immediate immSrc)
Taints regDst from immSrc with an assignment - regDst is untained. Returns true if reDst is still tainted.
bool taintAssignment(Register regDst, MemoryAccess memSrc)
Taints regDst from MemSrc with an assignment - regDst is tainted if memSrc is tainted, otherwise regDst is untained. Return true if regDst is tainted.
bool taintAssignment(Register regDst, Register regSrc)
Taints regDst from regSrc with an assignment - regDst is tainted if regSrc is tainted, otherwise regDst is untained. Return true if regDst is tainted.
bool taintMemory(integer addr)
Taints an address. Returns true if the address is tainted.
bool taintMemory(MemoryAccess mem)
Taints a memory. Returns true if the memory is tainted.
bool taintRegister(Register reg)
Taints a register. Returns true if the register is tainted.
bool taintUnion(MemoryAccess memDst, Immediate immSrc)
Taints memDst from immSrc with an union - memDst does not changes. Returns true if memDst is tainted.
bool taintUnion(MemoryAccess memDst, MemoryAccess memSrc)
Taints memDst from memSrc with an union - memDst is tainted if memDst or memSrc are tainted. Returns true if memDst is tainted.
bool taintUnion(MemoryAccess memDst, Register regSrc)
Taints memDst from RegSrc with an union - memDst is tainted if memDst or regSrc are tainted. Returns true if memDst is tainted.
bool taintUnion(Register regDst, Immediate immSrc)
Taints regDst from immSrc with an union - regDst does not changes. Returns true if regDst is tainted.
bool taintUnion(Register regDst, MemoryAccess memSrc)
Taints regDst from memSrc with an union - regDst is tainted if regDst or memSrc are tainted. Returns true if regDst is tainted.
bool taintUnion(Register regDst, Register regSrc)
Taints regDst from regSrc with an union - regDst is tainted if regDst or regSrc are tainted. Returns true if regDst is tainted.
bool untaintMemory(integer addr)
Untaints an address. Returns true if the address is still tainted.
bool untaintMemory(MemoryAccess mem)
Untaints a memory. Returns true if the memory is still tainted.
bool untaintRegister(Register reg)
Untaints a register. Returns true if the register is still tainted.