Work with CPU architectures, registers, and instruction information
The Architecture class provides an interface to CPU architectures in Binary Ninja. It handles instruction disassembly, lifting to IL, register information, and architecture-specific operations.
from binaryninja import Architecture# Get architecture by namex86_64 = Architecture['x86_64']arm64 = Architecture['aarch64']mips = Architecture['mips32']# List all architecturesfor arch in Architecture: print(arch.name)# From a BinaryViewarch = bv.arch# From a functionarch = func.arch
# Get all registersfor reg_name, reg_info in arch.regs.items(): print(f"{reg_name}: {reg_info.size} bytes")# Get specific registerreg_info = arch.regs['rax']print(f"Size: {reg_info.size}")print(f"Offset: {reg_info.offset}")print(f"Index: {reg_info.index}")# Get register name from indexreg_name = arch.get_reg_name(0)# Stack pointersp_name = arch.stack_pointerprint(f"Stack pointer: {sp_name}")# Link register (if applicable)if arch.link_reg: print(f"Link register: {arch.link_reg}")# Global registersfor reg in arch.global_regs: print(f"Global: {reg}")
# Get all flagsfor flag_name in arch.flags: print(flag_name)# Get flag write typesfor write_type in arch.flag_write_types: print(write_type)# Get semantic flag classesfor flag_class in arch.semantic_flag_classes: print(flag_class)# Get semantic flag groups for flag_group in arch.semantic_flag_groups: print(flag_group)
# Get all intrinsicsfor intrinsic_name, intrinsic_info in arch.intrinsics.items(): print(f"{intrinsic_name}") print(f" Inputs: {intrinsic_info.inputs}") print(f" Outputs: {intrinsic_info.outputs}")# Get specific intrinsicintrinsic = arch.intrinsics['_cpuid']
# Get all calling conventionsfor cc in arch.calling_conventions: print(f"Calling convention: {cc.name}")# Get default calling conventiondefault_cc = arch.calling_conventions[0]# Get specific calling conventioncc = arch.get_calling_convention_by_name('cdecl')if cc: print(f"Int parameters: {cc.int_arg_regs}") print(f"Return register: {cc.int_return_reg}")
def enumerate_arch_features(arch_name): """Print all features of an architecture.""" arch = Architecture[arch_name] print(f"Architecture: {arch.name}") print(f" Address size: {arch.address_size} bytes") print(f" Endianness: {arch.endianness.name}") print(f" Max instruction: {arch.max_instr_length} bytes") print(f" Alignment: {arch.instr_alignment}") print(f" Stack pointer: {arch.stack_pointer}") if arch.link_reg: print(f" Link register: {arch.link_reg}") print(f"\n Registers ({len(arch.regs)}):") for name, info in sorted(arch.regs.items()): print(f" {name}: {info.size} bytes") print(f"\n Calling conventions ({len(arch.calling_conventions)}):") for cc in arch.calling_conventions: print(f" {cc.name}") print(f"\n Intrinsics ({len(arch.intrinsics)}):") for name in sorted(arch.intrinsics.keys())[:10]: print(f" {name}") if len(arch.intrinsics) > 10: print(f" ... and {len(arch.intrinsics) - 10} more")# Usageenumerate_arch_features('x86_64')
def disassemble_range(bv, start, end): """Disassemble instructions in a range.""" arch = bv.arch addr = start while addr < end: data = bv.read(addr, arch.max_instr_length) # Get instruction text tokens, length = arch.get_instruction_text(data, addr) if not tokens or length == 0: print(f"{addr:#x}: <invalid>") addr += 1 continue # Format instruction instr_text = ''.join(t.text for t in tokens) print(f"{addr:#x}: {instr_text}") addr += length# Usagedisassemble_range(bv, 0x401000, 0x401100)