mate_query.cpg.models.node.ast.bin module

Nodes in the x86_64 binary AST.

At runtime, the models here are accessed via attributes on a CPG, not directly.

class mate_query.cpg.models.node.ast.bin.ASMBlock(uuid: str, kind: NodeKind, attributes: Dict[str, Any] = {})

Bases: mate_query.cpg.models.node._typechecking.NodeMixin

A basic block in the x86_64 binary

Parameters

  • uuid (str) –

  • kind (NodeKind) –

  • attributes (Dict[str, Any]) –

property entry: sqlalchemy.orm.relationships.RelationshipProperty

Returns the entry ASMInst for this block.

filename
Return type

str

func_offset
Return type

int

func_reference
Return type

str

property instructions: sqlalchemy.orm.relationships.RelationshipProperty

Returns a sequence of every ASMInst in this block.

offset
Return type

int

pretty_string
Return type

str

size

The size of this basic block, in bytes

Return type

int

source
Return type

list

property terminator: sqlalchemy.orm.relationships.RelationshipProperty

Returns the terminating ASMInst for this block.

unpaired
Return type

bool

va
Return type

int

va_end
Return type

int

class mate_query.cpg.models.node.ast.bin.ASMGlobalVariable(uuid: str, kind: NodeKind, attributes: Dict[str, Any] = {})

Bases: mate_query.cpg.models.node._typechecking.NodeMixin

A program global variable at the binary level

Parameters

  • uuid (str) –

  • kind (NodeKind) –

  • attributes (Dict[str, Any]) –

definition

Indicates whether this visitation of the global variable is a definition

Return type

bool

definition_location

A definition location for a global variable in a source-language file

Return type

dict

dwarf_location

Location of this variable in memory, expressed as either an absolute address or an offset from a register

Return type

list

property dwarf_type: sqlalchemy.orm.relationships.RelationshipProperty

Returns the DWARFType for this global variable.

local_to_unit

Indicates whether or not this global variable is local to this translation unit

Return type

bool

name

The source-level name of this global variable

Return type

str

pretty_string
Return type

str

source_scope

Source scoping information using DWARF

Return type

dict

thread_local
Return type

bool

type_id
Return type

str

va
Return type

int

class mate_query.cpg.models.node.ast.bin.ASMInst(uuid: str, kind: NodeKind, attributes: Dict[str, Any] = {})

Bases: mate_query.cpg.models.node._typechecking.NodeMixin

An x86_64 instruction in the binary, including layout and semantic information

Parameters

  • uuid (str) –

  • kind (NodeKind) –

  • attributes (Dict[str, Any]) –

asm

The disassembled instruction, in Intel format

Return type

str

mnemonic

The assembly mnemonic for this instruction

Return type

str

pretty_string
Return type

str

size

The decoded size of this instruction, in bytes

Return type

int

property used_memory: List[mate_common.models.cpg_types.bin.UsedMemory]

Returns a sequence of UsedMemory for each discrete memory access in this instruction.

property used_registers: List[mate_common.models.cpg_types.bin.UsedRegister]

Returns a sequence of UsedRegister for each register used by this instruction.

va
Return type

int

class mate_query.cpg.models.node.ast.bin.PLTStub(uuid: str, kind: NodeKind, attributes: Dict[str, Any] = {})

Bases: mate_query.cpg.models.node._typechecking.NodeMixin

A stub for a function that’s accessed through the binary’s Procedure Linkage Table

Parameters

  • uuid (str) –

  • kind (NodeKind) –

  • attributes (Dict[str, Any]) –

symbol

The linker symbol for this PLT entry

Return type

str

va

The virtual address of this PLT entry

Return type

int

property vtables: sqlalchemy.orm.relationships.RelationshipProperty

Returns a sequence of VTable instances associated with this PLT stub.

class mate_query.cpg.models.node.ast.bin.VTable(uuid: str, kind: NodeKind, attributes: Dict[str, Any] = {})

Bases: mate_query.cpg.models.node._typechecking.NodeMixin

A virtual table for a C++ class

Parameters

  • uuid (str) –

  • kind (NodeKind) –

  • attributes (Dict[str, Any]) –

class_name

The name of the C++ class that this virtual table belongs to

Return type

str

members

The virtual addresses for each entry in the virtual table

Return type

list

rtti_va

The virtual address to the RTTI entry for this virtual table

Return type

int

size

The size of the virtual table, in bytes. This includes the RTTI and ‘offset to base’ fields

Return type

int

symbol

The linker symbol for this virtual table

Return type

str

va

The virtual address for the virtual table itself

Return type

int