Search for raw byte patterns (hex sequences, opcodes) in binary code. Use when looking for specific instruction sequences, machine code patterns, UEFI SMI handlers, or known vulnerability signatures by their byte representation.
中文简介正在准备中。当前显示原文说明。
查看安装方法安装前可以查看交给 AI 代理的指令内容。
Search for raw byte patterns (hex sequences) in binary code.
Using the VulHunt MCP tools, open the project (open_project) and run the following Lua query (query_project), adapting it as needed:
local result = project:search_code("<byte_pattern>")
if result then
local entry = {
function_address = tostring(result.function_address),
start_address = tostring(result.start_address),
end_address = tostring(result.end_address),
instructions = {},
}
for _, insn in ipairs(result.insns) do
table.insert(entry.instructions, {
mnemonic = insn.mnemonic,
address = tostring(insn.address),
})
end
return entry
end
The byte pattern is a hex string (e.g., "554889e5................", where .. matches any byte).
Returns a JSON object containing:
function_address - the address of the function containing the matchstart_address - the start address of the matched patternend_address - the end address of the matched patterninstructions - list of matched instructions with their mnemonics and addressesFor UEFI targets, additional functions and options are available:
-- Search code within sw_smi_handlers
local result = project:search_code("<byte_pattern>", "sw_smi_handlers")
-- Search code within child_sw_smi_handlers
local result = project:search_code("<byte_pattern>", "child_sw_smi_handlers")
-- Search for a protocol GUID (returns a boolean)
local guid_found = project:search_guid("5B1B31A1-9562-11D2-8E3F-00A0C969723B", "EFI_LOADED_IMAGE_PROTOCOL_GUID")
-- Search for an NVRAM variable (returns a boolean)
local nvram_found = project:search_nvram("GetVariable", "PlatformLang", "8BE4DF61-93CA-11D2-AA0D-00E098032B8C")
-- Search for a protocol (returns a boolean)
local protocol_found = project:search_protocol("LocateProtocol", "PCD_PROTOCOL_GUID", "11B34006-D85B-4D0A-A290-D5A571310EF7")
-- Search for a PPI (returns a boolean)
local ppi_found = project:search_ppi("LocatePpi", "PPIName", "9C21FD11-434A-12D3-D10D-109048052C8A")
NOTE: The architecture of the loaded binary can be obtained using
project.architecture.
URLs to additional documentation pages are available at https://vulhunt.re/llm.txt
/code-pattern-matching) - For higher-level semantic pattern matching in decompiled code, while byte-pattern-matching works at the raw instruction level/decompiler) - Decompile matched code to understand what the byte pattern represents还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Interact with the Binarly Transparency Platform (BTP) via CLI commands for uploading firmware, running scans, downloading BA2 archives, and pushing custom rules. Use when you need to interact with the Binarly Transparency Platform or working with BA2s.
中文简介正在准备中。当前显示原文说明。
Find all locations where functions are called in a binary. Use when analyzing callers of a function, checking call relationships, or identifying which functions invoke a specific API.
中文简介正在准备中。当前显示原文说明。
Search for code patterns in decompiled output using Weggli semantic matching. Use when finding vulnerable code constructs like unchecked memcpy, buffer operations, or specific function call patterns in pseudocode.
中文简介正在准备中。当前显示原文说明。
Track data flow between function parameters, calls, and arguments using taint analysis. Use when detecting vulnerabilities like command injection, buffer overflows, or tracing user input to dangerous functions.
中文简介正在准备中。当前显示原文说明。
Decompile a function to C-like pseudocode for human-readable analysis. Use to understand function logic, review control flow, or prepare for code pattern matching.
中文简介正在准备中。当前显示原文说明。
Find and list functions in a binary by name, address, regex, or byte pattern. Use as the starting point for binary analysis, to locate specific functions, or to enumerate all functions matching criteria.
中文简介正在准备中。当前显示原文说明。