Menu
Find and list functions in a binary by name, address, regex, or byte pattern. Use as the starting point for binary analysis, to locate specific functions, or to enumerate all functions matching criteria.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
| name | functions |
| description | Find and list functions in a binary by name, address, regex, or byte pattern. Use as the starting point for binary analysis, to locate specific functions, or to enumerate all functions matching criteria. |
Find and list functions in a binary by name, address, or pattern.
Using the VulHunt MCP tools, open the project (open_project) and run the following Lua query (query_project), adapting it as needed:
local fs = project:functions(<target_function>)
-- Single result (FunctionContext)
if type(fs) ~= "table" then
return {
function_name = tostring(fs.name),
function_address = tostring(fs.address),
function_total_bytes = tostring(fs.total_bytes)
}
end
-- Multiple results (FunctionContext[])
local results = {}
for _, f in ipairs(fs) do
table.insert(results, {
function_name = tostring(f.name),
function_address = tostring(f.address),
function_total_bytes = tostring(f.total_bytes)
})
end
return results
Possible values for <target_function>:
"system"AddressValue.new(0x1234){matching = "<regex>", kind = "symbol", all = true}{matching = "41544155", kind = "bytes", all = true}If no argument is passed to project:functions(), all functions are returned
allis a boolean. If set totrue, it returns a table containing all matching functions. Iffalse(default), it returns only the first matching value. The for loop is not necessary if the function target is only one (i.e.allis not set to true)
Returns a JSON object containing:
function_name is the function namefunction_address is the function addressfunction_total_bytes is the function length in bytes, calculated as the sum of the sizes of all its code blocksIt is also possible to get all functions satisfying certain criteria:
local function search_criteria(f)
return f:named(<target_call>) and f:has_call(<target_call>)
end
local fs = project:functions_where(search_criteria)
Possible values for <target_call>:
"system"AddressValue.new(<hex_addr>) (e.g., <hex_addr> = 0x1234){matching = "<regex>", kind = "symbol"}{matching = "41544155", kind = "bytes"}project<target_call> parameterURLs to additional documentation pages are available at https://vulhunt.re/llm.txt
/decompiler) - Decompile functions to understand their implementation and logic/call-sites) - Find where functions are called and analyze their usage patterns/byte-pattern-matching) - Alternative method to find functions by searching for specific instruction sequences/dataflow-analysis) - Track data flow within functions to detect vulnerabilitiesInteract with the Binarly Transparency Platform (BTP) via CLI commands for uploading firmware, running scans, downloading BA2 archives, and pushing custom rules. Use when you need to interact with the Binarly Transparency Platform or working with BA2s.
Search for raw byte patterns (hex sequences, opcodes) in binary code. Use when looking for specific instruction sequences, machine code patterns, UEFI SMI handlers, or known vulnerability signatures by their byte representation.
Find all locations where functions are called in a binary. Use when analyzing callers of a function, checking call relationships, or identifying which functions invoke a specific API.
Search for code patterns in decompiled output using Weggli semantic matching. Use when finding vulnerable code constructs like unchecked memcpy, buffer operations, or specific function call patterns in pseudocode.
Track data flow between function parameters, calls, and arguments using taint analysis. Use when detecting vulnerabilities like command injection, buffer overflows, or tracing user input to dangerous functions.
Decompile a function to C-like pseudocode for human-readable analysis. Use to understand function logic, review control flow, or prepare for code pattern matching.