LocalClient API Reference

May 5, 2026 ยท View on GitHub

Reference for the libghidra C++ LocalClient in the 0.0.1 release -- an offline binary analysis engine embedding Ghidra's Sleigh decompiler. No Java, no network, no running Ghidra instance required.

Overview

LocalClient implements the shared IClient surface backed by Ghidra's C++ decompiler engine, with unsupported live-Ghidra concepts returning NOT_SUPPORTED. It supports decompilation, function/symbol/type queries, memory read/write, instruction disassembly, comments, data items, cross-references, and basic block/CFG extraction.

All methods return StatusOr<T> -- check .ok(), then access .value.

Out of scope: program-wide enumeration

IClient is the shared API for both HttpClient (talks to a running Ghidra instance) and LocalClient (this header โ€” standalone C++ decompiler). Methods that enumerate everything in the analyzed program โ€” ListFunctions, ListBasicBlocks, ListCfgEdges, ListXrefs, ListDefinedStrings โ€” only have meaningful semantics on top of Ghidra's analysis pass, which runs in the Java side of the live host. The standalone decompiler does not run an analysis pass, so those calls always return empty results in local mode by design. Drive LocalClient with explicit addresses (GetDecompilation(addr), ListInstructions(start, end), ReadBytes(addr, n), RenameFunction(addr, name)); if you need program-wide enumeration, route the call through HttpClient against a Ghidra host.

Quick Start

#include "libghidra/ghidra.hpp"

auto client = ghidra::local({});

ghidra::OpenRequest req;
req.program_path = "/path/to/binary.exe";
auto r = client->OpenProgram(req);
if (!r.ok()) { /* handle error */ }

auto decomp = client->GetDecompilation(0x140001000, 30000);
if (decomp.ok() && decomp.value->decompilation)
    printf("%s\n", decomp.value->decompilation->pseudocode.c_str());

Factory & Options

ghidra::local(opts) / CreateLocalClient(opts)

auto client = ghidra::local({
    .ghidra_root  = "",              // Ghidra source tree (empty = embedded specs)
    .state_path   = "state.xml",     // XML persistence (empty = disabled)
    .default_arch = "x86:LE:64:default",  // Sleigh ID (empty = auto-detect)
    .pool_size    = 4,               // Parallel decompiler slots (default: 1)
});
FieldTypeDefaultDescription
ghidra_rootstring""Path to Ghidra source tree for .sla/.pspec/.cspec files. Empty uses embedded specs.
state_pathstring""Path for auto-save/load of analysis state (XML). Empty disables persistence.
default_archstring""Sleigh language ID hint (e.g. "x86:LE:64:default"). Empty auto-detects from binary format.
pool_sizeint1Number of independent decompiler instances for parallel work. Each loads the binary separately.

Type aliases:

  • ghidra::Client = IClient
  • ghidra::LocalOptions = LocalClientOptions
  • ghidra::OpenRequest = OpenProgramRequest
  • ghidra::Result<T> = StatusOr<T>

Error Handling

Every method returns StatusOr<T>:

auto result = client->ListFunctions(0, UINT64_MAX, 0, 0);
if (!result.ok()) {
    // result.status.code    -- error code (e.g. "NOT_SUPPORTED", "INVALID_ARGUMENT")
    // result.status.message -- human-readable description
    return;
}
// result.value is std::optional<T>, guaranteed non-empty when ok() is true
for (auto& f : result.value->functions) { ... }

Common error codes:

  • "NOT_SUPPORTED" -- method not implemented by this backend
  • "INVALID_ARGUMENT" -- bad parameters (e.g. unknown type name)
  • "NOT_FOUND" -- entity not found at the given address/name

Session

Live HttpClient/headless sessions also expose project lifecycle helpers: OpenProject, CloseProject, ListProjectFiles, and ImportProgram. Those methods are intentionally NOT_SUPPORTED by LocalClient, because the offline backend loads one program database rather than a full Ghidra project.

For live project workflows, list or import project programs first, then switch the active program with CloseProgram(ShutdownPolicy::kSave) followed by OpenProgram({.project_path = ..., .project_name = ..., .program_path = "/domain/path"}). See examples/list_project_files.cpp and examples/switch_active_program.cpp.

OpenProgram

StatusOr<OpenProgramResponse> OpenProgram(const OpenProgramRequest& request)

Opens a binary for analysis. Must be called before any query methods.

ghidra::OpenRequest req;
req.program_path = "/path/to/binary.exe";
auto r = client->OpenProgram(req);
// r.value->program_name   -- detected program name
// r.value->language_id    -- Sleigh language (e.g. "x86:LE:64:default")
// r.value->compiler_spec  -- compiler spec (e.g. "windows")
// r.value->image_base     -- loaded image base address
FieldTypeDescription
program_pathstringPath to binary file (required)
project_pathstringUnused by LocalClient
project_namestringUnused by LocalClient
analyzeboolUnused by LocalClient
read_onlyboolUnused by LocalClient

CloseProgram

StatusOr<CloseProgramResponse> CloseProgram(ShutdownPolicy policy)

Closes the current program. Pass ShutdownPolicy::kSave to save state first, kDiscard to abandon changes.

SaveProgram

StatusOr<SaveProgramResponse> SaveProgram()

Saves analysis state to state_path (if configured). Includes renames, types, and other mutations.

DiscardProgram

StatusOr<DiscardProgramResponse> DiscardProgram()

Discards all unsaved mutations since last save.

GetRevision

StatusOr<RevisionResponse> GetRevision()

Returns native freshness metadata for the current Ghidra program. modification_number is Ghidra's own Program.getModificationNumber() value, while program_id and path/file metadata disambiguate program switches.

auto rev = client->GetRevision();
uint64_t id = rev.value->program_id;
uint64_t n = rev.value->modification_number;

GetStatus

StatusOr<HealthStatus> GetStatus()

Returns backend status information.

auto s = client->GetStatus();
// s.value->service_name     -- "libghidra-local"
// s.value->service_version  -- version string
// s.value->host_mode        -- "local"
// s.value->modification_number -- native Ghidra modification number

GetCapabilities

StatusOr<std::vector<Capability>> GetCapabilities()

Lists all capabilities with their support status ("supported", "not_supported").

auto caps = client->GetCapabilities();
for (auto& c : *caps.value) {
    printf("%s: %s\n", c.id.c_str(), c.status.c_str());
    // c.note -- optional explanation
}

Shutdown

StatusOr<ShutdownResponse> Shutdown(ShutdownPolicy policy)

Shuts down the client. Equivalent to CloseProgram for the local backend.

Decompiler

GetDecompilation

StatusOr<GetDecompilationResponse> GetDecompilation(uint64_t address, int timeout_ms)

Decompiles the function at address. This is a prerequisite for signature, xref, and basic block data.

auto d = client->GetDecompilation(0x140001000, 30000);
if (d.ok() && d.value->decompilation) {
    auto& dec = *d.value->decompilation;
    // dec.pseudocode            -- C-like source
    // dec.function_name         -- function name
    // dec.prototype             -- function prototype
    // dec.function_entry_address
    // dec.completed             -- true if decompilation succeeded
    // dec.error_message         -- non-empty on failure
}

ListDecompilations

StatusOr<ListDecompilationsResponse> ListDecompilations(
    uint64_t range_start, uint64_t range_end, int limit, int offset, int timeout_ms)

Batch-decompiles all functions in the address range. Uses the decompiler pool for parallel execution when pool_size > 1.

auto client = ghidra::local({.pool_size = 4});
// ... open program ...
auto ds = client->ListDecompilations(0, 0, 0, 0, 60000);
for (auto& d : ds.value->decompilations) {
    if (d.completed) printf("%s: %zu bytes\n", d.function_name.c_str(), d.pseudocode.size());
}

Pass range_start = 0, range_end = 0 for all functions.

Functions

GetFunction

StatusOr<GetFunctionResponse> GetFunction(uint64_t address)

Gets a single function by entry address.

auto f = client->GetFunction(0x140001000);
if (f.ok() && f.value->function) {
    // f.value->function->name, entry_address, start_address, end_address, size
    // f.value->function->prototype, parameter_count, is_thunk, namespace_name
}

ListFunctions

StatusOr<ListFunctionsResponse> ListFunctions(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Lists functions in an address range. limit=0 returns all. range_start=0, range_end=UINT64_MAX covers everything.

auto funcs = client->ListFunctions(0, UINT64_MAX, 10, 0);
for (auto& f : funcs.value->functions) {
    printf("0x%llx  %s  (%u bytes)\n", f.entry_address, f.name.c_str(), (unsigned)f.size);
}

RenameFunction

StatusOr<RenameFunctionResponse> RenameFunction(uint64_t address, const string& new_name)

Renames the function at address. Increments revision.

ListBasicBlocks

StatusOr<ListBasicBlocksResponse> ListBasicBlocks(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Extracts basic blocks for functions in the range. Requires prior decompilation.

auto blocks = client->ListBasicBlocks(func.start_address, func.end_address, 0, 0);
for (auto& b : blocks.value->blocks) {
    // b.function_entry, b.start_address, b.end_address, b.in_degree, b.out_degree
}

Note: Basic blocks do not survive clearAnalysis() -- they are extracted during decompilation.

ListCFGEdges

StatusOr<ListCFGEdgesResponse> ListCFGEdges(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Extracts control flow graph edges for functions in the range. Requires prior decompilation.

auto edges = client->ListCFGEdges(func.start_address, func.end_address, 0, 0);
for (auto& e : edges.value->edges) {
    // e.function_entry, e.src_block_start, e.dst_block_start, e.edge_kind
}

Memory

ReadBytes

StatusOr<ReadBytesResponse> ReadBytes(uint64_t address, uint32_t length)

Reads raw bytes from the program image. After WriteBytes, returns patched data from the CoW overlay.

auto r = client->ReadBytes(0x140001000, 32);
for (auto b : r.value->data) printf("%02x ", b);

WriteBytes

StatusOr<WriteBytesResponse> WriteBytes(uint64_t address, const vector<uint8_t>& data)

Writes bytes via a Copy-on-Write overlay. The original binary is never modified; patches are layered on top. Installed lazily on first write.

auto w = client->WriteBytes(0x140001000, {0x90, 0x90, 0x90, 0x90});
printf("Wrote %u bytes\n", w.value->bytes_written);

Note: Writes go through the primary decompiler slot only. Each pool slot would need its own overlay for thread safety.

PatchBytesBatch

StatusOr<PatchBytesBatchResponse> PatchBytesBatch(const vector<BytePatch>& patches)

Applies multiple patches atomically.

libghidra::client::BytePatch p1{0x1000, {0x90, 0x90}};
libghidra::client::BytePatch p2{0x2000, {0xCC}};
auto r = client->PatchBytesBatch({p1, p2});
printf("Applied %u patches, %u bytes\n", r.value->patch_count, r.value->bytes_written);

ListMemoryBlocks

StatusOr<ListMemoryBlocksResponse> ListMemoryBlocks(int limit, int offset)

Lists memory blocks (segments) with permissions.

auto blocks = client->ListMemoryBlocks(0, 0);
for (auto& b : blocks.value->blocks) {
    printf("%s  0x%llx-0x%llx  %c%c%c\n",
           b.name.c_str(), b.start_address, b.end_address,
           b.is_read ? 'R' : '-', b.is_write ? 'W' : '-', b.is_execute ? 'X' : '-');
}

Symbols

GetSymbol

StatusOr<GetSymbolResponse> GetSymbol(uint64_t address)

Gets the primary symbol at an address.

auto s = client->GetSymbol(0x140001000);
if (s.ok() && s.value->symbol) {
    // s.value->symbol->name, address, type, namespace_name, source
    // s.value->symbol->is_primary, is_external, is_dynamic, symbol_id
}

ListSymbols

StatusOr<ListSymbolsResponse> ListSymbols(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Lists symbols in an address range.

RenameSymbol

StatusOr<RenameSymbolResponse> RenameSymbol(uint64_t address, const string& new_name)

Renames the symbol at address. For function symbols, delegates to RenameFunction.

DeleteSymbol

StatusOr<DeleteSymbolResponse> DeleteSymbol(uint64_t address, const string& name_filter)

Deletes symbols at address matching name_filter.

Types

Querying Types

GetType

StatusOr<GetTypeResponse> GetType(const string& path)

Gets a type by name or path (e.g. "int", "my_struct_t").

auto t = client->GetType("int");
// t.value->type->name, kind, length, type_id, path_name, display_name

ListTypes

StatusOr<ListTypesResponse> ListTypes(const string& query, int limit, int offset)

Lists all types. Pass empty query for no filter.

ListTypeAliases

StatusOr<ListTypeAliasesResponse> ListTypeAliases(const string& query, int limit, int offset)

Lists typedef aliases. Each alias has name, target_type, declaration.

ListTypeEnums

StatusOr<ListTypeEnumsResponse> ListTypeEnums(const string& query, int limit, int offset)

Lists enum types. Each has name, width, is_signed, declaration.

ListTypeUnions

StatusOr<ListTypeUnionsResponse> ListTypeUnions(const string& query, int limit, int offset)

Lists union types. Each has name, size, declaration.

Struct Operations

CreateType

StatusOr<CreateTypeResponse> CreateType(const string& name, const string& kind, uint64_t size)

Creates a new type. kind is "struct" for structs.

client->CreateType("packet_t", "struct", 16);

AddTypeMember

StatusOr<AddTypeMemberResponse> AddTypeMember(
    const string& parent_type, const string& member_name,
    const string& member_type, uint64_t size)

Appends a field to a struct via read-modify-write internally.

client->AddTypeMember("packet_t", "magic", "uint", 4);
client->AddTypeMember("packet_t", "flags", "byte", 1);

ListTypeMembers

StatusOr<ListTypeMembersResponse> ListTypeMembers(
    const string& type_id_or_path, int limit, int offset)

Lists struct fields with ordinal, name, member_type, offset, size, comment.

RenameTypeMember

StatusOr<RenameTypeMemberResponse> RenameTypeMember(
    const string& parent_type, uint64_t ordinal, const string& new_name)

Renames a struct field by ordinal (0-based).

SetTypeMemberType

StatusOr<SetTypeMemberTypeResponse> SetTypeMemberType(
    const string& parent_type, uint64_t ordinal, const string& member_type)

Changes a struct field's type by ordinal.

SetTypeMemberComment

StatusOr<SetTypeMemberCommentResponse> SetTypeMemberComment(
    const string& parent_type, uint64_t ordinal, const string& comment)

Sets a comment on a struct field.

DeleteTypeMember

StatusOr<DeleteTypeMemberResponse> DeleteTypeMember(
    const string& parent_type, uint64_t ordinal)

Deletes a struct field by ordinal.

Enum Operations

CreateTypeEnum

StatusOr<CreateTypeEnumResponse> CreateTypeEnum(
    const string& name, uint64_t width, bool is_signed)

Creates an enum type.

client->CreateTypeEnum("error_code_t", 4, false);  // 4-byte unsigned

AddTypeEnumMember

StatusOr<AddTypeEnumMemberResponse> AddTypeEnumMember(
    const string& type, const string& name, int64_t value)

Adds a named value to an enum.

ListTypeEnumMembers

StatusOr<ListTypeEnumMembersResponse> ListTypeEnumMembers(
    const string& type_id_or_path, int limit, int offset)

Lists enum values with ordinal, name, value, comment.

RenameTypeEnumMember

StatusOr<RenameTypeEnumMemberResponse> RenameTypeEnumMember(
    const string& type, uint64_t ordinal, const string& new_name)

SetTypeEnumMemberValue

StatusOr<SetTypeEnumMemberValueResponse> SetTypeEnumMemberValue(
    const string& type, uint64_t ordinal, int64_t value)

SetTypeEnumMemberComment

StatusOr<SetTypeEnumMemberCommentResponse> SetTypeEnumMemberComment(
    const string& type, uint64_t ordinal, const string& comment)

DeleteTypeEnumMember

StatusOr<DeleteTypeEnumMemberResponse> DeleteTypeEnumMember(
    const string& type, uint64_t ordinal)

DeleteTypeEnum

StatusOr<DeleteTypeEnumResponse> DeleteTypeEnum(const string& type_id_or_path)

Type Aliases

CreateTypeAlias

StatusOr<CreateTypeAliasResponse> CreateTypeAlias(
    const string& name, const string& target_type)

Creates a typedef alias.

client->CreateTypeAlias("DWORD", "uint");

SetTypeAliasTarget

StatusOr<SetTypeAliasTargetResponse> SetTypeAliasTarget(
    const string& type_id_or_path, const string& target_type)

Retargets an existing alias.

DeleteTypeAlias

StatusOr<DeleteTypeAliasResponse> DeleteTypeAlias(const string& type_id_or_path)

Type Lifecycle

RenameType

StatusOr<RenameTypeResponse> RenameType(
    const string& type_id_or_path, const string& new_name)

Renames any type in-place.

DeleteType

StatusOr<DeleteTypeResponse> DeleteType(const string& type_id_or_path)

Deletes a type. Throws on core/built-in types.

Function Signatures

GetFunctionSignature

StatusOr<GetFunctionSignatureResponse> GetFunctionSignature(uint64_t address)

Gets the full signature for a function. Requires prior decompilation.

auto sig = client->GetFunctionSignature(addr);
if (sig.ok() && sig.value->signature) {
    auto& s = *sig.value->signature;
    // s.prototype, s.return_type, s.calling_convention, s.has_var_args
    for (auto& p : s.parameters) {
        // p.ordinal, p.name, p.data_type, p.is_auto_parameter
    }
}

ListFunctionSignatures

StatusOr<ListFunctionSignaturesResponse> ListFunctionSignatures(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Lists signatures for all functions in range. Requires prior decompilation.

SetFunctionSignature

StatusOr<SetFunctionSignatureResponse> SetFunctionSignature(
    uint64_t address, const string& prototype)

Sets a function's prototype string.

client->SetFunctionSignature(0x1000, "int process_packet(int flags)");

RenameFunctionParameter

StatusOr<RenameFunctionParameterResponse> RenameFunctionParameter(
    uint64_t address, int ordinal, const string& new_name)

Renames a parameter by ordinal (0-based).

SetFunctionParameterType

StatusOr<SetFunctionParameterTypeResponse> SetFunctionParameterType(
    uint64_t address, int ordinal, const string& data_type)

Changes a parameter's type by ordinal.

RenameFunctionLocal

StatusOr<RenameFunctionLocalResponse> RenameFunctionLocal(
    uint64_t address, const string& local_id, const string& new_name)

Renames a local variable by its identifier.

SetFunctionLocalType

StatusOr<SetFunctionLocalTypeResponse> SetFunctionLocalType(
    uint64_t address, const string& local_id, const string& data_type)

Changes a local variable's type.

Listing

Instructions

GetInstruction

StatusOr<GetInstructionResponse> GetInstruction(uint64_t address)

Gets a single instruction at an address.

auto insn = client->GetInstruction(0x140001000);
if (insn.ok() && insn.value->instruction) {
    auto& i = *insn.value->instruction;
    // i.address, i.mnemonic, i.operand_text, i.disassembly, i.length
}

ListInstructions

StatusOr<ListInstructionsResponse> ListInstructions(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Disassembles all instructions in an address range.

Comments

SetComment

StatusOr<SetCommentResponse> SetComment(uint64_t address, CommentKind kind, const string& text)

Sets a comment. CommentKind values: kEol, kPre, kPost, kPlate, kRepeatable.

GetComments

StatusOr<GetCommentsResponse> GetComments(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Lists comments in an address range. Each has address, kind, text.

DeleteComment

StatusOr<DeleteCommentResponse> DeleteComment(uint64_t address, CommentKind kind)

Deletes a specific comment at an address.

Data Items

ApplyDataType

StatusOr<ApplyDataTypeResponse> ApplyDataType(uint64_t address, const string& data_type)

Applies a data type at an address, creating a data item.

client->ApplyDataType(0x140004000, "int");

ListDataItems

StatusOr<ListDataItemsResponse> ListDataItems(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Lists defined data items. Each has address, name, data_type, size, value_repr.

RenameDataItem

StatusOr<RenameDataItemResponse> RenameDataItem(uint64_t address, const string& new_name)

DeleteDataItem

StatusOr<DeleteDataItemResponse> DeleteDataItem(uint64_t address)

ListDefinedStrings

StatusOr<ListDefinedStringsResponse> ListDefinedStrings(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Lists defined string data items. Each has address, value, length, data_type, encoding.

Caveat: The LocalClient does not have a string analysis pass, so this typically returns an empty list unless data items have been explicitly created with string types.

Cross-References

ListXrefs

StatusOr<ListXrefsResponse> ListXrefs(
    uint64_t range_start, uint64_t range_end, int limit, int offset)

Extracts cross-references derived from pcode analysis. Includes both call and data references. Requires decompilation of the source functions (triggers automatically).

auto xrefs = client->ListXrefs(0, UINT64_MAX, 0, 0);
for (auto& x : xrefs.value->xrefs) {
    // x.from_address, x.to_address, x.ref_type
    // x.is_flow, x.is_memory, x.is_external
}

Uses the decompiler pool for parallel extraction when pool_size > 1.

Unsupported Methods

These methods return NOT_SUPPORTED on the LocalClient:

MethodReason
ListSwitchTablesLive/structural analysis surface not implemented locally
ListDominatorsLive/structural analysis surface not implemented locally
ListPostDominatorsLive/structural analysis surface not implemented locally
ListLoopsLive/structural analysis surface not implemented locally
ListFunctionTagsGhidra database tag metadata is not modeled locally
CreateFunctionTagGhidra database tag metadata is not modeled locally
DeleteFunctionTagGhidra database tag metadata is not modeled locally
ListFunctionTagMappingsGhidra database tag metadata is not modeled locally
TagFunctionGhidra database tag metadata is not modeled locally
UntagFunctionGhidra database tag metadata is not modeled locally
ParseDeclarationsGhidra parser service is not embedded in the local backend
ListBookmarksGUI-only concept, no engine backing
AddBookmarkGUI-only concept, no engine backing
DeleteBookmarkGUI-only concept, no engine backing
ListBreakpointsDebugger concept, no engine backing
AddBreakpointDebugger concept, no engine backing
SetBreakpointEnabledDebugger concept, no engine backing
SetBreakpointKindDebugger concept, no engine backing
SetBreakpointSizeDebugger concept, no engine backing
SetBreakpointConditionDebugger concept, no engine backing
SetBreakpointGroupDebugger concept, no engine backing
DeleteBreakpointDebugger concept, no engine backing

Appendix

Complete Method Table

AreaMethodSupported
SessionOpenProgramYes
CloseProgramYes
SaveProgramYes
DiscardProgramYes
GetRevisionYes
GetStatusYes
GetCapabilitiesYes
ShutdownYes
DecompilerGetDecompilationYes
ListDecompilationsYes (parallel)
FunctionsGetFunctionYes
ListFunctionsYes
RenameFunctionYes
ListBasicBlocksYes
ListCFGEdgesYes
ListSwitchTablesNo
ListDominatorsNo
ListPostDominatorsNo
ListLoopsNo
ListFunctionTagsNo
CreateFunctionTagNo
DeleteFunctionTagNo
ListFunctionTagMappingsNo
TagFunctionNo
UntagFunctionNo
MemoryReadBytesYes
WriteBytesYes (CoW overlay)
PatchBytesBatchYes (CoW overlay)
ListMemoryBlocksYes
SymbolsGetSymbolYes
ListSymbolsYes
RenameSymbolPartial (function symbols only)
DeleteSymbolYes
TypesGetTypeYes
ListTypesYes
CreateTypePartial (struct creation)
DeleteTypeYes
RenameTypeYes
ListTypeAliasesYes
CreateTypeAliasYes
SetTypeAliasTargetYes
DeleteTypeAliasYes
ListTypeEnumsYes
CreateTypeEnumYes
DeleteTypeEnumYes
ListTypeEnumMembersYes
AddTypeEnumMemberYes
RenameTypeEnumMemberYes
SetTypeEnumMemberValueYes
SetTypeEnumMemberCommentYes
ParseDeclarationsNo
DeleteTypeEnumMemberYes
ListTypeMembersYes
AddTypeMemberYes
RenameTypeMemberYes
SetTypeMemberTypeYes
SetTypeMemberCommentYes
DeleteTypeMemberYes
ListTypeUnionsYes
SignaturesGetFunctionSignatureYes
ListFunctionSignaturesYes
SetFunctionSignatureYes
RenameFunctionParameterYes
SetFunctionParameterTypeYes
RenameFunctionLocalYes
SetFunctionLocalTypeYes
ApplyDataTypeYes
ListingGetInstructionYes
ListInstructionsYes
GetCommentsYes
SetCommentYes
DeleteCommentYes
ListDataItemsYes
RenameDataItemYes
DeleteDataItemYes
ListDefinedStringsYes
XrefsListXrefsYes (parallel)
BookmarksListBookmarksNo
AddBookmarkNo
DeleteBookmarkNo
BreakpointsListBreakpointsNo
AddBreakpointNo
SetBreakpointEnabledNo
SetBreakpointKindNo
SetBreakpointSizeNo
SetBreakpointConditionNo
SetBreakpointGroupNo
DeleteBreakpointNo

Pagination Conventions

All List* methods accept limit and offset:

  • limit = 0 -- return all results (no cap)
  • offset = 0 -- start from the beginning

Range parameters (range_start, range_end) filter by address:

  • range_start = 0, range_end = UINT64_MAX -- entire address space
  • range_start = 0, range_end = 0 -- also means "all" for some methods (ListDecompilations)

Architecture String Format

Sleigh language IDs follow the pattern: <processor>:<endian>:<size>:<variant>

Examples:

  • x86:LE:64:default -- x86-64, little-endian
  • x86:LE:32:default -- x86-32, little-endian
  • ARM:LE:32:v8 -- ARM 32-bit, little-endian, ARMv8
  • AARCH64:LE:64:v8A -- AArch64
  • MIPS:BE:32:default -- MIPS 32-bit, big-endian
  • RISCV:LE:64:default -- RISC-V 64-bit

When default_arch is empty, the backend auto-detects from the binary's format headers (PE, ELF, Mach-O).