Struct Ctree 

pub struct Ctree { /* private fields */ }

An owned, interned, Send syntax tree of a decompiled function, from Database::decompile. The root is always a block statement.

Materialized on the kernel thread and then analyzed anywhere: a read-only snapshot with no in-place mutation. It does not track the live database, so it goes stale if the function is re-decompiled; writing back to IDA is a separate concern, not routed through these handles.

CtreeBuilder builds one directly, with no kernel, for testing matchers against a known shape:

use idakit::Address;
use idakit::decompiler::ctree::{CtreeBuilder, Local, LocalLocation};
use idakit::types::{TypeShape, TypeValue};

let mut b = CtreeBuilder::new();
let ty = b.intern_type(TypeValue {
    shape: TypeShape::Unknown,
    size: None,
});
let arg = b.push_local(Local {
    name: "a".into(),
    ty,
    is_arg: true,
    is_result: false,
    is_byref: false,
    width: 8,
    comment: None,
    location: LocalLocation::Register(0),
});

// `foo(a);`
let a = b.var(ty, arg);
let foo = b.obj(ty, Address::new_const(0x1000), Some("foo"));
let call = b.call_expression(ty, foo, vec![a]);
let stmt = b.expression_statement(call);
let block = b.block(vec![stmt]);
let tree = b.finish(block);

// Whole-tree scans find the call and the local reference without walking the tree shape.
assert_eq!(
    tree.calls().collect::<Vec<_>>(),
    vec![(call, foo, [a].as_slice())]
);
assert_eq!(tree.vars().map(|(_, v)| v).collect::<Vec<_>>(), vec![arg]);

Implementations

impl Ctree

pub fn to_pseudocode(&self) -> String

Render this function’s body as C-like pseudocode.

Examples found in repository

examples/ctree_dump.rs (line 61)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut args = std::env::args().skip(1);
    let bin = args
        .next()
        .expect("usage: ctree_dump <binary> [name-substring]");
    let filter = args.next().unwrap_or_default();

    Ida::run(move |ida| -> Result<(), Error> {
        ida.call(move |idb| -> Result<(), Error> {
            idb.open(&bin).run_auto(true).call()?;

            let mut matched = 0;
            let eas: Vec<_> = idb.functions().map(|f| (f.address(), f.name())).collect();
            for (address, name) in eas {
                let name = String::from(name);
                if !filter.is_empty() && !name.contains(&filter) {
                    continue;
                }
                let Ok(cf) = idb.decompile(address) else {
                    continue;
                };
                let Ok(tree) = cf.ctree() else { continue };
                matched += 1;
                println!("\n========== {name}  @ {address:#x} ==========");
                if let Some(pc) = cf.pseudocode() {
                    println!("--- IDA ---\n{pc}");
                }
                println!("--- idakit ---\n{}", tree.to_pseudocode());
                println!("--- structure ---");
                dump(
                    &tree,
                    idakit::decompiler::ctree::NodeRef::Statement(tree.root()),
                    0,
                );
            }
            println!("\n[ctree_dump] {matched} function(s) matched filter {filter:?}");

            idb.close(false);
            Ok(())
        })?
    })??;

    Ok(())
}

examples/probe_ctree_counts.rs (line 62)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let bin = std::env::args()
        .nth(1)
        .expect("usage: probe_ctree_counts <db.i64>");

    Ida::run(move |ida| -> Result<(), Error> {
        ida.call(move |idb| -> Result<(), Error> {
            idb.open(&bin).run_auto(false).call()?;

            let eas: Vec<_> = idb
                .functions()
                .map(|f| (f.address(), String::from(f.name())))
                .collect();
            let mut checked = 0usize;
            let mut mismatches = 0usize;
            let mut first_dumped = false;
            for (address, name) in eas {
                let Ok(cf) = idb.decompile(address) else {
                    continue;
                };
                let Ok(tree) = cf.ctree() else { continue };
                checked += 1;
                let (visitor_total, expected) = cf.expr_extraction_expectation();
                let extracted = tree.expressions().count() as i32;
                if extracted != expected {
                    mismatches += 1;
                    println!(
                        "MISMATCH {name} @ {address:#x}: extracted={extracted} expected={expected} \
                         visitor={visitor_total} (elided empties {})",
                        visitor_total - expected
                    );
                    if !first_dumped {
                        first_dumped = true;
                        println!("--- idakit render ---\n{}", tree.to_pseudocode());
                        println!("--- structure ---");
                        dump(
                            &tree,
                            idakit::decompiler::ctree::NodeRef::Statement(tree.root()),
                            0,
                        );
                    }
                }
            }
            println!("\n[probe] {checked} decompiled, {mismatches} mismatched");
            idb.close(false);
            Ok(())
        })?
    })??;
    Ok(())
}

impl Ctree

pub fn root(&self) -> StatementId

The root statement (a block).

Examples found in repository

examples/ctree_dump.rs (line 65)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut args = std::env::args().skip(1);
    let bin = args
        .next()
        .expect("usage: ctree_dump <binary> [name-substring]");
    let filter = args.next().unwrap_or_default();

    Ida::run(move |ida| -> Result<(), Error> {
        ida.call(move |idb| -> Result<(), Error> {
            idb.open(&bin).run_auto(true).call()?;

            let mut matched = 0;
            let eas: Vec<_> = idb.functions().map(|f| (f.address(), f.name())).collect();
            for (address, name) in eas {
                let name = String::from(name);
                if !filter.is_empty() && !name.contains(&filter) {
                    continue;
                }
                let Ok(cf) = idb.decompile(address) else {
                    continue;
                };
                let Ok(tree) = cf.ctree() else { continue };
                matched += 1;
                println!("\n========== {name}  @ {address:#x} ==========");
                if let Some(pc) = cf.pseudocode() {
                    println!("--- IDA ---\n{pc}");
                }
                println!("--- idakit ---\n{}", tree.to_pseudocode());
                println!("--- structure ---");
                dump(
                    &tree,
                    idakit::decompiler::ctree::NodeRef::Statement(tree.root()),
                    0,
                );
            }
            println!("\n[ctree_dump] {matched} function(s) matched filter {filter:?}");

            idb.close(false);
            Ok(())
        })?
    })??;

    Ok(())
}

examples/probe_ctree_counts.rs (line 66)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let bin = std::env::args()
        .nth(1)
        .expect("usage: probe_ctree_counts <db.i64>");

    Ida::run(move |ida| -> Result<(), Error> {
        ida.call(move |idb| -> Result<(), Error> {
            idb.open(&bin).run_auto(false).call()?;

            let eas: Vec<_> = idb
                .functions()
                .map(|f| (f.address(), String::from(f.name())))
                .collect();
            let mut checked = 0usize;
            let mut mismatches = 0usize;
            let mut first_dumped = false;
            for (address, name) in eas {
                let Ok(cf) = idb.decompile(address) else {
                    continue;
                };
                let Ok(tree) = cf.ctree() else { continue };
                checked += 1;
                let (visitor_total, expected) = cf.expr_extraction_expectation();
                let extracted = tree.expressions().count() as i32;
                if extracted != expected {
                    mismatches += 1;
                    println!(
                        "MISMATCH {name} @ {address:#x}: extracted={extracted} expected={expected} \
                         visitor={visitor_total} (elided empties {})",
                        visitor_total - expected
                    );
                    if !first_dumped {
                        first_dumped = true;
                        println!("--- idakit render ---\n{}", tree.to_pseudocode());
                        println!("--- structure ---");
                        dump(
                            &tree,
                            idakit::decompiler::ctree::NodeRef::Statement(tree.root()),
                            0,
                        );
                    }
                }
            }
            println!("\n[probe] {checked} decompiled, {mismatches} mismatched");
            idb.close(false);
            Ok(())
        })?
    })??;
    Ok(())
}

pub fn expression(&self, id: ExpressionId) -> &ExpressionNode

The expression node behind a handle.

pub fn statement(&self, id: StatementId) -> &StatementNode

The statement node behind a handle.

pub fn kind(&self, id: ExpressionId) -> &ExpressionKind

The expression kind behind a handle: the kind field of expression(id), the form matchers want when projecting with the ExpressionKind as_* accessors.

Examples found in repository

examples/taint.rs (line 56)

fn callee_name(tree: &Ctree, callee: ExpressionId) -> Option<String> {
    let kind = tree.kind(callee);
    if let Some((_, name)) = kind.as_obj() {
        return name.map(str::to_owned);
    }
    kind.as_helper().map(str::to_owned)
}

/// Builds the callee-name map for a tree.
///
/// The tree carries callee names directly, so this is pure: no `Database` access, no
/// kernel-thread name resolution.
fn resolve_callees(tree: &Ctree) -> HashMap<ExpressionId, String> {
    let mut map = HashMap::new();
    for (id, callee, _) in tree.calls() {
        if let Some(name) = callee_name(tree, callee) {
            map.insert(id, name);
        }
    }
    map
}

/// Whether `e`'s subtree reads a tainted local or calls a source directly.
///
/// Flow-insensitive and deliberately crude, doing real work proportional to tree size.
fn expression_tainted(img: &TaintInput, e: ExpressionId, tainted: &HashSet<u32>) -> bool {
    img.tree
        .expression_descendants(NodeRef::Expression(e))
        .any(|id| match img.tree.kind(id).as_var() {
            Some(LocalId(i)) => tainted.contains(&i),
            None => img.callees.get(&id).is_some_and(|n| matches(n, SOURCES)),
        })
}

/// The pure phase returns the number of source->sink flows found. No `Database` access,
/// so this is exactly the work that could move to a worker thread.
fn analyze(img: &TaintInput) -> usize {
    // Collect `Var(i) = rhs` definitions once.
    let defs: Vec<(u32, ExpressionId)> = img
        .tree
        .assigns()
        .filter_map(|(_, _, x, y)| {
            let LocalId(i) = img.tree.kind(x).as_var()?;
            Some((i, y))
        })
        .collect();

    // Fixpoint: a local is tainted once any of its defining RHS is tainted.
    let mut tainted: HashSet<u32> = HashSet::new();
    loop {
        let before = tainted.len();
        for &(lv, rhs) in &defs {
            if !tainted.contains(&lv) && expression_tainted(img, rhs, &tainted) {
                tainted.insert(lv);
            }
        }
        if tainted.len() == before {
            break;
        }
    }

    // Sinks: a tainted argument to a dangerous call is a flow.
    img.tree
        .calls()
        .filter(|(id, _, args)| {
            img.callees.get(id).is_some_and(|n| matches(n, SINKS))
                && args.iter().any(|a| expression_tainted(img, *a, &tainted))
        })
        .count()
}

examples/ctree_dump.rs (line 18)

fn dump(tree: &Ctree, node: idakit::decompiler::ctree::NodeRef, depth: usize) {
    use idakit::decompiler::ctree::NodeRef;
    let pad = "  ".repeat(depth);
    let label = match node {
        NodeRef::Expression(id) => format!("{:?}", tree.kind(id)),
        NodeRef::Statement(id) => format!("{:?}", tree.statement_kind(id)),
    };
    let line: String = label
        .lines()
        .next()
        .unwrap_or("")
        .chars()
        .take(90)
        .collect();
    println!("{pad}{line}");
    for c in tree.children(node) {
        dump(tree, c, depth + 1);
    }
}

examples/probe_ctree_counts.rs (line 13)

fn dump(tree: &Ctree, node: idakit::decompiler::ctree::NodeRef, depth: usize) {
    use idakit::decompiler::ctree::NodeRef;
    let pad = "  ".repeat(depth);
    let label = match node {
        NodeRef::Expression(id) => format!("{:?}", tree.kind(id)),
        NodeRef::Statement(id) => format!("{:?}", tree.statement_kind(id)),
    };
    let line: String = label
        .lines()
        .next()
        .unwrap_or("")
        .chars()
        .take(90)
        .collect();
    println!("{pad}{line}");
    for c in tree.children(node) {
        dump(tree, c, depth + 1);
    }
}

pub fn statement_kind(&self, id: StatementId) -> &StatementKind

The statement kind behind a handle: the kind field of statement(id).

Examples found in repository

examples/ctree_dump.rs (line 19)

fn dump(tree: &Ctree, node: idakit::decompiler::ctree::NodeRef, depth: usize) {
    use idakit::decompiler::ctree::NodeRef;
    let pad = "  ".repeat(depth);
    let label = match node {
        NodeRef::Expression(id) => format!("{:?}", tree.kind(id)),
        NodeRef::Statement(id) => format!("{:?}", tree.statement_kind(id)),
    };
    let line: String = label
        .lines()
        .next()
        .unwrap_or("")
        .chars()
        .take(90)
        .collect();
    println!("{pad}{line}");
    for c in tree.children(node) {
        dump(tree, c, depth + 1);
    }
}

examples/probe_ctree_counts.rs (line 14)

fn dump(tree: &Ctree, node: idakit::decompiler::ctree::NodeRef, depth: usize) {
    use idakit::decompiler::ctree::NodeRef;
    let pad = "  ".repeat(depth);
    let label = match node {
        NodeRef::Expression(id) => format!("{:?}", tree.kind(id)),
        NodeRef::Statement(id) => format!("{:?}", tree.statement_kind(id)),
    };
    let line: String = label
        .lines()
        .next()
        .unwrap_or("")
        .chars()
        .take(90)
        .collect();
    println!("{pad}{line}");
    for c in tree.children(node) {
        dump(tree, c, depth + 1);
    }
}

pub fn type_of(&self, id: TypeId) -> &TypeValue

The type behind a handle (e.g. an ExpressionNode::ty).

pub fn local(&self, id: LocalId) -> &Local

The local variable a ExpressionKind::Var refers to.

pub fn locals(&self) -> impl ExactSizeIterator<Item = &Local>

Every local variable of the function, in local-index order.

Examples found in repository

examples/probe_argloc.rs (line 28)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use idakit::decompiler::ctree::LocalLocation as L;
    let mut args = std::env::args().skip(1);
    let bin = args
        .next()
        .expect("usage: probe_argloc <db.i64> [max-funcs]");
    let max: usize = args.next().and_then(|s| s.parse().ok()).unwrap_or(2000);

    Ida::run(move |ida| -> Result<(), Error> {
        ida.call(move |idb| -> Result<(), Error> {
            idb.open(&bin).run_auto(false).call()?;

            let mut n = [0usize; 8];
            let mut decompiled = 0usize;
            let mut examples: Vec<String> = Vec::new();
            let eas: Vec<_> = idb.functions().take(max).map(|f| f.address()).collect();
            for ea in eas {
                let Ok(cf) = idb.decompile(ea) else { continue };
                let Ok(tree) = cf.ctree() else { continue };
                decompiled += 1;
                for lv in tree.locals() {
                    let i = match &lv.location {
                        L::Register(_) => 0,
                        L::RegisterPair { .. } => 1,
                        L::Stack(_) => 2,
                        L::RegisterRelative { .. } => 3,
                        L::Static(_) => 4,
                        L::Scattered(_) => 5,
                        L::Custom => 6,
                        L::Unallocated => 7,
                    };
                    n[i] += 1;
                    if matches!(lv.location, L::Scattered(_) | L::RegisterPair { .. } | L::RegisterRelative { .. })
                        && examples.len() < 12
                    {
                        examples.push(format!("  {} {:?} = {:?}", lv.name, lv.width, lv.location));
                    }
                }
            }
            println!(
                "{decompiled} fns | reg={} pair={} stack={} rrel={} static={} scatter={} custom={} none={}",
                n[0], n[1], n[2], n[3], n[4], n[5], n[6], n[7]
            );
            if !examples.is_empty() {
                println!("rich-variant examples:");
                for e in &examples {
                    println!("{e}");
                }
            }
            idb.close(false);
            Ok(())
        })?
    })??;
    Ok(())
}

pub fn this_local(&self) -> Option<LocalId>

The function’s first argument local: the implicit this in a member function, or simply the first parameter otherwise. None if the function takes no arguments.

A pure structural accessor: it reads the local table’s argument flags and makes no assumption about calling convention.

pub fn expressions( &self, ) -> impl ExactSizeIterator<Item = (ExpressionId, &ExpressionNode)>

Every expression node, flat, in allocation order.

Useful for whole-tree scans, like “find all calls”, that don’t need the tree shape.

Examples found in repository

examples/taint.rs (line 172)

fn run(idb: &mut Database, db: &str) -> Result<(), Error> {
    idb.open(db).call()?;

    let limit = std::env::var("TAINT_LIMIT")
        .ok()
        .and_then(|s| s.parse::<usize>().ok())
        .unwrap_or(usize::MAX);

    let eas: Vec<Address> = idb.functions().map(|f| f.address()).take(limit).collect();
    println!("[taint] sweeping {} functions", eas.len());

    let mut t = Totals::default();
    let wall = Instant::now();

    for (i, &address) in eas.iter().enumerate() {
        let started = Instant::now();
        let Ok(cf) = idb.decompile(address) else {
            t.decompile_failed += 1;
            continue;
        };
        t.decompile += started.elapsed();

        let started = Instant::now();
        let Ok(tree) = cf.ctree() else {
            t.extract_failed += 1;
            continue;
        };
        t.extract += started.elapsed();

        let started = Instant::now();
        let callees = resolve_callees(&tree);
        t.resolve += started.elapsed();

        t.nodes += (tree.expressions().count() + tree.statements().count()) as u64;
        let img = TaintInput { tree, callees };

        let started = Instant::now();
        t.flows += analyze(&img);
        t.analyze += started.elapsed();

        t.funcs += 1;
        if (i + 1) % 5000 == 0 {
            println!("[taint] {} / {} ...", i + 1, eas.len());
        }
    }

    report(&t, wall.elapsed());
    idb.close(false);
    Ok(())
}

examples/probe_ctree_counts.rs (line 52)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let bin = std::env::args()
        .nth(1)
        .expect("usage: probe_ctree_counts <db.i64>");

    Ida::run(move |ida| -> Result<(), Error> {
        ida.call(move |idb| -> Result<(), Error> {
            idb.open(&bin).run_auto(false).call()?;

            let eas: Vec<_> = idb
                .functions()
                .map(|f| (f.address(), String::from(f.name())))
                .collect();
            let mut checked = 0usize;
            let mut mismatches = 0usize;
            let mut first_dumped = false;
            for (address, name) in eas {
                let Ok(cf) = idb.decompile(address) else {
                    continue;
                };
                let Ok(tree) = cf.ctree() else { continue };
                checked += 1;
                let (visitor_total, expected) = cf.expr_extraction_expectation();
                let extracted = tree.expressions().count() as i32;
                if extracted != expected {
                    mismatches += 1;
                    println!(
                        "MISMATCH {name} @ {address:#x}: extracted={extracted} expected={expected} \
                         visitor={visitor_total} (elided empties {})",
                        visitor_total - expected
                    );
                    if !first_dumped {
                        first_dumped = true;
                        println!("--- idakit render ---\n{}", tree.to_pseudocode());
                        println!("--- structure ---");
                        dump(
                            &tree,
                            idakit::decompiler::ctree::NodeRef::Statement(tree.root()),
                            0,
                        );
                    }
                }
            }
            println!("\n[probe] {checked} decompiled, {mismatches} mismatched");
            idb.close(false);
            Ok(())
        })?
    })??;
    Ok(())
}

pub fn statements( &self, ) -> impl ExactSizeIterator<Item = (StatementId, &StatementNode)>

Every statement node, flat, in allocation order.

Examples found in repository

examples/taint.rs (line 172)

fn run(idb: &mut Database, db: &str) -> Result<(), Error> {
    idb.open(db).call()?;

    let limit = std::env::var("TAINT_LIMIT")
        .ok()
        .and_then(|s| s.parse::<usize>().ok())
        .unwrap_or(usize::MAX);

    let eas: Vec<Address> = idb.functions().map(|f| f.address()).take(limit).collect();
    println!("[taint] sweeping {} functions", eas.len());

    let mut t = Totals::default();
    let wall = Instant::now();

    for (i, &address) in eas.iter().enumerate() {
        let started = Instant::now();
        let Ok(cf) = idb.decompile(address) else {
            t.decompile_failed += 1;
            continue;
        };
        t.decompile += started.elapsed();

        let started = Instant::now();
        let Ok(tree) = cf.ctree() else {
            t.extract_failed += 1;
            continue;
        };
        t.extract += started.elapsed();

        let started = Instant::now();
        let callees = resolve_callees(&tree);
        t.resolve += started.elapsed();

        t.nodes += (tree.expressions().count() + tree.statements().count()) as u64;
        let img = TaintInput { tree, callees };

        let started = Instant::now();
        t.flows += analyze(&img);
        t.analyze += started.elapsed();

        t.funcs += 1;
        if (i + 1) % 5000 == 0 {
            println!("[taint] {} / {} ...", i + 1, eas.len());
        }
    }

    report(&t, wall.elapsed());
    idb.close(false);
    Ok(())
}

pub fn calls( &self, ) -> impl Iterator<Item = (ExpressionId, ExpressionId, &[ExpressionId])>

Every call in the tree as (node, callee, args).

The whole-tree scan behind “find every call”, without re-spelling the as_call filter.

Examples found in repository

examples/taint.rs (line 69)

fn resolve_callees(tree: &Ctree) -> HashMap<ExpressionId, String> {
    let mut map = HashMap::new();
    for (id, callee, _) in tree.calls() {
        if let Some(name) = callee_name(tree, callee) {
            map.insert(id, name);
        }
    }
    map
}

/// Whether `e`'s subtree reads a tainted local or calls a source directly.
///
/// Flow-insensitive and deliberately crude, doing real work proportional to tree size.
fn expression_tainted(img: &TaintInput, e: ExpressionId, tainted: &HashSet<u32>) -> bool {
    img.tree
        .expression_descendants(NodeRef::Expression(e))
        .any(|id| match img.tree.kind(id).as_var() {
            Some(LocalId(i)) => tainted.contains(&i),
            None => img.callees.get(&id).is_some_and(|n| matches(n, SOURCES)),
        })
}

/// The pure phase returns the number of source->sink flows found. No `Database` access,
/// so this is exactly the work that could move to a worker thread.
fn analyze(img: &TaintInput) -> usize {
    // Collect `Var(i) = rhs` definitions once.
    let defs: Vec<(u32, ExpressionId)> = img
        .tree
        .assigns()
        .filter_map(|(_, _, x, y)| {
            let LocalId(i) = img.tree.kind(x).as_var()?;
            Some((i, y))
        })
        .collect();

    // Fixpoint: a local is tainted once any of its defining RHS is tainted.
    let mut tainted: HashSet<u32> = HashSet::new();
    loop {
        let before = tainted.len();
        for &(lv, rhs) in &defs {
            if !tainted.contains(&lv) && expression_tainted(img, rhs, &tainted) {
                tainted.insert(lv);
            }
        }
        if tainted.len() == before {
            break;
        }
    }

    // Sinks: a tainted argument to a dangerous call is a flow.
    img.tree
        .calls()
        .filter(|(id, _, args)| {
            img.callees.get(id).is_some_and(|n| matches(n, SINKS))
                && args.iter().any(|a| expression_tainted(img, *a, &tainted))
        })
        .count()
}

pub fn assigns( &self, ) -> impl Iterator<Item = (ExpressionId, AssignmentOp, ExpressionId, ExpressionId)>

Every assignment in the tree as (node, op, lhs, rhs).

Examples found in repository

examples/taint.rs (line 95)

fn analyze(img: &TaintInput) -> usize {
    // Collect `Var(i) = rhs` definitions once.
    let defs: Vec<(u32, ExpressionId)> = img
        .tree
        .assigns()
        .filter_map(|(_, _, x, y)| {
            let LocalId(i) = img.tree.kind(x).as_var()?;
            Some((i, y))
        })
        .collect();

    // Fixpoint: a local is tainted once any of its defining RHS is tainted.
    let mut tainted: HashSet<u32> = HashSet::new();
    loop {
        let before = tainted.len();
        for &(lv, rhs) in &defs {
            if !tainted.contains(&lv) && expression_tainted(img, rhs, &tainted) {
                tainted.insert(lv);
            }
        }
        if tainted.len() == before {
            break;
        }
    }

    // Sinks: a tainted argument to a dangerous call is a flow.
    img.tree
        .calls()
        .filter(|(id, _, args)| {
            img.callees.get(id).is_some_and(|n| matches(n, SINKS))
                && args.iter().any(|a| expression_tainted(img, *a, &tainted))
        })
        .count()
}

pub fn vars(&self) -> impl Iterator<Item = (ExpressionId, LocalId)>

Every local-variable reference in the tree as (node, local).

pub fn types(&self) -> impl ExactSizeIterator<Item = (TypeId, &TypeValue)>

Every interned type, flat.

pub fn expression_at(&self, address: Address) -> Option<ExpressionId>

The first expression node whose source address is address, or None if none is. Several nodes can share one address; this returns the first in allocation order and items_at yields them all.

pub fn statement_at(&self, address: Address) -> Option<StatementId>

The first statement node whose source address is address, or None.

pub fn items_at(&self, address: Address) -> impl Iterator<Item = NodeRef> + '_

Every node whose source address is address, in allocation order with expressions before statements.

The flat, address-keyed counterpart to the structural descendants walk, answering “what did the decompiler place at this instruction?” without navigating the tree.

pub fn parent(&self, node: NodeRef) -> Option<NodeRef>

This node’s parent, or None for the root.

pub fn children(&self, node: NodeRef) -> Vec<NodeRef>

This node’s direct children, in source order.

Examples found in repository

examples/ctree_dump.rs (line 29)

fn dump(tree: &Ctree, node: idakit::decompiler::ctree::NodeRef, depth: usize) {
    use idakit::decompiler::ctree::NodeRef;
    let pad = "  ".repeat(depth);
    let label = match node {
        NodeRef::Expression(id) => format!("{:?}", tree.kind(id)),
        NodeRef::Statement(id) => format!("{:?}", tree.statement_kind(id)),
    };
    let line: String = label
        .lines()
        .next()
        .unwrap_or("")
        .chars()
        .take(90)
        .collect();
    println!("{pad}{line}");
    for c in tree.children(node) {
        dump(tree, c, depth + 1);
    }
}

examples/probe_ctree_counts.rs (line 24)

fn dump(tree: &Ctree, node: idakit::decompiler::ctree::NodeRef, depth: usize) {
    use idakit::decompiler::ctree::NodeRef;
    let pad = "  ".repeat(depth);
    let label = match node {
        NodeRef::Expression(id) => format!("{:?}", tree.kind(id)),
        NodeRef::Statement(id) => format!("{:?}", tree.statement_kind(id)),
    };
    let line: String = label
        .lines()
        .next()
        .unwrap_or("")
        .chars()
        .take(90)
        .collect();
    println!("{pad}{line}");
    for c in tree.children(node) {
        dump(tree, c, depth + 1);
    }
}

pub fn children_for_each(&self, node: NodeRef, f: impl FnMut(NodeRef))

Visit each direct child without allocating. The push-based counterpart to children, which buffers into a Vec.

pub fn descendants(&self, node: NodeRef) -> Descendants<'_>

A pre-order walk of node and all its descendants (the node itself first).

pub fn expression_descendants( &self, node: NodeRef, ) -> impl Iterator<Item = ExpressionId> + '_

Like descendants but yielding only the expression handles, skipping statements.

Examples found in repository

examples/taint.rs (line 82)

fn expression_tainted(img: &TaintInput, e: ExpressionId, tainted: &HashSet<u32>) -> bool {
    img.tree
        .expression_descendants(NodeRef::Expression(e))
        .any(|id| match img.tree.kind(id).as_var() {
            Some(LocalId(i)) => tainted.contains(&i),
            None => img.callees.get(&id).is_some_and(|n| matches(n, SOURCES)),
        })
}

Trait Implementations

impl Clone for Ctree

fn clone(&self) -> Ctree

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Ctree

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Ctree

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for Ctree

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Ctree

fn eq(&self, other: &Ctree) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Ctree

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Ctree