code-pattern-matching
Code Pattern Matching
Search for code patterns in decompiled output using the Weggli pattern matching engine.
When to use
- Find specific code patterns in decompiled functions (e.g.,
memcpy(dst, src, len)) - Search for vulnerable code constructs across functions
- Match variable usage patterns with semantic constraints
- Locate specific function call patterns with regex filtering
Instructions
Using the VulHunt MCP tools, open the project (open_project) and run the following Lua query (query_project), adapting it as needed:
local decomp = project:decompile(<target_function>)
local matches = decomp:query({
raw = true, -- If true, the query will be used as-is; otherwise, it will be wrapped in {{}}
More from vulhunt-re/skills
decompiler
Decompile a function to C-like pseudocode for human-readable analysis. Use to understand function logic, review control flow, or prepare for code pattern matching.
17functions
Find and list functions in a binary by name, address, regex, or byte pattern. Use as the starting point for binary analysis, to locate specific functions, or to enumerate all functions matching criteria.
6btp-ba2-cli
Interact with the Binarly Transparency Platform (BTP) via CLI commands for uploading firmware, running scans, downloading BA2 archives, and pushing custom rules. Use when you need to interact with the Binarly Transparency Platform or working with BA2s.
6call-sites
Find all locations where functions are called in a binary. Use when analyzing callers of a function, checking call relationships, or identifying which functions invoke a specific API.
6dataflow-analysis
Track data flow between function parameters, calls, and arguments using taint analysis. Use when detecting vulnerabilities like command injection, buffer overflows, or tracing user input to dangerous functions.
6byte-pattern-matching
Search for raw byte patterns (hex sequences, opcodes) in binary code. Use when looking for specific instruction sequences, machine code patterns, UEFI SMI handlers, or known vulnerability signatures by their byte representation.
5