Binary Ninja Intermediate Language Series, Part 3: High Level IL¶
Binary Ninja Intermediate Language: High Level IL¶
The High Level Intermediate Language (HLIL) is Binary Ninja's decompiler output. Much like LLIL and MLIL, this representation is tree based and has many of the same instructions. This representation is distinct in a few key ways.
 High level language concepts are recovered.
 Expressions are folded
Purposes of HLIL¶
 Simplified representation
 Small discrete operations
 Enables sourcelevel forms of queries and analysis
In the rest of this article we will explore the instruction set.
The Instruction Set¶
The instruction set is made up of HighLevelILInstruction
objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an HLIL instruction:+
>>> current_il_instruction
<HighLevelILVarInit: uint64_t rax_2 = zx.q(rax_1  0x6c)>
>>> type(current_il_instruction)
<class 'binaryninja.highlevelil.HighLevelILVarInit'>
current_il_instruction
is mapped to whatever il instruction is currently selected viewed and is not generally available to those writing plugins or scripts. You can see a full list of our magic variables here.
There are a number of properties that can be queried on the HighLevelILInstruction
object, and the validity of these properties changes depending on what the current operation is. The properties in HLIL are extremely similar to those in MLIL, with one notable exception being that HLIL_CALL
instruction objects do not have a .output
property, but instead HLIL_CALL
s that have return values will be the inst.right
of a HighLevelILVarInit
, HighLevelILVarAssign
, or similar.
Control Flow¶
HLIL_JUMP
 Branch to thedest
expression's addressHLIL_CALL
 Branch to thedest
expression function, saving the return address, with the list of parametersparams
HLIL_RET
 Return to the calling function.HLIL_NORET
 This instruction will never be executed, the instruction before it is a call that doesn't returnHLIL_IF
 Branch to thetrue
/false
HLIL instruction identifier depending on the result of thecondition
expressionHLIL_GOTO
 Branch to thedest
expression idHLIL_TAILCALL
 This instruction calls the expressiondest
usingparams
as input andoutput
for return values not existHLIL_SYSCALL
 Make a system/service call with parametersparams
and outputoutput
HLIL_WHILE
HLIL_DO_WHILE
HLIL_FOR
HLIL_SWITCH
HLIL_CASE
HLIL_BREAK
HLIL_CONTINUE

Variable Reads and Writes¶
HLIL_VAR_DECLARE
 A declaration ofvar
HLIL_VAR_INIT
 Initializesdest
to the result of an expressionsrc
HLIL_ASSIGN
 Sets a variabledest
to the result of an expressionsrc
HLIL_ASSIGN_UNPACK
HLIL_VAR
 A variable expressionsrc
HLIL_VAR_PHI
 APHI
represents the combination of several prior versions of a variable when differnet basic blocks coalesce into a single destination and it's unknown which path was taken.HLIL_MEM_PHI
 A memoryPHI
represents memory modifications that could have occured down different source basic blocks similar to aVAR_PHI
.HLIL_ADDRESS_OF
 The address of variablesrc
HLIL_CONST
 A constant integral valueconstant
HLIL_CONST_DATA
 A constant data referenceconstant data reference
HLIL_CONST_PTR
 A constant integral value which is used as a pointerconstant
HLIL_EXTERN_PTR
 A symbolic pointerconstant
+offset
to a symbol that exists outside the binaryHLIL_FLOAT_CONST
 A floating point constantconstant
HLIL_IMPORT
 Aconstant
integral value representing an imported addressHLIL_LOW_PART
size
bytes from the low end ofsrc
expressionHLIL_STRUCT_FIELD
HLIL_ARRAY_INDEX
HLIL_SPLIT
 A split pair of variableshigh
:low
which can be used a single expressionHLIL_DEREF
 Dereferencessrc
HLIL_DEREF_FIELD

Arithmetic Operations¶
HLIL_ADD
 Addsleft
expression toright
expressionHLIL_ADC
 Adds with carry theleft
expression to theright
expression with carry from thecarry
expressionHLIL_SUB
 Subtracts theright
expression from theleft
expressionHLIL_SBB
 Subtraction with borrow theright
expression from theleft
expression with carry from thecarry
expressionHLIL_AND
 Bitwise ANDleft
expression with theright
expressionHLIL_OR
 Bitwise ORleft
expression with theright
expressionHLIL_XOR
 Bitwise XORleft
expression with theright
expressionHLIL_LSL
 Logical shift left theleft
expression by the number of bits stored in theright
expressionHLIL_LSR
 Logical shift right theleft
expression by the number of bits stored in theright
expressionHLIL_ASR
 Arithmetic shift right theleft
expression by the number of bits stored in theright
expressionHLIL_ROL
 Rotate left theleft
expression by the number of bits stored in theright
expressionHLIL_RLC
 Rotate left with carry theleft
expression and thecarry
expression by the number of bits stored in theright
expressionHLIL_ROR
 Rotate right theleft
expression by the number of bits stored in theright
expressionHLIL_RRC
 Rotate right with carry theleft
expression and thecarry
expression by the number of bits stored in theright
expressionHLIL_MUL
 Singleprecision multiply theleft
expression with theright
expressionHLIL_MULU_DP
 Doubleprecision unsigned multiply theleft
expression with theright
expression, result expression is twice the size of the input expressionsHLIL_MULS_DP
 Doubleprecision signed multiply theleft
expression with theright
expression, result expression is twice the size of the input expressionsHLIL_DIVU
 Unsigned singleprecision divideleft
expression by theright
expressionHLIL_DIVU_DP
 Unsigned doubleprecision divideleft
expression by theright
expressionHLIL_DIVS
 Signed singleprecision divideleft
expression by theright
expressionHLIL_DIVS_DP
 Signed doubleprecision divideleft
expression by theright
expressionHLIL_MODU
 Unsigned singleprecision modulus ofleft
expression by theright
expressionHLIL_MODU_DP
 Unsigned doubleprecision modulus ofleft
expression by theright
expressionHLIL_MODS
 Signed singleprecision modulus ofleft
expression by theright
expressionHLIL_MODS_DP
 Signed doubleprecision modulus ofleft
expression by theright
expressionHLIL_NEG
 Sign inversion ofsrc
expressionHLIL_NOT
 Bitwise inversion ofsrc
expressionHLIL_FADD
 IEEE754 floating point addition ofleft
expression withright
expressionHLIL_FSUB
 IEEE754 floating point subtraction ofleft
expression withright
expressionHLIL_FMUL
 IEEE754 floating point multiplication ofleft
expression withright
expressionHLIL_FDIV
 IEEE754 floating point division ofleft
expression withright
expressionHLIL_FSQRT
 IEEE754 floating point square root ofleft
expression withright
expressionHLIL_FNEG
 IEEE754 floating point sign negation ofsrc
expressionHLIL_FABS
 IEEE754 floating point absolute value ofsrc
expressionHLIL_FLOAT_TO_INT
 IEEE754 floating point to integer conversion ofsrc
expressionHLIL_INT_TO_FLOAT
 Integer to IEEE754 floating point conversion ofsrc
expressionHLIL_FLOAT_CONV
 Convert bytes insrc
expression to IEEE754 floating pointHLIL_ROUND_TO_INT
 Rounds the IEEE754 floating point numbersrc
expressionHLIL_FLOOR
 Computes the floating point floor of the IEEE754 number insrc
HLIL_CEIL
 Computes the floating point floor of the IEEE754 number insrc
HLIL_FTRUNC
 Computes the floating point truncation of the IEEE754 number insrc
HLIL_SX
 Sign extends thesrc
expressionHLIL_ZX
 Zero extends thesrc
expressionHLIL_ADD_OVERFLOW
 Calculates overflow of the addition ofleft
expression withright
expressionHLIL_BOOL_TO_INT
 Converts a boolsrc
to an integer
Comparison Instructions¶
HLIL_CMP_E
 Compare expression evaluates to true ifleft
expression is equal toright
HLIL_CMP_NE
 Compare expression evaluates to true ifleft
expression is not equal toright
HLIL_CMP_SLT
 Compare expression evaluates to true ifleft
expression is signed less thanright
HLIL_CMP_ULT
 Compare expression evaluates to true ifleft
expression is unsigned less thanright
HLIL_CMP_SLE
 Compare expression evaluates to true ifleft
expression is signed less than or equal toright
HLIL_CMP_ULE
 Compare expression evaluates to true ifleft
expression is unsigned less than or equal toright
HLIL_CMP_SGE
 Compare expression evaluates to true ifleft
expression is signed greater than or equal toright
HLIL_CMP_UGE
 Compare expression evaluates to true ifleft
expression is unsigned greater than or equal toright
HLIL_CMP_SGT
 Compare expression evaluates to true ifleft
expression is signed greater thanright
HLIL_CMP_UGT
 Compare expression evaluates to true ifleft
expression is unsigned greater thanright
HLIL_TEST_BIT
 Test if bitright
in expressionleft
is setHLIL_FCMP_E
 Floating point compare expressions  evaluates to true ifleft
expression is equal toright
HLIL_FCMP_NE
 Floating point compare expressions  evaluates to true ifleft
expression is not equal toright
HLIL_FCMP_LT
 Floating point compare expressions  evaluates to true ifleft
expression is less thanright
HLIL_FCMP_LE
 Floating point compare expressions  evaluates to true ifleft
expression is less than or equal toright
HLIL_FCMP_GE
 Floating point compare expressions  evaluates to true ifleft
expression is greater than or equal toright
HLIL_FCMP_GT
 Floating point compare expressions  evaluates to true ifleft
expression is greater thanright
HLIL_FCMP_O
 Floating point compare expressions  evaluates to true if bothleft
andright
expressions are ordered (not NaN)HLIL_FCMP_UO
 Floating point compare expressions  evaluates to true if eitherleft
orright
expression is unordered (NaN)
Miscellaneous Instructions¶
HLIL_NOP
 No operationHLIL_BP
 Breakpoint instructionHLIL_TRAP
 Interrupt/trap instruction withvector
expressionHLIL_INTRINSIC
 Intrinsic instruction defined by the architectureHLIL_UNDEF
 The expression performs undefined behaviorHLIL_UNIMPL
 The expression is not implementedHLIL_UNIMPL_MEM
 The expression is not implemented but does accesssrc
memoryHLIL_BLOCK
HLIL_LABEL
HLIL_UNREACHABLE
