reaching_definitions
Compute the reaching-definitions graph for a binary function to reveal def-use relationships, showing where each variable was defined and which definitions reach each instruction.
Instructions
Compute the reaching-definitions graph for function.
A reaching definition is "where was the value used at instruction X defined?" angr computes the dataflow analysis statically. The output is a def-use graph: every variable gets a list of definitions; every instruction that reads a variable gets the list of definitions that may reach it.
Useful for the re-mba-deobfuscate skill: the MBA
identity x + y == (x & y) + (x | y) looks like
arithmetic, but the reaching-defs graph reveals that (x & y)
and (x | y) were both defined from the same source — the
identity is a no-op substitution.
Args:
path: PE / ELF / MachO
function: function name (e.g. "main")
Returns::
{"path": "...", "function": "...",
"defs": [{"variable": "...", "defined_at": "0x..."}],
"uses": [{"at": "0x...", "reads": ["var1", "var2"]}]}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| function | Yes |