From vulhunt
Find and list functions in binaries by name, address, regex, or byte pattern. Use for binary analysis, locating specific functions, or enumerating matches.
npx claudepluginhub vulhunt-re/skills --plugin vulhuntThis skill uses the workspace's default tool permissions.
Find and list functions in a binary by name, address, or pattern.
Finds function call sites in binaries using VulHunt Lua queries. Useful for analyzing callers of functions, checking call relationships, or identifying API invocations.
Locates functions in target processes by string references, RTTI patterns, behavior via hardware breakpoints, or disassembly. Useful for reverse engineering without symbols.
Share bugs, ideas, or general feedback.
Find and list functions in a binary by name, address, or pattern.
Using the VulHunt MCP tools, open the project (open_project) and run the following Lua query (query_project), adapting it as needed:
local fs = project:functions(<target_function>)
-- Single result (FunctionContext)
if type(fs) ~= "table" then
return {
function_name = tostring(fs.name),
function_address = tostring(fs.address),
function_total_bytes = tostring(fs.total_bytes)
}
end
-- Multiple results (FunctionContext[])
local results = {}
for _, f in ipairs(fs) do
table.insert(results, {
function_name = tostring(f.name),
function_address = tostring(f.address),
function_total_bytes = tostring(f.total_bytes)
})
end
return results
Possible values for <target_function>:
"system"AddressValue.new(0x1234){matching = "<regex>", kind = "symbol", all = true}{matching = "41544155", kind = "bytes", all = true}If no argument is passed to project:functions(), all functions are returned
allis a boolean. If set totrue, it returns a table containing all matching functions. Iffalse(default), it returns only the first matching value. The for loop is not necessary if the function target is only one (i.e.allis not set to true)
Returns a JSON object containing:
function_name is the function namefunction_address is the function addressfunction_total_bytes is the function length in bytes, calculated as the sum of the sizes of all its code blocksIt is also possible to get all functions satisfying certain criteria:
local function search_criteria(f)
return f:named(<target_call>) and f:has_call(<target_call>)
end
local fs = project:functions_where(search_criteria)
Possible values for <target_call>:
"system"AddressValue.new(<hex_addr>) (e.g., <hex_addr> = 0x1234){matching = "<regex>", kind = "symbol"}{matching = "41544155", kind = "bytes"}project<target_call> parameterURLs to additional documentation pages are available at https://vulhunt.re/llm.txt
/decompiler) - Decompile functions to understand their implementation and logic/call-sites) - Find where functions are called and analyze their usage patterns/byte-pattern-matching) - Alternative method to find functions by searching for specific instruction sequences/dataflow-analysis) - Track data flow within functions to detect vulnerabilities