Symbols (malcat.syms)

malcat.syms: bindings.CrossReferences

The malcat.syms object is a bindings.Symbols instance that gives you access to all the symbols defined inside tha analysis.

Note that in addition to this documentation, you can find usage examples in the sample script which is loaded when you hit F8.

Accessing / enumerating symbols

class bindings.Symbols

Iterate over all the symbols

for sym in itertools.islice(malcat.syms, 5):
    print(f"* 0x{} = {} ({sym.type})")
Return type

iterator over Symbol


Iterate over all the cross-references contained in the interval (effective address):

text =[".text"]
for sym in malcat.syms[text.start : text.end]:
    print(f"* 0x{} = {} ({sym.type})")

interval (slice) – effective address interval

Return type

iterator over References


Returns the effective address of the first symbol named name or None if no symbol named name is defined

ep_address = malcat.syms["EntryPoint"]
print(f"Entry point defined at 0x{}")

name (str) – name of the symbol to query

Return type

int or None


Returns the list of Symbol defined at the effective address ea.

ep_address = malcat.syms["EntryPoint"]
print(f"* List of symbols defined at 0x{}:")
for sym in malcat.syms[ep_address]:
    print(f"    * 0x{} = {} ({sym.type})")

ea (int) – effective address

Return type



return True iff there is at least one symbol named name defined


name (str) – symbol name to query

Return type



return True iff there is at least one symbol defined at the effective address ea


ea (int) – address to query

Return type



return the number of addresses where at least one symbol is defined

if len(malcat.syms) == 0:
    raise ValueError("No symbol defined!")
Return type


number_of_imports: int

total number of bindings.Symbol.Type.IMPORT symbols

number_of_exports: int

total number of bindings.Symbol.Type.EXPORT symbols

number_of_functions: int

total number of bindings.Symbol.Type.FUNCTION symbols

number_of_variables: int

total number of bindings.Symbol.Type.VARIABLE symbols

number_of_typedefs: int

total number of bindings.Symbol.Type.TYPEDEF symbols

number_of_entrypoints: int

total number of bindings.Symbol.Type.ENTRY symbols

number_of_labels: int

total number of bindings.Symbol.Type.LABEL symbols

Symbol definition

In Malcat, symbols are just named addresses. They also have a category, the one you can see in the Symbols list view.

class bindings.Symbol

A single symbol, which is nothing more than a named address

address: int (effective address)

effective address of the symbol

name: str

name of the symbol

type: bindings.Symbol.Type

type/category of the symbol. Can be any of:

The type/category of symbols has the following meaning:

class bindings.Symbol.Type

the start of a function definition. This symbol is only set for functions having a name, set by a FLIRT signature for instance, of via debug information


an entry point of the program. Note that more than one ENTRY symbol can exist (for instance a .NET program has a PE entry point and a .NET entry point symbols)


an exported function definition or exported variable


an imported function address. Note thatfor PE imports, the impport name will be of the form kernel32.VirtualProtect: dll in lowercase without extension followed by a dot and the API name.


an arbitary named address, can be anything. can be set by the user.


a type definition, e.g. a TypeDef entry in .NET, or an RTTI vtable


a variable definition