Symbols (malcat.syms)

malcat.syms: bindings.CrossReferences

The malcat.syms object is a bindings.Symbols instance that gives you access to all the symbols defined inside tha analysis.

Note that in addition to this documentation, you can find usage examples in the sample script which is loaded when you hit F8.

Accessing / enumerating symbols

class bindings.Symbols
__iter__()

Iterate over all the symbols

for sym in itertools.islice(malcat.syms, 5):
    print(f"* 0x{malcat.map.to_virt(sym.address):x} = {sym.name} ({sym.type})")
Return type

iterator over Symbol

__getitem__(interval)

Iterate over all the cross-references contained in the interval (effective address):

text = malcat.map[".text"]
for sym in malcat.syms[text.start : text.end]:
    print(f"* 0x{malcat.map.to_virt(sym.address):x} = {sym.name} ({sym.type})")
Parameters

interval (slice) – effective address interval

Return type

iterator over References

__getitem__(name)

Returns the effective address of the first symbol named name or None if no symbol named name is defined

ep_address = malcat.syms["EntryPoint"]
print(f"Entry point defined at 0x{ malcat.map.to_virt(ep_address):x}")
Parameters

name (str) – name of the symbol to query

Return type

int or None

__getitem__(ea)

Returns the list of Symbol defined at the effective address ea.

ep_address = malcat.syms["EntryPoint"]
print(f"* List of symbols defined at 0x{ malcat.map.to_virt(ep_address):x}:")
for sym in malcat.syms[ep_address]:
    print(f"    * 0x{malcat.map.to_virt(sym.address):x} = {sym.name} ({sym.type})")
Parameters

ea (int) – effective address

Return type

List[Symbol]

__contains__(name)

return True iff there is at least one symbol named name defined

Parameters

name (str) – symbol name to query

Return type

bool

__contains__(ea)

return True iff there is at least one symbol defined at the effective address ea

Parameters

ea (int) – address to query

Return type

bool

__len__()

return the number of addresses where at least one symbol is defined

if len(malcat.syms) == 0:
    raise ValueError("No symbol defined!")
Return type

int

number_of_imports: int

total number of bindings.Symbol.Type.IMPORT symbols

number_of_exports: int

total number of bindings.Symbol.Type.EXPORT symbols

number_of_functions: int

total number of bindings.Symbol.Type.FUNCTION symbols

number_of_variables: int

total number of bindings.Symbol.Type.VARIABLE symbols

number_of_typedefs: int

total number of bindings.Symbol.Type.TYPEDEF symbols

number_of_entrypoints: int

total number of bindings.Symbol.Type.ENTRY symbols

number_of_labels: int

total number of bindings.Symbol.Type.LABEL symbols

Symbol definition

In Malcat, symbols are just named addresses. They also have a category, the one you can see in the Symbols list view.

class bindings.Symbol

A single symbol, which is nothing more than a named address

address: int (effective address)

effective address of the symbol

name: str

name of the symbol

type: bindings.Symbol.Type

type/category of the symbol. Can be any of:

The type/category of symbols has the following meaning:

class bindings.Symbol.Type
FUNCTION

the start of a function definition. This symbol is only set for functions having a name, set by a FLIRT signature for instance, of via debug information

ENTRY

an entry point of the program. Note that more than one ENTRY symbol can exist (for instance a .NET program has a PE entry point and a .NET entry point symbols)

EXPORT

an exported function definition or exported variable

IMPORT

an imported function address. Note thatfor PE imports, the impport name will be of the form kernel32.VirtualProtect: dll in lowercase without extension followed by a dot and the API name.

LABEL

an arbitary named address, can be anything. can be set by the user.

TYPEDEF

a type definition, e.g. a TypeDef entry in .NET, or an RTTI vtable

VARIABLE

a variable definition