Document the difference between the AST and non AST versions of HLIL

[v-p-b]

Version and Platform (required):

• Binary Ninja Version: 5.2.8286-dev
• Edition: Non-Commercial
• OS: Ubuntu Linux (running with this Dockerfile)
• OS Version: 24.04 LTS
• CPU Architecture: x64

Bug Description:

Disassembly settings are ignored when using the HighLevelILInstruction.get_lines() function:

settings = function.DisassemblySettings.default_linear_settings()
settings.set_option(DisassemblyOption.ShowAddress)
settings.set_option(DisassemblyOption.IndentHLILBody)

for func in bv.functions:
    hlil = func.high_level_il
    for hli in hlil.instructions:
        for hl_line in hli.get_lines(settings):
            print("".join([t.text for t in hl_line.tokens]))

The resulting output doesn't show indents or addresses. The same settings object works with LinearViewObject.hlil(...)

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

1. Run the previous script (you can use the container linked above, but I don't think it matters)
2. Observe that the requested data (addresses, indentation) is not present in the output

Expected Behavior:
I expect DisassemblySettings being applied on the output token list.

Screenshots/Video Recording:
N/A

Binary:
N/A

Additional Information:

N/A

[plafosse]

The problem here is that there are two forms of HLIL one is AST form the one you see in linear view and the other is the graph representation that you see in graph view. You're iterating the one from graph view which doesn't contain indentation and ignores those. You need to iterate hlil.root

>>> for a in current_function.hlil.root:
...  print(a)
... 
int64_t x8 = *___stack_chk_guard
_strlen(*arg2)
void var_20
void* __s = &var_20 - ((___chkstk_darwin() + 0xf) & 0xfffffffffffffff0)
__builtin_strcpy(__s, "Hello, world!\n")
uint64_t result = _strlen(__s)
if (*___stack_chk_guard == x8)
    return result
___stack_chk_fail()
noreturn

[v-p-b]

Thanks, TIL! I searched for a solution for a long time but didn't stumble upon anything describing this difference. Is my search-fu (and LLM prompts) weak or maybe the documentation could be improved?

[plafosse]

Good point! This concept should absolutely be covered by https://docs.binary.ninja/dev/bnil-hlil.html I'll re-open as a documentation issue.

What should be covered:

• The over all concept of how/why there are two different representations
• How to go from ast to non-ast versions of the same instruction
• How to get root ast node
• Others?