{"id":24370,"library":"pypcode","title":"pypcode","description":"pypcode is a Python binding for Ghidra's SLEIGH library, providing machine code disassembly and intermediate representation (IR) translation. Version 3.3.3 supports Python >=3.10. Development on GitHub under the angr project, with periodic releases aligned with Ghidra updates.","status":"active","version":"3.3.3","language":"python","source_language":"en","source_url":"https://github.com/angr/pypcode","tags":["disassembly","ghidra","sleigh","ir","binary-analysis"],"install":[{"cmd":"pip install pypcode","lang":"bash","label":"Install from PyPI"}],"dependencies":[{"reason":"Required for parsing SLEIGH specs during build","package":"pycparser","optional":false}],"imports":[{"note":"Wildcard imports are discouraged and may pollute the namespace.","wrong":"from pypcode import *","symbol":"pypcode","correct":"import pypcode"},{"note":"Direct import of Arch class as used in quickstart.","symbol":"pypcode.Arch","correct":"from pypcode import Arch"},{"note":"Context is the core disassembly object.","symbol":"pypcode.Context","correct":"from pypcode import Context"}],"quickstart":{"code":"import pypcode\n\n# List supported architectures\nprint(pypcode.Arch.list())\n\n# Create a context for x86-64 (default little endian)\nctx = pypcode.Context.by_name(\"x86:LE:64:default\")\n\n# Set the spec (architecture specification)\nctx.set_spec(\"x86:LE:64:default\")\n\n# Disassemble some bytes\ncode = bytes([0x48, 0x89, 0xe5, 0x48, 0x83, 0xec, 0x10])\nctx.disassemble(code, base=0x4000)\n\n# Get disassembly lines\nfor line in ctx.disassembly_lines():\n    print(line)","lang":"python","description":"Initialize a disassembly context for x86-64, disassemble a few bytes, and print the disassembly."},"warnings":[{"fix":"Replace calls to pypcode.open() with pypcode.Context.by_name() and related methods.","message":"pypcode 3.x changed the API significantly from 2.x. The old 'pypcode.open()' function is removed. Use 'pypcode.Context' instead.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Instead of 'from pypcode.Arch import x86', use 'pypcode.Context.by_name(\"x86:LE:64:default\")'.","message":"The 'pypcode.Arch' module no longer directly provides architecture constants. Use 'pypcode.Arch.list()' and select by name.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Ensure you pass a bytes-like object (e.g., bytes.fromhex('...') or b'...').","message":"The 'disassemble()' method expects raw bytes as a bytes object. Passing a string will fail silently or raise confusing errors.","severity":"gotcha","affected_versions":"all"},{"fix":"Use 'ctx.disassembly_lines()' to get a list of strings, or 'ctx.disassembly_iter()' for an iterator.","message":"The method 'get_disassembly()' is deprecated in favor of 'disassembly_lines()' or 'disassembly_iter()'.","severity":"deprecated","affected_versions":">=3.3.0"}],"env_vars":null,"last_verified":"2026-05-01T00:00:00.000Z","next_check":"2026-07-30T00:00:00.000Z","problems":[{"fix":"Use 'pypcode.Context.by_name()' and 'ctx.set_spec()' instead.","cause":"pypcode 3.x removed the 'open' function.","error":"ImportError: cannot import name 'open' from 'pypcode'"},{"fix":"Ensure you have installed pypcode >=3.0.0 and use 'import pypcode; pypcode.Arch.list()'.","cause":"The 'Arch' module may not be imported implicitly; also possible version mismatch.","error":"AttributeError: module 'pypcode' has no attribute 'Arch'"},{"fix":"Use correct spec name from 'pypcode.Arch.list()' or install Ghidra processor specs if using custom ones.","cause":"The spec name is incorrect or the required SLEIGH files are missing (especially when using custom specs).","error":"RuntimeError: Failed to load spec for x86:LE:64:default"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}