pypcode

3.3.3 verified Fri May 01 auth: no python

pypcode is a Python binding for Ghidra's SLEIGH library, providing machine code disassembly and intermediate representation (IR) translation. Version 3.3.3 supports Python >=3.10. Development on GitHub under the angr project, with periodic releases aligned with Ghidra updates.

pip install pypcode

Common errors

error ImportError: cannot import name 'open' from 'pypcode' ↓

cause pypcode 3.x removed the 'open' function.

fix

Use 'pypcode.Context.by_name()' and 'ctx.set_spec()' instead.

error AttributeError: module 'pypcode' has no attribute 'Arch' ↓

cause The 'Arch' module may not be imported implicitly; also possible version mismatch.

fix

Ensure you have installed pypcode >=3.0.0 and use 'import pypcode; pypcode.Arch.list()'.

error RuntimeError: Failed to load spec for x86:LE:64:default ↓

cause The spec name is incorrect or the required SLEIGH files are missing (especially when using custom specs).

fix

Use correct spec name from 'pypcode.Arch.list()' or install Ghidra processor specs if using custom ones.

Warnings

breaking pypcode 3.x changed the API significantly from 2.x. The old 'pypcode.open()' function is removed. Use 'pypcode.Context' instead. ↓

fix Replace calls to pypcode.open() with pypcode.Context.by_name() and related methods.

breaking The 'pypcode.Arch' module no longer directly provides architecture constants. Use 'pypcode.Arch.list()' and select by name. ↓

fix Instead of 'from pypcode.Arch import x86', use 'pypcode.Context.by_name("x86:LE:64:default")'.

gotcha The 'disassemble()' method expects raw bytes as a bytes object. Passing a string will fail silently or raise confusing errors. ↓

fix Ensure you pass a bytes-like object (e.g., bytes.fromhex('...') or b'...').

deprecated The method 'get_disassembly()' is deprecated in favor of 'disassembly_lines()' or 'disassembly_iter()'. ↓

fix Use 'ctx.disassembly_lines()' to get a list of strings, or 'ctx.disassembly_iter()' for an iterator.

Imports

pypcode
wrong
```
from pypcode import *
```
correct
```
import pypcode
```
Wildcard imports are discouraged and may pollute the namespace.
pypcode.Arch
```
from pypcode import Arch
```
Direct import of Arch class as used in quickstart.
pypcode.Context
```
from pypcode import Context
```
Context is the core disassembly object.

Quickstart

Initialize a disassembly context for x86-64, disassemble a few bytes, and print the disassembly.

import pypcode

# List supported architectures
print(pypcode.Arch.list())

# Create a context for x86-64 (default little endian)
ctx = pypcode.Context.by_name("x86:LE:64:default")

# Set the spec (architecture specification)
ctx.set_spec("x86:LE:64:default")

# Disassemble some bytes
code = bytes([0x48, 0x89, 0xe5, 0x48, 0x83, 0xec, 0x10])
ctx.disassemble(code, base=0x4000)

# Get disassembly lines
for line in ctx.disassembly_lines():
    print(line)