pypcode

What it is and what it does

pypcode is a Python binding to the SLEIGH disassembly library from Ghidra, enabling programmatic analysis of machine code. It translates binary instructions into an intermediate representation (IR) suitable for further analysis, symbolic execution, or reverse engineering. The library was designed primarily for use with angr, which layers symbolic execution and program analysis on top of pypcode's IR output.

The package supports current Python versions (3.12–3.14) and is distributed as precompiled wheels across major platforms and architectures, eliminating the need to build SLEIGH from source. It has no runtime dependencies beyond Python itself, making installation straightforward. Active maintenance and a growing user base (214 repository stars) suggest stable, ongoing development.

Use it for:

• Reverse engineering and analyzing compiled binaries programmatically without manual disassembly.
• Building symbolic execution pipelines with angr using pypcode's IR as the foundation.
• Cross-platform binary analysis workflows that need consistent IR representation across architectures.
• Security research and vulnerability analysis requiring machine code inspection and transformation.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

pypcode provides machine code disassembly and intermediate representation (IR) translation for Python, using the SLEIGH library from Ghidra to convert binary code into analyzable IR.

Yes, if you need programmatic binary disassembly and IR translation. pypcode is actively maintained, permissively licensed, has no external runtime dependencies, and integrates directly with angr for symbolic execution. Install friction is moderate but manageable via precompiled wheels. No known vulnerabilities. Not necessary if you only need command-line disassembly or don't work with binary analysis.

Install

pypcode on PyPI

pip install pypcode

uv add pypcode

poetry add pypcode

Installing pypcode

Before you install

Medium install friction due to compiled wheels for multiple Python versions (3.12–3.14) and architectures. Active maintenance with a recent release (90 days ago) and ongoing repository activity; no runtime dependencies to manage.

License in practice

Triple-licensed under BSD-2-Clause, Apache-2.0, and Zlib (permissive). All three are business-friendly; you may use, modify, and distribute the package under any of these terms.

Quickstart

pip install pypcode
import pypcode
# Use pypcode with angr or standalone for disassembly and IR translation

Requires Python 3.12 or later; precompiled wheels available for macOS (x86_64, arm64), Linux (x86_64, aarch64), and Windows (amd64).

Verify before relying

• Specific IR translation capabilities and supported architectures beyond what SLEIGH provides.
• Performance characteristics and scalability for large binaries.
• Integration depth and API stability with angr's symbolic execution framework.

Package facts

Evidence: pypcode-4.0.0-cp312-cp312-macosx_10_14_x86_64.whl; pypcode-4.0.0-cp312-cp312-macosx_11_0_arm64.whl; pypcode-4.0.0-cp312-cp312-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl; pypcode-4.0.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl; pypcode-4.0.0-cp312-cp312-win_amd64.whl; pypcode-4.0.0-cp313-cp313-macosx_10_14_x86_64.whl; pypcode-4.0.0-cp313-cp313-macosx_11_0_arm64.whl; pypcode-4.0.0-cp313-cp313-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl; pypcode-4.0.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl; pypcode-4.0.0-cp313-cp313-win_amd64.whl; pypcode-4.0.0-cp314-cp314-macosx_10_15_x86_64.whl; pypcode-4.0.0-cp314-cp314-macosx_11_0_arm64.whl; pypcode-4.0.0-cp314-cp314-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl; pypcode-4.0.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl; pypcode-4.0.0-cp314-cp314-win_amd64.whl

Tags

More Software Development packages