---
id: pypcode
version: "4.0.0"
license: BSD-2-Clause AND Apache-2.0 AND Zlib
license_treatment: permissive
maintenance: active
---

# pypcode — Machine code disassembly and IR translation library

License: permissive · Maintenance: active · Downloads: 296.2K/mo

## What it is and what it does

pypcode is a Python binding to the SLEIGH disassembly library from Ghidra, enabling programmatic analysis of machine code. It translates binary instructions into an intermediate representation (IR) suitable for further analysis, symbolic execution, or reverse engineering. The library was designed primarily for use with angr, which layers symbolic execution and program analysis on top of pypcode's IR output.

The package supports current Python versions (3.12–3.14) and is distributed as precompiled wheels across major platforms and architectures, eliminating the need to build SLEIGH from source. It has no runtime dependencies beyond Python itself, making installation straightforward. Active maintenance and a growing user base (214 repository stars) suggest stable, ongoing development.

Use it for:

- Reverse engineering and analyzing compiled binaries programmatically without manual disassembly.
- Building symbolic execution pipelines with angr using pypcode's IR as the foundation.
- Cross-platform binary analysis workflows that need consistent IR representation across architectures.
- Security research and vulnerability analysis requiring machine code inspection and transformation.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

pypcode provides machine code disassembly and intermediate representation (IR) translation for Python, using the SLEIGH library from Ghidra to convert binary code into analyzable IR.

Yes, if you need programmatic binary disassembly and IR translation. pypcode is actively maintained, permissively licensed, has no external runtime dependencies, and integrates directly with angr for symbolic execution. Install friction is moderate but manageable via precompiled wheels. No known vulnerabilities. Not necessary if you only need command-line disassembly or don't work with binary analysis.

## Install

pip install pypcode
uv add pypcode
poetry add pypcode

## Installing pypcode

Before you install: Medium install friction due to compiled wheels for multiple Python versions (3.12–3.14) and architectures. Active maintenance with a recent release (90 days ago) and ongoing repository activity; no runtime dependencies to manage.

License in practice: Triple-licensed under BSD-2-Clause, Apache-2.0, and Zlib (permissive). All three are business-friendly; you may use, modify, and distribute the package under any of these terms.

Quickstart:

pip install pypcode
import pypcode
# Use pypcode with angr or standalone for disassembly and IR translation

Requires Python 3.12 or later; precompiled wheels available for macOS (x86_64, arm64), Linux (x86_64, aarch64), and Windows (amd64).

Verify before relying:

- Specific IR translation capabilities and supported architectures beyond what SLEIGH provides.
- Performance characteristics and scalability for large binaries.
- Integration depth and API stability with angr's symbolic execution framework.

## Package facts

- License: BSD-2-Clause AND Apache-2.0 AND Zlib (permissive)
- Python support: supports_current
- Install friction: medium
- Maintenance: active
- Downloads: 296.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

machine code disassembly python, binary code analysis IR translation, ghidra sleigh python binding, reverse engineering disassembler, p-code intermediate representation, reverse-engineering, binary-analysis, symbolic-execution

[View on SkillFed](https://skillfed.io/packages/pypcode) · [View on PyPI](https://pypi.org/project/pypcode/)