pypcode

library4.0.0pypypi✓ verified 86d ago

pypcode is a Python binding for Ghidra's SLEIGH library, providing machine code disassembly and intermediate representation (IR) translation. Version 3.3.3 supports Python >=3.10. Development on GitHub under the angr project, with periodic releases aligned with Ghidra updates.

data devops

pip install pypcode

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · PYPCODE

pypcode

datapythonv4.0.0

Install

2.9s avg

Import

60ms

Disk

131MB

Pass rate

5/ 10

Env Coverage5 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v3.3.3 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

build_error

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 2.9s · import 0.060s · 49MB

131MB installed

● package 131MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

pypcode

✓ import pypcode

✗ from pypcode import *

Wildcard imports are discouraged and may pollute the namespace.

pypcode.Arch

✓ from pypcode import Arch

Direct import of Arch class as used in quickstart.

pypcode.Context

✓ from pypcode import Context

Context is the core disassembly object.

Initialize a disassembly context for x86-64, disassemble a few bytes, and print the disassembly.

import pypcode # List supported architectures print(pypcode.Arch.list()) # Create a context for x86-64 (default little endian) ctx = pypcode.Context.by_name("x86:LE:64:default") # Set the spec (architecture specification) ctx.set_spec("x86:LE:64:default") # Disassemble some bytes code = bytes([0x48, 0x89, 0xe5, 0x48, 0x83, 0xec, 0x10]) ctx.disassemble(code, base=0x4000) # Get disassembly lines for line in ctx.disassembly_lines(): print(line)

Debug

Known issues

breakingpypcode 3.x changed the API significantly from 2.x. The old 'pypcode.open()' function is removed. Use 'pypcode.Context' instead.

fix

Replace calls to pypcode.open() with pypcode.Context.by_name() and related methods.

affects: >=3.0.0

breakingThe 'pypcode.Arch' module no longer directly provides architecture constants. Use 'pypcode.Arch.list()' and select by name.

fix

Instead of 'from pypcode.Arch import x86', use 'pypcode.Context.by_name("x86:LE:64:default")'.

affects: >=3.0.0

gotchaThe 'disassemble()' method expects raw bytes as a bytes object. Passing a string will fail silently or raise confusing errors.

fix

Ensure you pass a bytes-like object (e.g., bytes.fromhex('...') or b'...').

affects: all

deprecatedThe method 'get_disassembly()' is deprecated in favor of 'disassembly_lines()' or 'disassembly_iter()'.

fix

Use 'ctx.disassembly_lines()' to get a list of strings, or 'ctx.disassembly_iter()' for an iterator.

affects: >=3.3.0

Errors

Common errors & fixes

ImportError: cannot import name 'open' from 'pypcode'

pypcode 3.x removed the 'open' function.

fix

Use 'pypcode.Context.by_name()' and 'ctx.set_spec()' instead.

AttributeError: module 'pypcode' has no attribute 'Arch'

The 'Arch' module may not be imported implicitly; also possible version mismatch.

fix

Ensure you have installed pypcode >=3.0.0 and use 'import pypcode; pypcode.Arch.list()'.

RuntimeError: Failed to load spec for x86:LE:64:default

The spec name is incorrect or the required SLEIGH files are missing (especially when using custom specs).

fix

Use correct spec name from 'pypcode.Arch.list()' or install Ghidra processor specs if using custom ones.

Upgrade

Version history

4.0.0latest on PyPI · released May 16, 2026

Audit

Dependencies

pycparserrequiredRequired for parsing SLEIGH specs during build

Agent activity

11 hits · last 30 days

node

Resources

githubhttps://github.com/angr/pypcode ↗

packagehttps://pypi.org/project/pypcode/ ↗

homepagehttps://api.angr.io/projects/pypcode/en/latest/ ↗