ESIL(7)

🦋 ESIL(7) — Evaluable Strings Intermediate Language 🦋

🌸 NAME 🌸

ESIL — Evaluable Strings Intermediate Language

---

✨ SYNOPSIS ✨

Okay so ESIL — that's Evaluable Strings Intermediate Language — gives you an abstract, stack-based format for representing CPU instruction semantics across all kinds of architectures. It makes instruction emulation for analysis and debugging inside the radare2 framework happen. Iconic behavior, honestly. 💅

---

💖 DESCRIPTION 💖

Evaluable Strings Intermediate Language (ESIL) uses a Forth-like syntax, and it gives you a way to describe and emulate what machine instructions do in a platform-agnostic manner. It is especially useful in reverse engineering, letting you do cross-architecture binary analysis and exploitation through radare2. Obsessed. 🦋

At its core, ESIL is a stack-based language where operations manipulate values on a stack. Each CPU instruction gets translated into an ESIL expression that models its behavior. This abstraction layer lets radare2 emulate code execution without actually running it, which is invaluable for analyzing untrusted binaries or understanding complex code flows. No cap, that's the whole vibe. 🔥

---

🎀 SYNTAX 🎀

ESIL expressions use a series of operands and operations, manipulating values on an internal stack. These expressions are executed inside an ESIL virtual machine (VM), which enables simulation of CPU instructions' effects on registers and memory. ✨

The basic components of ESIL syntax are:

• Uppercase words are special keywords that operate on the ESIL VM (e.g., POP, DUP, TRAP)
• Lowercase words are register names that can be used for reading or writing through operations
• Words starting with $ represent internal variables of the VM that are readonly (e.g., $z for zero flag)
• Numbers can be in base 10 or hexadecimal (with 0x prefix)
• Operations are separated by commas
• Results are pushed onto the stack or written to registers/memory

The rest of keywords can be added or removed via ESIL or architecture plugins, but this document describes the common and standard ESIL commands. 🫶

---

🦋 USING ESIL IN RADARE2 🦋

radare2 provides several ways to work with ESIL:

• The e asm.esil=true option displays ESIL expressions alongside assembly instructions
• The e emu.str=true option enables string emulation during analysis
• The ae command family provides ways to evaluate and debug ESIL expressions
• Visual mode offers ESIL debugging capabilities through the VdE command

These features allow users to inspect register states, memory modifications, and operation flow without actually executing the binary code on the CPU. Literally the whole point. 💀

---

💅 ESIL COMMANDS 💅

radare2 leverages ESIL for detailed emulation of instruction execution, enabling users to step through instructions, inspect changes to registers and memory, and evaluate conditional logic in a controlled environment. It's giving microscope for code. 🔬

Here are the most commonly used ESIL-related commands:

• ae [expr] — evaluate an ESIL expression. Note that some expressions contain special characters that can be evaluated by the radare2 shell, so it's better to prefix the command with a single quote ' to skip that parsing.
• aei — initialize the ESIL VM state (required before emulation)
• aeim — initialize ESIL VM stack memory
• aeip — initialize ESIL program counter to current offset
• aer — show or modify ESIL registers
• aes — ESIL Step: execute a single step in ESIL emulation
• aeso — ESIL Step Over: perform a step over call instructions in ESIL emulation
• aesu [addr] — ESIL Step Until: continue ESIL execution until a specified address is reached
• aev [expr] — enter the interactive visual debugger to debug and emulate an ESIL expression

Typical workflow for ESIL emulation:

aei      # Initialize ESIL VM state
aeim     # Initialize memory for ESIL VM
aeip     # Set program counter to current address
aes      # Start stepping through instructions

---

🔥 ESIL OPERATION CATEGORIES 🔥

The comma-separated words in an ESIL expression can be grouped into different categories:

Internal flags

Prefixed with $, they represent internal states of the ESIL VM and are used to perform conditional operations:

• $z — Zero flag: set when result is zero
• $c — Carry flag: set when operation produces a carry
• $b — Borrow flag: set when operation requires a borrow
• $p — Parity flag: set when result has even parity
• $s — Sign flag: set when result is negative
• $o — Overflow flag: set when result overflows
• $$ — current address being executed
• $ds, $jt, $js — used for delay slots and jump targeting

Assignment operations

Pop value and destination from stack and perform assignment:

• = — strong assignment (updates flags)
• := — weak assignment (no flag updates)

Arithmetic and binary operations

Basic math operations:

• + — addition
• - — subtraction
• * — multiplication
• L* — long multiplication (128-bit result)
• / — division
• ~/ — signed division
• % — modulo
• ~% — signed modulo
• ~ — sign extension
• & — bitwise AND
• | — bitwise OR
• ^ — bitwise XOR
• ! — logical NOT
• << — left shift
• >> — right shift
• ROL — rotate left
• ROR — rotate right
• ASR — arithmetic shift right, signed at the width of the value's register
• CLZ — count leading zeros of a value within an explicit width
• POPCNT — count the set bits of a value

An operation takes an explicit leading width operand only when its result depends on that width: CLZ does (the count for 1 is 31 at width 32 and 63 at width 64), POPCNT does not.

The shifts are total: <<, >> and ASR by a count of 64 or more push 0, 0 and the sign fill respectively, and ASR of a register by its width or more pushes the sign fill.

Comparison operations

Compare values and set flags:

• == — equality comparison
• < — less than
• <= — less than or equal
• > — greater than
• >= — greater than or equal

Control flow

Conditional expressions and flow control:

• ?{ — if condition, execute next block if top of stack is non-zero
• } — end of conditional block
• }{ — else statement
• GOTO — jump to specified location
• BREAK — stop execution

Memory access

Read from or write to memory:

• Reading: [1], [2], [4], [8], [16] — read 1, 2, 4, 8, or 16 bytes
• Writing: =[1], =[2], =[4], =[8], =[16] — write 1, 2, 4, 8, or 16 bytes
• Combined: |=[2], +=[4], &=[4], --=[2] — read-modify-write operations
• Special: [*], =[*] — variable size operations

Stack manipulation

Special operations to manage the ESIL stack:

• STACK — display stack contents
• POP — remove top value
• DUP — duplicate top value
• NUM — push number or register value
• SWAP — swap top two values
• ROT — rotate the third stack element to the top: [x,y,z] becomes [y,z,x]
• CLEAR — empty the stack

Special operations

• () — syscall
• $ — hardware interrupt
• #! — execute radare2 command
• TRAP — CPU trap
• BITS — change bits mode

Floating point operations

• NAN — check if value is Not-a-Number
• I2D, U2D — convert integer to double (signed, unsigned)
• D2I — convert double to integer
• D2F, F2D — convert between double and float
• F==, F!=, F<, F<= — floating point comparisons
• F+, F-, F*, F/ — floating point arithmetic
• -F — negate floating point value
• CEIL, FLOOR, ROUND — rounding operations
• SQRT — square root

---

🌈 UNDERSTANDING ESIL EXPRESSIONS 🌈

ESIL expressions are evaluated from left to right, with values being pushed onto or popped from a stack. The following examples demonstrate how common CPU instructions translate to ESIL:

mov eax, 0x3

Simply assigns the value 3 to register eax:

3,eax,=

add ebx, eax

Adds the value in eax to ebx and stores the result in ebx:

eax,ebx,+=

This is equivalent to the longer form:

eax,ebx,+,ebx,=

xor eax, eax

Performs XOR on eax with itself (effectively zeroing it):

eax,eax,^=

mov byte [ebx], 0x3

Writes the value 3 to the memory address in ebx:

3,ebx,=[1]

test eax, eax

Sets flags based on eax value (primarily the zero flag):

eax,eax,&,zf,=

jz 0x123456

Jumps to address if zero flag is set:

zf,?{,0x123456,eip,=,}

---

👑 VISUAL ESIL DEBUGGER 👑

radare2 provides a visual ESIL debugger that allows stepping through ESIL expressions to understand exactly how they work. This is accessed through the aev command or in visual mode with VdE. 🧚

The visual ESIL debugger offers several advantages:

• Step-by-step execution of ESIL expressions
• Visualization of the stack after each operation
• Inspection of register and flag changes
• Memory access monitoring
• Finer-grained control than regular ESIL emulation

When using the visual ESIL debugger, you can use the following controls:

• s — step forward one ESIL operation
• r — reset the ESIL VM state
• q — quit the debugger

This tool is particularly useful for understanding complex instructions or when debugging emulation issues.

🌸 PRACTICAL USAGE EXAMPLES 🌸

okay bestie, this is the part where it stops being theory and starts being hands on keyboard 💅 here's how you actually use ESIL in radare2 for analysis and debugging, fr fr:

✨ Basic ESIL evaluation ✨

so to evaluate a simple ESIL expression, you just hit it with:

[0x00000000]> ae 1,1,+
2

and boom, it gives you 2 back — math is mathing 🔥

---

🎀 Step-by-step emulation 🎀

to emulate a function and actually see the register changes happen, do this little ritual in order:

[0x00000000]> aei      # Initialize ESIL VM
[0x00000000]> aeim     # Initialize memory
[0x00000000]> aeip     # Set PC to current address
[0x00000000]> aes      # Step one instruction
[0x00000000]> aer      # View registers

like, aei wakes the VM up, aeim gives it a memory to live in, aeip points the PC at the current address, aes steps one (1) single instruction, and aer is your vibe check for the registers 🫶 so iconic honestly

---

🦋 ESIL debugging of an expression 🦋

wanna debug a complex ESIL expression with the visual debugger? just:

[0x00000000]> aev 1,5,+,eax,=

the visual debugger ate that assignment expression up, no cap ✨

---

💜 Conditional emulation 💜

to emulate until a condition is met:

[0x00000000]> aecu 0x4000  # Continue until address 0x4000

it just keeps going until it reaches 0x4000, periodt 💅

---

👑 R2WARS 👑

okay so this is literally the fun one — a code-wars-like game built on top of ESIL, used at the r2con conference 🔥 players write small programs that compete in a virtual arena, and the ESIL VM is the one executing and evaluating their behavior. main character energy for the VM honestly 😭

more info: https://github.com/radareorg/r2wars

---

⭐ SEE ALSO ⭐

• radare2(1)

---

🌈 WWW 🌈

https://www.radare.org/

---

💖 AUTHORS 💖

• pancake <pancake@nopcode.org>

---

k that's the whole page bestie, you're officially ESIL-pilled 🧚💫 and just so you have the receipts: this was ESIL(7) from August 26, 2026 — go forth and emulate, love u 💜🌸