Varnodes

Varnodes are a core concept in certain intermediate representations used by decompilers and binary analysis frameworks, notably the P-code IR employed by Ghidra. A varnode represents a value that can appear as either a storage location or a literal during program analysis. In essence, it is the unit that holds data as it flows through instructions in the IR.

Each varnode has a size and a storage context. The size indicates how many bytes (or bits) the value occupies. The storage context, sometimes called a space or address space, specifies where the value resides, such as a processor register, a memory location, or a constant. Varnodes can thus model both memory-resident values and immediate constants. A constant varnode encodes a literal value without an associated address in memory or a register.

Varnodes participate in data-flow relations within the IR. P-code operations consume one or more input varnodes and produce one or more output varnodes, representing the result of an instruction or a temporary computation. Through analysis, varnodes can be renamed, split, merged, or rewritten as the decompiler reconstructs higher-level variables and expressions. They also enable tracking of how a value is stored and transformed across instructions, which is essential for variable recovery and type inference.

In practice, varnodes provide a uniform abstraction for representing runtime values across different architectures. They help map machine code to higher-level constructs by keeping track of where data lives (registers, stack slots, or memory) and how its size changes through operations. See also P-code, Ghidra, and decompilation concepts.