Trees       Indices       Help   
Hex-Rays
Module idc
[frames] | no frames]

Module idc

IDC compatibility module

This file contains IDA built-in function declarations and internal bit definitions. Each byte of the program has 32-bit flags (low 8 bits keep the byte value). These 32 bits are used in GetFlags/SetFlags functions. You may freely examine these bits using GetFlags() but the use of the SetFlags() function is strongly discouraged.

This file is subject to change without any notice. Future versions of IDA may use other definitions.

Classes
  DeprecatedIDCError
Exception for deprecated function calls
Functions
 
hasValue(F)
 
byteValue(F)
Get byte value from flags Get value of byte provided that the byte is initialized.
 
isLoaded(ea)
Is the byte initialized?
 
isCode(F)
 
isData(F)
 
isTail(F)
 
isUnknown(F)
 
isHead(F)
 
isFlow(F)
 
isVar(F)
 
isExtra(F)
 
isRef(F)
 
hasName(F)
 
hasUserName(F)
 
isDefArg0(F)
 
isDefArg1(F)
 
isDec0(F)
 
isDec1(F)
 
isHex0(F)
 
isHex1(F)
 
isOct0(F)
 
isOct1(F)
 
isBin0(F)
 
isBin1(F)
 
isOff0(F)
 
isOff1(F)
 
isChar0(F)
 
isChar1(F)
 
isSeg0(F)
 
isSeg1(F)
 
isEnum0(F)
 
isEnum1(F)
 
isFop0(F)
 
isFop1(F)
 
isStroff0(F)
 
isStroff1(F)
 
isStkvar0(F)
 
isStkvar1(F)
 
isByte(F)
 
isWord(F)
 
isDwrd(F)
 
isQwrd(F)
 
isOwrd(F)
 
isTbyt(F)
 
isFloat(F)
 
isDouble(F)
 
isPackReal(F)
 
isASCII(F)
 
isStruct(F)
 
isAlign(F)
 
IsString(var)
 
IsLong(var)
 
IsFloat(var)
 
MK_FP(seg, off)
Return value of expression: ((seg<<4) + off)
 
form(format, *args)
 
substr(s, x1, x2)
 
strstr(s1, s2)
 
strlen(s)
 
xtol(s)
 
atoa(ea)
Convert address value to a string Return address in the form 'seg000:1234' (the same as in line prefixes)
 
ltoa(n, radix)
 
atol(s)
 
rotate_left(value, count, nbits, offset)
Rotate a value to the left (or right)
 
rotate_dword(x, count)
 
rotate_word(x, count)
 
rotate_byte(x, count)
 
AddHotkey(hotkey, idcfunc)
Add hotkey for IDC function
 
DelHotkey(hotkey)
Delete IDC function hotkey
 
Jump(ea)
Move cursor to the specifed linear address
 
Wait()
Process all entries in the autoanalysis queue Wait for the end of autoanalysis
 
CompileEx(input, isfile)
Compile an IDC script
 
Eval(expr)
Evaluate an IDC expression
 
EVAL_FAILURE(code)
Check the result of Eval() for evaluation failures
 
SaveBase(idbname, flags=0)
Save current database to the specified idb file
 
Exit(code)
Stop execution of IDC program, close the database and exit to OS
 
Exec(command)
Execute an OS command.
 
Sleep(milliseconds)
Sleep the specified number of milliseconds This function suspends IDA for the specified amount of time
 
RunPlugin(name, arg)
Load and run a plugin
 
ApplySig(name)
Load (plan to apply) a FLIRT signature file
 
DeleteAll()
Delete all segments, instructions, comments, i.e.
 
MakeCode(ea)
Create an instruction at the specified address
 
AnalyzeArea(sEA, eEA)
Perform full analysis of the area
 
MakeNameEx(ea, name, flags)
Rename an address
 
MakeComm(ea, comment)
Set an indented regular comment of an item
 
MakeRptCmt(ea, comment)
Set an indented repeatable comment of an item
 
MakeArray(ea, nitems)
Create an array.
 
MakeStr(ea, endea)
Create a string.
 
MakeData(ea, flags, size, tid)
Create a data item at the specified address
 
MakeByte(ea)
Convert the current item to a byte
 
MakeWord(ea)
Convert the current item to a word (2 bytes)
 
MakeDword(ea)
Convert the current item to a double word (4 bytes)
 
MakeQword(ea)
Convert the current item to a quadro word (8 bytes)
 
MakeOword(ea)
Convert the current item to a octa word (16 bytes)
 
MakeFloat(ea)
Convert the current item to a floating point (4 bytes)
 
MakeDouble(ea)
Convert the current item to a double floating point (8 bytes)
 
MakePackReal(ea)
Convert the current item to a packed real (10 or 12 bytes)
 
MakeTbyte(ea)
Convert the current item to a tbyte (10 or 12 bytes)
 
MakeStructEx(ea, size, strname)
Convert the current item to a structure instance
 
MakeCustomDataEx(ea, size, dtid, fid)
Convert the item at address to custom data.
 
MakeAlign(ea, count, align)
Convert the current item to an alignment directive
 
MakeLocal(start, end, location, name)
Create a local variable
 
MakeUnkn(ea, flags)
Convert the current item to an explored item
 
MakeUnknown(ea, size, flags)
Convert the current item to an explored item
 
SetArrayFormat(ea, flags, litems, align)
Set array representation format
 
OpBinary(ea, n)
Convert an operand of the item (instruction or data) to a binary number
 
OpOctal(ea, n)
Convert an operand of the item (instruction or data) to an octal number
 
OpDecimal(ea, n)
Convert an operand of the item (instruction or data) to a decimal number
 
OpHex(ea, n)
Convert an operand of the item (instruction or data) to a hexadecimal number
 
OpChr(ea, n)
 
OpOff(ea, n, base)
Convert operand to an offset (for the explanations of 'ea' and 'n' please see OpBinary())
 
OpOffEx(ea, n, reftype, target, base, tdelta)
Convert operand to a complex offset expression This is a more powerful version of OpOff() function.
 
OpSeg(ea, n)
Convert operand to a segment expression
 
OpNumber(ea, n)
Convert operand to a number (with default number base, radix)
 
OpFloat(ea, n)
Convert operand to a floating-point number
 
OpAlt(ea, n, opstr)
Specify operand represenation manually.
 
OpSign(ea, n)
Change sign of the operand
 
OpNot(ea, n)
Toggle the bitwise not operator for the operand
 
OpEnumEx(ea, n, enumid, serial)
Convert operand to a symbolic constant
 
OpStroffEx(ea, n, strid, delta)
Convert operand to an offset in a structure
 
OpStkvar(ea, n)
Convert operand to a stack variable
 
OpHigh(ea, n, target)
Convert operand to a high offset High offset is the upper 16bits of an offset.
 
MakeVar(ea)
Mark the location as "variable"
 
ExtLinA(ea, n, line)
Specify an additional line to display before the generated ones.
 
ExtLinB(ea, n, line)
Specify an additional line to display after the generated ones.
 
DelExtLnA(ea, n)
Delete an additional anterior line
 
DelExtLnB(ea, n)
Delete an additional posterior line
 
SetManualInsn(ea, insn)
Specify instruction represenation manually.
 
GetManualInsn(ea)
Get manual representation of instruction
 
PatchDbgByte(ea, value)
Change a byte in the debugged process memory only
 
PatchByte(ea, value)
Change value of a program byte If debugger was active then the debugged process memory will be patched too
 
PatchWord(ea, value)
Change value of a program word (2 bytes)
 
PatchDword(ea, value)
Change value of a double word
 
SetFlags(ea, flags)
Set new value of flags This function should not used be used directly if possible.
 
SetRegEx(ea, reg, value, tag)
Set value of a segment register.
 
AutoMark2(start, end, queuetype)
Plan to perform an action in the future.
 
AutoUnmark(start, end, queuetype)
Remove range of addresses from a queue.
 
AutoMark(ea, qtype)
Plan to analyze an address
 
GenerateFile(filetype, path, ea1, ea2, flags)
Generate an output file
 
GenFuncGdl(outfile, title, ea1, ea2, flags)
Generate a flow chart GDL file
 
GenCallGdl(outfile, title, flags)
Generate a function call graph GDL file
 
GetIdaDirectory()
Get IDA directory
 
GetInputFile()
Get input file name
 
GetInputFilePath()
Get input file path
 
SetInputFilePath(path)
Set input file name This function updates the file name that is stored in the database It is used by the debugger and other parts of IDA Use it when the database is moved to another location or when you use remote debugging.
 
GetIdbPath()
Get IDB full path
 
GetInputMD5()
Return the MD5 hash of the input binary file
 
GetFlags(ea)
Get internal flags
 
IdbByte(ea)
Get one byte (8-bit) of the program at 'ea' from the database even if the debugger is active
 
GetManyBytes(ea, size, use_dbg=False)
Return the specified number of bytes of the program
 
Byte(ea)
Get value of program byte
 
DbgByte(ea)
Get value of program byte using the debugger memory
 
DbgWord(ea)
Get value of program word using the debugger memory
 
DbgDword(ea)
Get value of program double-word using the debugger memory
 
DbgQword(ea)
Get value of program quadro-word using the debugger memory
 
GetOriginalByte(ea)
Get original value of program byte
 
Word(ea)
Get value of program word (2 bytes)
 
Dword(ea)
Get value of program double word (4 bytes)
 
Qword(ea)
Get value of program quadro word (8 bytes)
 
GetFloat(ea)
Get value of a floating point number (4 bytes)
 
GetDouble(ea)
Get value of a floating point number (8 bytes)
 
LocByName(name)
Get linear address of a name
 
LocByNameEx(fromaddr, name)
Get linear address of a name
 
SegByBase(base)
Get segment by segment base
 
ScreenEA()
Get linear address of cursor
 
GetCurrentLine()
Get the disassembly line at the cursor
 
SelStart()
Get start address of the selected area returns BADADDR - the user has not selected an area
 
SelEnd()
Get end address of the selected area
 
GetReg(ea, reg)
Get value of segment register at the specified address
 
NextAddr(ea)
Get next address in the program
 
PrevAddr(ea)
Get previous address in the program
 
NextHead(ea, maxea=4294967295)
Get next defined item (instruction or data) in the program
 
PrevHead(ea, minea=0)
Get previous defined item (instruction or data) in the program
 
NextNotTail(ea)
Get next not-tail address in the program This function searches for the next displayable address in the program.
 
PrevNotTail(ea)
Get previous not-tail address in the program This function searches for the previous displayable address in the program.
 
ItemHead(ea)
Get starting address of the item (instruction or data)
 
ItemEnd(ea)
Get address of the end of the item (instruction or data)
 
ItemSize(ea)
Get size of instruction or data item in bytes
 
NameEx(fromaddr, ea)
Get visible name of program byte
 
GetTrueNameEx(fromaddr, ea)
Get true name of program byte
 
Demangle(name, disable_mask)
Demangle a name
 
GetDisasm(ea)
Get disassembly line
 
GetMnem(ea)
Get instruction mnemonics
 
GetOpnd(ea, n)
Get operand of an instruction
 
GetOpType(ea, n)
Get type of instruction operand
 
GetOperandValue(ea, n)
Get number used in the operand
 
LineA(ea, num)
Get anterior line
 
LineB(ea, num)
Get posterior line
 
GetCommentEx(ea, repeatable)
Get regular indented comment
 
CommentEx(ea, repeatable)
 
AltOp(ea, n)
Get manually entered operand string
 
GetString(ea, length=-1, strtype=0)
Get string contents
 
GetStringType(ea)
Get string type
 
FindVoid(ea, flag)
 
FindCode(ea, flag)
 
FindData(ea, flag)
 
FindUnexplored(ea, flag)
 
FindExplored(ea, flag)
 
FindImmediate(ea, flag, value)
 
FindText(ea, flag, y, x, searchstr)
Returns: ea of result or BADADDR if not found
 
FindBinary(ea, flag, searchstr, radix=16)
Returns: ea of result or BADADDR if not found
 
ChangeConfig(directive)
Parse one or more ida.cfg config directives
 
GetLongPrm(offset)
 
GetShortPrm(offset)
 
GetCharPrm(offset)
 
SetLongPrm(offset, value)
 
SetShortPrm(offset, value)
 
SetCharPrm(offset, value)
 
SetProcessorType(processor, level)
Change current processor
 
SetPrcsr(processor)
 
Batch(batch)
Enable/disable batch mode of operation
 
AskStr(defval, prompt)
Ask the user to enter a string
 
AskFile(forsave, mask, prompt)
Ask the user to choose a file
 
AskAddr(defval, prompt)
Ask the user to enter an address
 
AskLong(defval, prompt)
Ask the user to enter a number
 
ProcessUiAction(name, flags=0)
Invokes an IDA UI action by name
 
AskSeg(defval, prompt)
Ask the user to enter a segment value
 
AskIdent(defval, prompt)
Ask the user to enter an identifier
 
AskYN(defval, prompt)
Ask the user a question and let him answer Yes/No/Cancel
 
Message(msg)
Display a message in the message window
 
Warning(msg)
Display a message in a message box
 
Fatal(format)
Display a fatal message in a message box and quit IDA
 
SetStatus(status)
Change IDA indicator.
 
Refresh()
Refresh all disassembly views
 
RefreshLists()
Refresh all list views (names, functions, etc)
 
AskSelector(sel)
Get a selector value
 
FindSelector(val)
Find a selector which has the specifed value
 
SetSelector(sel, value)
Set a selector value
 
DelSelector(sel)
Delete a selector
 
FirstSeg()
Get first segment
 
NextSeg(ea)
Get next segment
 
SegStart(ea)
Get start address of a segment
 
SegEnd(ea)
Get end address of a segment
 
SegName(ea)
Get name of a segment
 
AddSeg(startea, endea, base, use32, align, comb)
Create a new segment
 
DelSeg(ea, flags)
Delete a segment
 
SetSegBounds(ea, startea, endea, flags)
Change segment boundaries
 
RenameSeg(ea, name)
Change name of the segment
 
SetSegClass(ea, segclass)
Change class of the segment
 
SegAlign(ea, alignment)
Change alignment of the segment
 
SegComb(segea, comb)
Change combination of the segment
 
SetSegAddressing(ea, bitness)
Change segment addressing
 
SegByName(segname)
Get segment by name
 
SetSegDefReg(ea, reg, value)
Set default segment register value for a segment
 
SetSegmentType(segea, segtype)
Set segment type
 
GetSegmentAttr(segea, attr)
Get segment attribute
 
SetSegmentAttr(segea, attr, value)
Set segment attribute
 
MoveSegm(ea, to, flags)
Move a segment to a new address This function moves all information to the new address It fixes up address sensitive information in the kernel The total effect is equal to reloading the segment to the target address
 
rebase_program(delta, flags)
Rebase the whole program by 'delta' bytes
 
SetStorageType(startEA, endEA, stt)
Set storage type
 
AddCodeXref(From, To, flowtype)
 
DelCodeXref(From, To, undef)
Unmark exec flow 'from' 'to'
 
Rfirst(From)
Get first code xref from 'From'
 
Rnext(From, current)
Get next code xref from
 
RfirstB(To)
Get first code xref to 'To'
 
RnextB(To, current)
Get next code xref to 'To'
 
Rfirst0(From)
Get first xref from 'From'
 
Rnext0(From, current)
Get next xref from
 
RfirstB0(To)
Get first xref to 'To'
 
RnextB0(To, current)
Get next xref to 'To'
 
add_dref(From, To, drefType)
Create Data Ref
 
del_dref(From, To)
Unmark Data Ref
 
Dfirst(From)
Get first data xref from 'From'
 
Dnext(From, current)
Get next data xref from 'From'
 
DfirstB(To)
Get first data xref to 'To'
 
DnextB(To, current)
Get next data xref to 'To'
 
XrefType()
Return type of the last xref obtained by [RD]first/next[B0] functions.
 
fopen(f, mode)
 
fclose(handle)
 
filelength(handle)
 
fseek(handle, offset, origin)
 
ftell(handle)
 
LoadFile(filepath, pos, ea, size)
Load file into IDA database
 
loadfile(filepath, pos, ea, size)
 
SaveFile(filepath, pos, ea, size)
Save from IDA database to file
 
savefile(filepath, pos, ea, size)
 
fgetc(handle)
 
fputc(byte, handle)
 
fprintf(handle, format, *args)
 
readshort(handle, mostfirst)
 
readlong(handle, mostfirst)
 
writeshort(handle, word, mostfirst)
 
writelong(handle, dword, mostfirst)
 
readstr(handle)
 
writestr(handle, s)
 
MakeFunction(start, end=4294967295)
Create a function
 
DelFunction(ea)
Delete a function
 
SetFunctionEnd(ea, end)
Change function end address
 
NextFunction(ea)
Find next function
 
PrevFunction(ea)
Find previous function
 
GetFunctionAttr(ea, attr)
Get a function attribute
 
SetFunctionAttr(ea, attr, value)
Set a function attribute
 
GetFunctionFlags(ea)
Retrieve function flags
 
SetFunctionFlags(ea, flags)
Change function flags
 
GetFunctionName(ea)
Retrieve function name
 
GetFunctionCmt(ea, repeatable)
Retrieve function comment
 
SetFunctionCmt(ea, cmt, repeatable)
Set function comment
 
ChooseFunction(title)
Ask the user to select a function
 
GetFuncOffset(ea)
Convert address to 'funcname+offset' string
 
FindFuncEnd(ea)
Determine a new function boundaries
 
GetFrame(ea)
Get ID of function frame structure
 
GetFrameLvarSize(ea)
Get size of local variables in function frame
 
GetFrameRegsSize(ea)
Get size of saved registers in function frame
 
GetFrameArgsSize(ea)
Get size of arguments in function frame which are purged upon return
 
GetFrameSize(ea)
Get full size of function frame
 
MakeFrame(ea, lvsize, frregs, argsize)
Make function frame
 
GetSpd(ea)
Get current delta for the stack pointer
 
GetSpDiff(ea)
Get modification of SP made by the instruction
 
SetSpDiff(ea, delta)
Setup modification of SP made by the instruction
 
GetEntryPointQty()
Retrieve number of entry points
 
AddEntryPoint(ordinal, ea, name, makecode)
Add entry point
 
GetEntryOrdinal(index)
Retrieve entry point ordinal number
 
GetEntryPoint(ordinal)
Retrieve entry point address
 
GetEntryName(ordinal)
Retrieve entry point name
 
RenameEntryPoint(ordinal, name)
Rename entry point
 
GetNextFixupEA(ea)
Find next address with fixup information
 
GetPrevFixupEA(ea)
Find previous address with fixup information
 
GetFixupTgtType(ea)
Get fixup target type
 
GetFixupTgtSel(ea)
Get fixup target selector
 
GetFixupTgtOff(ea)
Get fixup target offset
 
GetFixupTgtDispl(ea)
Get fixup target displacement
 
SetFixup(ea, fixuptype, targetsel, targetoff, displ)
Set fixup information
 
DelFixup(ea)
Delete fixup information
 
MarkPosition(ea, lnnum, x, y, slot, comment)
Mark position
 
GetMarkedPos(slot)
Get marked position
 
GetMarkComment(slot)
Get marked position comment
 
GetStrucQty()
Get number of defined structure types
 
GetFirstStrucIdx()
Get index of first structure type
 
GetLastStrucIdx()
Get index of last structure type
 
GetNextStrucIdx(index)
Get index of next structure type
 
GetPrevStrucIdx(index)
Get index of previous structure type
 
GetStrucIdx(sid)
Get structure index by structure ID
 
GetStrucId(index)
Get structure ID by structure index
 
GetStrucIdByName(name)
Get structure ID by structure name
 
GetStrucName(sid)
Get structure type name
 
GetStrucComment(sid, repeatable)
Get structure type comment
 
GetStrucSize(sid)
Get size of a structure
 
GetMemberQty(sid)
Get number of members of a structure
 
GetStrucPrevOff(sid, offset)
Get previous offset in a structure
 
GetStrucNextOff(sid, offset)
Get next offset in a structure
 
GetFirstMember(sid)
Get offset of the first member of a structure
 
GetLastMember(sid)
Get offset of the last member of a structure
 
GetMemberOffset(sid, member_name)
Get offset of a member of a structure by the member name
 
GetMemberName(sid, member_offset)
Get name of a member of a structure
 
GetMemberComment(sid, member_offset, repeatable)
Get comment of a member
 
GetMemberSize(sid, member_offset)
Get size of a member
 
GetMemberFlag(sid, member_offset)
Get type of a member
 
GetMemberStrId(sid, member_offset)
Get structure id of a member
 
IsUnion(sid)
Is a structure a union?
 
AddStrucEx(index, name, is_union)
Define a new structure type
 
DelStruc(sid)
Delete a structure type
 
SetStrucIdx(sid, index)
Change structure index
 
SetStrucName(sid, name)
Change structure name
 
SetStrucComment(sid, comment, repeatable)
Change structure comment
 
AddStrucMember(sid, name, offset, flag, typeid, nbytes, target=-1, tdelta=0, reftype=2)
Add structure member
 
DelStrucMember(sid, member_offset)
Delete structure member
 
SetMemberName(sid, member_offset, name)
Change structure member name
 
SetMemberType(sid, member_offset, flag, typeid, nitems, target=-1, tdelta=0, reftype=2)
Change structure member type
 
SetMemberComment(sid, member_offset, comment, repeatable)
Change structure member comment
 
GetFchunkAttr(ea, attr)
Get a function chunk attribute
 
SetFchunkAttr(ea, attr, value)
Set a function chunk attribute
 
GetFchunkReferer(ea, idx)
Get a function chunk referer
 
NextFchunk(ea)
Get next function chunk
 
PrevFchunk(ea)
Get previous function chunk
 
AppendFchunk(funcea, ea1, ea2)
Append a function chunk to the function
 
RemoveFchunk(funcea, tailea)
Remove a function chunk from the function
 
SetFchunkOwner(tailea, funcea)
Change the function chunk owner
 
FirstFuncFchunk(funcea)
Get the first function chunk of the specified function
 
NextFuncFchunk(funcea, tailea)
Get the next function chunk of the specified function
 
GetEnumQty()
Get number of enum types
 
GetnEnum(idx)
Get ID of the specified enum by its serial number
 
GetEnumIdx(enum_id)
Get serial number of enum by its ID
 
GetEnum(name)
Get enum ID by the name of enum
 
GetEnumName(enum_id)
Get name of enum
 
GetEnumCmt(enum_id, repeatable)
Get comment of enum
 
GetEnumSize(enum_id)
Get size of enum
 
GetEnumWidth(enum_id)
Get width of enum elements
 
GetEnumFlag(enum_id)
Get flag of enum
 
GetConstByName(name)
Get member of enum - a symbolic constant ID
 
GetConstValue(const_id)
Get value of symbolic constant
 
GetConstBmask(const_id)
Get bit mask of symbolic constant
 
GetConstEnum(const_id)
Get id of enum by id of constant
 
GetConstEx(enum_id, value, serial, bmask)
Get id of constant
 
GetFirstBmask(enum_id)
Get first bitmask in the enum (bitfield)
 
GetLastBmask(enum_id)
Get last bitmask in the enum (bitfield)
 
GetNextBmask(enum_id, value)
Get next bitmask in the enum (bitfield)
 
GetPrevBmask(enum_id, value)
Get prev bitmask in the enum (bitfield)
 
GetBmaskName(enum_id, bmask)
Get bitmask name (only for bitfields)
 
GetBmaskCmt(enum_id, bmask, repeatable)
Get bitmask comment (only for bitfields)
 
SetBmaskName(enum_id, bmask, name)
Set bitmask name (only for bitfields)
 
SetBmaskCmt(enum_id, bmask, cmt, repeatable)
Set bitmask comment (only for bitfields)
 
GetFirstConst(enum_id, bmask)
Get first constant in the enum
 
GetLastConst(enum_id, bmask)
Get last constant in the enum
 
GetNextConst(enum_id, value, bmask)
Get next constant in the enum
 
GetPrevConst(enum_id, value, bmask)
Get prev constant in the enum
 
GetConstName(const_id)
Get name of a constant
 
GetConstCmt(const_id, repeatable)
Get comment of a constant
 
AddEnum(idx, name, flag)
Add a new enum type
 
DelEnum(enum_id)
Delete enum type
 
SetEnumIdx(enum_id, idx)
Give another serial number to a enum
 
SetEnumName(enum_id, name)
Rename enum
 
SetEnumCmt(enum_id, cmt, repeatable)
Set comment of enum
 
SetEnumFlag(enum_id, flag)
Set flag of enum
 
SetEnumBf(enum_id, flag)
Set bitfield property of enum
 
SetEnumWidth(enum_id, width)
Set width of enum elements
 
IsBitfield(enum_id)
Is enum a bitfield?
 
AddConstEx(enum_id, name, value, bmask)
Add a member of enum - a symbolic constant
 
DelConstEx(enum_id, value, serial, bmask)
Delete a member of enum - a symbolic constant
 
SetConstName(const_id, name)
Rename a member of enum - a symbolic constant
 
SetConstCmt(const_id, cmt, repeatable)
Set a comment of a symbolic constant
 
CreateArray(name)
Create array.
 
GetArrayId(name)
Get array array_id, by name.
 
RenameArray(array_id, newname)
Rename array, by its ID.
 
DeleteArray(array_id)
Delete array, by its ID.
 
SetArrayLong(array_id, idx, value)
Sets the long value of an array element.
 
SetArrayString(array_id, idx, value)
Sets the string value of an array element.
 
GetArrayElement(tag, array_id, idx)
Get value of array element.
 
DelArrayElement(tag, array_id, idx)
Delete an array element.
 
GetFirstIndex(tag, array_id)
Get index of the first existing array element.
 
GetLastIndex(tag, array_id)
Get index of last existing array element.
 
GetNextIndex(tag, array_id, idx)
Get index of the next existing array element.
 
GetPrevIndex(tag, array_id, idx)
Get index of the previous existing array element.
 
SetHashLong(hash_id, key, value)
Sets the long value of a hash element.
 
GetHashLong(hash_id, key)
Gets the long value of a hash element.
 
SetHashString(hash_id, key, value)
Sets the string value of a hash element.
 
GetHashString(hash_id, key)
Gets the string value of a hash element.
 
DelHashElement(hash_id, key)
Delete a hash element.
 
GetFirstHashKey(hash_id)
Get the first key in the hash.
 
GetLastHashKey(hash_id)
Get the last key in the hash.
 
GetNextHashKey(hash_id, key)
Get the next key in the hash.
 
GetPrevHashKey(hash_id, key)
Get the previous key in the hash.
 
AddSourceFile(ea1, ea2, filename)
Mark a range of address as belonging to a source file An address range may belong only to one source file.
 
GetSourceFile(ea)
Get name of source file occupying the given address
 
DelSourceFile(ea)
Delete information about the source file
 
SetLineNumber(ea, lnnum)
Set source line number
 
GetLineNumber(ea)
Get source line number
 
DelLineNumber(ea)
Delete information about source line number
 
LoadTil(name)
Load a type library
 
Til2Idb(idx, type_name)
Copy information from type library to database Copy structure, union, or enum definition from the type library to the IDA database.
 
GetType(ea)
Get type of function/variable
 
SizeOf(typestr)
Returns the size of the type.
 
GuessType(ea)
Guess type of function/variable
 
SetType(ea, newtype)
Set type of function/variable
 
ParseType(inputtype, flags)
Parse type declaration
 
ParseTypes(inputtype, flags=0)
Parse type declarations
 
GetMaxLocalType()
Get number of local types + 1
 
SetLocalType(ordinal, input, flags)
Parse one type declaration and store it in the specified slot
 
GetLocalType(ordinal, flags)
Retrieve a local type declaration
 
GetLocalTypeName(ordinal)
Retrieve a local type name
 
HideArea(start, end, description, header, footer, color)
Hide an area
 
SetHiddenArea(ea, visible)
Set hidden area state
 
DelHiddenArea(ea)
Delete a hidden area
 
LoadDebugger(dbgname, use_remote)
Load the debugger
 
StartDebugger(path, args, sdir)
Launch the debugger
 
StopDebugger()
Stop the debugger Kills the currently debugger process and returns to the disassembly mode
 
PauseProcess()
Suspend the running process Tries to suspend the process.
 
GetProcessQty()
Take a snapshot of running processes and return their number.
 
GetProcessPid(idx)
Get the process ID of a running process
 
GetProcessName(idx)
Get the name of a running process
 
AttachProcess(pid, event_id)
Attach the debugger to a running process
 
DetachProcess()
Detach the debugger from the debugged process.
 
GetThreadQty()
Get number of threads.
 
GetThreadId(idx)
Get the ID of a thread
 
GetCurrentThreadId()
Get current thread ID
 
SelectThread(tid)
Select the given thread as the current debugged thread.
 
SuspendThread(tid)
Suspend thread
 
ResumeThread(tid)
Resume thread
 
GetFirstModule()
Enumerate process modules
 
GetNextModule(base)
Enumerate process modules
 
GetModuleName(base)
Get process module name
 
GetModuleSize(base)
Get process module size
 
StepInto()
Execute one instruction in the current thread.
 
StepOver()
Execute one instruction in the current thread, but without entering into functions Others threads keep suspended.
 
RunTo(ea)
Execute the process until the given address is reached.
 
StepUntilRet()
Execute instructions in the current thread until a function return instruction is reached.
 
GetDebuggerEvent(wfne, timeout)
Wait for the next event This function (optionally) resumes the process execution and wait for a debugger event until timeout
 
ResumeProcess()
 
SendDbgCommand(cmd)
Sends a command to the debugger module and returns the output string.
 
RefreshDebuggerMemory()
Refresh debugger memory Upon this call IDA will forget all cached information about the debugged process.
 
TakeMemorySnapshot(only_loader_segs)
Take memory snapshot of the debugged process
 
GetProcessState()
Get debugged process state
 
GetEventId()
Get ID of debug event
 
GetEventPid()
Get process ID for debug event
 
GetEventTid()
Get type ID for debug event
 
GetEventEa()
Get ea for debug event
 
IsEventHandled()
Is the debug event handled?
 
GetEventModuleName()
Get module name for debug event
 
GetEventModuleBase()
Get module base for debug event
 
GetEventModuleSize()
Get module size for debug event
 
GetEventExitCode()
Get exit code for debug event
 
GetEventInfo()
Get debug event info
 
GetEventBptHardwareEa()
Get hardware address for BREAKPOINT event
 
GetEventExceptionCode()
Get exception code for EXCEPTION event
 
GetEventExceptionEa()
Get address for EXCEPTION event
 
CanExceptionContinue()
Can it continue after EXCEPTION event?
 
GetEventExceptionInfo()
Get info for EXCEPTION event
 
SetDebuggerOptions(opt)
Get/set debugger options
 
GetDebuggerEventCondition()
Return the debugger event condition
 
SetDebuggerEventCondition(cond)
Set the debugger event condition
 
SetRemoteDebugger(hostname, password, portnum)
Set remote debugging options
 
GetExceptionQty()
Get number of defined exception codes
 
GetExceptionCode(idx)
Get exception code
 
GetExceptionName(code)
Get exception information
 
GetExceptionFlags(code)
Get exception information
 
DefineException(code, name, desc, flags)
Add exception handling information
 
SetExceptionFlags(code, flags)
Set exception flags
 
ForgetException(code)
Delete exception handling information
 
GetRegValue(name)
Get register value
 
SetRegValue(value, name)
Set register value
 
GetBptQty()
Get number of breakpoints.
 
GetBptEA(n)
Get breakpoint address
 
GetBptAttr(ea, bptattr)
Get the characteristics of a breakpoint
 
SetBptAttr(address, bptattr, value)
modifiable characteristics of a breakpoint
 
SetBptCnd(ea, cnd)
Set breakpoint condition
 
AddBptEx(ea, size, bpttype)
Add a new breakpoint
 
AddBpt(ea)
 
DelBpt(ea)
Delete breakpoint
 
EnableBpt(ea, enable)
Enable/disable breakpoint
 
CheckBpt(ea)
Check a breakpoint
 
EnableTracing(trace_level, enable)
Enable step tracing
 
GetColor(ea, what)
Get item color
 
SetColor(ea, what, color)
Set item color
 
SetXML(path, name, value)
Set or update one or more XML values.
 
GetXML(path)
Get one XML value.
 
ArmForceBLJump(ea)
Some ARM compilers in Thumb mode use BL (branch-and-link) instead of B (branch) for long jumps, since BL has more range.
 
ArmForceBLCall(ea)
Force BL instruction to be a call
 
Compile(file)
 
OpOffset(ea, base)
 
OpNum(ea)
 
OpChar(ea)
 
OpSegment(ea)
 
OpDec(ea)
 
OpAlt1(ea, opstr)
 
OpAlt2(ea, opstr)
 
StringStp(x)
 
LowVoids(x)
 
HighVoids(x)
 
TailDepth(x)
 
Analysis(x)
 
Tabs(x)
 
Voids(x)
 
XrefShow(x)
 
Indent(x)
 
CmtIndent(x)
 
AutoShow(x)
 
MinEA()
 
MaxEA()
 
BeginEA()
 
set_start_cs(x)
 
set_start_ip(x)
 
WriteMap(filepath)
 
WriteTxt(filepath, ea1, ea2)
 
WriteExe(filepath)
 
BeginTypeUpdating(utp)
Begin type updating.
 
EndTypeUpdating(utp)
End type updating.
 
AddConst(enum_id, name, value)
 
AddStruc(index, name)
 
AddUnion(index, name)
 
OpStroff(ea, n, strid)
 
OpEnum(ea, n, enumid)
 
DelConst(constid, v, mask)
 
GetConst(constid, v, mask)
 
AnalyseArea(sEA, eEA)
 
MakeStruct(ea, name)
 
MakeCustomData(ea, size, dtid, fid)
 
Name(ea)
 
GetTrueName(ea)
 
MakeName(ea, name)
 
SegCreate(a1, a2, base, use32, align, comb)
 
SegDelete(ea, flags)
 
SegBounds(ea, startea, endea, flags)
 
SegRename(ea, name)
 
SegClass(ea, segclass)
 
SegAddrng(ea, bitness)
 
SegDefReg(ea, reg, value)
 
Comment(ea)
Returns the non-repeatable comment or None
 
RptCmt(ea)
 
SetReg(ea, reg, value)
 
here()
 
isEnabled(ea)
Variables
  __EA64__ = False
  WORDMASK = 4294967295
  BADADDR = 4294967295
  BADSEL = 4294967295
  MAXADDR = 4278190080
  SIZE_MAX = 4294967295
  MS_VAL = 255
  FF_IVL = 256
  MS_CLS = 1536
  FF_CODE = 1536
  FF_DATA = 1024
  FF_TAIL = 512
  FF_UNK = 0
  MS_COMM = 1046528
  FF_COMM = 2048
  FF_REF = 4096
  FF_LINE = 8192
  FF_NAME = 16384
  FF_LABL = 32768
  FF_FLOW = 65536
  FF_VAR = 524288
  FF_ANYNAME = 49152
  MS_0TYPE = 15728640
  FF_0VOID = 0
  FF_0NUMH = 1048576
  FF_0NUMD = 2097152
  FF_0CHAR = 3145728
  FF_0SEG = 4194304
  FF_0OFF = 5242880
  FF_0NUMB = 6291456
  FF_0NUMO = 7340032
  FF_0ENUM = 8388608
  FF_0FOP = 9437184
  FF_0STRO = 10485760
  FF_0STK = 11534336
  MS_1TYPE = 251658240
  FF_1VOID = 0
  FF_1NUMH = 16777216
  FF_1NUMD = 33554432
  FF_1CHAR = 50331648
  FF_1SEG = 67108864
  FF_1OFF = 83886080
  FF_1NUMB = 100663296
  FF_1NUMO = 117440512
  FF_1ENUM = 134217728
  FF_1FOP = 150994944
  FF_1STRO = 167772160
  FF_1STK = 184549376
  DT_TYPE = 4026531840
  FF_BYTE = 0
  FF_WORD = 268435456
  FF_DWRD = 536870912
  FF_QWRD = 805306368
  FF_TBYT = 1073741824
  FF_ASCI = 1342177280
  FF_STRU = 1610612736
  FF_OWRD = 1879048192
  FF_FLOAT = 2147483648
  FF_DOUBLE = 2415919104
  FF_PACKREAL = 2684354560
  FF_ALIGN = 2952790016
  MS_CODE = 4026531840
  FF_FUNC = 268435456
  FF_IMMD = 1073741824
  FF_JUMP = 2147483648
  NEF_SEGS = 1
  NEF_RSCS = 2
  NEF_NAME = 4
  NEF_MAN = 8
  NEF_FILL = 16
  NEF_IMPS = 32
  NEF_FIRST = 128
  NEF_CODE = 256
  NEF_RELOAD = 512
  NEF_FLAT = 1024
  IDCHK_OK = 0
  IDCHK_ARG = -1
  IDCHK_KEY = -2
  IDCHK_MAX = -3
  DBFL_BAK = 4
  SN_CHECK = 1
  SN_NOCHECK = 0
  SN_PUBLIC = 2
  SN_NON_PUBLIC = 4
  SN_WEAK = 8
  SN_NON_WEAK = 16
  SN_AUTO = 32
  SN_NON_AUTO = 64
  SN_NOLIST = 128
  SN_NOWARN = 256
  SN_LOCAL = 512
  DOUNK_SIMPLE = 0
  DOUNK_EXPAND = 1
  DOUNK_DELNAMES = 2
  AP_ALLOWDUPS = 1
  AP_SIGNED = 2
  AP_INDEX = 4
  AP_ARRAY = 8
  AP_IDXBASEMASK = 240
  AP_IDXDEC = 0
  AP_IDXHEX = 16
  AP_IDXOCT = 32
  AP_IDXBIN = 48
  OPND_OUTER = 128
  REF_OFF8 = 0
  REF_OFF16 = 1
  REF_OFF32 = 2
  REF_LOW8 = 3
  REF_LOW16 = 4
  REF_HIGH8 = 5
  REF_HIGH16 = 6
  REF_VHIGH = 7
  REF_VLOW = 8
  REF_OFF64 = 9
  REFINFO_RVA = 16
  REFINFO_PASTEND = 32
  REFINFO_NOBASE = 128
  SR_inherit = 1
  SR_user = 2
  SR_auto = 3
  SR_autostart = 4
  AU_UNK = 10
  AU_CODE = 20
  AU_PROC = 30
  AU_USED = 40
  AU_LIBF = 60
  AU_FINAL = 200
  OFILE_MAP = 0
  OFILE_EXE = 1
  OFILE_IDC = 2
  OFILE_LST = 3
  OFILE_ASM = 4
  OFILE_DIF = 5
  GENFLG_MAPSEG = 1
  GENFLG_MAPNAME = 2
  GENFLG_MAPDMNG = 4
  GENFLG_MAPLOC = 8
  GENFLG_IDCTYPE = 8
  GENFLG_ASMTYPE = 16
  GENFLG_GENHTML = 32
  GENFLG_ASMINC = 64
  CHART_PRINT_NAMES = 4096
  CHART_GEN_GDL = 16384
  CHART_WINGRAPH = 32768
  CHART_NOLIBFUNCS = 1024
  o_void = 0
  o_reg = 1
  o_mem = 2
  o_phrase = 3
  o_displ = 4
  o_imm = 5
  o_far = 6
  o_near = 7
  o_idpspec0 = 8
  o_idpspec1 = 9
  o_idpspec2 = 10
  o_idpspec3 = 11
  o_idpspec4 = 12
  o_idpspec5 = 13
  o_last = 14
  o_trreg = 8
  o_dbreg = 9
  o_crreg = 10
  o_mmxreg = 12
  o_xmmreg = 13
  o_reglist = 9
  o_creglist = 10
  o_creg = 11
  o_fpreg = 12
  o_fpreglist = 13
  o_text = 14
  o_spr = 8
  o_twofpr = 9
  o_shmbme = 10
  o_crf = 11
  o_crb = 12
  o_dcr = 13
  ASCSTR_LAST = 7
  SEARCH_UP = 0
  SEARCH_DOWN = 1
  SEARCH_NEXT = 2
  SEARCH_CASE = 4
  SEARCH_REGEX = 8
  SEARCH_NOBRK = 16
  SEARCH_NOSHOW = 32
  INF_VERSION = 3
  INF_PROCNAME = 5
  INF_LFLAGS = 13
  LFLG_PC_FPP = 1
  LFLG_PC_FLAT = 2
  LFLG_64BIT = 4
  LFLG_DBG_NOPATH = 8
  LFLG_SNAPSHOT = 16
  INF_DEMNAMES = 14
  DEMNAM_CMNT = 0
  DEMNAM_NAME = 1
  DEMNAM_NONE = 2
  INF_FILETYPE = 15
  FT_EXE_OLD = 0
  FT_COM_OLD = 1
  FT_BIN = 2
  FT_DRV = 3
  FT_WIN = 4
  FT_HEX = 5
  FT_MEX = 6
  FT_LX = 7
  FT_LE = 8
  FT_NLM = 9
  FT_COFF = 10
  FT_PE = 11
  FT_OMF = 12
  FT_SREC = 13
  FT_ZIP = 14
  FT_OMFLIB = 15
  FT_AR = 16
  FT_LOADER = 17
  FT_ELF = 18
  FT_W32RUN = 19
  FT_AOUT = 20
  FT_PRC = 21
  FT_EXE = 22
  FT_COM = 23
  FT_AIXAR = 24
  INF_FCORESIZ = 17
  OSTYPE_MSDOS = 1
  OSTYPE_WIN = 2
  OSTYPE_OS2 = 4
  OSTYPE_NETW = 8
  APPT_CONSOLE = 1
  APPT_GRAPHIC = 2
  APPT_PROGRAM = 4
  APPT_LIBRARY = 8
  APPT_DRIVER = 16
  APPT_1THREAD = 32
  APPT_MTHREAD = 64
  APPT_16BIT = 128
  APPT_32BIT = 256
  INF_START_AF = 33
  AF_FIXUP = 1
  AF_MARKCODE = 2
  AF_UNK = 4
  AF_CODE = 8
  AF_PROC = 16
  AF_USED = 32
  AF_FLIRT = 64
  AF_PROCPTR = 128
  AF_JFUNC = 256
  AF_NULLSUB = 512
  AF_LVAR = 1024
  AF_TRACE = 2048
  AF_ASCII = 4096
  AF_IMMOFF = 8192
  AF_DREFOFF = 16384
  AF_FINAL = 32768
  INFFL_LZERO = 1
  INFFL_LOADIDC = 4
  SW_SEGXRF = 1
  SW_XRFMRK = 2
  SW_XRFFNC = 4
  SW_XRFVAL = 8
  SW_RPTCMT = 1
  SW_ALLCMT = 2
  SW_NOCMT = 4
  SW_LINNUM = 8
  SW_MICRO = 16
  NM_REL_OFF = 0
  NM_PTR_OFF = 1
  NM_NAM_OFF = 2
  NM_REL_EA = 3
  NM_PTR_EA = 4
  NM_NAM_EA = 5
  NM_EA = 6
  NM_EA4 = 7
  NM_EA8 = 8
  NM_SHORT = 9
  NM_SERIAL = 10
  PREF_SEGADR = 1
  PREF_FNCOFF = 2
  PREF_STACK = 4
  ASCF_GEN = 1
  ASCF_AUTO = 2
  ASCF_SERIAL = 4
  ASCF_COMMENT = 16
  ASCF_SAVECASE = 32
  LN_NORMAL = 1
  LN_PUBLIC = 2
  LN_AUTO = 4
  LN_WEAK = 8
  ASCSTR_TERMCHR = 0
  ASCSTR_C = 0
  ASCSTR_PASCAL = 1
  ASCSTR_LEN2 = 2
  ASCSTR_UNICODE = 3
  ASCSTR_LEN4 = 4
  ASCSTR_ULEN2 = 5
  ASCSTR_ULEN4 = 6
  AF2_JUMPTBL = 1
  AF2_DODATA = 2
  AF2_HFLIRT = 4
  AF2_STKARG = 8
  AF2_REGARG = 16
  AF2_CHKUNI = 32
  AF2_SIGCMT = 64
  AF2_SIGMLT = 128
  AF2_FTAIL = 256
  AF2_DATOFF = 512
  AF2_ANORET = 1024
  AF2_VERSP = 2048
  AF2_DOCODE = 4096
  AF2_TRFUNC = 8192
  AF2_PURDAT = 16384
  COMP_MASK = 15
  COMP_UNK = 0
  COMP_MS = 1
  COMP_BC = 2
  COMP_WATCOM = 3
  COMP_GNU = 6
  COMP_VISAGE = 7
  COMP_BP = 8
  INF_SIZEOF_LDBL = 196
  INF_CORESTART = 21
  INF_OSTYPE = 25
  INF_APPTYPE = 27
  INF_START_SP = 29
  INF_AF = 45
  INF_START_IP = 35
  INF_BEGIN_EA = 39
  INF_MIN_EA = 43
  INF_MAX_EA = 47
  INF_OMIN_EA = 51
  INF_OMAX_EA = 55
  INF_LOW_OFF = 59
  INF_HIGH_OFF = 63
  INF_MAXREF = 67
  INF_ASCII_BREAK = 71
  INF_WIDE_HIGH_BYTE_FIRST = 72
  INF_INDENT = 73
  INF_COMMENT = 74
  INF_XREFNUM = 75
  INF_ENTAB = 76
  INF_SPECSEGS = 77
  INF_VOIDS = 78
  INF_SHOWAUTO = 80
  INF_AUTO = 81
  INF_BORDER = 82
  INF_NULL = 83
  INF_GENFLAGS = 84
  INF_SHOWPREF = 85
  INF_PREFSEG = 86
  INF_ASMTYPE = 87
  INF_BASEADDR = 88
  INF_XREFS = 92
  INF_BINPREF = 93
  INF_CMTFLAG = 95
  INF_NAMETYPE = 96
  INF_SHOWBADS = 97
  INF_PREFFLAG = 98
  INF_PACKBASE = 99
  INF_ASCIIFLAGS = 100
  INF_LISTNAMES = 101
  INF_ASCIIPREF = 102
  INF_ASCIISERNUM = 118
  INF_ASCIIZEROES = 122
  INF_MF = 126
  INF_ORG = 127
  INF_ASSUME = 128
  INF_CHECKARG = 129
  INF_START_SS = 130
  INF_START_CS = 134
  INF_MAIN = 138
  INF_SHORT_DN = 142
  INF_LONG_DN = 146
  INF_DATATYPES = 150
  INF_STRTYPE = 154
  INF_AF2 = 158
  INF_NAMELEN = 160
  INF_MARGIN = 162
  INF_LENXREF = 164
  INF_LPREFIX = 166
  INF_LPREFIXLEN = 182
  INF_COMPILER = 183
  INF_MODEL = 184
  INF_SIZEOF_INT = 185
  INF_SIZEOF_BOOL = 186
  INF_SIZEOF_ENUM = 187
  INF_SIZEOF_ALGN = 188
  INF_SIZEOF_SHORT = 189
  INF_SIZEOF_LONG = 190
  INF_SIZEOF_LLONG = 191
  INF_CHANGE_COUNTER = 192
  INF_SIZEOF_LBDL = 280
  SETPROC_COMPAT = 0
  SETPROC_ALL = 1
  SETPROC_USER = 2
  SETPROC_FATAL = 128
  IDA_STATUS_READY = 0
  IDA_STATUS_THINKING = 1
  IDA_STATUS_WAITING = 2
  IDA_STATUS_WORK = 3
  SEGMOD_KILL = 1
  SEGMOD_KEEP = 2
  SEGMOD_SILENT = 4
  saAbs = 0
  saRelByte = 1
  saRelWord = 2
  saRelPara = 3
  saRelPage = 4
  saRelDble = 5
  saRel4K = 6
  saGroup = 7
  saRel32Bytes = 8
  saRel64Bytes = 9
  saRelQword = 10
  scPriv = 0
  scPub = 2
  scPub2 = 4
  scStack = 5
  scCommon = 6
  scPub3 = 7
  SEG_NORM = 0
  SEG_XTRN = 1
  SEG_CODE = 2
  SEG_DATA = 3
  SEG_IMP = 4
  SEG_GRP = 6
  SEG_NULL = 7
  SEG_UNDF = 8
  SEG_BSS = 9
  SEG_ABSSYM = 10
  SEG_COMM = 11
  SEG_IMEM = 12
  SEGATTR_START = 0
  SEGATTR_END = 4
  SEGATTR_ORGBASE = 16
  SEGATTR_ALIGN = 20
  SEGATTR_COMB = 21
  SEGATTR_PERM = 22
  SEGATTR_BITNESS = 23
  SEGATTR_FLAGS = 24
  SEGATTR_SEL = 26
  SEGATTR_ES = 30
  SEGATTR_CS = 34
  SEGATTR_SS = 38
  SEGATTR_DS = 42
  SEGATTR_FS = 46
  SEGATTR_GS = 50
  SEGATTR_TYPE = 94
  SEGATTR_COLOR = 95
  SFL_COMORG = 1
  SFL_OBOK = 2
  SFL_HIDDEN = 4
  SFL_DEBUG = 8
  SFL_LOADER = 16
  SFL_HIDETYPE = 32
  MSF_SILENT = 1
  MSF_NOFIX = 2
  MSF_LDKEEP = 4
  MSF_FIXONCE = 8
  MOVE_SEGM_OK = 0
  MOVE_SEGM_PARAM = -1
  MOVE_SEGM_ROOM = -2
  MOVE_SEGM_IDP = -3
  MOVE_SEGM_CHUNK = -4
  MOVE_SEGM_LOADER = -5
  MOVE_SEGM_ODD = -6
  STT_VA = 0
  STT_MM = 1
  fl_CF = 16
  fl_CN = 17
  fl_JF = 18
  fl_JN = 19
  fl_F = 21
  XREF_USER = 32
  dr_O = 1
  dr_W = 2
  dr_R = 3
  dr_T = 4
  dr_I = 5
  FUNCATTR_START = 0
  FUNCATTR_END = 4
  FUNCATTR_FLAGS = 8
  FUNCATTR_FRAME = 10
  FUNCATTR_FRSIZE = 14
  FUNCATTR_FRREGS = 18
  FUNCATTR_ARGSIZE = 20
  FUNCATTR_FPD = 24
  FUNCATTR_COLOR = 28
  FUNCATTR_OWNER = 10
  FUNCATTR_REFQTY = 14
  FUNC_NORET = 1
  FUNC_FAR = 2
  FUNC_LIB = 4
  FUNC_STATIC = 8
  FUNC_FRAME = 16
  FUNC_USERFAR = 32
  FUNC_HIDDEN = 64
  FUNC_THUNK = 128
  FUNC_BOTTOMBP = 256
  FUNC_NORET_PENDING = 512
  FUNC_SP_READY = 1024
  FUNC_PURGED_OK = 16384
  FUNC_TAIL = 32768
  FIXUP_MASK = 15
  FIXUP_OFF8 = 0
  FIXUP_BYTE = 0
  FIXUP_OFF16 = 1
  FIXUP_SEG16 = 2
  FIXUP_PTR32 = 3
  FIXUP_OFF32 = 4
  FIXUP_PTR48 = 5
  FIXUP_HI8 = 6
  FIXUP_HI16 = 7
  FIXUP_LOW8 = 8
  FIXUP_LOW16 = 9
  FIXUP_REL = 16
  FIXUP_SELFREL = 0
  FIXUP_EXTDEF = 32
  FIXUP_UNUSED = 64
  FIXUP_CREATED = 128
  STRUC_ERROR_MEMBER_NAME = -1
  STRUC_ERROR_MEMBER_OFFSET = -2
  STRUC_ERROR_MEMBER_SIZE = -3
  STRUC_ERROR_MEMBER_TINFO = -4
  STRUC_ERROR_MEMBER_STRUCT = -5
  STRUC_ERROR_MEMBER_UNIVAR = -6
  STRUC_ERROR_MEMBER_VARLAST = -7
  ENUM_MEMBER_ERROR_NAME = 1
  ENUM_MEMBER_ERROR_VALUE = 2
  ENUM_MEMBER_ERROR_ENUM = 3
  ENUM_MEMBER_ERROR_MASK = 4
  ENUM_MEMBER_ERROR_ILLV = 5
  AR_LONG = 'A'
Array of longs
  AR_STR = 'S'
Array of strings
  PT_FILE = 1
  PT_SILENT = 2
  PT_PAKDEF = 0
  PT_PAK1 = 16
  PT_PAK2 = 32
  PT_PAK4 = 48
  PT_PAK8 = 64
  PT_PAK16 = 80
  PRTYPE_1LINE = 0
  PRTYPE_MULTI = 1
  PRTYPE_TYPE = 2
  PRTYPE_PRAGMA = 4
  WFNE_ANY = 1
  WFNE_SUSP = 2
  WFNE_SILENT = 4
  WFNE_CONT = 8
  WFNE_NOWAIT = 16
  NOTASK = -2
  DBG_ERROR = -1
  DBG_TIMEOUT = 0
  PROCESS_START = 1
  PROCESS_EXIT = 2
  THREAD_START = 4
  THREAD_EXIT = 8
  BREAKPOINT = 16
  STEP = 32
  EXCEPTION = 64
  LIBRARY_LOAD = 128
  LIBRARY_UNLOAD = 256
  INFORMATION = 512
  SYSCALL = 1024
  WINMESSAGE = 2048
  PROCESS_ATTACH = 4096
  PROCESS_DETACH = 8192
  PROCESS_SUSPEND = 16384
  DSTATE_SUSP = -1
  DSTATE_NOTASK = 0
  DSTATE_RUN = 1
  DSTATE_RUN_WAIT_ATTACH = 2
  DSTATE_RUN_WAIT_END = 3
Get various information about the current debug event These functions are valid only when the current event exists (the process is in the suspended state)
  DOPT_SEGM_MSGS = 1
  DOPT_START_BPT = 2
  DOPT_THREAD_MSGS = 4
  DOPT_THREAD_BPT = 8
  DOPT_BPT_MSGS = 16
  DOPT_LIB_MSGS = 64
  DOPT_LIB_BPT = 128
  DOPT_INFO_MSGS = 256
  DOPT_INFO_BPT = 512
  DOPT_REAL_MEMORY = 1024
  DOPT_REDO_STACK = 2048
  DOPT_ENTRY_BPT = 4096
  DOPT_EXCDLG = 24576
  EXCDLG_NEVER = 0
  EXCDLG_UNKNOWN = 8192
  EXCDLG_ALWAYS = 24576
  DOPT_LOAD_DINFO = 32768
  EXC_BREAK = 1
  EXC_HANDLE = 2
  BPTATTR_EA = 1
  BPTATTR_SIZE = 2
  BPTATTR_TYPE = 3
  BPT_EXEC = 0
  BPT_WRITE = 1
  BPT_RDWR = 3
  BPT_SOFT = 4
  BPTATTR_COUNT = 4
  BPTATTR_FLAGS = 5
  BPT_BRK = 1
  BPT_TRACE = 2
  BPT_UPDMEM = 4
  BPT_ENABLED = 8
  BPT_LOWCND = 16
  BPTATTR_COND = 6
  BPLT_ABS = 0
  BPLT_REL = 1
  BPLT_SYM = 2
  BPTCK_NONE = -1
  BPTCK_NO = 0
  BPTCK_YES = 1
  BPTCK_ACT = 2
  TRACE_STEP = 0
  TRACE_INSN = 1
  TRACE_FUNC = 2
  CIC_ITEM = 1
  CIC_FUNC = 2
  CIC_SEGM = 3
  DEFCOLOR = 4294967295
  UTP_STRUCT = 1
  UTP_ENUM = 0
  SEGDEL_PERM = 1
  SEGDEL_KEEP = 2
  SEGDEL_SILENT = 4
  ARGV = ['hrdoc.py']
The command line arguments passed to IDA via the -S switch.
  __package__ = None
Function Details

byteValue(F)

 

Get byte value from flags Get value of byte provided that the byte is initialized. This macro works ok only for 8-bit byte machines.

atoa(ea)

 

Convert address value to a string Return address in the form 'seg000:1234' (the same as in line prefixes)

Parameters:
  • ea - address to format

rotate_left(value, count, nbits, offset)

 

Rotate a value to the left (or right)

Parameters:
  • value - value to rotate
  • count - number of times to rotate. negative counter means rotate to the right
  • nbits - number of bits to rotate
  • offset - offset of the first bit to rotate
Returns:
the value with the specified field rotated all other bits are not modified

AddHotkey(hotkey, idcfunc)

 

Add hotkey for IDC function

Parameters:
  • hotkey - hotkey name ('a', "Alt-A", etc)
  • idcfunc - IDC function name
Returns:
None

DelHotkey(hotkey)

 

Delete IDC function hotkey

Parameters:
  • hotkey - hotkey code to delete

Jump(ea)

 

Move cursor to the specifed linear address

Parameters:
  • ea - linear address

Wait()

 

Process all entries in the autoanalysis queue Wait for the end of autoanalysis

Note: This function will suspend execution of the calling script till the autoanalysis queue is empty.

CompileEx(input, isfile)

 

Compile an IDC script

The input should not contain functions that are currently executing - otherwise the behaviour of the replaced functions is undefined.

Parameters:
  • input - if isfile != 0, then this is the name of file to compile otherwise it holds the text to compile
  • isfile - specify if 'input' holds a filename or the expression itself
Returns:
0 - ok, otherwise it returns an error message

Eval(expr)

 

Evaluate an IDC expression

Parameters:
  • expr - an expression
Returns:
the expression value. If there are problems, the returned value will be "IDC_FAILURE: xxx" where xxx is the error description

Note: Python implementation evaluates IDC only, while IDC can call other registered languages

EVAL_FAILURE(code)

 

Check the result of Eval() for evaluation failures

Parameters:
  • code - result of Eval()
Returns:
True if there was an evaluation error

SaveBase(idbname, flags=0)

 

Save current database to the specified idb file

Parameters:
  • idbname - name of the idb file. if empty, the current idb file will be used.
  • flags - DBFL_BAK or 0

Exit(code)

 

Stop execution of IDC program, close the database and exit to OS

Parameters:
  • code - code to exit with.
Returns:
-

Exec(command)

 

Execute an OS command.

Parameters:
  • command - command line to execute
Returns:
error code from OS

Note: IDA will wait for the started program to finish. In order to start the command in parallel, use OS methods. For example, you may start another program in parallel using "start" command.

Sleep(milliseconds)

 

Sleep the specified number of milliseconds This function suspends IDA for the specified amount of time

Parameters:
  • milliseconds - time to sleep

RunPlugin(name, arg)

 

Load and run a plugin

Parameters:
  • name - The plugin name is a short plugin name without an extension
  • arg - integer argument
Returns:
0 if could not load the plugin, 1 if ok

ApplySig(name)

 

Load (plan to apply) a FLIRT signature file

Parameters:
  • name - signature name without path and extension
Returns:
0 if could not load the signature file, !=0 otherwise

DeleteAll()

 

Delete all segments, instructions, comments, i.e. everything except values of bytes.

MakeCode(ea)

 

Create an instruction at the specified address

Parameters:
  • ea - linear address
Returns:
0 - can not create an instruction (no such opcode, the instruction would overlap with existing items, etc) otherwise returns length of the instruction in bytes

AnalyzeArea(sEA, eEA)

 

Perform full analysis of the area

Parameters:
  • sEA - starting linear address
  • eEA - ending linear address (excluded)
Returns:
1-ok, 0-Ctrl-Break was pressed.

MakeNameEx(ea, name, flags)

 

Rename an address

Parameters:
  • ea - linear address
  • name - new name of address. If name == "", then delete old name
  • flags - combination of SN_... constants
Returns:
1-ok, 0-failure

MakeComm(ea, comment)

 

Set an indented regular comment of an item

Parameters:
  • ea - linear address
  • comment - comment string
Returns:
None

MakeRptCmt(ea, comment)

 

Set an indented repeatable comment of an item

Parameters:
  • ea - linear address
  • comment - comment string
Returns:
None

MakeArray(ea, nitems)

 

Create an array.

Parameters:
  • ea - linear address
  • nitems - size of array in items

Note: This function will create an array of the items with the same type as the type of the item at 'ea'. If the byte at 'ea' is undefined, then this function will create an array of bytes.

MakeStr(ea, endea)

 

Create a string.

This function creates a string (the string type is determined by the value of GetLongPrm(INF_STRTYPE))

Parameters:
  • ea - linear address
  • endea - ending address of the string (excluded) if endea == BADADDR, then length of string will be calculated by the kernel
Returns:
1-ok, 0-failure

Note: The type of an existing string is returned by GetStringType()

MakeData(ea, flags, size, tid)

 

Create a data item at the specified address

Parameters:
  • ea - linear address
  • flags - FF_BYTE..FF_PACKREAL
  • size - size of item in bytes
  • tid - for FF_STRU the structure id
Returns:
1-ok, 0-failure

MakeByte(ea)

 

Convert the current item to a byte

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakeWord(ea)

 

Convert the current item to a word (2 bytes)

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakeDword(ea)

 

Convert the current item to a double word (4 bytes)

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakeQword(ea)

 

Convert the current item to a quadro word (8 bytes)

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakeOword(ea)

 

Convert the current item to a octa word (16 bytes)

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakeFloat(ea)

 

Convert the current item to a floating point (4 bytes)

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakeDouble(ea)

 

Convert the current item to a double floating point (8 bytes)

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakePackReal(ea)

 

Convert the current item to a packed real (10 or 12 bytes)

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakeTbyte(ea)

 

Convert the current item to a tbyte (10 or 12 bytes)

Parameters:
  • ea - linear address
Returns:
1-ok, 0-failure

MakeStructEx(ea, size, strname)

 

Convert the current item to a structure instance

Parameters:
  • ea - linear address
  • size - structure size in bytes. -1 means that the size will be calculated automatically
  • strname - name of a structure type
Returns:
1-ok, 0-failure

MakeCustomDataEx(ea, size, dtid, fid)

 

Convert the item at address to custom data.

Parameters:
  • ea - linear address.
  • size - custom data size in bytes.
  • dtid - data type ID.
  • fid - data format ID.
Returns:
1-ok, 0-failure

MakeAlign(ea, count, align)

 

Convert the current item to an alignment directive

Parameters:
  • ea - linear address
  • count - number of bytes to convert
  • align - 0 or 1..32 if it is 0, the correct alignment will be calculated by the kernel
Returns:
1-ok, 0-failure

MakeLocal(start, end, location, name)

 

Create a local variable

Parameters:
  • start - start of address range for the local variable
  • end - end of address range for the local variable
  • location - the variable location in the "[bp+xx]" form where xx is a number. The location can also be specified as a register name.
  • name - name of the local variable
Returns:
1-ok, 0-failure

Note: For the stack variables the end address is ignored. If there is no function at 'start' then this function. will fail.

MakeUnkn(ea, flags)

 

Convert the current item to an explored item

Parameters:
  • ea - linear address
  • flags - combination of DOUNK_* constants
Returns:
None

MakeUnknown(ea, size, flags)

 

Convert the current item to an explored item

Parameters:
  • ea - linear address
  • size - size of the range to undefine (for MakeUnknown)
  • flags - combination of DOUNK_* constants
Returns:
None

SetArrayFormat(ea, flags, litems, align)

 

Set array representation format

Parameters:
  • ea - linear address
  • flags - combination of AP_... constants or 0
  • litems - number of items per line. 0 means auto
  • align - element alignment
    • -1: do not align
    • 0: automatic alignment
    • other values: element width
Returns:
1-ok, 0-failure

OpBinary(ea, n)

 

Convert an operand of the item (instruction or data) to a binary number

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands
Returns:
1-ok, 0-failure

Note: the data items use only the type of the first operand

OpOctal(ea, n)

 

Convert an operand of the item (instruction or data) to an octal number

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpDecimal(ea, n)

 

Convert an operand of the item (instruction or data) to a decimal number

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpHex(ea, n)

 

Convert an operand of the item (instruction or data) to a hexadecimal number

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpChr(ea, n)

 
Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpOff(ea, n, base)

 

Convert operand to an offset (for the explanations of 'ea' and 'n' please see OpBinary())

Example:

seg000:2000 dw 1234h

and there is a segment at paragraph 0x1000 and there is a data item within the segment at 0x1234:

seg000:1234 MyString db 'Hello, world!',0

Then you need to specify a linear address of the segment base to create a proper offset:

OpOff(["seg000",0x2000],0,0x10000);

and you will have:

seg000:2000 dw offset MyString

Motorola 680x0 processor have a concept of "outer offsets". If you want to create an outer offset, you need to combine number of the operand with the following bit:

Please note that the outer offsets are meaningful only for Motorola 680x0.

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands
  • base - base of the offset as a linear address If base == BADADDR then the current operand becomes non-offset

OpOffEx(ea, n, reftype, target, base, tdelta)

 

Convert operand to a complex offset expression This is a more powerful version of OpOff() function. It allows to explicitly specify the reference type (off8,off16, etc) and the expression target with a possible target delta. The complex expressions are represented by IDA in the following form:

target + tdelta - base

If the target is not present, then it will be calculated using

target = operand_value - tdelta + base

The target must be present for LOW.. and HIGH.. reference types

Parameters:
  • ea - linear address of the instruction/data
  • n - number of operand to convert (the same as in OpOff)
  • reftype - one of REF_... constants
  • target - an explicitly specified expression target. if you don't want to specify it, use -1. Please note that LOW... and HIGH... reference type requre the target.
  • base - the offset base (a linear address)
  • tdelta - a displacement from the target which will be displayed in the expression.
Returns:
success (boolean)

OpSeg(ea, n)

 

Convert operand to a segment expression

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpNumber(ea, n)

 

Convert operand to a number (with default number base, radix)

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpFloat(ea, n)

 

Convert operand to a floating-point number

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands
Returns:
1-ok, 0-failure

OpAlt(ea, n, opstr)

 

Specify operand represenation manually.

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands
  • opstr - a string represenation of the operand

Note: IDA will not check the specified operand, it will simply display it instead of the orginal representation of the operand.

OpSign(ea, n)

 

Change sign of the operand

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpNot(ea, n)

 

Toggle the bitwise not operator for the operand

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpEnumEx(ea, n, enumid, serial)

 

Convert operand to a symbolic constant

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands
  • enumid - id of enumeration type
  • serial - serial number of the constant in the enumeration The serial numbers are used if there are more than one symbolic constant with the same value in the enumeration. In this case the first defined constant get the serial number 0, then second 1, etc. There could be 256 symbolic constants with the same value in the enumeration.

OpStroffEx(ea, n, strid, delta)

 

Convert operand to an offset in a structure

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands
  • strid - id of a structure type
  • delta - struct offset delta. usually 0. denotes the difference between the structure base and the pointer into the structure.

OpStkvar(ea, n)

 

Convert operand to a stack variable

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands

OpHigh(ea, n, target)

 

Convert operand to a high offset High offset is the upper 16bits of an offset. This type is used by TMS320C6 processors (and probably by other RISC processors too)

Parameters:
  • ea - linear address
  • n - number of operand
    • 0 - the first operand
    • 1 - the second, third and all other operands
    • -1 - all operands
  • target - the full value (all 32bits) of the offset

MakeVar(ea)

 

Mark the location as "variable"

Parameters:
  • ea - address to mark
Returns:
None

Note: All that IDA does is to mark the location as "variable". Nothing else, no additional analysis is performed. This function may disappear in the future.

ExtLinA(ea, n, line)

 

Specify an additional line to display before the generated ones.

Parameters:
  • ea - linear address
  • n - number of anterior additioal line (0..MAX_ITEM_LINES)
  • line - the line to display
Returns:
None

Note: IDA displays additional lines from number 0 up to the first unexisting additional line. So, if you specify additional line #150 and there is no additional line #149, your line will not be displayed. MAX_ITEM_LINES is defined in IDA.CFG

ExtLinB(ea, n, line)

 

Specify an additional line to display after the generated ones.

Parameters:
  • ea - linear address
  • n - number of posterior additioal line (0..MAX_ITEM_LINES)
  • line - the line to display
Returns:
None

Note: IDA displays additional lines from number 0 up to the first unexisting additional line. So, if you specify additional line #150 and there is no additional line #149, your line will not be displayed. MAX_ITEM_LINES is defined in IDA.CFG

DelExtLnA(ea, n)

 

Delete an additional anterior line

Parameters:
  • ea - linear address
  • n - number of anterior additioal line (0..500)
Returns:
None

DelExtLnB(ea, n)

 

Delete an additional posterior line

Parameters:
  • ea - linear address
  • n - number of posterior additioal line (0..500)
Returns:
None

SetManualInsn(ea, insn)

 

Specify instruction represenation manually.

Parameters:
  • ea - linear address
  • insn - a string represenation of the operand

Note: IDA will not check the specified instruction, it will simply display it instead of the orginal representation.

GetManualInsn(ea)

 

Get manual representation of instruction

Parameters:
  • ea - linear address

Note: This function returns value set by SetManualInsn earlier.

PatchDbgByte(ea, value)

 

Change a byte in the debugged process memory only

Parameters:
  • ea - address
  • value - new value of the byte
Returns:
1 if successful, 0 if not

PatchByte(ea, value)

 

Change value of a program byte If debugger was active then the debugged process memory will be patched too

Parameters:
  • ea - linear address
  • value - new value of the byte
Returns:
1 if successful, 0 if not

PatchWord(ea, value)

 

Change value of a program word (2 bytes)

Parameters:
  • ea - linear address
  • value - new value of the word
Returns:
1 if successful, 0 if not

PatchDword(ea, value)

 

Change value of a double word

Parameters:
  • ea - linear address
  • value - new value of the double word
Returns:
1 if successful, 0 if not

SetFlags(ea, flags)

 

Set new value of flags This function should not used be used directly if possible. It changes properties of a program byte and if misused, may lead to very-very strange results.

Parameters:
  • ea - adress
  • flags - new flags value

SetRegEx(ea, reg, value, tag)

 

Set value of a segment register.

Parameters:
  • ea - linear address
  • reg - name of a register, like "cs", "ds", "es", etc.
  • value - new value of the segment register.
  • tag - of SR_... constants

Note: IDA keeps tracks of all the points where segment register change their values. This function allows you to specify the correct value of a segment register if IDA is not able to find the corrent value.

See also SetReg() compatibility macro.

AutoMark2(start, end, queuetype)

 

Plan to perform an action in the future. This function will put your request to a special autoanalysis queue. Later IDA will retrieve the request from the queue and process it. There are several autoanalysis queue types. IDA will process all queries from the first queue and then switch to the second queue, etc.

GenerateFile(filetype, path, ea1, ea2, flags)

 

Generate an output file

Parameters:
  • filetype - type of output file. One of OFILE_... symbols. See below.
  • path - the output file path (will be overwritten!)
  • ea1 - start address. For some file types this argument is ignored
  • ea2 - end address. For some file types this argument is ignored
  • flags - bit combination of GENFLG_...
Returns:
number of the generated lines. -1 if an error occured OFILE_EXE: 0-can't generate exe file, 1-ok

GenFuncGdl(outfile, title, ea1, ea2, flags)

 

Generate a flow chart GDL file

Parameters:
  • outfile - output file name. GDL extension will be used
  • title - graph title
  • ea1 - beginning of the area to flow chart
  • ea2 - end of the area to flow chart.
  • flags - combination of CHART_... constants

Note: If ea2 == BADADDR then ea1 is treated as an address within a function. That function will be flow charted.

GenCallGdl(outfile, title, flags)

 

Generate a function call graph GDL file

Parameters:
  • outfile - output file name. GDL extension will be used
  • title - graph title
  • flags - combination of CHART_GEN_GDL, CHART_WINGRAPH, CHART_NOLIBFUNCS

GetIdaDirectory()

 

Get IDA directory

This function returns the directory where IDA.EXE resides

GetInputFile()

 

Get input file name

This function returns name of the file being disassembled

GetInputFilePath()

 

Get input file path

This function returns the full path of the file being disassembled

SetInputFilePath(path)

 

Set input file name This function updates the file name that is stored in the database It is used by the debugger and other parts of IDA Use it when the database is moved to another location or when you use remote debugging.

Parameters:
  • path - new input file path

GetIdbPath()

 

Get IDB full path

This function returns full path of the current IDB database

GetInputMD5()

 

Return the MD5 hash of the input binary file

Returns:
MD5 string or None on error

GetFlags(ea)

 

Get internal flags

Parameters:
  • ea - linear address
Returns:
32-bit value of internal flags. See start of IDC.IDC file for explanations.

IdbByte(ea)

 

Get one byte (8-bit) of the program at 'ea' from the database even if the debugger is active

Parameters:
  • ea - linear address
Returns:
byte value. If the byte has no value then 0xFF is returned.

Note: If the current byte size is different from 8 bits, then the returned value may have more 1's. To check if a byte has a value, use this expr: hasValue(GetFlags(ea))

GetManyBytes(ea, size, use_dbg=False)

 

Return the specified number of bytes of the program

Parameters:
  • ea - linear address
  • size - size of buffer in normal 8-bit bytes
  • use_dbg - if True, use debugger memory, otherwise just the database
Returns:
None on failure otherwise a string containing the read bytes

Byte(ea)

 

Get value of program byte

Parameters:
  • ea - linear address
Returns:
value of byte. If byte has no value then returns 0xFF If the current byte size is different from 8 bits, then the returned value might have more 1's. To check if a byte has a value, use functions hasValue(GetFlags(ea))

DbgByte(ea)

 

Get value of program byte using the debugger memory

Parameters:
  • ea - linear address
Returns:
The value or None on failure.

DbgWord(ea)

 

Get value of program word using the debugger memory

Parameters:
  • ea - linear address
Returns:
The value or None on failure.

DbgDword(ea)

 

Get value of program double-word using the debugger memory

Parameters:
  • ea - linear address
Returns:
The value or None on failure.

DbgQword(ea)

 

Get value of program quadro-word using the debugger memory

Parameters:
  • ea - linear address
Returns:
The value or None on failure.

GetOriginalByte(ea)

 

Get original value of program byte

Parameters:
  • ea - linear address
Returns:
the original value of byte before any patch applied to it

Word(ea)

 

Get value of program word (2 bytes)

Parameters:
  • ea - linear address
Returns:
the value of the word. If word has no value then returns 0xFFFF If the current byte size is different from 8 bits, then the returned value might have more 1's.

Dword(ea)

 

Get value of program double word (4 bytes)

Parameters:
  • ea - linear address
Returns:
the value of the double word. If failed returns -1

Qword(ea)

 

Get value of program quadro word (8 bytes)

Parameters:
  • ea - linear address
Returns:
the value of the quadro word. If failed, returns -1

GetFloat(ea)

 

Get value of a floating point number (4 bytes)

Parameters:
  • ea - linear address
Returns:
float

GetDouble(ea)

 

Get value of a floating point number (8 bytes)

Parameters:
  • ea - linear address
Returns:
double

LocByName(name)

 

Get linear address of a name

Parameters:
  • name - name of program byte
Returns:
address of the name BADADDR - No such name

LocByNameEx(fromaddr, name)

 

Get linear address of a name

Parameters:
  • fromaddr - the referring address. Allows to retrieve local label addresses in functions. If a local name is not found, then address of a global name is returned.
  • name - name of program byte
Returns:
address of the name (BADADDR - no such name)

Note: Dummy names (like byte_xxxx where xxxx are hex digits) are parsed by this function to obtain the address. The database is not consulted for them.

SegByBase(base)

 

Get segment by segment base

Parameters:
  • base - segment base paragraph or selector
Returns:
linear address of the start of the segment or BADADDR if no such segment

GetCurrentLine()

 

Get the disassembly line at the cursor

Returns:
string

SelEnd()

 

Get end address of the selected area

Returns:
BADADDR - the user has not selected an area

GetReg(ea, reg)

 

Get value of segment register at the specified address

Parameters:
  • ea - linear address
  • reg - name of segment register
Returns:
the value of the segment register or -1 on error

Note: The segment registers in 32bit program usually contain selectors, so to get paragraph pointed by the segment register you need to call AskSelector() function.

NextAddr(ea)

 

Get next address in the program

Parameters:
  • ea - linear address
Returns:
BADADDR - the specified address in the last used address

PrevAddr(ea)

 

Get previous address in the program

Parameters:
  • ea - linear address
Returns:
BADADDR - the specified address in the first address

NextHead(ea, maxea=4294967295)

 

Get next defined item (instruction or data) in the program

Parameters:
  • ea - linear address to start search from
  • maxea - the search will stop at the address maxea is not included in the search range
Returns:
BADADDR - no (more) defined items

PrevHead(ea, minea=0)

 

Get previous defined item (instruction or data) in the program

Parameters:
  • ea - linear address to start search from
  • minea - the search will stop at the address minea is included in the search range
Returns:
BADADDR - no (more) defined items

NextNotTail(ea)

 

Get next not-tail address in the program This function searches for the next displayable address in the program. The tail bytes of instructions and data are not displayable.

Parameters:
  • ea - linear address
Returns:
BADADDR - no (more) not-tail addresses

PrevNotTail(ea)

 

Get previous not-tail address in the program This function searches for the previous displayable address in the program. The tail bytes of instructions and data are not displayable.

Parameters:
  • ea - linear address
Returns:
BADADDR - no (more) not-tail addresses

ItemHead(ea)

 

Get starting address of the item (instruction or data)

Parameters:
  • ea - linear address
Returns:
the starting address of the item if the current address is unexplored, returns 'ea'

ItemEnd(ea)

 

Get address of the end of the item (instruction or data)

Parameters:
  • ea - linear address
Returns:
address past end of the item at 'ea'

ItemSize(ea)

 

Get size of instruction or data item in bytes

Parameters:
  • ea - linear address
Returns:
1..n

NameEx(fromaddr, ea)

 

Get visible name of program byte

This function returns name of byte as it is displayed on the screen. If a name contains illegal characters, IDA replaces them by the substitution character during displaying. See IDA.CFG for the definition of the substitution character.

Parameters:
  • fromaddr - the referring address. May be BADADDR. Allows to retrieve local label addresses in functions. If a local name is not found, then a global name is returned.
  • ea - linear address
Returns:
"" - byte has no name

GetTrueNameEx(fromaddr, ea)

 

Get true name of program byte

This function returns name of byte as is without any replacements.

Parameters:
  • fromaddr - the referring address. May be BADADDR. Allows to retrieve local label addresses in functions. If a local name is not found, then a global name is returned.
  • ea - linear address
Returns:
"" - byte has no name

Demangle(name, disable_mask)

 

Demangle a name

Parameters:
  • name - name to demangle
  • disable_mask - a mask that tells how to demangle the name it is a good idea to get this mask using GetLongPrm(INF_SHORT_DN) or GetLongPrm(INF_LONG_DN)
Returns:
a demangled name If the input name cannot be demangled, returns None

GetDisasm(ea)

 

Get disassembly line

Parameters:
  • ea - linear address of instruction
Returns:
"" - no instruction at the specified location

Note: this function may not return exactly the same mnemonics as you see on the screen.

GetMnem(ea)

 

Get instruction mnemonics

Parameters:
  • ea - linear address of instruction
Returns:
"" - no instruction at the specified location

Note: this function may not return exactly the same mnemonics as you see on the screen.

GetOpnd(ea, n)

 

Get operand of an instruction

Parameters:
  • ea - linear address of instruction
  • n - number of operand: 0 - the first operand 1 - the second operand
Returns:
the current text representation of operand

GetOpType(ea, n)

 

Get type of instruction operand

Parameters:
  • ea - linear address of instruction
  • n - number of operand: 0 - the first operand 1 - the second operand
Returns:
any of o_* constants or -1 on error

GetOperandValue(ea, n)

 

Get number used in the operand

This function returns an immediate number used in the operand

Parameters:
  • ea - linear address of instruction
  • n - the operand number
Returns:
value operand is an immediate value => immediate value operand has a displacement => displacement operand is a direct memory ref => memory address operand is a register => register number operand is a register phrase => phrase number otherwise => -1

LineA(ea, num)

 

Get anterior line

Parameters:
  • ea - linear address
  • num - number of anterior line (0..MAX_ITEM_LINES) MAX_ITEM_LINES is defined in IDA.CFG
Returns:
anterior line string

LineB(ea, num)

 

Get posterior line

Parameters:
  • ea - linear address
  • num - number of posterior line (0..MAX_ITEM_LINES)
Returns:
posterior line string

GetCommentEx(ea, repeatable)

 

Get regular indented comment

Parameters:
  • ea - linear address
Returns:
string or None if it fails

AltOp(ea, n)

 

Get manually entered operand string

Parameters:
  • ea - linear address
  • n - number of operand: 0 - the first operand 1 - the second operand
Returns:
string or None if it fails

GetString(ea, length=-1, strtype=0)

 

Get string contents

Parameters:
  • ea - linear address
  • length - string length. -1 means to calculate the max string length
  • strtype - the string type (one of ASCSTR_... constants)
Returns:
string contents or empty string

GetStringType(ea)

 

Get string type

Parameters:
  • ea - linear address
Returns:
One of ASCSTR_... constants

FindText(ea, flag, y, x, searchstr)

 
Parameters:
  • ea - start address
  • flag - combination of SEARCH_* flags
  • y - number of text line at ea to start from (0..MAX_ITEM_LINES)
  • x - coordinate in this line
  • searchstr - search string
Returns:
ea of result or BADADDR if not found

FindBinary(ea, flag, searchstr, radix=16)

 
Parameters:
  • ea - start address
  • flag - combination of SEARCH_* flags
  • searchstr - a string as a user enters it for Search Text in Core
  • radix - radix of the numbers (default=16)
Returns:
ea of result or BADADDR if not found

Note: Example: "41 42" - find 2 bytes 41h,42h (radix is 16)

ChangeConfig(directive)

 

Parse one or more ida.cfg config directives

Parameters:
  • directive - directives to process, for example: PACK_DATABASE=2

Note: If the directives are erroneous, a fatal error will be generated. The changes will be effective only for the current session.

SetProcessorType(processor, level)

 

Change current processor

Parameters:
  • processor - name of processor in short form. run 'ida ?' to get list of allowed processor types
  • level - the power of request:
    • SETPROC_COMPAT - search for the processor type in the current module
    • SETPROC_ALL - search for the processor type in all modules only if there were not calls with SETPROC_USER
    • SETPROC_USER - search for the processor type in all modules and prohibit level SETPROC_USER
    • SETPROC_FATAL - can be combined with previous bits. means that if the processor type can't be set, IDA should display an error message and exit.

Batch(batch)

 

Enable/disable batch mode of operation

Parameters:
  • batch - Batch mode 0 - ida will display dialog boxes and wait for the user input 1 - ida will not display dialog boxes, warnings, etc.
Returns:
old balue of batch flag

AskStr(defval, prompt)

 

Ask the user to enter a string

Parameters:
  • defval - the default string value. This value will appear in the dialog box.
  • prompt - the prompt to display in the dialog box
Returns:
the entered string or None.

AskFile(forsave, mask, prompt)

 

Ask the user to choose a file

Parameters:
  • forsave - 0: "Open" dialog box, 1: "Save" dialog box
  • mask - the input file mask as "*.*" or the default file name.
  • prompt - the prompt to display in the dialog box
Returns:
the selected file or None.

AskAddr(defval, prompt)

 

Ask the user to enter an address

Parameters:
  • defval - an ea_t designating the default address value. This value will appear in the dialog box.
  • prompt - the prompt to display in the dialog box
Returns:
the entered address or BADADDR.

AskLong(defval, prompt)

 

Ask the user to enter a number

Parameters:
  • defval - a number designating the default value. This value will appear in the dialog box.
  • prompt - the prompt to display in the dialog box
Returns:
the entered number or -1.

ProcessUiAction(name, flags=0)

 

Invokes an IDA UI action by name

Parameters:
  • name - Command name
  • flags - Reserved. Must be zero
Returns:
Boolean

AskSeg(defval, prompt)

 

Ask the user to enter a segment value

Parameters:
  • defval - the default value. This value will appear in the dialog box.
  • prompt - the prompt to display in the dialog box
Returns:
the entered segment selector or BADSEL.

AskIdent(defval, prompt)

 

Ask the user to enter an identifier

Parameters:
  • defval - the default identifier. This value will appear in the dialog box.
  • prompt - the prompt to display in the dialog box
Returns:
the entered identifier or None.

AskYN(defval, prompt)

 

Ask the user a question and let him answer Yes/No/Cancel

Parameters:
  • defval - the default answer. This answer will be selected if the user presses Enter. -1:cancel,0-no,1-ok
  • prompt - the prompt to display in the dialog box
Returns:
-1:cancel,0-no,1-ok

Message(msg)

 

Display a message in the message window

Parameters:
  • msg - message to print (formatting is done in Python)

    This function can be used to debug IDC scripts

Warning(msg)

 

Display a message in a message box

Parameters:
  • msg - message to print (formatting is done in Python)

    This function can be used to debug IDC scripts The user will be able to hide messages if they appear twice in a row on the screen

Fatal(format)

 

Display a fatal message in a message box and quit IDA

Parameters:
  • format - message to print

SetStatus(status)

 

Change IDA indicator.

Parameters:
  • status - new status
Returns:
the previous status.

AskSelector(sel)

 

Get a selector value

Parameters:
  • sel - the selector number
Returns:
selector value if found otherwise the input value (sel)

Note: selector values are always in paragraphs

FindSelector(val)

 

Find a selector which has the specifed value

Parameters:
  • val - value to search for
Returns:
the selector number if found, otherwise the input value (val & 0xFFFF)

Note: selector values are always in paragraphs

SetSelector(sel, value)

 

Set a selector value

Parameters:
  • sel - the selector number
  • value - value of selector
Returns:
None

Note: ida supports up to 4096 selectors. if 'sel' == 'val' then the selector is destroyed because it has no significance

DelSelector(sel)

 

Delete a selector

Parameters:
  • sel - the selector number to delete
Returns:
None

Note: if the selector is found, it will be deleted

FirstSeg()

 

Get first segment

Returns:
address of the start of the first segment BADADDR - no segments are defined

NextSeg(ea)

 

Get next segment

Parameters:
  • ea - linear address
Returns:
start of the next segment BADADDR - no next segment

SegStart(ea)

 

Get start address of a segment

Parameters:
  • ea - any address in the segment
Returns:
start of segment BADADDR - the specified address doesn't belong to any segment

SegEnd(ea)

 

Get end address of a segment

Parameters:
  • ea - any address in the segment
Returns:
end of segment (an address past end of the segment) BADADDR - the specified address doesn't belong to any segment

SegName(ea)

 

Get name of a segment

Parameters:
  • ea - any address in the segment
Returns:
"" - no segment at the specified address

AddSeg(startea, endea, base, use32, align, comb)

 

Create a new segment

Parameters:
  • startea - linear address of the start of the segment
  • endea - linear address of the end of the segment this address will not belong to the segment 'endea' should be higher than 'startea'
  • base - base paragraph or selector of the segment. a paragraph is 16byte memory chunk. If a selector value is specified, the selector should be already defined.
  • use32 - 0: 16bit segment, 1: 32bit segment, 2: 64bit segment
  • align - segment alignment. see below for alignment values
  • comb - segment combination. see below for combination values.
Returns:
0-failed, 1-ok

DelSeg(ea, flags)

 

Delete a segment

Parameters:
  • ea - any address in the segment
  • flags - combination of SEGMOD_* flags
Returns:
boolean success

SetSegBounds(ea, startea, endea, flags)

 

Change segment boundaries

Parameters:
  • ea - any address in the segment
  • startea - new start address of the segment
  • endea - new end address of the segment
  • flags - combination of SEGMOD_... flags
Returns:
boolean success

RenameSeg(ea, name)

 

Change name of the segment

Parameters:
  • ea - any address in the segment
  • name - new name of the segment
Returns:
success (boolean)

SetSegClass(ea, segclass)

 

Change class of the segment

Parameters:
  • ea - any address in the segment
  • segclass - new class of the segment
Returns:
success (boolean)

SegAlign(ea, alignment)

 

Change alignment of the segment

Parameters:
  • ea - any address in the segment
  • alignment - new alignment of the segment (one of the sa... constants)
Returns:
success (boolean)

SegComb(segea, comb)

 

Change combination of the segment

Parameters:
  • segea - any address in the segment
  • comb - new combination of the segment (one of the sc... constants)
Returns:
success (boolean)

SetSegAddressing(ea, bitness)

 

Change segment addressing

Parameters:
  • ea - any address in the segment
  • bitness - 0: 16bit, 1: 32bit, 2: 64bit
Returns:
success (boolean)

SegByName(segname)

 

Get segment by name

Parameters:
  • segname - name of segment
Returns:
segment selector or BADADDR

SetSegDefReg(ea, reg, value)

 

Set default segment register value for a segment

Parameters:
  • ea - any address in the segment if no segment is present at the specified address then all segments will be affected
  • reg - name of segment register
  • value - default value of the segment register. -1-undefined.

SetSegmentType(segea, segtype)

 

Set segment type

Parameters:
  • segea - any address within segment
  • segtype - new segment type:
Returns:
!=0 - ok

GetSegmentAttr(segea, attr)

 

Get segment attribute

Parameters:
  • segea - any address within segment
  • attr - one of SEGATTR_... constants

SetSegmentAttr(segea, attr, value)

 

Set segment attribute

Parameters:
  • segea - any address within segment
  • attr - one of SEGATTR_... constants

Note: Please note that not all segment attributes are modifiable. Also some of them should be modified using special functions like SetSegAddressing, etc.

MoveSegm(ea, to, flags)

 

Move a segment to a new address This function moves all information to the new address It fixes up address sensitive information in the kernel The total effect is equal to reloading the segment to the target address

Parameters:
  • ea - any address within the segment to move
  • to - new segment start address
  • flags - combination MFS_... constants
Returns:
MOVE_SEGM_... error code

rebase_program(delta, flags)

 

Rebase the whole program by 'delta' bytes

Parameters:
  • delta - number of bytes to move the program
  • flags - combination of MFS_... constants it is recommended to use MSF_FIXONCE so that the loader takes care of global variables it stored in the database
Returns:
error code MOVE_SEGM_...

SetStorageType(startEA, endEA, stt)

 

Set storage type

Parameters:
  • startEA - starting address
  • endEA - ending address
  • stt - new storage type, one of STT_VA and STT_MM
Returns:
0 - ok, otherwise internal error code

DelCodeXref(From, To, undef)

 

Unmark exec flow 'from' 'to'

Parameters:
  • undef - make 'To' undefined if no more references to it
Returns:
1 - planned to be made undefined

XrefType()

 

Return type of the last xref obtained by [RD]first/next[B0] functions.

Returns:
constants fl_* or dr_*

LoadFile(filepath, pos, ea, size)

 

Load file into IDA database

Parameters:
  • filepath - path to input file
  • pos - position in the file
  • ea - linear address to load
  • size - number of bytes to load
Returns:
0 - error, 1 - ok

SaveFile(filepath, pos, ea, size)

 

Save from IDA database to file

Parameters:
  • filepath - path to output file
  • pos - position in the file
  • ea - linear address to save from
  • size - number of bytes to save
Returns:
0 - error, 1 - ok

MakeFunction(start, end=4294967295)

 

Create a function

Parameters:
  • start - function bounds
  • end - function bounds

    If the function end address is BADADDR, then IDA will try to determine the function bounds automatically. IDA will define all necessary instructions to determine the function bounds.

Returns:
!=0 - ok

Note: an instruction should be present at the start address

DelFunction(ea)

 

Delete a function

Parameters:
  • ea - any address belonging to the function
Returns:
!=0 - ok

SetFunctionEnd(ea, end)

 

Change function end address

Parameters:
  • ea - any address belonging to the function
  • end - new function end address
Returns:
!=0 - ok

NextFunction(ea)

 

Find next function

Parameters:
  • ea - any address belonging to the function
Returns:
BADADDR - no more functions otherwise returns the next function start address

PrevFunction(ea)

 

Find previous function

Parameters:
  • ea - any address belonging to the function
Returns:
BADADDR - no more functions otherwise returns the previous function start address

GetFunctionAttr(ea, attr)

 

Get a function attribute

Parameters:
  • ea - any address belonging to the function
  • attr - one of FUNCATTR_... constants
Returns:
BADADDR - error otherwise returns the attribute value

SetFunctionAttr(ea, attr, value)

 

Set a function attribute

Parameters:
  • ea - any address belonging to the function
  • attr - one of FUNCATTR_... constants
  • value - new value of the attribute
Returns:
1-ok, 0-failed

GetFunctionFlags(ea)

 

Retrieve function flags

Parameters:
  • ea - any address belonging to the function
Returns:
-1 - function doesn't exist otherwise returns the flags

SetFunctionFlags(ea, flags)

 

Change function flags

Parameters:
  • ea - any address belonging to the function
  • flags - see GetFunctionFlags() for explanations
Returns:
!=0 - ok

GetFunctionName(ea)

 

Retrieve function name

Parameters:
  • ea - any address belonging to the function
Returns:
null string - function doesn't exist otherwise returns function name

GetFunctionCmt(ea, repeatable)

 

Retrieve function comment

Parameters:
  • ea - any address belonging to the function
  • repeatable - 1: get repeatable comment 0: get regular comment
Returns:
function comment string

SetFunctionCmt(ea, cmt, repeatable)

 

Set function comment

Parameters:
  • ea - any address belonging to the function
  • cmt - a function comment line
  • repeatable - 1: get repeatable comment 0: get regular comment

ChooseFunction(title)

 

Ask the user to select a function

Arguments:

Parameters:
  • title - title of the dialog box
Returns:
-1 - user refused to select a function otherwise returns the selected function start address

GetFuncOffset(ea)

 

Convert address to 'funcname+offset' string

Parameters:
  • ea - address to convert
Returns:
if the address belongs to a function then return a string formed as 'name+offset' where 'name' is a function name 'offset' is offset within the function else return null string

FindFuncEnd(ea)

 

Determine a new function boundaries

Parameters:
  • ea - starting address of a new function
Returns:
if a function already exists, then return its end address. If a function end cannot be determined, the return BADADDR otherwise return the end address of the new function

GetFrame(ea)

 

Get ID of function frame structure

Parameters:
  • ea - any address belonging to the function
Returns:
ID of function frame or None In order to access stack variables you need to use structure member manipulaion functions with the obtained ID.

GetFrameLvarSize(ea)

 

Get size of local variables in function frame

Parameters:
  • ea - any address belonging to the function
Returns:
Size of local variables in bytes. If the function doesn't have a frame, return 0 If the function does't exist, return None

GetFrameRegsSize(ea)

 

Get size of saved registers in function frame

Parameters:
  • ea - any address belonging to the function
Returns:
Size of saved registers in bytes. If the function doesn't have a frame, return 0 This value is used as offset for BP (if FUNC_FRAME is set) If the function does't exist, return None

GetFrameArgsSize(ea)

 

Get size of arguments in function frame which are purged upon return

Parameters:
  • ea - any address belonging to the function
Returns:
Size of function arguments in bytes. If the function doesn't have a frame, return 0 If the function does't exist, return -1

GetFrameSize(ea)

 

Get full size of function frame

Parameters:
  • ea - any address belonging to the function
Returns:
Size of function frame in bytes. This function takes into account size of local variables + size of saved registers + size of return address + size of function arguments If the function doesn't have a frame, return size of function return address in the stack. If the function does't exist, return 0

MakeFrame(ea, lvsize, frregs, argsize)

 

Make function frame

Parameters:
  • ea - any address belonging to the function
  • lvsize - size of function local variables
  • frregs - size of saved registers
  • argsize - size of function arguments
Returns:
ID of function frame or -1 If the function did not have a frame, the frame will be created. Otherwise the frame will be modified

GetSpd(ea)

 

Get current delta for the stack pointer

Parameters:
  • ea - end address of the instruction i.e.the last address of the instruction+1
Returns:
The difference between the original SP upon entering the function and SP for the specified address

GetSpDiff(ea)

 

Get modification of SP made by the instruction

Parameters:
  • ea - end address of the instruction i.e.the last address of the instruction+1
Returns:
Get modification of SP made at the specified location If the specified location doesn't contain a SP change point, return 0 Otherwise return delta of SP modification

SetSpDiff(ea, delta)

 

Setup modification of SP made by the instruction

Parameters:
  • ea - end address of the instruction i.e.the last address of the instruction+1
  • delta - the difference made by the current instruction.
Returns:
1-ok, 0-failed

GetEntryPointQty()

 

Retrieve number of entry points

Returns:
number of entry points

AddEntryPoint(ordinal, ea, name, makecode)

 

Add entry point

Parameters:
  • ordinal - entry point number if entry point doesn't have an ordinal number, 'ordinal' should be equal to 'ea'
  • ea - address of the entry point
  • name - name of the entry point. If null string, the entry point won't be renamed.
  • makecode - if 1 then this entry point is a start of a function. Otherwise it denotes data bytes.
Returns:
0 - entry point with the specifed ordinal already exists 1 - ok

GetEntryOrdinal(index)

 

Retrieve entry point ordinal number

Parameters:
  • index - 0..GetEntryPointQty()-1
Returns:
0 if entry point doesn't exist otherwise entry point ordinal

GetEntryPoint(ordinal)

 

Retrieve entry point address

Parameters:
  • ordinal - entry point number it is returned by GetEntryPointOrdinal()
Returns:
BADADDR if entry point doesn't exist otherwise entry point address. If entry point address is equal to its ordinal number, then the entry point has no ordinal.

GetEntryName(ordinal)

 

Retrieve entry point name

Parameters:
  • ordinal - entry point number, ass returned by GetEntryPointOrdinal()
Returns:
entry point name or None

RenameEntryPoint(ordinal, name)

 

Rename entry point

Parameters:
  • ordinal - entry point number
  • name - new name
Returns:
!=0 - ok

GetNextFixupEA(ea)

 

Find next address with fixup information

Parameters:
  • ea - current address
Returns:
BADADDR - no more fixups otherwise returns the next address with fixup information

GetPrevFixupEA(ea)

 

Find previous address with fixup information

Parameters:
  • ea - current address
Returns:
BADADDR - no more fixups otherwise returns the previous address with fixup information

GetFixupTgtType(ea)

 

Get fixup target type

Parameters:
  • ea - address to get information about
Returns:
-1 - no fixup at the specified address otherwise returns fixup target type:

GetFixupTgtSel(ea)

 

Get fixup target selector

Parameters:
  • ea - address to get information about
Returns:
-1 - no fixup at the specified address otherwise returns fixup target selector

GetFixupTgtOff(ea)

 

Get fixup target offset

Parameters:
  • ea - address to get information about
Returns:
-1 - no fixup at the specified address otherwise returns fixup target offset

GetFixupTgtDispl(ea)

 

Get fixup target displacement

Parameters:
  • ea - address to get information about
Returns:
-1 - no fixup at the specified address otherwise returns fixup target displacement

SetFixup(ea, fixuptype, targetsel, targetoff, displ)

 

Set fixup information

Parameters:
  • ea - address to set fixup information about
  • fixuptype - fixup type. see GetFixupTgtType() for possible fixup types.
  • targetsel - target selector
  • targetoff - target offset
  • displ - displacement
Returns:
none

DelFixup(ea)

 

Delete fixup information

Parameters:
  • ea - address to delete fixup information about
Returns:
None

MarkPosition(ea, lnnum, x, y, slot, comment)

 

Mark position

Parameters:
  • ea - address to mark
  • lnnum - number of generated line for the 'ea'
  • x - x coordinate of cursor
  • y - y coordinate of cursor
  • slot - slot number: 1..1024 if the specifed value is not within the range, IDA will ask the user to select slot.
  • comment - description of the mark. Should be not empty.
Returns:
None

GetMarkedPos(slot)

 

Get marked position

Parameters:
  • slot - slot number: 1..1024 if the specifed value is <= 0 range, IDA will ask the user to select slot.
Returns:
BADADDR - the slot doesn't contain a marked address otherwise returns the marked address

GetMarkComment(slot)

 

Get marked position comment

Parameters:
  • slot - slot number: 1..1024
Returns:
None if the slot doesn't contain a marked address otherwise returns the marked address comment

GetStrucQty()

 

Get number of defined structure types

Returns:
number of structure types

GetFirstStrucIdx()

 

Get index of first structure type

Returns:
BADADDR if no structure type is defined index of first structure type. Each structure type has an index and ID. INDEX determines position of structure definition in the list of structure definitions. Index 1 is listed first, after index 2 and so on. The index of a structure type can be changed any time, leading to movement of the structure definition in the list of structure definitions. ID uniquely denotes a structure type. A structure gets a unique ID at the creation time and this ID can't be changed. Even when the structure type gets deleted, its ID won't be resued in the future.

GetLastStrucIdx()

 

Get index of last structure type

Returns:
BADADDR if no structure type is defined index of last structure type. See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetNextStrucIdx(index)

 

Get index of next structure type

Parameters:
  • index - current structure index
Returns:
BADADDR if no (more) structure type is defined index of the next structure type. See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetPrevStrucIdx(index)

 

Get index of previous structure type

Parameters:
  • index - current structure index
Returns:
BADADDR if no (more) structure type is defined index of the presiouvs structure type. See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetStrucIdx(sid)

 

Get structure index by structure ID

Parameters:
  • sid - structure ID
Returns:
BADADDR if bad structure ID is passed otherwise returns structure index. See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetStrucId(index)

 

Get structure ID by structure index

Parameters:
  • index - structure index
Returns:
BADADDR if bad structure index is passed otherwise returns structure ID.

Note: See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetStrucIdByName(name)

 

Get structure ID by structure name

Parameters:
  • name - structure type name
Returns:
BADADDR if bad structure type name is passed otherwise returns structure ID.

GetStrucName(sid)

 

Get structure type name

Parameters:
  • sid - structure type ID
Returns:
-1 if bad structure type ID is passed otherwise returns structure type name.

GetStrucComment(sid, repeatable)

 

Get structure type comment

Parameters:
  • sid - structure type ID
  • repeatable - 1: get repeatable comment 0: get regular comment
Returns:
None if bad structure type ID is passed otherwise returns comment.

GetStrucSize(sid)

 

Get size of a structure

Parameters:
  • sid - structure type ID
Returns:
0 if bad structure type ID is passed otherwise returns size of structure in bytes.

GetMemberQty(sid)

 

Get number of members of a structure

Parameters:
  • sid - structure type ID
Returns:
-1 if bad structure type ID is passed otherwise returns number of members.

Note: Union members are, in IDA's internals, located at subsequent byte offsets: member 0 -> offset 0x0, member 1 -> offset 0x1, etc...

GetStrucPrevOff(sid, offset)

 

Get previous offset in a structure

Parameters:
  • sid - structure type ID
  • offset - current offset
Returns:
-1 if bad structure type ID is passed or no (more) offsets in the structure otherwise returns previous offset in a structure.
Notes:
  • IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes. This function returns a member offset or a hole offset. It will return size of the structure if input 'offset' is bigger than the structure size.
  • Union members are, in IDA's internals, located at subsequent byte offsets: member 0 -> offset 0x0, member 1 -> offset 0x1, etc...

GetStrucNextOff(sid, offset)

 

Get next offset in a structure

Parameters:
  • sid - structure type ID
  • offset - current offset
Returns:
-1 if bad structure type ID is passed or no (more) offsets in the structure otherwise returns next offset in a structure.
Notes:
  • IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes. This function returns a member offset or a hole offset. It will return size of the structure if input 'offset' belongs to the last member of the structure.
  • Union members are, in IDA's internals, located at subsequent byte offsets: member 0 -> offset 0x0, member 1 -> offset 0x1, etc...

GetFirstMember(sid)

 

Get offset of the first member of a structure

Parameters:
  • sid - structure type ID
Returns:
-1 if bad structure type ID is passed or structure has no members otherwise returns offset of the first member.
Notes:
  • IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes.
  • Union members are, in IDA's internals, located at subsequent byte offsets: member 0 -> offset 0x0, member 1 -> offset 0x1, etc...

GetLastMember(sid)

 

Get offset of the last member of a structure

Parameters:
  • sid - structure type ID
Returns:
-1 if bad structure type ID is passed or structure has no members otherwise returns offset of the last member.
Notes:
  • IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes.
  • Union members are, in IDA's internals, located at subsequent byte offsets: member 0 -> offset 0x0, member 1 -> offset 0x1, etc...

GetMemberOffset(sid, member_name)

 

Get offset of a member of a structure by the member name

Parameters:
  • sid - structure type ID
  • member_name - name of structure member
Returns:
-1 if bad structure type ID is passed or no such member in the structure otherwise returns offset of the specified member.

Note: Union members are, in IDA's internals, located at subsequent byte offsets: member 0 -> offset 0x0, member 1 -> offset 0x1, etc...

GetMemberName(sid, member_offset)

 

Get name of a member of a structure

Parameters:
  • sid - structure type ID
  • member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.
Returns:
None if bad structure type ID is passed or no such member in the structure otherwise returns name of the specified member.

GetMemberComment(sid, member_offset, repeatable)

 

Get comment of a member

Parameters:
  • sid - structure type ID
  • member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.
  • repeatable - 1: get repeatable comment 0: get regular comment
Returns:
None if bad structure type ID is passed or no such member in the structure otherwise returns comment of the specified member.

GetMemberSize(sid, member_offset)

 

Get size of a member

Parameters:
  • sid - structure type ID
  • member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.
Returns:
-1 if bad structure type ID is passed or no such member in the structure otherwise returns size of the specified member in bytes.

GetMemberFlag(sid, member_offset)

 

Get type of a member

Parameters:
  • sid - structure type ID
  • member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.
Returns:
-1 if bad structure type ID is passed or no such member in the structure otherwise returns type of the member, see bit definitions above. If the member type is a structure then function GetMemberStrid() should be used to get the structure type id.

GetMemberStrId(sid, member_offset)

 

Get structure id of a member

Parameters:
  • sid - structure type ID
  • member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.
Returns:
-1 if bad structure type ID is passed or no such member in the structure otherwise returns structure id of the member. If the current member is not a structure, returns -1.

IsUnion(sid)

 

Is a structure a union?

Parameters:
  • sid - structure type ID
Returns:
1: yes, this is a union id 0: no

Note: Unions are a special kind of structures

AddStrucEx(index, name, is_union)

 

Define a new structure type

Parameters:
  • index - index of new structure type If another structure has the specified index, then index of that structure and all other structures will be incremented, freeing the specifed index. If index is == -1, then the biggest index number will be used. See GetFirstStrucIdx() for the explanation of structure indices and IDs.
  • name - name of the new structure type.
  • is_union - 0: structure 1: union
Returns:
-1 if can't define structure type because of bad structure name: the name is ill-formed or is already used in the program. otherwise returns ID of the new structure type

DelStruc(sid)

 

Delete a structure type

Parameters:
  • sid - structure type ID
Returns:
0 if bad structure type ID is passed 1 otherwise the structure type is deleted. All data and other structure types referencing to the deleted structure type will be displayed as array of bytes.

SetStrucIdx(sid, index)

 

Change structure index

Parameters:
  • sid - structure type ID
  • index - new index of the structure
Returns:
!= 0 - ok

Note: See GetFirstStrucIdx() for the explanation of structure indices and IDs.

SetStrucName(sid, name)

 

Change structure name

Parameters:
  • sid - structure type ID
  • name - new name of the structure
Returns:
!= 0 - ok

SetStrucComment(sid, comment, repeatable)

 

Change structure comment

Parameters:
  • sid - structure type ID
  • comment - new comment of the structure
  • repeatable - 1: change repeatable comment 0: change regular comment
Returns:
!= 0 - ok

AddStrucMember(sid, name, offset, flag, typeid, nbytes, target=-1, tdelta=0, reftype=2)

 

Add structure member

Parameters:
  • sid - structure type ID
  • name - name of the new member
  • offset - offset of the new member -1 means to add at the end of the structure
  • flag - type of the new member. Should be one of FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA
  • typeid - if isStruc(flag) then typeid specifies the structure id for the member if isOff0(flag) then typeid specifies the offset base. if isASCII(flag) then typeid specifies the string type (ASCSTR_...). if isStroff(flag) then typeid specifies the structure id if isEnum(flag) then typeid specifies the enum id if isCustom(flags) then typeid specifies the dtid and fid: dtid|(fid<<16) Otherwise typeid should be -1.
  • nbytes - number of bytes in the new member
  • target - target address of the offset expr. You may specify it as -1, ida will calculate it itself
  • tdelta - offset target delta. usually 0
  • reftype - see REF_... definitions
Returns:
0 - ok, otherwise error code (one of STRUC_ERROR_*)

Note: The remaining arguments are allowed only if isOff0(flag) and you want to specify a complex offset expression

DelStrucMember(sid, member_offset)

 

Delete structure member

Parameters:
  • sid - structure type ID
  • member_offset - offset of the member
Returns:
!= 0 - ok.

Note: IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes.

SetMemberName(sid, member_offset, name)

 

Change structure member name

Parameters:
  • sid - structure type ID
  • member_offset - offset of the member
  • name - new name of the member
Returns:
!= 0 - ok.

SetMemberType(sid, member_offset, flag, typeid, nitems, target=-1, tdelta=0, reftype=2)

 

Change structure member type

Parameters:
  • sid - structure type ID
  • member_offset - offset of the member
  • flag - new type of the member. Should be one of FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA
  • typeid - if isStruc(flag) then typeid specifies the structure id for the member if isOff0(flag) then typeid specifies the offset base. if isASCII(flag) then typeid specifies the string type (ASCSTR_...). if isStroff(flag) then typeid specifies the structure id if isEnum(flag) then typeid specifies the enum id if isCustom(flags) then typeid specifies the dtid and fid: dtid|(fid<<16) Otherwise typeid should be -1.
  • nitems - number of items in the member
  • target - target address of the offset expr. You may specify it as -1, ida will calculate it itself
  • tdelta - offset target delta. usually 0
  • reftype - see REF_... definitions
Returns:
!=0 - ok.

Note: The remaining arguments are allowed only if isOff0(flag) and you want to specify a complex offset expression

SetMemberComment(sid, member_offset, comment, repeatable)

 

Change structure member comment

Parameters:
  • sid - structure type ID
  • member_offset - offset of the member
  • comment - new comment of the structure member
  • repeatable - 1: change repeatable comment 0: change regular comment
Returns:
!= 0 - ok

GetFchunkAttr(ea, attr)

 

Get a function chunk attribute

Parameters:
  • ea - any address in the chunk
  • attr - one of: FUNCATTR_START, FUNCATTR_END, FUNCATTR_OWNER, FUNCATTR_REFQTY
Returns:
desired attribute or -1

SetFchunkAttr(ea, attr, value)

 

Set a function chunk attribute

Parameters:
  • ea - any address in the chunk
  • attr - only FUNCATTR_START, FUNCATTR_END, FUNCATTR_OWNER
  • value - desired value
Returns:
0 if failed, 1 if success

GetFchunkReferer(ea, idx)

 

Get a function chunk referer

Parameters:
  • ea - any address in the chunk
  • idx - referer index (0..GetFchunkAttr(FUNCATTR_REFQTY))
Returns:
referer address or BADADDR

NextFchunk(ea)

 

Get next function chunk

Parameters:
  • ea - any address
Returns:
the starting address of the next function chunk or BADADDR

Note: This function enumerates all chunks of all functions in the database

PrevFchunk(ea)

 

Get previous function chunk

Parameters:
  • ea - any address
Returns:
the starting address of the function chunk or BADADDR

Note: This function enumerates all chunks of all functions in the database

AppendFchunk(funcea, ea1, ea2)

 

Append a function chunk to the function

Parameters:
  • funcea - any address in the function
  • ea1 - start of function tail
  • ea2 - end of function tail
Returns:
0 if failed, 1 if success

Note: If a chunk exists at the specified addresses, it must have exactly the specified boundaries

RemoveFchunk(funcea, tailea)

 

Remove a function chunk from the function

Parameters:
  • funcea - any address in the function
  • tailea - any address in the function chunk to remove
Returns:
0 if failed, 1 if success

SetFchunkOwner(tailea, funcea)

 

Change the function chunk owner

Parameters:
  • tailea - any address in the function chunk
  • funcea - the starting address of the new owner
Returns:
0 if failed, 1 if success

Note: The new owner must already have the chunk appended before the call

FirstFuncFchunk(funcea)

 

Get the first function chunk of the specified function

Parameters:
  • funcea - any address in the function
Returns:
the function entry point or BADADDR

Note: This function returns the first (main) chunk of the specified function

NextFuncFchunk(funcea, tailea)

 

Get the next function chunk of the specified function

Parameters:
  • funcea - any address in the function
  • tailea - any address in the current chunk
Returns:
the starting address of the next function chunk or BADADDR

Note: This function returns the next chunk of the specified function

GetEnumQty()

 

Get number of enum types

Returns:
number of enumerations

GetnEnum(idx)

 

Get ID of the specified enum by its serial number

Parameters:
  • idx - number of enum (0..GetEnumQty()-1)
Returns:
ID of enum or -1 if error

GetEnumIdx(enum_id)

 

Get serial number of enum by its ID

Parameters:
  • enum_id - ID of enum
Returns:
(0..GetEnumQty()-1) or -1 if error

GetEnum(name)

 

Get enum ID by the name of enum

Arguments: name - name of enum

returns: ID of enum or -1 if no such enum exists

GetEnumName(enum_id)

 

Get name of enum

Parameters:
  • enum_id - ID of enum
Returns:
name of enum or empty string

GetEnumCmt(enum_id, repeatable)

 

Get comment of enum

Parameters:
  • enum_id - ID of enum
  • repeatable - 0:get regular comment 1:get repeatable comment
Returns:
comment of enum

GetEnumSize(enum_id)

 

Get size of enum

Parameters:
  • enum_id - ID of enum
Returns:
number of constants in the enum Returns 0 if enum_id is bad.

GetEnumWidth(enum_id)

 

Get width of enum elements

Parameters:
  • enum_id - ID of enum
Returns:
log2(size of enum elements in bytes)+1 possible returned values are 1..7 1-1byte,2-2bytes,3-4bytes,4-8bytes,etc Returns 0 if enum_id is bad or the width is unknown.

GetEnumFlag(enum_id)

 

Get flag of enum

Parameters:
  • enum_id - ID of enum
Returns:
flags of enum. These flags determine representation of numeric constants (binary,octal,decimal,hex) in the enum definition. See start of this file for more information about flags. Returns 0 if enum_id is bad.

GetConstByName(name)

 

Get member of enum - a symbolic constant ID

Parameters:
  • name - name of symbolic constant
Returns:
ID of constant or -1

GetConstValue(const_id)

 

Get value of symbolic constant

Parameters:
  • const_id - id of symbolic constant
Returns:
value of constant or 0

GetConstBmask(const_id)

 

Get bit mask of symbolic constant

Parameters:
  • const_id - id of symbolic constant
Returns:
bitmask of constant or 0 ordinary enums have bitmask = -1

GetConstEnum(const_id)

 

Get id of enum by id of constant

Parameters:
  • const_id - id of symbolic constant
Returns:
id of enum the constant belongs to. -1 if const_id is bad.

GetConstEx(enum_id, value, serial, bmask)

 

Get id of constant

Parameters:
  • enum_id - id of enum
  • value - value of constant
  • serial - serial number of the constant in the enumeration. See OpEnumEx() for details.
  • bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask
Returns:
id of constant or -1 if error

GetFirstBmask(enum_id)

 

Get first bitmask in the enum (bitfield)

Parameters:
  • enum_id - id of enum (bitfield)
Returns:
the smallest bitmask of constant or -1 no bitmasks are defined yet All bitmasks are sorted by their values as unsigned longs.

GetLastBmask(enum_id)

 

Get last bitmask in the enum (bitfield)

Parameters:
  • enum_id - id of enum
Returns:
the biggest bitmask or -1 no bitmasks are defined yet All bitmasks are sorted by their values as unsigned longs.

GetNextBmask(enum_id, value)

 

Get next bitmask in the enum (bitfield)

Parameters:
  • enum_id - id of enum
  • value - value of the current bitmask
Returns:
value of a bitmask with value higher than the specified value. -1 if no such bitmasks exist. All bitmasks are sorted by their values as unsigned longs.

GetPrevBmask(enum_id, value)

 

Get prev bitmask in the enum (bitfield)

Parameters:
  • enum_id - id of enum
  • value - value of the current bitmask
Returns:
value of a bitmask with value lower than the specified value. -1 no such bitmasks exist. All bitmasks are sorted by their values as unsigned longs.

GetBmaskName(enum_id, bmask)

 

Get bitmask name (only for bitfields)

Parameters:
  • enum_id - id of enum
  • bmask - bitmask of the constant
Returns:
name of bitmask or None

GetBmaskCmt(enum_id, bmask, repeatable)

 

Get bitmask comment (only for bitfields)

Parameters:
  • enum_id - id of enum
  • bmask - bitmask of the constant
  • repeatable - type of comment, 0-regular, 1-repeatable
Returns:
comment attached to bitmask or None

SetBmaskName(enum_id, bmask, name)

 

Set bitmask name (only for bitfields)

Parameters:
  • enum_id - id of enum
  • bmask - bitmask of the constant
  • name - name of bitmask
Returns:
1-ok, 0-failed

SetBmaskCmt(enum_id, bmask, cmt, repeatable)

 

Set bitmask comment (only for bitfields)

Parameters:
  • enum_id - id of enum
  • bmask - bitmask of the constant
  • cmt - comment repeatable - type of comment, 0-regular, 1-repeatable
Returns:
1-ok, 0-failed

GetFirstConst(enum_id, bmask)

 

Get first constant in the enum

Parameters:
  • enum_id - id of enum
  • bmask - bitmask of the constant (ordinary enums accept only -1 as a bitmask)
Returns:
value of constant or -1 no constants are defined All constants are sorted by their values as unsigned longs.

GetLastConst(enum_id, bmask)

 

Get last constant in the enum

Parameters:
  • enum_id - id of enum
  • bmask - bitmask of the constant (ordinary enums accept only -1 as a bitmask)
Returns:
value of constant or -1 no constants are defined All constants are sorted by their values as unsigned longs.

GetNextConst(enum_id, value, bmask)

 

Get next constant in the enum

Parameters:
  • enum_id - id of enum
  • bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask
  • value - value of the current constant
Returns:
value of a constant with value higher than the specified value. -1 no such constants exist. All constants are sorted by their values as unsigned longs.

GetPrevConst(enum_id, value, bmask)

 

Get prev constant in the enum

Parameters:
  • enum_id - id of enum
  • bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask
  • value - value of the current constant
Returns:
value of a constant with value lower than the specified value. -1 no such constants exist. All constants are sorted by their values as unsigned longs.

GetConstName(const_id)

 

Get name of a constant

Parameters:
  • const_id - id of const

    Returns: name of constant

GetConstCmt(const_id, repeatable)

 

Get comment of a constant

Parameters:
  • const_id - id of const
  • repeatable - 0:get regular comment, 1:get repeatable comment
Returns:
comment string

AddEnum(idx, name, flag)

 

Add a new enum type

Parameters:
  • idx - serial number of the new enum. If another enum with the same serial number exists, then all enums with serial numbers >= the specified idx get their serial numbers incremented (in other words, the new enum is put in the middle of the list of enums).

    If idx >= GetEnumQty() or idx == -1 then the new enum is created at the end of the list of enums.

  • name - name of the enum.
  • flag - flags for representation of numeric constants in the definition of enum.
Returns:
id of new enum or BADADDR

DelEnum(enum_id)

 

Delete enum type

Parameters:
  • enum_id - id of enum
Returns:
None

SetEnumIdx(enum_id, idx)

 

Give another serial number to a enum

Parameters:
  • enum_id - id of enum
  • idx - new serial number. If another enum with the same serial number exists, then all enums with serial numbers >= the specified idx get their serial numbers incremented (in other words, the new enum is put in the middle of the list of enums).

    If idx >= GetEnumQty() then the enum is moved to the end of the list of enums.

Returns:
comment string

SetEnumName(enum_id, name)

 

Rename enum

Parameters:
  • enum_id - id of enum
  • name - new name of enum
Returns:
1-ok,0-failed

SetEnumCmt(enum_id, cmt, repeatable)

 

Set comment of enum

Parameters:
  • enum_id - id of enum
  • cmt - new comment for the enum
  • repeatable - is the comment repeatable?
    • 0:set regular comment
    • 1:set repeatable comment
Returns:
1-ok,0-failed

SetEnumFlag(enum_id, flag)

 

Set flag of enum

Parameters:
  • enum_id - id of enum
  • flag - flags for representation of numeric constants in the definition of enum.
Returns:
1-ok,0-failed

SetEnumBf(enum_id, flag)

 

Set bitfield property of enum

Parameters:
  • enum_id - id of enum
  • flag - flags
    • 1: convert to bitfield
    • 0: convert to ordinary enum
Returns:
1-ok,0-failed

SetEnumWidth(enum_id, width)

 

Set width of enum elements

Parameters:
  • enum_id - id of enum
  • width - element width in bytes allowed values: 0-unknown or 1..7: (log2 of the element size)+1
Returns:
1-ok, 0-failed

IsBitfield(enum_id)

 

Is enum a bitfield?

Parameters:
  • enum_id - id of enum
Returns:
1-yes, 0-no, ordinary enum

AddConstEx(enum_id, name, value, bmask)

 

Add a member of enum - a symbolic constant

Parameters:
  • enum_id - id of enum
  • name - name of symbolic constant. Must be unique in the program.
  • value - value of symbolic constant.
  • bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask all bits set in value should be set in bmask too
Returns:
0-ok, otherwise error code (one of ENUM_MEMBER_ERROR_*)

DelConstEx(enum_id, value, serial, bmask)

 

Delete a member of enum - a symbolic constant

Parameters:
  • enum_id - id of enum
  • value - value of symbolic constant.
  • serial - serial number of the constant in the enumeration. See OpEnumEx() for for details.
  • bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask
Returns:
1-ok, 0-failed

SetConstName(const_id, name)

 

Rename a member of enum - a symbolic constant

Parameters:
  • const_id - id of const
  • name - new name of constant
Returns:
1-ok, 0-failed

SetConstCmt(const_id, cmt, repeatable)

 

Set a comment of a symbolic constant

Parameters:
  • const_id - id of const
  • cmt - new comment for the constant
  • repeatable - is the comment repeatable? 0: set regular comment 1: set repeatable comment
Returns:
1-ok, 0-failed

CreateArray(name)

 

Create array.

Parameters:
  • name - The array name.
Returns:
-1 in case of failure, a valid array_id otherwise.

GetArrayId(name)

 

Get array array_id, by name.

Parameters:
  • name - The array name.
Returns:
-1 in case of failure (i.e., no array with that name exists), a valid array_id otherwise.

RenameArray(array_id, newname)

 

Rename array, by its ID.

Parameters:
  • id - The ID of the array to rename.
  • newname - The new name of the array.
Returns:
1 in case of success, 0 otherwise

DeleteArray(array_id)

 

Delete array, by its ID.

Parameters:
  • array_id - The ID of the array to delete.

SetArrayLong(array_id, idx, value)

 

Sets the long value of an array element.

Parameters:
  • array_id - The array ID.
  • idx - Index of an element.
  • value - 32bit or 64bit value to store in the array
Returns:
1 in case of success, 0 otherwise

SetArrayString(array_id, idx, value)

 

Sets the string value of an array element.

Parameters:
  • array_id - The array ID.
  • idx - Index of an element.
  • value - String value to store in the array
Returns:
1 in case of success, 0 otherwise

GetArrayElement(tag, array_id, idx)

 

Get value of array element.

Parameters:
  • tag - Tag of array, specifies one of two array types: AR_LONG, AR_STR
  • array_id - The array ID.
  • idx - Index of an element.
Returns:
Value of the specified array element. Note that this function may return char or long result. Unexistent array elements give zero as a result.

DelArrayElement(tag, array_id, idx)

 

Delete an array element.

Parameters:
  • tag - Tag of array, specifies one of two array types: AR_LONG, AR_STR
  • array_id - The array ID.
  • idx - Index of an element.
Returns:
1 in case of success, 0 otherwise.

GetFirstIndex(tag, array_id)

 

Get index of the first existing array element.

Parameters:
  • tag - Tag of array, specifies one of two array types: AR_LONG, AR_STR
  • array_id - The array ID.
Returns:
-1 if the array is empty, otherwise index of first array element of given type.

GetLastIndex(tag, array_id)

 

Get index of last existing array element.

Parameters:
  • tag - Tag of array, specifies one of two array types: AR_LONG, AR_STR
  • array_id - The array ID.
Returns:
-1 if the array is empty, otherwise index of first array element of given type.

GetNextIndex(tag, array_id, idx)

 

Get index of the next existing array element.

Parameters:
  • tag - Tag of array, specifies one of two array types: AR_LONG, AR_STR
  • array_id - The array ID.
  • idx - Index of the current element.
Returns:
-1 if no more elements, otherwise returns index of the next array element of given type.

GetPrevIndex(tag, array_id, idx)

 

Get index of the previous existing array element.

Parameters:
  • tag - Tag of array, specifies one of two array types: AR_LONG, AR_STR
  • array_id - The array ID.
  • idx - Index of the current element.
Returns:
-1 if no more elements, otherwise returns index of the previous array element of given type.

SetHashLong(hash_id, key, value)

 

Sets the long value of a hash element.

Parameters:
  • hash_id - The hash ID.
  • key - Key of an element.
  • value - 32bit or 64bit value to store in the hash
Returns:
1 in case of success, 0 otherwise

GetHashLong(hash_id, key)

 

Gets the long value of a hash element.

Parameters:
  • hash_id - The hash ID.
  • key - Key of an element.
Returns:
the 32bit or 64bit value of the element, or 0 if no such element.

SetHashString(hash_id, key, value)

 

Sets the string value of a hash element.

Parameters:
  • hash_id - The hash ID.
  • key - Key of an element.
  • value - string value to store in the hash
Returns:
1 in case of success, 0 otherwise

GetHashString(hash_id, key)

 

Gets the string value of a hash element.

Parameters:
  • hash_id - The hash ID.
  • key - Key of an element.
Returns:
the string value of the element, or None if no such element.

DelHashElement(hash_id, key)

 

Delete a hash element.

Parameters:
  • hash_id - The hash ID.
  • key - Key of an element
Returns:
1 upon success, 0 otherwise.

GetFirstHashKey(hash_id)

 

Get the first key in the hash.

Parameters:
  • hash_id - The hash ID.
Returns:
the key, 0 otherwise.

GetLastHashKey(hash_id)

 

Get the last key in the hash.

Parameters:
  • hash_id - The hash ID.
Returns:
the key, 0 otherwise.

GetNextHashKey(hash_id, key)

 

Get the next key in the hash.

Parameters:
  • hash_id - The hash ID.
  • key - The current key.
Returns:
the next key, 0 otherwise

GetPrevHashKey(hash_id, key)

 

Get the previous key in the hash.

Parameters:
  • hash_id - The hash ID.
  • key - The current key.
Returns:
the previous key, 0 otherwise

AddSourceFile(ea1, ea2, filename)

 

Mark a range of address as belonging to a source file An address range may belong only to one source file. A source file may be represented by several address ranges.

Parameters:
  • ea1 - linear address of start of the address range
  • ea2 - linear address of end of the address range
  • filename - name of source file.
Returns:
1-ok, 0-failed.

Note: IDA can keep information about source files used to create the program. Each source file is represented by a range of addresses. A source file may contains several address ranges.

GetSourceFile(ea)

 

Get name of source file occupying the given address

Parameters:
  • ea - linear address
Returns:
NULL - source file information is not found otherwise returns pointer to file name

DelSourceFile(ea)

 

Delete information about the source file

Parameters:
  • ea - linear address belonging to the source file
Returns:
NULL - source file information is not found otherwise returns pointer to file name

SetLineNumber(ea, lnnum)

 

Set source line number

Parameters:
  • ea - linear address
  • lnnum - number of line in the source file
Returns:
None

GetLineNumber(ea)

 

Get source line number

Parameters:
  • ea - linear address
Returns:
number of line in the source file or -1

DelLineNumber(ea)

 

Delete information about source line number

Parameters:
  • ea - linear address
Returns:
None

LoadTil(name)

 

Load a type library

Parameters:
  • name - name of type library.
Returns:
1-ok, 0-failed.

Til2Idb(idx, type_name)

 

Copy information from type library to database Copy structure, union, or enum definition from the type library to the IDA database.

Parameters:
  • idx - the position of the new type in the list of types (structures or enums) -1 means at the end of the list
  • type_name - name of type to copy
Returns:
BADNODE-failed, otherwise the type id (structure id or enum id)

GetType(ea)

 

Get type of function/variable

Parameters:
  • ea - the address of the object
Returns:
type string or None if failed

SizeOf(typestr)

 

Returns the size of the type. It is equivalent to IDC's sizeof(). Use name, tp, fld = idc.ParseType() ; Sizeof(fld) to retrieve the size

Returns:
-1 if typestring is not valid otherwise the size of the type

GuessType(ea)

 

Guess type of function/variable

Parameters:
  • ea - the address of the object, can be the structure member id too
Returns:
type string or None if failed

SetType(ea, newtype)

 

Set type of function/variable

Parameters:
  • ea - the address of the object
  • newtype - the type string in C declaration form. Must contain the closing ';' if specified as an empty string, then the assciated with 'ea' will be deleted
Returns:
1-ok, 0-failed.

ParseType(inputtype, flags)

 

Parse type declaration

Parameters:
  • inputtype - file name or C declarations (depending on the flags)
  • flags - combination of PT_... constants or 0
Returns:
None on failure or (name, type, fields) tuple

ParseTypes(inputtype, flags=0)

 

Parse type declarations

Parameters:
  • inputtype - file name or C declarations (depending on the flags)
  • flags - combination of PT_... constants or 0
Returns:
number of parsing errors (0 no errors)

GetMaxLocalType()

 

Get number of local types + 1

Returns:
value >= 1. 1 means that there are no local types.

SetLocalType(ordinal, input, flags)

 

Parse one type declaration and store it in the specified slot

Parameters:
  • ordinal - slot number (1...NumberOfLocalTypes) -1 means allocate new slot or reuse the slot of the existing named type
  • input - C declaration. Empty input empties the slot
  • flags - combination of PT_... constants or 0
Returns:
slot number or 0 if error

GetLocalType(ordinal, flags)

 

Retrieve a local type declaration

Parameters:
  • ordinal - slot number (1...NumberOfLocalTypes)
  • flags - any of PRTYPE_* constants
Returns:
local type as a C declaration or ""

Note: This function can return types strings up to 64KiB. Use idaapi.idc_get_local_type() for larger types.

GetLocalTypeName(ordinal)

 

Retrieve a local type name

Parameters:
  • ordinal - slot number (1...NumberOfLocalTypes)

    returns: local type name or None

HideArea(start, end, description, header, footer, color)

 

Hide an area

Hidden areas - address ranges which can be replaced by their descriptions

Parameters:
  • start - area start
  • end - area end
  • description - description to display if the area is collapsed
  • header - header lines to display if the area is expanded
  • footer - footer lines to display if the area is expanded
  • color - RGB color code (-1 means default color)
Returns:
!=0 - ok

SetHiddenArea(ea, visible)

 

Set hidden area state

Parameters:
  • ea - any address belonging to the hidden area
  • visible - new state of the area
Returns:
!= 0 - ok

DelHiddenArea(ea)

 

Delete a hidden area

Parameters:
  • ea - any address belonging to the hidden area
Returns:
!= 0 - ok

LoadDebugger(dbgname, use_remote)

 

Load the debugger

Parameters:
  • dbgname - debugger module name Examples: win32, linux, mac.
  • use_remote - 0/1: use remote debugger or not

Note: This function is needed only when running idc scripts from the command line. In other cases IDA loads the debugger module automatically.

StartDebugger(path, args, sdir)

 

Launch the debugger

Parameters:
  • path - path to the executable file.
  • args - command line arguments
  • sdir - initial directory for the process
Returns:
-1-failed, 0-cancelled by the user, 1-ok

Note: For all args: if empty, the default value from the database will be used See the important note to the StepInto() function

StopDebugger()

 

Stop the debugger Kills the currently debugger process and returns to the disassembly mode

Returns:
success

PauseProcess()

 

Suspend the running process Tries to suspend the process. If successful, the PROCESS_SUSPEND debug event will arrive (see GetDebuggerEvent)

Returns:
success

Note: To resume a suspended process use the GetDebuggerEvent function. See the important note to the StepInto() function

GetProcessPid(idx)

 

Get the process ID of a running process

Parameters:
  • idx - number of process, is in range 0..GetProcessQty()-1
Returns:
0 if failure

GetProcessName(idx)

 

Get the name of a running process

Parameters:
  • idx - number of process, is in range 0..GetProcessQty()-1
Returns:
None if failure

AttachProcess(pid, event_id)

 

Attach the debugger to a running process

Parameters:
  • pid - PID of the process to attach to. If NO_PROCESS, a dialog box will interactively ask the user for the process to attach to.
  • event_id - reserved, must be -1
Returns:
  • -2: impossible to find a compatible process
  • -1: impossible to attach to the given process (process died, privilege needed, not supported by the debugger plugin, ...)
  • 0: the user cancelled the attaching to the process
  • 1: the debugger properly attached to the process

Note: See the important note to the StepInto() function

DetachProcess()

 

Detach the debugger from the debugged process.

Returns:
success

GetThreadQty()

 

Get number of threads.

Returns:
number of threads

GetThreadId(idx)

 

Get the ID of a thread

Parameters:
  • idx - number of thread, is in range 0..GetThreadQty()-1
Returns:
-1 if failure

GetCurrentThreadId()

 

Get current thread ID

Returns:
-1 if failure

SelectThread(tid)

 

Select the given thread as the current debugged thread.

Parameters:
  • tid - ID of the thread to select
Returns:
success

Note: The process must be suspended to select a new thread.

SuspendThread(tid)

 

Suspend thread

Parameters:
  • tid - thread id
Returns:
-1:network error, 0-failed, 1-ok

Note: Suspending a thread may deadlock the whole application if the suspended was owning some synchronization objects.

ResumeThread(tid)

 

Resume thread

Parameters:
  • tid - thread id
Returns:
-1:network error, 0-failed, 1-ok

GetFirstModule()

 

Enumerate process modules

Returns:
first module's base address or None on failure

GetNextModule(base)

 

Enumerate process modules

Parameters:
  • base - previous module's base address
Returns:
next module's base address or None on failure

GetModuleName(base)

 

Get process module name

Parameters:
  • base - the base address of the module
Returns:
required info or None

GetModuleSize(base)

 

Get process module size

Parameters:
  • base - the base address of the module
Returns:
required info or -1

StepInto()

 

Execute one instruction in the current thread. Other threads are kept suspended.

Returns:
success

Note: You must call GetDebuggerEvent() after this call in order to find out what happened. Normally you will get the STEP event but other events are possible (for example, an exception might occur or the process might exit). This remark applies to all execution control functions. The event codes depend on the issued command.

StepOver()

 

Execute one instruction in the current thread, but without entering into functions Others threads keep suspended. See the important note to the StepInto() function

Returns:
success

RunTo(ea)

 

Execute the process until the given address is reached. If no process is active, a new process is started. See the important note to the StepInto() function

Returns:
success

StepUntilRet()

 

Execute instructions in the current thread until a function return instruction is reached. Other threads are kept suspended. See the important note to the StepInto() function

Returns:
success

GetDebuggerEvent(wfne, timeout)

 

Wait for the next event This function (optionally) resumes the process execution and wait for a debugger event until timeout

Parameters:
  • wfne - combination of WFNE_... constants
  • timeout - number of seconds to wait, -1-infinity
Returns:
debugger event codes, see below

SendDbgCommand(cmd)

 

Sends a command to the debugger module and returns the output string. An exception will be raised if the debugger is not running or the current debugger does not export the 'SendDbgCommand' IDC command.

RefreshDebuggerMemory()

 

Refresh debugger memory Upon this call IDA will forget all cached information about the debugged process. This includes the segmentation information and memory contents (register cache is managed automatically). Also, this function refreshes exported name from loaded DLLs. You must call this function before using the segmentation information, memory contents, or names of a non-suspended process. This is an expensive call.

TakeMemorySnapshot(only_loader_segs)

 

Take memory snapshot of the debugged process

Parameters:
  • only_loader_segs - 0-copy all segments to idb 1-copy only SFL_LOADER segments

GetProcessState()

 

Get debugged process state

Returns:
one of the DBG_... constants (see below)

GetEventId()

 

Get ID of debug event

Returns:
event ID

GetEventPid()

 

Get process ID for debug event

Returns:
process ID

GetEventTid()

 

Get type ID for debug event

Returns:
type ID

GetEventEa()

 

Get ea for debug event

Returns:
ea

IsEventHandled()

 

Is the debug event handled?

Returns:
boolean

GetEventModuleName()

 

Get module name for debug event

Returns:
module name

GetEventModuleBase()

 

Get module base for debug event

Returns:
module base

GetEventModuleSize()

 

Get module size for debug event

Returns:
module size

GetEventExitCode()

 

Get exit code for debug event

Returns:
exit code for PROCESS_EXIT, THREAD_EXIT events

GetEventInfo()

 

Get debug event info

Returns:
event info: for LIBRARY_UNLOAD (unloaded library name) for INFORMATION (message to display)

GetEventBptHardwareEa()

 

Get hardware address for BREAKPOINT event

Returns:
hardware address

GetEventExceptionCode()

 

Get exception code for EXCEPTION event

Returns:
exception code

GetEventExceptionEa()

 

Get address for EXCEPTION event

Returns:
adress of exception

CanExceptionContinue()

 

Can it continue after EXCEPTION event?

Returns:
boolean

GetEventExceptionInfo()

 

Get info for EXCEPTION event

Returns:
info string

SetDebuggerOptions(opt)

 

Get/set debugger options

Parameters:
  • opt - combination of DOPT_... constants
Returns:
old options

SetRemoteDebugger(hostname, password, portnum)

 

Set remote debugging options

Parameters:
  • hostname - remote host name or address if empty, revert to local debugger
  • password - password for the debugger server
  • portnum - port number to connect (-1: don't change)
Returns:
nothing

GetExceptionCode(idx)

 

Get exception code

Parameters:
  • idx - number of exception in the vector (0..GetExceptionQty()-1)
Returns:
exception code (0 - error)

GetExceptionName(code)

 

Get exception information

Parameters:
  • code - exception code
Returns:
"" on error

GetExceptionFlags(code)

 

Get exception information

Parameters:
  • code - exception code
Returns:
-1 on error

DefineException(code, name, desc, flags)

 

Add exception handling information

Parameters:
  • code - exception code
  • name - exception name
  • desc - exception description
  • flags - exception flags (combination of EXC_...)
Returns:
failure description or ""

SetExceptionFlags(code, flags)

 

Set exception flags

Parameters:
  • code - exception code
  • flags - exception flags (combination of EXC_...)

ForgetException(code)

 

Delete exception handling information

Parameters:
  • code - exception code

GetRegValue(name)

 

Get register value

Parameters:
  • name - the register name
Returns:
register value (integer or floating point)

Note: The debugger should be running. otherwise the function fails the register name should be valid. It is not necessary to use this function to get register values because a register name in the script will do too.

SetRegValue(value, name)

 

Set register value

Parameters:
  • name - the register name
  • value - new register value

Note: The debugger should be running It is not necessary to use this function to set register values. A register name in the left side of an assignment will do too.

GetBptQty()

 

Get number of breakpoints.

Returns:
number of breakpoints

GetBptEA(n)

 

Get breakpoint address

Parameters:
  • n - number of breakpoint, is in range 0..GetBptQty()-1
Returns:
addresss of the breakpoint or BADADDR

GetBptAttr(ea, bptattr)

 

Get the characteristics of a breakpoint

Parameters:
  • ea - any address in the breakpoint range
  • bptattr - the desired attribute code, one of BPTATTR_... constants
Returns:
the desired attribute value or -1

SetBptAttr(address, bptattr, value)

 

modifiable characteristics of a breakpoint

Parameters:
  • address - any address in the breakpoint range
  • bptattr - the attribute code, one of BPTATTR_* constants BPTATTR_CND is not allowed, see SetBptCnd()
  • value - the attibute value
Returns:
success

SetBptCnd(ea, cnd)

 

Set breakpoint condition

Parameters:
  • ea - any address in the breakpoint range
  • cnd - breakpoint condition
Returns:
success

AddBptEx(ea, size, bpttype)

 

Add a new breakpoint

Parameters:
  • ea - any address in the process memory space:
  • size - size of the breakpoint (irrelevant for software breakpoints):
  • bpttype - type of the breakpoint (one of BPT_... constants)
Returns:
success

Note: Only one breakpoint can exist at a given address.

DelBpt(ea)

 

Delete breakpoint

Parameters:
  • ea - any address in the process memory space:
Returns:
success

EnableBpt(ea, enable)

 

Enable/disable breakpoint

Parameters:
  • ea - any address in the process memory space
Returns:
success

Note: Disabled breakpoints are not written to the process memory

CheckBpt(ea)

 

Check a breakpoint

Parameters:
  • ea - address in the process memory space
Returns:
one of BPTCK_... constants

EnableTracing(trace_level, enable)

 

Enable step tracing

Parameters:
  • trace_level - what kind of trace to modify
  • enable - 0: turn off, 1: turn on
Returns:
success

GetColor(ea, what)

 

Get item color

Parameters:
  • ea - address of the item
  • what - type of the item (one of CIC_* constants)
Returns:
color code in RGB (hex 0xBBGGRR)

SetColor(ea, what, color)

 

Set item color

Parameters:
  • ea - address of the item
  • what - type of the item (one of CIC_* constants)
  • color - new color code in RGB (hex 0xBBGGRR)
Returns:
success (True or False)

SetXML(path, name, value)

 

Set or update one or more XML values.

Parameters:
  • path - XPath expression of elements where to create value(s)
  • name - name of the element/attribute (use @XXX for an attribute) to create. If 'name' is empty, the elements or attributes returned by XPath are directly updated to contain the new 'value'.
  • value - value of the element/attribute
Returns:
success (True or False)

GetXML(path)

 

Get one XML value.

Parameters:
  • path - XPath expression to an element or attribute whose value is requested
Returns:
the value, None if failed

ArmForceBLJump(ea)

 

Some ARM compilers in Thumb mode use BL (branch-and-link) instead of B (branch) for long jumps, since BL has more range. By default, IDA tries to determine if BL is a jump or a call. You can override IDA's decision using commands in Edit/Other menu (Force BL call/Force BL jump) or the following two functions.

Force BL instruction to be a jump

Parameters:
  • ea - address of the BL instruction
Returns:
1-ok, 0-failed

ArmForceBLCall(ea)

 

Force BL instruction to be a call

Parameters:
  • ea - address of the BL instruction
Returns:
1-ok, 0-failed

BeginTypeUpdating(utp)

 

Begin type updating. Use this function if you plan to call AddEnumConst or similar type modification functions many times or from inside a loop

Parameters:
  • utp - one of UTP_xxxx consts
Returns:
None

EndTypeUpdating(utp)

 

End type updating. Refreshes the type system at the end of type modification operations

Parameters:
  • utp - one of idaapi.UTP_xxxx consts
Returns:
None

   Trees       Indices       Help   
Hex-Rays
Generated by Epydoc 3.0.1 on Mon Mar 05 14:43:02 2012 http://epydoc.sourceforge.net
[an error occurred while processing this directive]