IDA SDK
|
Routines to manipulate function stack frames, stack variables, register variables and local labels. More...
Classes | |
struct | stkpnt_t |
struct | stkpnts_t |
struct | regvar_t |
A register variable allows the user to rename a general processor register to a meaningful name. More... | |
struct | xreflist_entry_t |
An xref to an argument or variable located in a function's stack frame. More... | |
Macros | |
#define | STKVAR_VALID_SIZE 0x0001 |
x.dtyp contains correct variable type (for insns like 'lea' this bit must be off). More... | |
#define | REGVAR_ERROR_OK 0 |
all ok | |
#define | REGVAR_ERROR_ARG (-1) |
function arguments are bad | |
#define | REGVAR_ERROR_RANGE (-2) |
the definition range is bad | |
#define | REGVAR_ERROR_NAME (-3) |
the provided name(s) can't be accepted | |
Typedefs | |
typedef qvector< xreflist_entry_t > | xreflist_t |
vector of xrefs to variables in a function's stack frame | |
Enumerations | |
enum | frame_part_t { FPC_ARGS , FPC_RETADDR , FPC_SAVREGS , FPC_LVARS } |
Parts of a frame. | |
Functions | |
idaman bool ida_export | add_frame (func_t *pfn, sval_t frsize, ushort frregs, asize_t argsize) |
Add function frame. More... | |
idaman bool ida_export | del_frame (func_t *pfn) |
Delete a function frame. More... | |
idaman bool ida_export | set_frame_size (func_t *pfn, asize_t frsize, ushort frregs, asize_t argsize) |
Set size of function frame. More... | |
idaman asize_t ida_export | get_frame_size (const func_t *pfn) |
Get full size of a function frame. More... | |
idaman int ida_export | get_frame_retsize (const func_t *pfn) |
Get size of function return address. More... | |
idaman void ida_export | get_frame_part (range_t *range, const func_t *pfn, frame_part_t part) |
Get offsets of the frame part in the frame. More... | |
ea_t | frame_off_args (const func_t *pfn) |
Get starting address of arguments section. | |
ea_t | frame_off_retaddr (const func_t *pfn) |
Get starting address of return address section. | |
ea_t | frame_off_savregs (const func_t *pfn) |
Get starting address of saved registers section. | |
ea_t | frame_off_lvars (const func_t *pfn) |
Get start address of local variables section. | |
idaman struc_t *ida_export | get_frame (const func_t *pfn) |
Get pointer to function frame. More... | |
struc_t * | get_frame (ea_t ea) |
Get pointer to function frame. More... | |
sval_t | soff_to_fpoff (func_t *pfn, uval_t soff) |
Convert struct offsets into fp-relative offsets. More... | |
idaman bool ida_export | update_fpd (func_t *pfn, asize_t fpd) |
Update frame pointer delta. More... | |
idaman bool ida_export | set_purged (ea_t ea, int nbytes, bool override_old_value) |
Set the number of purged bytes for a function or data item (funcptr). More... | |
idaman ea_t ida_export | get_func_by_frame (tid_t frame_id) |
Get function by its frame id. More... | |
idaman member_t *ida_export | get_stkvar (sval_t *actval, const insn_t &insn, const op_t &x, sval_t v) |
Get pointer to stack variable. More... | |
idaman bool ida_export | add_stkvar (const insn_t &insn, const op_t &x, sval_t v, int flags) |
Automatically add stack variable if doesn't exist. More... | |
idaman bool ida_export | define_stkvar (func_t *pfn, const char *name, sval_t off, flags_t flags, const opinfo_t *ti, asize_t nbytes) |
Define/redefine a stack variable. More... | |
idaman ssize_t ida_export | build_stkvar_name (qstring *buf, const func_t *pfn, sval_t v) |
Build automatic stack variable name. More... | |
idaman ea_t ida_export | calc_stkvar_struc_offset (func_t *pfn, const insn_t &insn, int n) |
Calculate offset of stack variable in the frame structure. More... | |
idaman int ida_export | delete_wrong_frame_info (func_t *pfn, bool idaapi should_reanalyze(const insn_t &insn)) |
Find and delete wrong frame info. More... | |
idaman void ida_export | free_regvar (struct regvar_t *v) |
idaman int ida_export | add_regvar (func_t *pfn, ea_t ea1, ea_t ea2, const char *canon, const char *user, const char *cmt) |
Define a register variable. More... | |
idaman regvar_t *ida_export | find_regvar (func_t *pfn, ea_t ea1, ea_t ea2, const char *canon, const char *user) |
Find a register variable definition (powerful version). More... | |
regvar_t * | find_regvar (func_t *pfn, ea_t ea, const char *canon) |
Find a register variable definition. More... | |
bool | has_regvar (func_t *pfn, ea_t ea) |
Is there a register variable definition? More... | |
idaman int ida_export | rename_regvar (func_t *pfn, regvar_t *v, const char *user) |
Rename a register variable. More... | |
idaman int ida_export | set_regvar_cmt (func_t *pfn, regvar_t *v, const char *cmt) |
Set comment for a register variable. More... | |
idaman int ida_export | del_regvar (func_t *pfn, ea_t ea1, ea_t ea2, const char *canon) |
Delete a register variable definition. More... | |
idaman bool ida_export | add_auto_stkpnt (func_t *pfn, ea_t ea, sval_t delta) |
Add automatic SP register change point. More... | |
idaman bool ida_export | add_user_stkpnt (ea_t ea, sval_t delta) |
Add user-defined SP register change point. More... | |
idaman bool ida_export | del_stkpnt (func_t *pfn, ea_t ea) |
Delete SP register change point. More... | |
idaman sval_t ida_export | get_spd (func_t *pfn, ea_t ea) |
Get difference between the initial and current values of ESP. More... | |
idaman sval_t ida_export | get_effective_spd (func_t *pfn, ea_t ea) |
Get effective difference between the initial and current values of ESP. More... | |
idaman sval_t ida_export | get_sp_delta (func_t *pfn, ea_t ea) |
Get modification of SP made at the specified location. More... | |
idaman bool ida_export | recalc_spd (ea_t cur_ea) |
Recalculate SP delta for an instruction that stops execution. More... | |
idaman void ida_export | build_stkvar_xrefs (xreflist_t *out, func_t *pfn, const member_t *mptr) |
Fill 'out' with a list of all the xrefs made from function 'pfn', to the argument or variable 'mptr' in 'pfn's stack frame. More... | |
Routines to manipulate function stack frames, stack variables, register variables and local labels.
The frame is represented as a structure:
+------------------------------------------------+ | function arguments | +------------------------------------------------+ | return address (isn't stored in func_t) | +------------------------------------------------+ | saved registers (SI, DI, etc - func_t::frregs) | +------------------------------------------------+ <- typical BP | | | | | | func_t::fpd | | | | | <- real BP | local variables (func_t::frsize) | | | | | +------------------------------------------------+ <- SP
To access the structure of a function frame, use:
#define STKVAR_VALID_SIZE 0x0001 |
x.dtyp contains correct variable type (for insns like 'lea' this bit must be off).
In general, dr_O references do not allow to determine the variable size
Add function frame.
pfn | pointer to function structure |
frsize | size of function local variables |
frregs | size of saved registers |
argsize | size of function arguments range which will be purged upon return. this parameter is used for __stdcall and __pascal calling conventions. for other calling conventions please pass 0. |
1 | ok |
0 | failed (no function, frame already exists) |
idaman bool ida_export del_frame | ( | func_t * | pfn | ) |
Delete a function frame.
pfn | pointer to function structure |
idaman bool ida_export set_frame_size | ( | func_t * | pfn, |
asize_t | frsize, | ||
ushort | frregs, | ||
asize_t | argsize | ||
) |
Set size of function frame.
Note: The returned size may not include all stack arguments. It does so only for __stdcall and __fastcall calling conventions. To get the entire frame size for all cases use get_struc_size(get_frame(pfn)).
pfn | pointer to function structure |
frsize | size of function local variables |
frregs | size of saved registers |
argsize | size of function arguments that will be purged from the stack upon return |
idaman asize_t ida_export get_frame_size | ( | const func_t * | pfn | ) |
Get full size of a function frame.
This function takes into account size of local variables + size of saved registers + size of return address + number of purged bytes. The purged bytes correspond to the arguments of the functions with __stdcall and __fastcall calling conventions.
pfn | pointer to function structure, may be nullptr |
idaman int ida_export get_frame_retsize | ( | const func_t * | pfn | ) |
Get size of function return address.
pfn | pointer to function structure, can't be nullptr |
idaman void ida_export get_frame_part | ( | range_t * | range, |
const func_t * | pfn, | ||
frame_part_t | part | ||
) |
Get offsets of the frame part in the frame.
range | pointer to the output buffer with the frame part start/end(exclusive) offsets, can't be nullptr |
pfn | pointer to function structure, can't be nullptr |
part | frame part |
Get pointer to function frame.
pfn | pointer to function structure |
|
inline |
Get pointer to function frame.
ea | any address in the function |
Convert struct offsets into fp-relative offsets.
This function converts the offsets inside the struc_t object into the frame pointer offsets (for example, EBP-relative).
idaman bool ida_export update_fpd | ( | func_t * | pfn, |
asize_t | fpd | ||
) |
Update frame pointer delta.
pfn | pointer to function structure |
fpd | new fpd value. cannot be bigger than the local variable range size. |
idaman bool ida_export set_purged | ( | ea_t | ea, |
int | nbytes, | ||
bool | override_old_value | ||
) |
Set the number of purged bytes for a function or data item (funcptr).
This function will update the database and plan to reanalyze items referencing the specified address. It works only for processors with PR_PURGING bit in 16 and 32 bit modes.
ea | address of the function of item |
nbytes | number of purged bytes |
override_old_value | may overwrite old information about purged bytes |
idaman ea_t ida_export get_func_by_frame | ( | tid_t | frame_id | ) |
Get function by its frame id.
frame_id | id of the function frame |
idaman member_t *ida_export get_stkvar | ( | sval_t * | actval, |
const insn_t & | insn, | ||
const op_t & | x, | ||
sval_t | v | ||
) |
Get pointer to stack variable.
actval | actual value used to fetch stack variable this pointer may point to 'v' |
insn | the instruction |
x | reference to instruction operand |
v | immediate value in the operand (usually x.addr) |
Automatically add stack variable if doesn't exist.
Processor modules should use insn_t::create_stkvar().
insn | the instruction |
x | reference to instruction operand |
v | immediate value in the operand (usually x.addr) |
flags | Add stkvar flags |
idaman bool ida_export define_stkvar | ( | func_t * | pfn, |
const char * | name, | ||
sval_t | off, | ||
flags_t | flags, | ||
const opinfo_t * | ti, | ||
asize_t | nbytes | ||
) |
Define/redefine a stack variable.
pfn | pointer to function |
name | variable name, nullptr means autogenerate a name |
off | offset of the stack variable in the frame. negative values denote local variables, positive - function arguments. |
flags | variable type flags (byte_flag() for a byte variable, for example) |
ti | additional type information (like offsets, structs, etc) |
nbytes | number of bytes occupied by the variable |
Build automatic stack variable name.
buf | pointer to buffer |
pfn | pointer to function (can't be nullptr!) |
v | value of variable offset |
idaman int ida_export delete_wrong_frame_info | ( | func_t * | pfn, |
bool idaapi | should_reanalyzeconst insn_t &insn | ||
) |
Find and delete wrong frame info.
Namely, we delete:
pfn | pointer to the function |
should_reanalyze | callback to determine which instructions to reanalyze |
idaman int ida_export add_regvar | ( | func_t * | pfn, |
ea_t | ea1, | ||
ea_t | ea2, | ||
const char * | canon, | ||
const char * | user, | ||
const char * | cmt | ||
) |
Define a register variable.
pfn | function in which the definition will be created |
ea1,ea2 | range of addresses within the function where the definition will be used |
canon | name of a general register |
user | user-defined name for the register |
cmt | comment for the definition |
idaman regvar_t *ida_export find_regvar | ( | func_t * | pfn, |
ea_t | ea1, | ||
ea_t | ea2, | ||
const char * | canon, | ||
const char * | user | ||
) |
Find a register variable definition (powerful version).
One of 'canon' and 'user' should be nullptr. If both 'canon' and 'user' are nullptr it returns the first regvar definition in the range.
pfn | function in question |
ea1,ea2 | range of addresses to search. ea1==BADADDR means the entire function |
canon | name of a general register |
user | user-defined name for the register |
Find a register variable definition.
pfn | function in question |
ea | current address |
canon | name of a general register |
|
inline |
Is there a register variable definition?
pfn | function in question |
ea | current address |
Rename a register variable.
pfn | function in question |
v | variable to rename |
user | new user-defined name for the register |
Set comment for a register variable.
pfn | function in question |
v | variable to rename |
cmt | new comment |
idaman int ida_export del_regvar | ( | func_t * | pfn, |
ea_t | ea1, | ||
ea_t | ea2, | ||
const char * | canon | ||
) |
Delete a register variable definition.
pfn | function in question |
ea1,ea2 | range of addresses within the function where the definition holds |
canon | name of a general register |
Add automatic SP register change point.
pfn | pointer to function. may be nullptr. |
ea | linear address where SP changes. usually this is the end of the instruction which modifies the stack pointer ( insn_t::ea+ insn_t::size) |
delta | difference between old and new values of SP |
idaman bool ida_export add_user_stkpnt | ( | ea_t | ea, |
sval_t | delta | ||
) |
Add user-defined SP register change point.
ea | linear address where SP changes |
delta | difference between old and new values of SP |
idaman bool ida_export del_stkpnt | ( | func_t * | pfn, |
ea_t | ea | ||
) |
Delete SP register change point.
pfn | pointer to function. may be nullptr. |
ea | linear address |
Get difference between the initial and current values of ESP.
pfn | pointer to function. may be nullptr. |
ea | linear address of an instruction |
Get effective difference between the initial and current values of ESP.
This function returns the sp-diff used by the instruction. The difference between get_spd() and get_effective_spd() is present only for instructions like "pop [esp+N]": they modify sp and use the modified value.
pfn | pointer to function. may be nullptr. |
ea | linear address |
Get modification of SP made at the specified location.
pfn | pointer to function. may be nullptr. |
ea | linear address |
idaman bool ida_export recalc_spd | ( | ea_t | cur_ea | ) |
Recalculate SP delta for an instruction that stops execution.
The next instruction is not reached from the current instruction. We need to recalculate SP for the next instruction.
This function will create a new automatic SP register change point if necessary. It should be called from the emulator (emu.cpp) when auto_state == AU_USED if the current instruction doesn't pass the execution flow to the next instruction.
cur_ea | linear address of the current instruction |
1 | new stkpnt is added |
0 | nothing is changed |
idaman void ida_export build_stkvar_xrefs | ( | xreflist_t * | out, |
func_t * | pfn, | ||
const member_t * | mptr | ||
) |
Fill 'out' with a list of all the xrefs made from function 'pfn', to the argument or variable 'mptr' in 'pfn's stack frame.
out | the list of xrefs to fill. |
pfn | the function to scan. |
mptr | the argument/variable in pfn's stack frame. |