Module ida_bytes
[frames] | no frames]

Module ida_bytes

IDA Plugin SDK API wrapper: bytes

Classes
  data_type_t
Proxy of C++ data_type_t class
  data_format_t
Proxy of C++ data_format_t class
  hidden_range_t
Proxy of C++ hidden_range_t class
Functions
error_t
enable_flags(start_ea, end_ea, stt)
error_t
disable_flags(start_ea, end_ea)
error_t
change_storage_type(start_ea, end_ea, stt)
ea_t
next_addr(ea)
ea_t
prev_addr(ea)
ea_t
next_chunk(ea)
ea_t
prev_chunk(ea)
ea_t
chunk_start(ea)
asize_t
chunk_size(ea)
ea_t
free_chunk(bottom, size, step)
ea_t
next_unknown(ea, maxea)
ea_t
prev_unknown(ea, minea)
ea_t
prev_head(ea, minea)
ea_t
next_head(ea, maxea)
ea_t
prev_not_tail(ea)
ea_t
next_not_tail(ea)
ea_t
get_item_head(ea)
ea_t
get_item_end(ea)
ea_t
calc_max_item_end(ea, how=15)
asize_t
get_item_size(ea)
bool
is_mapped(ea)
flags_t
get_flags_ex(ea, how)
flags_t
get_flags(ea)
flags_t
get_full_flags(ea)
flags_t
get_item_flag(_from, n, ea, appzero)
bool
has_value(F)
 
del_value(ea)
bool
is_loaded(ea)
int
nbits(ea)
int
bytesize(ea)
uchar
get_byte(ea)
uchar
get_db_byte(ea)
ushort
get_word(ea)
uint32
get_dword(ea)
uint64
get_qword(ea)
uint32
get_wide_byte(ea)
uint64
get_wide_word(ea)
uint64
get_wide_dword(ea)
uint32
get_16bit(ea)
uint32
get_32bit(ea)
uint64
get_64bit(ea)
bool
get_data_value(v, ea, size)
uint32
get_original_byte(ea)
uint64
get_original_word(ea)
uint64
get_original_dword(ea)
uint64
get_original_qword(ea)
bool
put_byte(ea, x)
 
put_word(ea, x)
 
put_dword(ea, x)
 
put_qword(ea, x)
bool
patch_byte(ea, x)
bool
patch_word(ea, x)
bool
patch_dword(ea, x)
bool
patch_qword(ea, x)
bool
revert_byte(ea)
 
add_byte(ea, value)
 
add_word(ea, value)
 
add_dword(ea, value)
 
add_qword(ea, value)
bool
get_zero_ranges(zranges, range)
 
put_bytes(ea, buf)
 
patch_bytes(ea, buf)
bool
is_code(F)
bool
f_is_code(F, arg2)
bool
is_data(F)
bool
f_is_data(F, arg2)
bool
is_tail(F)
bool
f_is_tail(F, arg2)
bool
is_not_tail(F)
bool
f_is_not_tail(F, arg2)
bool
is_unknown(F)
bool
is_head(F)
bool
f_is_head(F, arg2)
bool
del_items(ea, flags=0, nbytes=1, may_destroy=None)
bool
is_manual_insn(ea)
ssize_t
get_manual_insn(ea)
 
set_manual_insn(ea, manual_insn)
bool
is_flow(F)
bool
has_extra_cmts(F)
bool
has_cmt(F)
bool
has_xref(F)
bool
f_has_xref(f, arg2)
bool
has_name(F)
bool
f_has_name(f, arg2)
bool
has_dummy_name(F)
bool
f_has_dummy_name(f, arg2)
bool
has_auto_name(F)
bool
has_any_name(F)
bool
has_user_name(F)
bool
f_has_user_name(F, arg2)
bool
is_invsign(ea, F, n)
bool
toggle_sign(ea, n)
bool
is_bnot(ea, F, n)
bool
toggle_bnot(ea, n)
bool
is_lzero(ea, n)
bool
set_lzero(ea, n)
bool
clr_lzero(ea, n)
bool
toggle_lzero(ea, n)
bool
leading_zero_important(ea, n)
bool
is_defarg0(F)
bool
is_defarg1(F)
bool
is_off0(F)
bool
is_off1(F)
bool
is_char0(F)
bool
is_char1(F)
bool
is_seg0(F)
bool
is_seg1(F)
bool
is_enum0(F)
bool
is_enum1(F)
bool
is_stroff0(F)
bool
is_stroff1(F)
bool
is_stkvar0(F)
bool
is_stkvar1(F)
bool
is_float0(F)
bool
is_float1(F)
bool
is_custfmt0(F)
bool
is_custfmt1(F)
bool
is_numop0(F)
bool
is_numop1(F)
flags_t
get_optype_flags0(F)
flags_t
get_optype_flags1(F)
bool
is_defarg(F, n)
bool
is_off(F, n)
bool
is_char(F, n)
bool
is_seg(F, n)
bool
is_enum(F, n)
bool
is_manual(F, n)
bool
is_stroff(F, n)
bool
is_stkvar(F, n)
bool
is_fltnum(F, n)
bool
is_custfmt(F, n)
bool
is_numop(F, n)
bool
is_suspop(ea, F, n)
bool
op_adds_xrefs(F, n)
bool
set_op_type(ea, type, n)
bool
op_seg(ea, n)
bool
op_enum(ea, n, id, serial)
enum_t
get_enum_id(ea, n)
bool
op_stroff(insn, n, path, path_len, delta)
int
get_stroff_path(path, delta, ea, n)
bool
op_stkvar(ea, n)
bool
set_forced_operand(ea, n, op)
ssize_t
get_forced_operand(ea, n)
bool
is_forced_operand(ea, n)
flags_t
char_flag()
flags_t
off_flag()
flags_t
enum_flag()
flags_t
stroff_flag()
flags_t
stkvar_flag()
flags_t
flt_flag()
flags_t
custfmt_flag()
flags_t
seg_flag()
flags_t
num_flag()
flags_t
hex_flag()
flags_t
dec_flag()
flags_t
oct_flag()
flags_t
bin_flag()
bool
op_chr(ea, n)
bool
op_num(ea, n)
bool
op_hex(ea, n)
bool
op_dec(ea, n)
bool
op_oct(ea, n)
bool
op_bin(ea, n)
bool
op_flt(ea, n)
bool
op_custfmt(ea, n, fid)
bool
clr_op_type(ea, n)
int
get_default_radix()
int
get_radix(F, n)
flags_t
code_flag()
flags_t
byte_flag()
flags_t
word_flag()
flags_t
dword_flag()
flags_t
qword_flag()
flags_t
oword_flag()
flags_t
yword_flag()
flags_t
zword_flag()
flags_t
tbyte_flag()
flags_t
strlit_flag()
flags_t
stru_flag()
flags_t
cust_flag()
flags_t
align_flag()
flags_t
float_flag()
flags_t
double_flag()
flags_t
packreal_flag()
bool
is_byte(F)
bool
is_word(F)
bool
is_dword(F)
bool
is_qword(F)
bool
is_oword(F)
bool
is_yword(F)
bool
is_zword(F)
bool
is_tbyte(F)
bool
is_float(F)
bool
is_double(F)
bool
is_pack_real(F)
bool
is_strlit(F)
bool
is_struct(F)
bool
is_align(F)
bool
is_custom(F)
bool
f_is_byte(F, arg2)
bool
f_is_word(F, arg2)
bool
f_is_dword(F, arg2)
bool
f_is_qword(F, arg2)
bool
f_is_oword(F, arg2)
bool
f_is_yword(F, arg2)
bool
f_is_tbyte(F, arg2)
bool
f_is_float(F, arg2)
bool
f_is_double(F, arg2)
bool
f_is_pack_real(F, arg2)
bool
f_is_strlit(F, arg2)
bool
f_is_struct(F, arg2)
bool
f_is_align(F, arg2)
bool
f_is_custom(F, arg2)
bool
is_same_data_type(F1, F2)
flags_t
get_flags_by_size(size)
bool
create_data(ea, dataflag, size, tid)
bool
create_byte(ea, length)
bool
create_word(ea, length)
bool
create_dword(ea, length)
bool
create_qword(ea, length)
bool
create_oword(ea, length)
bool
create_yword(ea, length)
bool
create_zword(ea, length)
bool
create_tbyte(ea, length)
bool
create_float(ea, length)
bool
create_double(ea, length)
bool
create_packed_real(ea, length)
bool
create_struct(ea, length, tid)
bool
create_custdata(ea, length, dtid, fid)
bool
create_align(ea, length, alignment)
int
calc_min_align(length)
int
calc_max_align(endea)
int
calc_def_align(ea, mina, maxa)
bool
create_16bit_data(ea, length)
bool
create_32bit_data(ea, length)
size_t
get_max_strlit_length(ea, strtype, options=0)
bool
create_strlit(start, len, strtype)
opinfo_t
get_opinfo(buf, ea, n, flags)
bool
set_opinfo(ea, n, flag, ti, suppress_events=False)
asize_t
get_data_elsize(ea, F, ti=None)
asize_t
get_full_data_elsize(ea, F, ti=None)
int
is_varsize_item(ea, F, ti=None, itemsize=None)
bool
can_define_item(ea, length, flags)
bool
has_immd(F)
bool
is_func(F)
bool
set_immd(ea)
data_type_t
get_custom_data_type(dtid)
data_format_t
get_custom_data_format(dfid)
bool
attach_custom_data_format(dtid, dfid)
bool
detach_custom_data_format(dtid, dfid)
bool
is_attached_custom_data_format(dtid, dfid)
int
get_custom_data_types(out, min_size=0, max_size=BADADDR)
int
get_custom_data_formats(out, dtid)
int
find_custom_data_type(name)
int
find_custom_data_format(name)
bool
set_cmt(ea, comm, rptble)
ssize_t
get_cmt(ea, rptble)
bool
append_cmt(ea, str, rptble)
ssize_t
get_predef_insn_cmt(ins)
ea_t
find_byte(sEA, size, value, bin_search_flags)
ea_t
find_byter(sEA, size, value, bin_search_flags)
ea_t
next_inited(ea, maxea)
ea_t
prev_inited(ea, minea)
bool
equal_bytes(ea, image, mask, len, sense_case)
bool
update_hidden_range(ha)
bool
add_hidden_range(ea1, ea2, description, header, footer, color)
hidden_range_t
get_hidden_range(ea)
hidden_range_t
getn_hidden_range(n)
int
get_hidden_range_qty()
int
get_hidden_range_num(ea)
hidden_range_t
get_prev_hidden_range(ea)
hidden_range_t
get_next_hidden_range(ea)
hidden_range_t
get_first_hidden_range()
hidden_range_t
get_last_hidden_range()
bool
del_hidden_range(ea)
bool
add_mapping(_from, to, size)
 
del_mapping(ea)
ea_t
use_mapping(ea)
size_t
get_mappings_qty()
bool
get_mapping(n)
int
visit_patched_bytes(ea1, ea2, py_callable)
Enumerates patched bytes in the given range and invokes a callable
ea_t
next_that(ea, maxea, callable)
Find next address with a flag satisfying the function 'testf'.
ea_t
prev_that(ea, minea, callable)
PyObject *
get_bytes(ea, size, gmb_flags=0x01)
Get the specified number of bytes of the program.
PyObject *
get_bytes_and_mask(ea, size, gmb_flags=0x01)
Get the specified number of bytes of the program, and a bitmask specifying what bytes are defined and what bytes are not.
PyObject *
get_strlit_contents(ea, py_len, type, flags=0)
Get bytes contents at location, possibly converted.
ea_t
bin_search(start_ea, end_ea, image, mask, step, flags)
PyObject *
print_strlit_type(strtype, flags=0)
int
register_custom_data_type(py_dt)
Registers a custom data type.
bool
unregister_custom_data_type(dtid)
Unregisters a custom data type.
int
register_custom_data_format(py_df)
Registers a custom data format with a given data type.
bool
unregister_custom_data_format(dfid)
Unregisters a custom data format
 
register_data_types_and_formats(formats)
Registers multiple data types and formats at once.
 
unregister_data_types_and_formats(formats)
As opposed to register_data_types_and_formats(), this function unregisters multiple data types and formats at once.
Variables
  ITEM_END_FIXUP = 1
  ITEM_END_INITED = 2
  ITEM_END_NAME = 4
  ITEM_END_XREF = 8
  GFE_VALUE = 1
  MS_VAL = 255
  FF_IVL = 256
  GMB_READALL = 1
  GMB_WAITBOX = 2
  MS_CLS = 1536
  FF_CODE = 1536
  FF_DATA = 1024
  FF_TAIL = 512
  FF_UNK = 0
  DELIT_SIMPLE = 0
  DELIT_EXPAND = 1
  DELIT_DELNAMES = 2
  DELIT_NOTRUNC = 4
  DELIT_NOUNAME = 8
  DELIT_NOCMT = 16
  MS_COMM = 1046528
  FF_COMM = 2048
  FF_REF = 4096
  FF_LINE = 8192
  FF_NAME = 16384
  FF_LABL = 32768
  FF_FLOW = 65536
  FF_SIGN = 131072
  FF_BNOT = 262144
  FF_UNUSED = 524288
  FF_ANYNAME = 49152
  MS_0TYPE = 15728640
  FF_0VOID = 0
  FF_0NUMH = 1048576
  FF_0NUMD = 2097152
  FF_0CHAR = 3145728
  FF_0SEG = 4194304
  FF_0OFF = 5242880
  FF_0NUMB = 6291456
  FF_0NUMO = 7340032
  FF_0ENUM = 8388608
  FF_0FOP = 9437184
  FF_0STRO = 10485760
  FF_0STK = 11534336
  FF_0FLT = 12582912
  FF_0CUST = 13631488
  MS_1TYPE = 251658240
  FF_1VOID = 0
  FF_1NUMH = 16777216
  FF_1NUMD = 33554432
  FF_1CHAR = 50331648
  FF_1SEG = 67108864
  FF_1OFF = 83886080
  FF_1NUMB = 100663296
  FF_1NUMO = 117440512
  FF_1ENUM = 134217728
  FF_1FOP = 150994944
  FF_1STRO = 167772160
  FF_1STK = 184549376
  FF_1FLT = 201326592
  FF_1CUST = 218103808
  OPND_OUTER = 128
  OPND_MASK = 15
  OPND_ALL = 15
  DT_TYPE = -268435456
  FF_BYTE = 0
  FF_WORD = 268435456
  FF_DWORD = 536870912
  FF_QWORD = 805306368
  FF_TBYTE = 1073741824
  FF_STRLIT = 1342177280
  FF_STRUCT = 1610612736
  FF_OWORD = 1879048192
  FF_FLOAT = -2147483648
  FF_DOUBLE = -1879048192
  FF_PACKREAL = -1610612736
  FF_ALIGN = -1342177280
  FF_CUSTOM = -805306368
  FF_YWORD = -536870912
  FF_ZWORD = -268435456
  ALOPT_IGNHEADS = 1
  ALOPT_IGNPRINT = 2
  ALOPT_IGNCLT = 4
  ALOPT_MAX4K = 8
  STRCONV_ESCAPE = 1
  STRCONV_REPLCHAR = 2
  STRCONV_INCLLEN = 4
  PSTF_TNORM = 0
  PSTF_TBRIEF = 1
  PSTF_TINLIN = 2
  PSTF_TMASK = 3
  PSTF_HOTKEY = 4
  PSTF_ENC = 8
  MS_CODE = 4026531840
  FF_FUNC = 268435456
  FF_IMMD = 1073741824
  FF_JUMP = 2147483648
  BIN_SEARCH_FORWARD = 1
  BIN_SEARCH_BACKWARD = -1
  BIN_SEARCH_CASE = 1
  BIN_SEARCH_NOCASE = 0
  BIN_SEARCH_NOBREAK = 2
  BIN_SEARCH_INITED = 4
  BIN_SEARCH_NOSHOW = 8
  DTP_NODUP = 1
  __package__ = None
Function Details

visit_patched_bytes(ea1, ea2, py_callable)

 

Enumerates patched bytes in the given range and invokes a callable

Parameters:
  • ea1 - start address
  • ea2 - end address
  • callable - a Python callable with the following prototype: callable(ea, fpos, org_val, patch_val). If the callable returns non-zero then that value will be returned to the caller and the enumeration will be interrupted.
Returns: int
Zero if the enumeration was successful or the return value of the callback if enumeration was interrupted.

next_that(ea, maxea, callable)

 

Find next address with a flag satisfying the function 'testf'. Start searching from address 'ea'+1 and inspect bytes up to 'maxea'. maxea is not included in the search range.

Parameters:
  • callable - a Python callable with the following prototype: callable(flags). Return True to stop enumeration.
Returns: ea_t
the found address or BADADDR.

get_bytes(ea, size, gmb_flags=0x01)

 

Get the specified number of bytes of the program.

Parameters:
  • ea - program address
  • size - number of bytes to return
Returns: PyObject *
the bytes (as a str), or None in case of failure

get_bytes_and_mask(ea, size, gmb_flags=0x01)

 

Get the specified number of bytes of the program, and a bitmask specifying what bytes are defined and what bytes are not.

Parameters:
  • ea - program address
  • size - number of bytes to return
Returns: PyObject *
a tuple (bytes, mask), or None in case of failure. Both 'bytes' and 'mask' are 'str' instances.

get_strlit_contents(ea, py_len, type, flags=0)

 

Get bytes contents at location, possibly converted. It works even if the string has not been created in the database yet.

Note that this will <b>always</b> return a simple string of bytes (i.e., a 'str' instance), and not a string of unicode characters.

If you want auto-conversion to unicode strings (that is: real strings), you should probably be using the idautils.Strings class.

Parameters:
  • ea - linear address of the string
  • len - length of the string in bytes (including terminating 0)
  • type - type of the string. Represents both the character encoding, <u>and</u> the 'type' of string at the given location.
  • flags - combination of STRCONV_..., to perform output conversion.
Returns: PyObject *
a bytes-filled str object.

register_custom_data_type(py_dt)

 

Registers a custom data type.

Parameters:
  • dt - an instance of the data_type_t class
Returns: int
< 0 if failed to register > 0 data type id

unregister_custom_data_type(dtid)

 

Unregisters a custom data type.

Parameters:
  • dtid - the data type id
Returns: bool
Boolean

register_custom_data_format(py_df)

 

Registers a custom data format with a given data type.

Parameters:
  • df - an instance of data_format_t
Returns: int
< 0 if failed to register > 0 data format id

unregister_custom_data_format(dfid)

 

Unregisters a custom data format

Parameters:
  • dfid - data format id
Returns: bool
Boolean

register_data_types_and_formats(formats)

 
Registers multiple data types and formats at once.
To register one type/format at a time use register_custom_data_type/register_custom_data_format

It employs a special table of types and formats described below:

The 'formats' is a list of tuples. If a tuple has one element then it is the format to be registered with dtid=0
If the tuple has more than one element, then tuple[0] is the data type and tuple[1:] are the data formats. For example:
many_formats = [
  (pascal_data_type(), pascal_data_format()),
  (simplevm_data_type(), simplevm_data_format()),
  (makedword_data_format(),),
  (simplevm_data_format(),)
]
The first two tuples describe data types and their associated formats.
The last two tuples describe two data formats to be used with built-in data types.
The data format may be attached to several data types. The id of the
data format is stored in the first data_format_t object. For example:
assert many_formats[1][1] != -1
assert many_formats[2][0] != -1
assert many_formats[3][0] == -1