Module index

Module ida_funcs

Routines for working with functions within the disassembled program.
This file also contains routines for working with library signatures (e.g. FLIRT).
Each function consists of function chunks. At least one function chunk must be present in the function definition - the function entry chunk. Other chunks are called function tails. There may be several of them for a function.
A function tail is a continuous range of addresses. It can be used in the definition of one or more functions. One function using the tail is singled out and called the tail owner. This function is considered as 'possessing' the tail. get_func() on a tail address will return the function possessing the tail. You can enumerate the functions using the tail by using func_parent_iterator_t.
Each function chunk in the disassembly is represented as an "range" (a range of addresses, see range.hpp for details) with characteristics.
A function entry must start with an instruction (code) byte.

Global variables

var FIND_FUNC_DEFINE
create instruction if undefined byte is encountered
var FIND_FUNC_EXIST
function exists already. its bounds are returned in 'nfn'.
var FIND_FUNC_IGNOREFN
ignore existing function boundaries. by default the function returns function boundaries if ea belongs to a function.
var FIND_FUNC_KEEPBD
do not modify incoming function boundaries, just create instructions inside the boundaries.
var FIND_FUNC_NORMAL
stop processing if undefined byte is encountered
var FIND_FUNC_OK
ok, 'nfn' is ready for add_func()
var FIND_FUNC_UNDEF
function has instructions that pass execution flow to unexplored bytes. nfn->end_ea will have the address of the unexplored byte.
var FUNC_BOTTOMBP
BP points to the bottom of the stack frame.
var FUNC_FAR
Far function.
var FUNC_FRAME
Function uses frame pointer (BP)
var FUNC_FUZZY_SP
Function changes SP in untraceable way, for example: and esp, 0FFFFFFF0h
var FUNC_HIDDEN
A hidden function chunk.
var FUNC_LIB
Library function.
var FUNC_LUMINA
Function info is provided by Lumina.
var FUNC_NORET
Function doesn't return.
var FUNC_NORET_PENDING
Function 'non-return' analysis must be performed. This flag is verified upon
func_does_return()
var FUNC_OUTLINE
Outlined code, not a real function.
var FUNC_PROLOG_OK
Prolog analysis has been performed by last SP-analysis
var FUNC_PURGED_OK
'argsize' field has been validated. If this bit is clear and 'argsize' is 0, then we do not known the real number of bytes removed from the stack. This bit is handled by the processor module.
var FUNC_REANALYZE
Function frame changed, request to reanalyze the function after the last insn is analyzed.
var FUNC_SP_READY
SP-analysis has been performed. If this flag is on, the stack change points should not be not modified anymore. Currently this analysis is performed only for PC
var FUNC_STATICDEF
Static function.
var FUNC_TAIL
This is a function tail. Other bits must be clear (except FUNC_HIDDEN).
var FUNC_THUNK
Thunk (jump) function.
var FUNC_USERFAR
User has specified far-ness of the function
var IDASGN_APPLIED
signature is already applied
var IDASGN_BADARG
bad number of signature
var IDASGN_CURRENT
signature is currently being applied
var IDASGN_OK
ok
var IDASGN_PLANNED
signature is planned to be applied
var LIBFUNC_DELAY
no decision because of lack of information
var LIBFUNC_FOUND
ok, library function is found
var LIBFUNC_NONE
no, this is not a library function
var MOVE_FUNC_BADSTART
bad new start address
var MOVE_FUNC_NOCODE
no instruction at 'newstart'
var MOVE_FUNC_NOFUNC
no function at 'ea'
var MOVE_FUNC_OK
ok
var MOVE_FUNC_REFUSED
a plugin refused the action

Functions

def add_func(*args) ‑> bool
add_func(ea1, ea2=BADADDR) -> bool
Add a new function. If the function end address is BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(..., FIND_FUNC_DEFINE).
ea1: (C++: ea_t) start address
ea2: (C++: ea_t) end address
return: success
def add_func_ex(*args) ‑> bool
add_func_ex(pfn) -> bool
Add a new function. If the fn->end_ea is BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(..., FIND_FUNC_DEFINE).
pfn: (C++: func_t *) ptr to filled function structure
return: success
def add_regarg(*args) ‑> void
add_regarg(pfn, reg, tif, name)
pfn: func_t *
reg: int
tif: tinfo_t const &
name: char const *
def append_func_tail(*args) ‑> bool
append_func_tail(pfn, ea1, ea2) -> bool
Append a new tail chunk to the function definition. If the tail already exists, then it will simply be added to the function tail list Otherwise a new tail will be created and its owner will be set to be our function If a new tail cannot be created, then this function will fail.
pfn: (C++: func_t *) pointer to the function
ea1: (C++: ea_t) start of the tail. If a tail already exists at the specified address
it must start at 'ea1'
ea2: (C++: ea_t) end of the tail. If a tail already exists at the specified address
it must end at 'ea2'. If specified as BADADDR, IDA will determine the end address itself.
def apply_idasgn_to(*args) ‑> int
apply_idasgn_to(signame, ea, is_startup) -> int
Apply a signature file to the specified address.
signame: (C++: const char *) short name of signature file (the file name without path)
ea: (C++: ea_t) address to apply the signature
is_startup: (C++: bool) if set, then the signature is treated as a startup one for
startup signature ida doesn't rename the first function of the applied module.
return: Library function codes
def apply_startup_sig(*args) ‑> bool
apply_startup_sig(ea, startup) -> bool
Apply a startup signature file to the specified address.
ea: (C++: ea_t) address to apply the signature to; usually idainfo::start_ea
startup: (C++: const char *) the name of the signature file without path and extension
return: true if successfully applied the signature
def calc_func_size(*args) ‑> asize_t
calc_func_size(pfn) -> asize_t
Calculate function size. This function takes into account all fragments of the function.
pfn: (C++: func_t *) ptr to function structure
def calc_idasgn_state(*args) ‑> int
calc_idasgn_state(n) -> int
Get state of a signature in the list of planned signatures
n: (C++: int) number of signature in the list (0..get_idasgn_qty()-1)
return: state of signature or IDASGN_BADARG
def calc_thunk_func_target(*args)
calc_thunk_func_target(pfn) -> ea_t
Calculate target of a thunk function.
pfn: (C++: func_t *) pointer to function (may not be nullptr)
return: the target function or BADADDR
def del_func(*args) ‑> bool
del_func(ea) -> bool
Delete a function.
ea: (C++: ea_t) any address in the function entry chunk
return: success
def del_idasgn(*args) ‑> int
del_idasgn(n) -> int
Remove signature from the list of planned signatures.
n: (C++: int) number of signature in the list (0..get_idasgn_qty()-1)
return: IDASGN_OK, IDASGN_BADARG, IDASGN_APPLIED
def f_any(*args) ‑> bool
f_any(arg1, arg2) -> bool
Helper function to accept any address.
arg1: flags64_t
arg2: void *
def find_func_bounds(*args) ‑> int
find_func_bounds(nfn, flags) -> int
Determine the boundaries of a new function. This function tries to find the start and end addresses of a new function. It calls the module with processor_t::func_bounds in order to fine tune the function boundaries.
nfn: (C++: func_t *) structure to fill with information \ nfn->start_ea points to the
start address of the new function.
flags: (C++: int) Find function bounds flags
return: Find function bounds result codes
def free_regarg(*args) ‑> void
free_regarg(v)
v: regarg_t *
def func_contains(*args) ‑> bool
func_contains(pfn, ea) -> bool
Does the given function contain the given address?
pfn: (C++: func_t *)
ea: (C++: ea_t)
def func_does_return(*args) ‑> bool
func_does_return(callee) -> bool
Does the function return?. To calculate the answer, FUNC_NORET flag and is_noret() are consulted The latter is required for imported functions in the .idata section. Since in .idata we have only function pointers but not functions, we have to introduce a special flag for them.
callee: (C++: ea_t)
def func_parent_iterator_set(*args) ‑> bool
func_parent_iterator_set(fpi, pfn) -> bool
fpi: func_parent_iterator_t *
pfn: func_t *
def func_t__from_ptrval__(*args) ‑> func_t *
func_t__from_ptrval__(ptrval) -> func_t
ptrval: size_t
def func_tail_iterator_set(*args) ‑> bool
func_tail_iterator_set(fti, pfn, ea) -> bool
fti: func_tail_iterator_t *
pfn: func_t *
ea: ea_t
def func_tail_iterator_set_ea(*args) ‑> bool
func_tail_iterator_set_ea(fti, ea) -> bool
fti: func_tail_iterator_t *
ea: ea_t
def get_current_idasgn(*args) ‑> int
get_current_idasgn() -> int
Get number of the the current signature.
return: 0..n-1
def get_fchunk(*args) ‑> func_t *
get_fchunk(ea) -> func_t
Get pointer to function chunk structure by address.
ea: (C++: ea_t) any address in a function chunk
return: ptr to a function chunk or nullptr. This function may return a function
entry as well as a function tail.
def get_fchunk_num(*args) ‑> int
get_fchunk_num(ea) -> int
Get ordinal number of a function chunk in the global list of function chunks.
ea: (C++: ea_t) any address in the function chunk
return: number of function chunk (0..get_fchunk_qty()-1). -1 means 'no function
chunk at the specified address'.
def get_fchunk_qty(*args) ‑> size_t
get_fchunk_qty() -> size_t
Get total number of function chunks in the program.
def get_fchunk_referer(*args) ‑> ea_t
get_fchunk_referer(ea, idx) -> ea_t
ea: ea_t
idx: size_t
def get_func(*args) ‑> func_t *
get_func(ea) -> func_t
Get pointer to function structure by address.
ea: (C++: ea_t) any address in a function
return: ptr to a function or nullptr. This function returns a function entry
chunk.
def get_func_bitness(*args) ‑> int
get_func_bitness(pfn) -> int
Get function bitness (which is equal to the function segment bitness). pfn==nullptr => returns 0
retval 0: 16
retval 1: 32
retval 2: 64
pfn: (C++: const func_t *) func_t const *
def get_func_bits(*args) ‑> int
get_func_bits(pfn) -> int
Get number of bits in the function addressing.
pfn: (C++: const func_t *) func_t const *
def get_func_bytes(*args) ‑> int
get_func_bytes(pfn) -> int
Get number of bytes in the function addressing.
pfn: (C++: const func_t *) func_t const *
def get_func_chunknum(*args) ‑> int
get_func_chunknum(pfn, ea) -> int
Get the containing tail chunk of 'ea'.
retval -1: means 'does not contain ea'
retval 0: means the 'pfn' itself contains ea
retval >0: the number of the containing function tail chunk
pfn: (C++: func_t *)
ea: (C++: ea_t)
def get_func_cmt(*args) ‑> qstring *
get_func_cmt(pfn, repeatable) -> str
Get function comment.
pfn: (C++: const func_t *) ptr to function structure
repeatable: (C++: bool) get repeatable comment?
return: size of comment or -1 In fact this function works with function chunks
too.
def get_func_name(*args) ‑> qstring *
get_func_name(ea) -> str
Get function name.
ea: (C++: ea_t) any address in the function
return: length of the function name
def get_func_num(*args) ‑> int
get_func_num(ea) -> int
Get ordinal number of a function.
ea: (C++: ea_t) any address in the function
return: number of function (0..get_func_qty()-1). -1 means 'no function at the
specified address'.
def get_func_qty(*args) ‑> size_t
get_func_qty() -> size_t
Get total number of functions in the program.
def get_func_ranges(*args) ‑> ea_t
get_func_ranges(ranges, pfn) -> ea_t
Get function ranges.
ranges: (C++: rangeset_t *) buffer to receive the range info
pfn: (C++: func_t *) ptr to function structure
return: end address of the last function range (BADADDR-error)
def get_idasgn_desc(*args) ‑> PyObject *
get_idasgn_desc(n) -> (str, str)
Get information about a signature in the list. It returns: (name of signature, names of optional libraries)
See also: get_idasgn_desc_with_matches
n: number of signature in the list (0..get_idasgn_qty()-1)
return: None on failure or tuple(signame, optlibs)
def get_idasgn_desc_with_matches(*args) ‑> PyObject *
get_idasgn_desc_with_matches(n) -> (str, str, int)
Get information about a signature in the list. It returns: (name of signature, names of optional libraries, number of matches)
n: number of signature in the list (0..get_idasgn_qty()-1)
return: None on failure or tuple(signame, optlibs, nmatches)
def get_idasgn_qty(*args) ‑> int
get_idasgn_qty() -> int
Get number of signatures in the list of planned and applied signatures.
return: 0..n
def get_idasgn_title(*args) ‑> qstring *
get_idasgn_title(name) -> str
Get full description of the signature by its short name.
name: (C++: const char *) short name of a signature
return: size of signature description or -1
def get_next_fchunk(*args) ‑> func_t *
get_next_fchunk(ea) -> func_t
Get pointer to the next function chunk in the global list.
ea: (C++: ea_t) any address in the program
return: ptr to function chunk or nullptr if next function chunk doesn't exist
def get_next_func(*args) ‑> func_t *
get_next_func(ea) -> func_t
Get pointer to the next function.
ea: (C++: ea_t) any address in the program
return: ptr to function or nullptr if next function doesn't exist
def get_next_func_addr(*args) ‑> ea_t
get_next_func_addr(pfn, ea) -> ea_t
pfn: func_t *
ea: ea_t
def get_prev_fchunk(*args) ‑> func_t *
get_prev_fchunk(ea) -> func_t
Get pointer to the previous function chunk in the global list.
ea: (C++: ea_t) any address in the program
return: ptr to function chunk or nullptr if previous function chunk doesn't
exist
def get_prev_func(*args) ‑> func_t *
get_prev_func(ea) -> func_t
Get pointer to the previous function.
ea: (C++: ea_t) any address in the program
return: ptr to function or nullptr if previous function doesn't exist
def get_prev_func_addr(*args) ‑> ea_t
get_prev_func_addr(pfn, ea) -> ea_t
pfn: func_t *
ea: ea_t
def getn_fchunk(*args) ‑> func_t *
getn_fchunk(n) -> func_t
Get pointer to function chunk structure by number.
n: (C++: int) number of function chunk, is in range 0..get_fchunk_qty()-1
return: ptr to a function chunk or nullptr. This function may return a function
entry as well as a function tail.
def getn_func(*args) ‑> func_t *
getn_func(n) -> func_t
Get pointer to function structure by number.
n: (C++: size_t) number of function, is in range 0..get_func_qty()-1
return: ptr to a function or nullptr. This function returns a function entry
chunk.
def is_finally_visible_func(*args) ‑> bool
is_finally_visible_func(pfn) -> bool
Is the function visible (event after considering SCF_SHHID_FUNC)?
pfn: (C++: func_t *)
def is_func_entry(*args) ‑> bool
is_func_entry(pfn) -> bool
Does function describe a function entry chunk?
pfn: (C++: const func_t *) func_t const *
def is_func_locked(*args) ‑> bool
is_func_locked(pfn) -> bool
Is the function pointer locked?
pfn: (C++: const func_t *) func_t const *
def is_func_tail(*args) ‑> bool
is_func_tail(pfn) -> bool
Does function describe a function tail chunk?
pfn: (C++: const func_t *) func_t const *
def is_same_func(*args) ‑> bool
is_same_func(ea1, ea2) -> bool
Do two addresses belong to the same function?
ea1: (C++: ea_t)
ea2: (C++: ea_t)
def is_visible_func(*args) ‑> bool
is_visible_func(pfn) -> bool
Is the function visible (not hidden)?
pfn: (C++: func_t *)
def lock_func_range(*args) ‑> void
lock_func_range(pfn, lock)
Lock function pointer Locked pointers are guaranteed to remain valid until they are unlocked. Ranges with locked pointers cannot be deleted or moved.
pfn: (C++: const func_t *) func_t const *
lock: (C++: bool)
def plan_to_apply_idasgn(*args) ‑> int
plan_to_apply_idasgn(fname) -> int
Add a signature file to the list of planned signature files.
fname: (C++: const char *) file name. should not contain directory part.
return: 0 if failed, otherwise number of planned (and applied) signatures
def read_regargs(*args) ‑> void
read_regargs(pfn)
pfn: func_t *
def reanalyze_function(*args) ‑> void
reanalyze_function(pfn, ea1=0, ea2=BADADDR, analyze_parents=False)
Reanalyze a function. This function plans to analyzes all chunks of the given function. Optional parameters (ea1, ea2) may be used to narrow the analyzed range.
pfn: (C++: func_t *) pointer to a function
ea1: (C++: ea_t) start of the range to analyze
ea2: (C++: ea_t) end of range to analyze
analyze_parents: (C++: bool) meaningful only if pfn points to a function tail. if
true, all tail parents will be reanalyzed. if false, only the given tail will be reanalyzed.
def reanalyze_noret_flag(*args) ‑> bool
reanalyze_noret_flag(ea) -> bool
Plan to reanalyze noret flag. This function does not remove FUNC_NORET if it is already present. It just plans to reanalysis.
ea: (C++: ea_t)
def remove_func_tail(*args) ‑> bool
remove_func_tail(pfn, tail_ea) -> bool
Remove a function tail. If the tail belongs only to one function, it will be completely removed. Otherwise if the function was the tail owner, the first function using this tail becomes the owner of the tail.
pfn: (C++: func_t *) pointer to the function
tail_ea: (C++: ea_t) any address inside the tail to remove
def set_func_cmt(*args) ‑> bool
set_func_cmt(pfn, cmt, repeatable) -> bool
Set function comment. This function works with function chunks too.
pfn: (C++: const func_t *) ptr to function structure
cmt: (C++: const char *) comment string, may be multiline (with ' '). Use empty str ("") to delete comment
repeatable: (C++: bool) set repeatable comment?
def set_func_end(*args) ‑> bool
set_func_end(ea, newend) -> bool
Move function chunk end address.
ea: (C++: ea_t) any address in the function
newend: (C++: ea_t) new end address of the function
return: success
def set_func_name_if_jumpfunc(*args) ‑> int
set_func_name_if_jumpfunc(pfn, oldname) -> int
Give a meaningful name to function if it consists of only 'jump' instruction.
pfn: (C++: func_t *) pointer to function (may be nullptr)
oldname: (C++: const char *) old name of function. if old name was in "j_..." form, then we
may discard it and set a new name. if oldname is not known, you may pass nullptr.
return: success
def set_func_start(*args) ‑> int
set_func_start(ea, newstart) -> int
Move function chunk start address.
ea: (C++: ea_t) any address in the function
newstart: (C++: ea_t) new end address of the function
return: Function move result codes
def set_noret_insn(*args) ‑> bool
set_noret_insn(insn_ea, noret) -> bool
Signal a non-returning instruction. This function can be used by the processor module to tell the kernel about non-returning instructions (like call exit). The kernel will perform the global function analysis and find out if the function returns at all. This analysis will be done at the first call to
func_does_return()
insn_ea: (C++: ea_t)
noret: (C++: bool)
return: true if the instruction 'noret' flag has been changed
def set_tail_owner(*args) ‑> bool
set_tail_owner(fnt, new_owner) -> bool
Set a new owner of a function tail. The new owner function must be already referring to the tail (after append_func_tail).
fnt: (C++: func_t *) pointer to the function tail
new_owner: (C++: ea_t) the entry point of the new owner function
def set_visible_func(*args) ‑> void
set_visible_func(pfn, visible)
Set visibility of function.
pfn: (C++: func_t *)
visible: (C++: bool)
def try_to_add_libfunc(*args) ‑> int
try_to_add_libfunc(ea) -> int
Apply the currently loaded signature file to the specified address. If a library function is found, then create a function and name it accordingly.
ea: (C++: ea_t) any address in the program
return: Library function codes
def update_func(*args) ‑> bool
update_func(pfn) -> bool
Update information about a function in the database (func_t). You must not change the function start and end addresses using this function. Use set_func_start() and set_func_end() for it.
pfn: (C++: func_t *) ptr to function structure
return: success

Classes

class dyn_ea_array (*args)
Proxy of C++ dynamic_wrapped_array_t< ea_t > class.
__init__(self, _data, _count) -> dyn_ea_array
_data: unsigned long long *
_count: size_t

Instance variables

var count
count
var data
data
class dyn_range_array (*args)
Proxy of C++ dynamic_wrapped_array_t< range_t > class.
__init__(self, _data, _count) -> dyn_range_array
_data: range_t *
_count: size_t

Instance variables

var count
count
var data
data
class dyn_regarg_array (*args)
Proxy of C++ dynamic_wrapped_array_t< regarg_t > class.
__init__(self, _data, _count) -> dyn_regarg_array
_data: regarg_t *
_count: size_t

Instance variables

var count
count
var data
data
class dyn_regvar_array (*args)
Proxy of C++ dynamic_wrapped_array_t< regvar_t > class.
__init__(self, _data, _count) -> dyn_regvar_array
_data: regvar_t *
_count: size_t

Instance variables

var count
count
var data
data
class dyn_stkpnt_array (*args)
Proxy of C++ dynamic_wrapped_array_t< stkpnt_t > class.
__init__(self, _data, _count) -> dyn_stkpnt_array
_data: stkpnt_t *
_count: size_t

Instance variables

var count
count
var data
data
class func_item_iterator_t (*args)
Proxy of C++ func_item_iterator_t class.
__init__(self) -> func_item_iterator_t
__init__(self, pfn, _ea=BADADDR) -> func_item_iterator_t
pfn: func_t *
_ea: ea_t

Methods

def addresses(self)
Provide an iterator on addresses contained within the function
def chunk(self, *args) ‑> range_t const &
chunk(self) -> range_t
def code_items(self)
Provide an iterator on code items contained within the function
def current(self, *args) ‑> ea_t
current(self) -> ea_t
def data_items(self)
Provide an iterator on data items contained within the function
def decode_preceding_insn(self, *args) ‑> bool
decode_preceding_insn(self, visited, p_farref, out) -> bool
visited: eavec_t *
p_farref: bool *
out: insn_t *
def decode_prev_insn(self, *args) ‑> bool
decode_prev_insn(self, out) -> bool
out: insn_t *
def first(self, *args) ‑> bool
first(self) -> bool
def head_items(self)
Provide an iterator on item heads contained within the function
def last(self, *args) ‑> bool
last(self) -> bool
def next(self, *args) ‑> bool
__next__(self, func) -> bool
func: testf_t *
def next_addr(self, *args) ‑> bool
next_addr(self) -> bool
def next_code(self, *args) ‑> bool
next_code(self) -> bool
def next_data(self, *args) ‑> bool
next_data(self) -> bool
def next_head(self, *args) ‑> bool
next_head(self) -> bool
def next_not_tail(self, *args) ‑> bool
next_not_tail(self) -> bool
def not_tails(self)
Provide an iterator on non-tail addresses contained within the function
def prev(self, *args) ‑> bool
prev(self, func) -> bool
func: testf_t *
def prev_addr(self, *args) ‑> bool
prev_addr(self) -> bool
def prev_code(self, *args) ‑> bool
prev_code(self) -> bool
def prev_data(self, *args) ‑> bool
prev_data(self) -> bool
def prev_head(self, *args) ‑> bool
prev_head(self) -> bool
def prev_not_tail(self, *args) ‑> bool
prev_not_tail(self) -> bool
def set(self, *args) ‑> bool
set(self, pfn, _ea=BADADDR) -> bool
Set a function range. if pfn == nullptr then a segment range will be set.
pfn: (C++: func_t *)
_ea: (C++: ea_t)
def set_range(self, *args) ‑> bool
set_range(self, ea1, ea2) -> bool
Set an arbitrary range.
ea1: (C++: ea_t)
ea2: (C++: ea_t)
def succ(self, *args) ‑> bool
succ(self, func) -> bool
Similar to next(), but succ() iterates the chunks from low to high addresses, while next() iterates through chunks starting at the function entry chunk
func: (C++: testf_t *)
def succ_code(self, *args) ‑> bool
succ_code(self) -> bool
class func_parent_iterator_t (*args)
Proxy of C++ func_parent_iterator_t class.
__init__(self) -> func_parent_iterator_t
__init__(self, _fnt) -> func_parent_iterator_t
_fnt: func_t *

Methods

def first(self, *args) ‑> bool
first(self) -> bool
def last(self, *args) ‑> bool
last(self) -> bool
def next(self, *args) ‑> bool
__next__(self) -> bool
def parent(self, *args) ‑> ea_t
parent(self) -> ea_t
def prev(self, *args) ‑> bool
prev(self) -> bool
def reset_fnt(self, *args) ‑> void
reset_fnt(self, _fnt)
_fnt: func_t *
def set(self, *args) ‑> bool
set(self, _fnt) -> bool
_fnt: func_t *
class func_t (*args)
Proxy of C++ func_t class.
__init__(self, start=0, end=0, f=0) -> func_t
start: ea_t
end: ea_t
f: flags64_t

Ancestors

Instance variables

var argsize
number of bytes purged from the stack upon returning
var color
user defined function color
var flags
Function flags
var fpd
frame pointer delta. (usually 0, i.e. realBP==typicalBP) use update_fpd() to modify it.
var frame
netnode id of frame structure - see frame.hpp
var frregs
size of saved registers in frame. This range is immediately above the local variables range.
var frsize
size of local variables part of frame in bytes. If FUNC_FRAME is set and fpd==0, the frame pointer (EBP) is assumed to point to the top of the local variables range.
var owner
the address of the main function possessing this tail
var pntqty
number of SP change points
var points : dynamic_wrapped_array_t< stkpnt_t >
array of SP change points. use ...stkpnt...() functions to access this array.
var referers : dynamic_wrapped_array_t< ea_t >
array of referers (function start addresses). use func_parent_iterator_t to access the referers.
var refqty
number of referers
var regargqty
number of register arguments. During analysis IDA tries to guess the register arguments. It stores store the guessing outcome in this field. As soon as it determines the final function prototype, regargqty is set to zero.
var regargs : dynamic_wrapped_array_t< regarg_t >
unsorted array of register arguments. use ...regarg...() functions to access this array. regargs are destroyed when the full function type is determined.
var regvarqty
number of register variables (-1-not read in yet) use find_regvar() to read register variables
var regvars : dynamic_wrapped_array_t< regvar_t >
array of register variables. this array is sorted by: start_ea. use ...regvar...() functions to access this array.
var tailqty
number of function tails
var tails : dynamic_wrapped_array_t< range_t >
array of tails, sorted by ea. use func_tail_iterator_t to access function tails.

Methods

def addresses(self)
Alias for func_item_iterator_t(self).addresses()
def analyzed_sp(self, *args) ‑> bool
analyzed_sp(self) -> bool
Has SP-analysis been performed?
def code_items(self)
Alias for func_item_iterator_t(self).code_items()
def data_items(self)
Alias for func_item_iterator_t(self).data_items()
def does_return(self, *args) ‑> bool
does_return(self) -> bool
Does function return?
def head_items(self)
Alias for func_item_iterator_t(self).head_items()
def is_far(self, *args) ‑> bool
is_far(self) -> bool
Is a far function?
def need_prolog_analysis(self, *args) ‑> bool
need_prolog_analysis(self) -> bool
Needs prolog analysis?
def not_tails(self)
Alias for func_item_iterator_t(self).not_tails()

Inherited members

class func_tail_iterator_t (*args)
Proxy of C++ func_tail_iterator_t class.
__init__(self) -> func_tail_iterator_t
__init__(self, _pfn, ea=BADADDR) -> func_tail_iterator_t
_pfn: func_t *
ea: ea_t

Methods

def chunk(self, *args) ‑> range_t const &
chunk(self) -> range_t
def first(self, *args) ‑> bool
first(self) -> bool
def last(self, *args) ‑> bool
last(self) -> bool
def main(self, *args) ‑> bool
main(self) -> bool
def next(self, *args) ‑> bool
__next__(self) -> bool
def prev(self, *args) ‑> bool
prev(self) -> bool
def set(self, *args) ‑> bool
set(self, _pfn, ea=BADADDR) -> bool
_pfn: func_t *
ea: ea_t
def set_ea(self, *args) ‑> bool
set_ea(self, ea) -> bool
ea: ea_t
def set_range(self, *args) ‑> bool
set_range(self, ea1, ea2) -> bool
ea1: ea_t
ea2: ea_t
class lock_func (*args)
Proxy of C++ lock_func class.
__init__(self, _pfn) -> lock_func
_pfn: func_t const *
class lock_func_with_tails_t (*args)
Proxy of C++ lock_func_with_tails_t class.
__init__(self, pfn) -> lock_func_with_tails_t
pfn: func_t *
class regarg_t (*args)
Proxy of C++ regarg_t class.
__init__(self) -> regarg_t
__init__(self, r) -> regarg_t
r: regarg_t const &

Instance variables

var name
name
var reg
reg
var type
type

Methods

def swap(self, *args) ‑> void
swap(self, r)
r: regarg_t &