IDA SDK
Classes | Functions | Macros | Typedefs | Variables
bytes.hpp File Reference

Detailed Description

Contains functions that deal with individual byte characteristics.

Each byte of the disassembled program is represented by a 32-bit value. We will call this value 'flags'. The structure of the flags is here.

You are not allowed to inspect individual bits of flags and modify them directly. Use special functions to inspect and/or modify flags.

Flags are kept in a virtual array file (*.id1). Addresses (ea) are all 32-bit (or 64-bit) quantities.

Classes

struct  data_type_t
 Information about a data type. More...
 
struct  data_format_t
 Information about a data format. More...
 
struct  compiled_binpat_t
 
struct  hidden_range_t
 Hidden ranges - address ranges which can be replaced by their descriptions. More...
 

Functions

idaman error_t ida_export enable_flags (ea_t start_ea, ea_t end_ea, storage_type_t stt)
 Allocate flags for address range. More...
 
idaman error_t ida_export disable_flags (ea_t start_ea, ea_t end_ea)
 Deallocate flags for address range. More...
 
idaman error_t ida_export change_storage_type (ea_t start_ea, ea_t end_ea, storage_type_t stt)
 Change flag storage type for address range. More...
 
idaman ea_t ida_export next_addr (ea_t ea)
 Get next address in the program (i.e. More...
 
idaman ea_t ida_export prev_addr (ea_t ea)
 Get previous address in the program. More...
 
idaman ea_t ida_export next_chunk (ea_t ea)
 Get the first address of next contiguous chunk in the program. More...
 
idaman ea_t ida_export prev_chunk (ea_t ea)
 Get the last address of previous contiguous chunk in the program. More...
 
idaman ea_t ida_export chunk_start (ea_t ea)
 Get start of the contiguous address block containing 'ea'. More...
 
idaman asize_t ida_export chunk_size (ea_t ea)
 Get size of the contiguous address block containing 'ea'. More...
 
idaman ea_t ida_export free_chunk (ea_t bottom, asize_t size, int32 step)
 Search for a hole in the addressing space of the program. More...
 
idaman ea_t ida_export next_that (ea_t ea, ea_t maxea, testf_t *testf, void *ud=NULL)
 Find next address with a flag satisfying the function 'testf'. More...
 
ea_t idaapi next_unknown (ea_t ea, ea_t maxea)
 Similar to next_that(), but will find the next address that is unexplored.
 
idaman ea_t ida_export prev_that (ea_t ea, ea_t minea, testf_t *testf, void *ud=NULL)
 Find previous address with a flag satisfying the function 'testf'. More...
 
ea_t idaapi prev_unknown (ea_t ea, ea_t minea)
 Similar to prev_that(), but will find the previous address that is unexplored.
 
idaman ea_t ida_export prev_head (ea_t ea, ea_t minea)
 Get start of previous defined item. More...
 
idaman ea_t ida_export next_head (ea_t ea, ea_t maxea)
 Get start of next defined item. More...
 
idaman ea_t ida_export prev_not_tail (ea_t ea)
 Get address of previous non-tail byte. More...
 
idaman ea_t ida_export next_not_tail (ea_t ea)
 Get address of next non-tail byte. More...
 
ea_t adjust_visea (ea_t ea)
 Adjust the address and get the nearest visible address. More...
 
idaman ea_t ida_export prev_visea (ea_t ea)
 Get previous visible address. More...
 
idaman ea_t ida_export next_visea (ea_t ea)
 Get next visible address. More...
 
bool is_first_visea (ea_t ea)
 Is an address the first visible address?
 
bool is_last_visea (ea_t ea)
 Is an address the last visible address?
 
bool is_visible_finally (ea_t ea)
 Is the address visible on the screen (not hidden)?
 
ea_t idaapi get_item_head (ea_t ea)
 Get the start address of the item at 'ea'. More...
 
idaman ea_t ida_export get_item_end (ea_t ea)
 Get the end address of the item at 'ea'. More...
 
idaman ea_t ida_export calc_max_item_end (ea_t ea, int how=15)
 Calculate maximal reasonable end address of a new item. More...
 
asize_t get_item_size (ea_t ea)
 Get size of item (instruction/data) in bytes. More...
 
void flush_flags (void)
 Flush virtual array to disk.
 
idaman bool ida_export is_mapped (ea_t ea)
 Is the specified address 'ea' present in the program?
 
idaman flags_t ida_export get_flags_ex (ea_t ea, int how)
 Get flags for the specified address, extended form.
 
flags_t idaapi get_flags (ea_t ea)
 get flags with FF_IVL & MS_VAL. More...
 
flags_t idaapi get_full_flags (ea_t ea)
 Get flags value for address 'ea'. More...
 
idaman flags_t ida_export get_item_flag (ea_t from, int n, ea_t ea, bool appzero)
 Get flag of the item at 'ea' even if it is a tail byte of some array or structure. More...
 
bool idaapi has_value (flags_t F)
 Do flags contain byte value?
 
idaman void ida_export del_value (ea_t ea)
 Delete byte value from flags. More...
 
idaman bool ida_export is_loaded (ea_t ea)
 Does the specified address have a byte value (is initialized?)
 
idaman int ida_export nbits (ea_t ea)
 Get number of bits in a byte at the given address. More...
 
int bytesize (ea_t ea)
 Get number of bytes required to store a byte at the given address.
 
idaman uchar ida_export get_byte (ea_t ea)
 Get one byte (8-bit) of the program at 'ea'. More...
 
idaman uchar ida_export get_db_byte (ea_t ea)
 Get one byte (8-bit) of the program at 'ea' from the database. More...
 
idaman ushort ida_export get_word (ea_t ea)
 Get one word (16-bit) of the program at 'ea'. More...
 
idaman uint32 ida_export get_dword (ea_t ea)
 Get one dword (32-bit) of the program at 'ea'. More...
 
idaman uint64 ida_export get_qword (ea_t ea)
 Get one qword (64-bit) of the program at 'ea'. More...
 
idaman uint64 ida_export get_wide_byte (ea_t ea)
 Get one wide byte of the program at 'ea'. More...
 
idaman uint64 ida_export get_wide_word (ea_t ea)
 Get one wide word (2 'byte') of the program at 'ea'. More...
 
idaman uint64 ida_export get_wide_dword (ea_t ea)
 Get two wide words (4 'bytes') of the program at 'ea'. More...
 
idaman uchar ida_export get_octet (ea_t *ea, uint64 *v, int *nbit)
 Get 8 bits of the program at 'ea'. More...
 
idaman uint32 ida_export get_16bit (ea_t ea)
 Get 16bits of the program at 'ea'. More...
 
idaman uint32 ida_export get_32bit (ea_t ea)
 Get not more than 32bits of the program at 'ea'. More...
 
idaman uint64 ida_export get_64bit (ea_t ea)
 Get not more than 64bits of the program at 'ea'. More...
 
idaman bool ida_export get_data_value (uval_t *v, ea_t ea, asize_t size)
 Get the value at of the item at 'ea'. More...
 
idaman int ida_export visit_patched_bytes (ea_t ea1, ea_t ea2, int(idaapi *cb)(ea_t ea, qoff64_t fpos, uint64 o, uint64 v, void *ud), void *ud=NULL)
 Visit all the patched bytes one byte at a time. More...
 
idaman uint64 ida_export get_original_byte (ea_t ea)
 Get original byte value (that was before patching). More...
 
idaman uint64 ida_export get_original_word (ea_t ea)
 Get original word value (that was before patching). More...
 
idaman uint64 ida_export get_original_dword (ea_t ea)
 Get original dword (that was before patching) This function works for wide byte processors too. More...
 
idaman uint64 ida_export get_original_qword (ea_t ea)
 Get original qword value (that was before patching) This function DOESN'T work for wide byte processors too. More...
 
idaman bool ida_export put_byte (ea_t ea, uint64 x)
 Set value of one byte of the program. More...
 
idaman void ida_export put_word (ea_t ea, uint64 x)
 Set value of one word of the program. More...
 
idaman void ida_export put_dword (ea_t ea, uint64 x)
 Set value of one dword of the program. More...
 
idaman void ida_export put_qword (ea_t ea, uint64 x)
 Set value of one qword (8 bytes) of the program. More...
 
idaman bool ida_export patch_byte (ea_t ea, uint64 x)
 Patch a byte of the program. More...
 
idaman bool ida_export patch_word (ea_t ea, uint64 x)
 Patch a word of the program. More...
 
idaman bool ida_export patch_dword (ea_t ea, uint64 x)
 Patch a dword of the program. More...
 
idaman bool ida_export patch_qword (ea_t ea, uint64 x)
 Patch a qword of the program. More...
 
idaman bool ida_export revert_byte (ea_t ea)
 Revert patched byte. More...
 
idaman void ida_export add_byte (ea_t ea, uint32 value)
 Add a value to one byte of the program. More...
 
idaman void ida_export add_word (ea_t ea, uint64 value)
 Add a value to one word of the program. More...
 
idaman void ida_export add_dword (ea_t ea, uint64 value)
 Add a value to one dword of the program. More...
 
idaman void ida_export add_qword (ea_t ea, uint64 value)
 Add a value to one qword of the program. More...
 
idaman bool ida_export get_zero_ranges (rangeset_t *zranges, const range_t *range)
 Return set of ranges with zero initialized bytes. More...
 
idaman ssize_t ida_export get_bytes (void *buf, ssize_t size, ea_t ea, int gmb_flags=0, void *mask=NULL)
 Get the specified number of bytes of the program into the buffer. More...
 
idaman void ida_export put_bytes (ea_t ea, const void *buf, size_t size)
 Modify the specified number of bytes of the program. More...
 
idaman void ida_export patch_bytes (ea_t ea, const void *buf, size_t size)
 Patch the specified number of bytes of the program. More...
 
bool idaapi is_code (flags_t F)
 Does flag denote start of an instruction?
 
bool idaapi f_is_code (flags_t F, void *)
 Does flag denote start of an instruction? More...
 
bool idaapi is_data (flags_t F)
 Does flag denote start of data?
 
bool idaapi f_is_data (flags_t F, void *)
 Does flag denote start of data? More...
 
bool idaapi is_tail (flags_t F)
 Does flag denote tail byte?
 
bool idaapi f_is_tail (flags_t F, void *)
 Does flag denote tail byte? More...
 
bool idaapi is_not_tail (flags_t F)
 Does flag denote tail byte? More...
 
bool idaapi f_is_not_tail (flags_t F, void *)
 Does flag denote tail byte? More...
 
bool idaapi is_unknown (flags_t F)
 Does flag denote unexplored byte?
 
bool idaapi is_head (flags_t F)
 Does flag denote start of instruction OR data?
 
bool idaapi f_is_head (flags_t F, void *)
 Does flag denote start of instruction OR data? More...
 
idaman bool ida_export del_items (ea_t ea, int flags=0, asize_t nbytes=1, may_destroy_cb_t *may_destroy=NULL)
 Convert item (instruction/data) to unexplored bytes. More...
 
idaman bool ida_export is_manual_insn (ea_t ea)
 Is the instruction overridden? More...
 
idaman ssize_t ida_export get_manual_insn (qstring *buf, ea_t ea)
 Retrieve the user-specified string for the manual instruction. More...
 
idaman void ida_export set_manual_insn (ea_t ea, const char *manual_insn)
 Set manual instruction string. More...
 
bool idaapi is_flow (flags_t F)
 Does the previous instruction exist and pass execution flow to the current byte?
 
bool idaapi has_extra_cmts (flags_t F)
 Does the current byte have additional anterior or posterior lines?
 
bool idaapi has_cmt (flags_t F)
 Does the current byte have an indented comment?
 
bool idaapi has_xref (flags_t F)
 Does the current byte have cross-references to it?
 
bool idaapi f_has_xref (flags_t f, void *)
 Does the current byte have cross-references to it? More...
 
bool idaapi has_name (flags_t F)
 Does the current byte have non-trivial (non-dummy) name?
 
bool idaapi f_has_name (flags_t f, void *)
 Does the current byte have non-trivial (non-dummy) name? More...
 
bool idaapi has_dummy_name (flags_t F)
 Does the current byte have dummy (auto-generated, with special prefix) name?
 
bool idaapi f_has_dummy_name (flags_t f, void *)
 Does the current byte have dummy (auto-generated, with special prefix) name? More...
 
bool idaapi has_auto_name (flags_t F)
 Does the current byte have auto-generated (no special prefix) name?
 
bool idaapi has_any_name (flags_t F)
 Does the current byte have any name?
 
bool idaapi has_user_name (flags_t F)
 Does the current byte have user-specified name?
 
bool idaapi f_has_user_name (flags_t F, void *)
 Does the current byte have user-specified name? More...
 
idaman bool ida_export is_invsign (ea_t ea, flags_t F, int n)
 Should sign of n-th operand inverted during output?. More...
 
idaman bool ida_export toggle_sign (ea_t ea, int n)
 Toggle sign of n-th operand. More...
 
idaman bool ida_export is_bnot (ea_t ea, flags_t F, int n)
 Should we negate the operand?. More...
 
idaman bool ida_export toggle_bnot (ea_t ea, int n)
 Toggle binary negation of operand. also see is_bnot()
 
idaman bool ida_export is_lzero (ea_t ea, int n)
 Display leading zeroes in operands. More...
 
idaman bool ida_export set_lzero (ea_t ea, int n)
 Set toggle lzero bit.
 
idaman bool ida_export clr_lzero (ea_t ea, int n)
 Clear lzero bit.
 
bool idaapi toggle_lzero (ea_t ea, int n)
 
idaman bool ida_export leading_zero_important (ea_t ea, int n)
 Check if leading zeroes are important.
 
bool idaapi is_defarg0 (flags_t F)
 Is the first operand defined? Initially operand has no defined representation.
 
bool idaapi is_defarg1 (flags_t F)
 Is the second operand defined? Initially operand has no defined representation.
 
bool idaapi is_off0 (flags_t F)
 Is the first operand offset? (example: push offset xxx)
 
bool idaapi is_off1 (flags_t F)
 Is the second operand offset? (example: mov ax, offset xxx)
 
bool idaapi is_char0 (flags_t F)
 Is the first operand character constant? (example: push 'a')
 
bool idaapi is_char1 (flags_t F)
 Is the second operand character constant? (example: mov al, 'a')
 
bool idaapi is_seg0 (flags_t F)
 Is the first operand segment selector? (example: push seg seg001)
 
bool idaapi is_seg1 (flags_t F)
 Is the second operand segment selector? (example: mov dx, seg dseg)
 
bool idaapi is_enum0 (flags_t F)
 Is the first operand a symbolic constant (enum member)?
 
bool idaapi is_enum1 (flags_t F)
 Is the second operand a symbolic constant (enum member)?
 
bool idaapi is_stroff0 (flags_t F)
 Is the first operand an offset within a struct?
 
bool idaapi is_stroff1 (flags_t F)
 Is the second operand an offset within a struct?
 
bool idaapi is_stkvar0 (flags_t F)
 Is the first operand a stack variable?
 
bool idaapi is_stkvar1 (flags_t F)
 Is the second operand a stack variable?
 
bool idaapi is_float0 (flags_t F)
 Is the first operand a floating point number?
 
bool idaapi is_float1 (flags_t F)
 Is the second operand a floating point number?
 
bool idaapi is_custfmt0 (flags_t F)
 Does the first operand use a custom data representation?
 
bool idaapi is_custfmt1 (flags_t F)
 Does the second operand use a custom data representation?
 
idaman bool ida_export is_numop0 (flags_t F)
 Is the first operand a number (i.e. binary, octal, decimal or hex?)
 
idaman bool ida_export is_numop1 (flags_t F)
 Is the second operand a number (i.e. binary, octal, decimal or hex?)
 
flags_t get_optype_flags0 (flags_t F)
 Get flags for first operand.
 
flags_t get_optype_flags1 (flags_t F)
 Get flags for second operand.
 
idaman bool ida_export is_defarg (flags_t F, int n)
 is defined?
 
idaman bool ida_export is_off (flags_t F, int n)
 is offset?
 
idaman bool ida_export is_char (flags_t F, int n)
 is character constant?
 
idaman bool ida_export is_seg (flags_t F, int n)
 is segment?
 
idaman bool ida_export is_enum (flags_t F, int n)
 is enum?
 
idaman bool ida_export is_manual (flags_t F, int n)
 is forced operand? (use is_forced_operand())
 
idaman bool ida_export is_stroff (flags_t F, int n)
 is struct offset?
 
idaman bool ida_export is_stkvar (flags_t F, int n)
 is stack variable?
 
idaman bool ida_export is_fltnum (flags_t F, int n)
 is floating point number?
 
idaman bool ida_export is_custfmt (flags_t F, int n)
 is custom data format?
 
idaman bool ida_export is_numop (flags_t F, int n)
 is number (bin, oct, dec, hex)?
 
idaman bool ida_export is_suspop (ea_t ea, flags_t F, int n)
 is suspicious operand?
 
idaman bool ida_export op_adds_xrefs (flags_t F, int n)
 Should processor module create xrefs from the operand?. More...
 
idaman bool ida_export set_op_type (ea_t ea, flags_t type, int n)
 (internal function) change representation of operand(s). More...
 
idaman bool ida_export op_seg (ea_t ea, int n)
 Set operand representation to be 'segment'. More...
 
idaman bool ida_export op_enum (ea_t ea, int n, enum_t id, uchar serial)
 Set operand representation to be 'enum_t'. More...
 
idaman enum_t ida_export get_enum_id (uchar *serial, ea_t ea, int n)
 Get enum id of 'enum' operand. More...
 
idaman bool ida_export op_stroff (const insn_t &insn, int n, const tid_t *path, int path_len, adiff_t delta)
 Set operand representation to be 'struct offset'. More...
 
idaman int ida_export get_stroff_path (tid_t *path, adiff_t *delta, ea_t ea, int n)
 Get struct path of operand. More...
 
idaman bool ida_export op_stkvar (ea_t ea, int n)
 Set operand representation to be 'stack variable'. More...
 
idaman bool ida_export set_forced_operand (ea_t ea, int n, const char *op)
 Set forced operand. More...
 
idaman ssize_t ida_export get_forced_operand (qstring *buf, ea_t ea, int n)
 Get forced operand. More...
 
idaman bool ida_export is_forced_operand (ea_t ea, int n)
 Is operand manually defined?. More...
 
flags_t idaapi char_flag (void)
 see Bits: instruction operand types
 
flags_t idaapi off_flag (void)
 see Bits: instruction operand types
 
flags_t idaapi enum_flag (void)
 see Bits: instruction operand types
 
flags_t idaapi stroff_flag (void)
 see Bits: instruction operand types
 
flags_t idaapi stkvar_flag (void)
 see Bits: instruction operand types
 
flags_t idaapi flt_flag (void)
 see Bits: instruction operand types
 
flags_t idaapi custfmt_flag (void)
 see Bits: instruction operand types
 
flags_t idaapi seg_flag (void)
 see Bits: instruction operand types
 
idaman flags_t ida_export num_flag (void)
 Get number of default base (bin, oct, dec, hex)
 
flags_t idaapi hex_flag (void)
 Get number flag of the base, regardless of current processor - better to use num_flag()
 
flags_t idaapi dec_flag (void)
 Get number flag of the base, regardless of current processor - better to use num_flag() More...
 
flags_t idaapi oct_flag (void)
 Get number flag of the base, regardless of current processor - better to use num_flag() More...
 
flags_t idaapi bin_flag (void)
 Get number flag of the base, regardless of current processor - better to use num_flag() More...
 
bool idaapi op_chr (ea_t ea, int n)
 set op type to char_flag()
 
bool idaapi op_num (ea_t ea, int n)
 set op type to num_flag()
 
bool idaapi op_hex (ea_t ea, int n)
 set op type to hex_flag()
 
bool idaapi op_dec (ea_t ea, int n)
 set op type to dec_flag()
 
bool idaapi op_oct (ea_t ea, int n)
 set op type to oct_flag()
 
bool idaapi op_bin (ea_t ea, int n)
 set op type to bin_flag()
 
bool idaapi op_flt (ea_t ea, int n)
 set op type to flt_flag()
 
idaman bool ida_export op_custfmt (ea_t ea, int n, int fid)
 Set custom data format for operand (fid-custom data format id)
 
idaman bool ida_export clr_op_type (ea_t ea, int n)
 Remove operand representation information. More...
 
idaman int ida_export get_default_radix (void)
 Get default base of number for the current processor. More...
 
idaman int ida_export get_radix (flags_t F, int n)
 Get radix of the operand, in: flags. More...
 
flags_t idaapi code_flag (void)
 FF_CODE
 
flags_t idaapi byte_flag (void)
 Get a flags_t representing a byte.
 
flags_t idaapi word_flag (void)
 Get a flags_t representing a word.
 
flags_t idaapi dword_flag (void)
 Get a flags_t representing a double word.
 
flags_t idaapi qword_flag (void)
 Get a flags_t representing a quad word.
 
flags_t idaapi oword_flag (void)
 Get a flags_t representing a octaword.
 
flags_t idaapi yword_flag (void)
 Get a flags_t representing a ymm word.
 
flags_t idaapi zword_flag (void)
 Get a flags_t representing a zmm word.
 
flags_t idaapi tbyte_flag (void)
 Get a flags_t representing a tbyte.
 
flags_t idaapi strlit_flag (void)
 Get a flags_t representing a string literal.
 
flags_t idaapi stru_flag (void)
 Get a flags_t representing a struct.
 
flags_t idaapi cust_flag (void)
 Get a flags_t representing custom type data.
 
flags_t idaapi align_flag (void)
 Get a flags_t representing an alignment directive.
 
flags_t idaapi float_flag (void)
 Get a flags_t representing a float.
 
flags_t idaapi double_flag (void)
 Get a flags_t representing a double.
 
flags_t idaapi packreal_flag (void)
 Get a flags_t representing a packed decimal real.
 
bool idaapi is_byte (flags_t F)
 FF_BYTE
 
bool idaapi is_word (flags_t F)
 FF_WORD
 
bool idaapi is_dword (flags_t F)
 FF_DWORD
 
bool idaapi is_qword (flags_t F)
 FF_QWORD
 
bool idaapi is_oword (flags_t F)
 FF_OWORD
 
bool idaapi is_yword (flags_t F)
 FF_YWORD
 
bool idaapi is_zword (flags_t F)
 FF_ZWORD
 
bool idaapi is_tbyte (flags_t F)
 FF_TBYTE
 
bool idaapi is_float (flags_t F)
 FF_FLOAT
 
bool idaapi is_double (flags_t F)
 FF_DOUBLE
 
bool idaapi is_pack_real (flags_t F)
 FF_PACKREAL
 
bool idaapi is_strlit (flags_t F)
 FF_STRLIT
 
bool idaapi is_struct (flags_t F)
 FF_STRUCT
 
bool idaapi is_align (flags_t F)
 FF_ALIGN
 
bool idaapi is_custom (flags_t F)
 FF_CUSTOM
 
bool idaapi f_is_byte (flags_t F, void *)
 See is_byte()
 
bool idaapi f_is_word (flags_t F, void *)
 See is_word()
 
bool idaapi f_is_dword (flags_t F, void *)
 See is_dword()
 
bool idaapi f_is_qword (flags_t F, void *)
 See is_qword()
 
bool idaapi f_is_oword (flags_t F, void *)
 See is_oword()
 
bool idaapi f_is_yword (flags_t F, void *)
 See is_yword()
 
bool idaapi f_is_tbyte (flags_t F, void *)
 See is_tbyte()
 
bool idaapi f_is_float (flags_t F, void *)
 See is_float()
 
bool idaapi f_is_double (flags_t F, void *)
 See is_double()
 
bool idaapi f_is_pack_real (flags_t F, void *)
 See is_pack_real()
 
bool idaapi f_is_strlit (flags_t F, void *)
 See is_strlit()
 
bool idaapi f_is_struct (flags_t F, void *)
 See is_struct()
 
bool idaapi f_is_align (flags_t F, void *)
 See is_align()
 
bool idaapi f_is_custom (flags_t F, void *)
 See is_custom()
 
bool idaapi is_same_data_type (flags_t F1, flags_t F2)
 Do the given flags specify the same data type?
 
idaman flags_t ida_export get_flags_by_size (size_t size)
 Get flags from size (in bytes). More...
 
idaman bool ida_export create_data (ea_t ea, flags_t dataflag, asize_t size, tid_t tid)
 Convert to data (byte, word, dword, etc). More...
 
bool idaapi create_byte (ea_t ea, asize_t length)
 Convert to byte.
 
bool idaapi create_word (ea_t ea, asize_t length)
 Convert to word.
 
bool idaapi create_dword (ea_t ea, asize_t length)
 Convert to dword.
 
bool idaapi create_qword (ea_t ea, asize_t length)
 Convert to quadword.
 
bool idaapi create_oword (ea_t ea, asize_t length)
 Convert to octaword/xmm word.
 
bool idaapi create_yword (ea_t ea, asize_t length)
 Convert to ymm word.
 
bool idaapi create_zword (ea_t ea, asize_t length)
 Convert to zmm word.
 
bool idaapi create_tbyte (ea_t ea, asize_t length)
 Convert to tbyte.
 
bool idaapi create_float (ea_t ea, asize_t length)
 Convert to float.
 
bool idaapi create_double (ea_t ea, asize_t length)
 Convert to double.
 
bool idaapi create_packed_real (ea_t ea, asize_t length)
 Convert to packed decimal real.
 
bool idaapi create_struct (ea_t ea, asize_t length, tid_t tid)
 Convert to struct.
 
bool idaapi create_custdata (ea_t ea, asize_t length, int dtid, int fid)
 Convert to custom data type.
 
idaman bool ida_export create_align (ea_t ea, asize_t length, int alignment)
 Alignment: 0 or 2..32. If it is 0, is will be calculated.
 
idaman int ida_export calc_min_align (asize_t length)
 Returns: 1..32.
 
idaman int ida_export calc_max_align (ea_t endea)
 Returns: 0..32.
 
idaman int ida_export calc_def_align (ea_t ea, int mina, int maxa)
 Calculate default alignment.
 
idaman bool ida_export create_16bit_data (ea_t ea, asize_t length)
 Convert to 16-bit quantity (take byte size into account)
 
idaman bool ida_export create_32bit_data (ea_t ea, asize_t length)
 Convert to 32-bit quantity (take byte size into account)
 
idaman size_t ida_export get_max_strlit_length (ea_t ea, int32 strtype, int options=0)
 Determine maximum length of string literal. More...
 
idaman ssize_t ida_export get_strlit_contents (qstring *utf8, ea_t ea, size_t len, int32 type, size_t *maxcps=NULL, int flags=0)
 Get contents of string literal, as UTF-8-encoded codepoints. More...
 
idaman bool ida_export create_strlit (ea_t start, size_t len, int32 strtype)
 Convert to string literal and give a meaningful name. More...
 
idaman bool ida_export print_strlit_type (qstring *out, int32 strtype, qstring *out_tooltip=NULL, int flags=0)
 Get string type information: the string type name (possibly decorated with hotkey markers), and the tooltip. More...
 
idaman opinfo_t *ida_export get_opinfo (opinfo_t *buf, ea_t ea, int n, flags_t flags)
 Get additional information about an operand representation. More...
 
idaman bool ida_export set_opinfo (ea_t ea, int n, flags_t flag, const opinfo_t *ti, bool suppress_events=false)
 Set additional information about an operand representation. More...
 
void del_one_opinfo (ea_t ea, int n, flags_t flag)
 Delete additional information about an operand representation. More...
 
void del_opinfo (ea_t ea, flags_t flag)
 See del_one_opinfo()
 
idaman asize_t ida_export get_data_elsize (ea_t ea, flags_t F, const opinfo_t *ti=NULL)
 Get size of data type specified in flags 'F'. More...
 
asize_t get_full_data_elsize (ea_t ea, flags_t F, const opinfo_t *ti=NULL)
 Get full size of data type specified in flags 'F'. More...
 
idaman int ida_export is_varsize_item (ea_t ea, flags_t F, const opinfo_t *ti=NULL, asize_t *itemsize=NULL)
 Is the item at 'ea' variable size?. More...
 
idaman bool ida_export can_define_item (ea_t ea, asize_t length, flags_t flags)
 Can define item (instruction/data) of the specified 'length', starting at 'ea'? More...
 
bool idaapi has_immd (flags_t F)
 Has immediate value?
 
bool idaapi is_func (flags_t F)
 Is function start?
 
idaman bool ida_export set_immd (ea_t ea)
 Set 'has immediate operand' flag. More...
 
idaman int ida_export register_custom_data_type (const data_type_t *dtinfo)
 Register a new data type. More...
 
idaman bool ida_export unregister_custom_data_type (int dtid)
 Unregister a data type. More...
 
idaman int ida_export register_custom_data_format (const data_format_t *dtform)
 Register a new data format. More...
 
idaman bool ida_export unregister_custom_data_format (int dfid)
 Unregister a data format. More...
 
idaman const data_type_t *ida_export get_custom_data_type (int dtid)
 Get definition of a registered custom data type. More...
 
idaman const data_format_t *ida_export get_custom_data_format (int dfid)
 Get definition of a registered custom data format. More...
 
idaman bool ida_export attach_custom_data_format (int dtid, int dfid)
 Attach the data format to the data type. More...
 
idaman bool ida_export detach_custom_data_format (int dtid, int dfid)
 Detach the data format from the data type. More...
 
idaman bool ida_export is_attached_custom_data_format (int dtid, int dfid)
 
idaman int ida_export get_custom_data_types (intvec_t *out, asize_t min_size=0, asize_t max_size=BADADDR)
 Get list of registered custom data type ids. More...
 
idaman int ida_export get_custom_data_formats (intvec_t *out, int dtid)
 Get list of attached custom data formats for the specified data type. More...
 
idaman int ida_export find_custom_data_type (const char *name)
 Get id of a custom data type. More...
 
idaman int ida_export find_custom_data_format (const char *name)
 Get id of a custom data format. More...
 
idaman bool ida_export set_cmt (ea_t ea, const char *comm, bool rptble)
 Set an indented comment. More...
 
idaman ssize_t ida_export get_cmt (qstring *buf, ea_t ea, bool rptble)
 Get an indented comment. More...
 
ssize_t get_repeatable_cmt (qstring *buf, ea_t ea)
 Get a repeatable comment of any type (indented or function comment). More...
 
ssize_t get_any_indented_cmt (qstring *buf, ea_t ea, color_t *cmttype)
 Get any indented comment (regular or repeatable indented or function). More...
 
idaman bool ida_export append_cmt (ea_t ea, const char *str, bool rptble)
 Append to an indented comment. More...
 
idaman ssize_t ida_export get_predef_insn_cmt (qstring *buf, const insn_t &ins)
 Get predefined comment. More...
 
idaman ea_t ida_export find_byte (ea_t sEA, asize_t size, uchar value, int bin_search_flags)
 Find forward a byte with the specified value (only 8-bit value from the database). More...
 
idaman ea_t ida_export find_byter (ea_t sEA, asize_t size, uchar value, int bin_search_flags)
 Find reverse a byte with the specified value (only 8-bit value from the database). More...
 
idaman bool ida_export parse_binpat_str (compiled_binpat_vec_t *out, ea_t ea, const char *in, int radix, int strlits_encoding=PBSENC_DEF1BPU, qstring *errbuf=NULL)
 Convert user-specified binary string to internal representation. More...
 
idaman ea_t ida_export bin_search2 (ea_t start_ea, ea_t end_ea, const compiled_binpat_vec_t &data, int flags)
 Search for a string in the program. More...
 
ea_t bin_search2 (ea_t start_ea, ea_t end_ea, const uchar *image, const uchar *mask, size_t len, int flags)
 
ea_t idaapi next_inited (ea_t ea, ea_t maxea)
 Find the next initialized address.
 
ea_t idaapi prev_inited (ea_t ea, ea_t minea)
 Find the previous initialized address.
 
idaman bool ida_export equal_bytes (ea_t ea, const uchar *image, const uchar *mask, size_t len, bool sense_case)
 Compare 'len' bytes of the program starting from 'ea' with 'image'. More...
 
idaman bool ida_export update_hidden_range (const hidden_range_t *ha)
 Update hidden range information in the database. More...
 
idaman bool ida_export add_hidden_range (ea_t ea1, ea_t ea2, const char *description, const char *header, const char *footer, bgcolor_t color)
 Mark a range of addresses as hidden. More...
 
idaman hidden_range_t *ida_export get_hidden_range (ea_t ea)
 Get pointer to hidden range structure, in: linear address. More...
 
idaman hidden_range_t *ida_export getn_hidden_range (int n)
 Get pointer to hidden range structure, in: number of hidden range. More...
 
idaman int ida_export get_hidden_range_qty (void)
 Get number of hidden ranges.
 
idaman int ida_export get_hidden_range_num (ea_t ea)
 Get number of a hidden range. More...
 
idaman hidden_range_t *ida_export get_prev_hidden_range (ea_t ea)
 Get pointer to previous hidden range. More...
 
idaman hidden_range_t *ida_export get_next_hidden_range (ea_t ea)
 Get pointer to next hidden range. More...
 
idaman hidden_range_t *ida_export get_first_hidden_range (void)
 Get pointer to the first hidden range. More...
 
idaman hidden_range_t *ida_export get_last_hidden_range (void)
 Get pointer to the last hidden range. More...
 
idaman bool ida_export del_hidden_range (ea_t ea)
 Delete hidden range. More...
 
idaman bool ida_export add_mapping (ea_t from, ea_t to, asize_t size)
 IDA supports memory mapping. More...
 
idaman void ida_export del_mapping (ea_t ea)
 Delete memory mapping range. More...
 
idaman ea_t ida_export use_mapping (ea_t ea)
 Translate address according to current mappings. More...
 
idaman size_t ida_export get_mappings_qty (void)
 Get number of mappings.
 
idaman bool ida_export get_mapping (ea_t *from, ea_t *to, asize_t *size, size_t n)
 Get memory mapping range by its number. More...
 
ssize_t get_hex_string (char *buf, size_t bufsize, const uchar *bytes, size_t len)
 

Macros

#define ITEM_END_FIXUP   0x0001
 stop at the first fixup
 
#define ITEM_END_INITED   0x0002
 stop when initialization changes More...
 
#define ITEM_END_NAME   0x0004
 stop at the first named location
 
#define ITEM_END_XREF   0x0008
 stop at the first referenced location
 
#define GFE_VALUE   0x0001
 get flags with FF_IVL & MS_VAL. More...
 
#define MS_VAL   0x000000FFLU
 Mask for byte value.
 
#define FF_IVL   0x00000100LU
 Byte has value ?
 
#define GMB_READALL   0x01
 try to read all bytes More...
 
#define GMB_WAITBOX   0x02
 show wait box (may return -1 in this case)
 
#define MS_CLS   0x00000600LU
 Mask for typing.
 
#define FF_CODE   0x00000600LU
 Code ?
 
#define FF_DATA   0x00000400LU
 Data ?
 
#define FF_TAIL   0x00000200LU
 Tail ?
 
#define FF_UNK   0x00000000LU
 Unknown ?
 
#define DELIT_SIMPLE   0x0000
 simply undefine the specified item(s)
 
#define DELIT_EXPAND   0x0001
 propagate undefined items; for example More...
 
#define DELIT_DELNAMES   0x0002
 delete any names at the specified More...
 
#define DELIT_NOTRUNC   0x0004
 don't truncate the current function More...
 
#define DELIT_NOUNAME   0x0008
 reject to delete if a user name is More...
 
#define DELIT_NOCMT   0x0010
 reject to delete if a comment is More...
 
#define MS_COMM   0x000FF800
 Mask of common bits.
 
#define FF_COMM   0x00000800
 Has comment ?
 
#define FF_REF   0x00001000
 has references
 
#define FF_LINE   0x00002000
 Has next or prev lines ?
 
#define FF_NAME   0x00004000
 Has name ?
 
#define FF_LABL   0x00008000
 Has dummy name?
 
#define FF_FLOW   0x00010000
 Exec flow from prev instruction.
 
#define FF_SIGN   0x00020000
 Inverted sign of operands.
 
#define FF_BNOT   0x00040000
 Bitwise negation of operands.
 
#define FF_UNUSED   0x00080000
 unused bit (was used for variable bytes)
 
#define FF_ANYNAME   (FF_LABL|FF_NAME)
 
#define MS_0TYPE   0x00F00000LU
 Mask for 1st arg typing.
 
#define FF_0VOID   0x00000000LU
 Void (unknown)?
 
#define FF_0NUMH   0x00100000LU
 Hexadecimal number?
 
#define FF_0NUMD   0x00200000LU
 Decimal number?
 
#define FF_0CHAR   0x00300000LU
 Char ('x')?
 
#define FF_0SEG   0x00400000LU
 Segment?
 
#define FF_0OFF   0x00500000LU
 Offset?
 
#define FF_0NUMB   0x00600000LU
 Binary number?
 
#define FF_0NUMO   0x00700000LU
 Octal number?
 
#define FF_0ENUM   0x00800000LU
 Enumeration?
 
#define FF_0FOP   0x00900000LU
 Forced operand?
 
#define FF_0STRO   0x00A00000LU
 Struct offset?
 
#define FF_0STK   0x00B00000LU
 Stack variable?
 
#define FF_0FLT   0x00C00000LU
 Floating point number?
 
#define FF_0CUST   0x00D00000LU
 Custom representation?
 
#define MS_1TYPE   0x0F000000LU
 Mask for the type of other operands.
 
#define FF_1VOID   0x00000000LU
 Void (unknown)?
 
#define FF_1NUMH   0x01000000LU
 Hexadecimal number?
 
#define FF_1NUMD   0x02000000LU
 Decimal number?
 
#define FF_1CHAR   0x03000000LU
 Char ('x')?
 
#define FF_1SEG   0x04000000LU
 Segment?
 
#define FF_1OFF   0x05000000LU
 Offset?
 
#define FF_1NUMB   0x06000000LU
 Binary number?
 
#define FF_1NUMO   0x07000000LU
 Octal number?
 
#define FF_1ENUM   0x08000000LU
 Enumeration?
 
#define FF_1FOP   0x09000000LU
 Forced operand?
 
#define FF_1STRO   0x0A000000LU
 Struct offset?
 
#define FF_1STK   0x0B000000LU
 Stack variable?
 
#define FF_1FLT   0x0C000000LU
 Floating point number?
 
#define FF_1CUST   0x0D000000LU
 Custom representation?
 
#define OPND_OUTER   0x80
 outer offset base (combined with operand number). More...
 
#define OPND_MASK   0x0F
 mask for operand number
 
#define OPND_ALL   OPND_MASK
 all operands
 
#define DT_TYPE   0xF0000000
 Mask for DATA typing.
 
#define FF_BYTE   0x00000000
 byte
 
#define FF_WORD   0x10000000
 word
 
#define FF_DWORD   0x20000000
 double word
 
#define FF_QWORD   0x30000000
 quadro word
 
#define FF_TBYTE   0x40000000
 tbyte
 
#define FF_STRLIT   0x50000000
 string literal
 
#define FF_STRUCT   0x60000000
 struct variable
 
#define FF_OWORD   0x70000000
 octaword/xmm word (16 bytes/128 bits)
 
#define FF_FLOAT   0x80000000
 float
 
#define FF_DOUBLE   0x90000000
 double
 
#define FF_PACKREAL   0xA0000000
 packed decimal real
 
#define FF_ALIGN   0xB0000000
 alignment directive
 
#define FF_CUSTOM   0xD0000000
 custom data type
 
#define FF_YWORD   0xE0000000
 ymm word (32 bytes/256 bits)
 
#define FF_ZWORD   0xF0000000
 zmm word (64 bytes/512 bits)
 
#define ALOPT_IGNHEADS   0x01
 don't stop if another data item is encountered. More...
 
#define ALOPT_IGNPRINT   0x02
 if set, don't stop at non-printable codepoints, More...
 
#define ALOPT_IGNCLT   0x04
 if set, don't stop at codepoints that are not More...
 
#define ALOPT_MAX4K   0x08
 if string length is more than 4K, return the More...
 
#define STRCONV_ESCAPE   0x00000001
 convert non-printable characters to C escapes (
, , )
 
#define STRCONV_REPLCHAR   0x00000002
 convert non-printable characters to the Unicode replacement character (U+FFFD)
 
#define STRCONV_INCLLEN   0x00000004
 for Pascal-style strings, include the prefixing length byte(s) as C-escaped sequence
 
#define PSTF_TNORM   0
 use normal name
 
#define PSTF_TBRIEF   1
 use brief name (e.g., in the 'Strings window')
 
#define PSTF_TINLIN   2
 use 'inline' name (e.g., in the structures comments)
 
#define PSTF_TMASK   3
 type mask
 
#define PSTF_HOTKEY   0x4
 have hotkey markers part of the name
 
#define PSTF_ENC   0x8
 if encoding is specified, append it
 
#define MS_CODE   0xF0000000LU
 Mask for code bits.
 
#define FF_FUNC   0x10000000LU
 function start?
 
#define FF_IMMD   0x40000000LU
 Has Immediate value ?
 
#define FF_JUMP   0x80000000LU
 Has jump table or switch_info?
 
#define DTP_NODUP   0x0001
 do not use dup construct
 
#define PBSENC_DEF1BPU   0
 
#define PBSENC_ALL   -1
 
#define BIN_SEARCH_CASE   0x01
 case sensitive
 
#define BIN_SEARCH_NOCASE   0x00
 case insensitive
 
#define BIN_SEARCH_NOBREAK   0x02
 don't check for Ctrl-Break
 
#define BIN_SEARCH_INITED   0x04
 find_byte, find_byter: any initilized value
 
#define BIN_SEARCH_NOSHOW   0x08
 don't show search progress or update screen
 
#define BIN_SEARCH_FORWARD   0x00
 search forward for bytes
 
#define BIN_SEARCH_BACKWARD   0x10
 search backward for bytes
 
#define SKIP_FF_MASK   ((const uchar *)0xFF)
 Used by equal_bytes() to skip 0xFF when searching the program.
 

Typedefs

typedef tid_t enum_t
 
typedef bool idaapi testf_t(flags_t flags, void *ud)
 Flag tester - see next_that(), prev_that()
 
typedef bool idaapi may_destroy_cb_t(ea_t)
 del_items' callback function
 
typedef qvector< compiled_binpat_tcompiled_binpat_vec_t
 

Variables

bool del_code_comments
 Delete an indented comment attached to an instruction when the instruction is deleted.
 

Macro Definition Documentation

#define GFE_VALUE   0x0001

get flags with FF_IVL & MS_VAL.

It is much slower under remote debugging because the kernel needs to read the process memory.

Function Documentation

idaman error_t ida_export enable_flags ( ea_t  start_ea,
ea_t  end_ea,
storage_type_t  stt 
)

Allocate flags for address range.

This function does not change the storage type of existing ranges. Exit with an error message if not enough disk space.

Parameters
start_eashould be lower than end_ea.
end_eadoes not belong to the range.
sttstorage_type_t
Returns
0 if ok, otherwise an error code
idaman error_t ida_export disable_flags ( ea_t  start_ea,
ea_t  end_ea 
)

Deallocate flags for address range.

Exit with an error message if not enough disk space (this may occur too).

Parameters
start_eashould be lower than end_ea.
end_eadoes not belong to the range.
Returns
0 if ok, otherwise return error code
idaman error_t ida_export change_storage_type ( ea_t  start_ea,
ea_t  end_ea,
storage_type_t  stt 
)

Change flag storage type for address range.

Parameters
start_eashould be lower than end_ea.
end_eadoes not belong to the range.
sttstorage_type_t
Returns
error code
idaman ea_t ida_export next_addr ( ea_t  ea)

Get next address in the program (i.e.

next address which has flags).

Returns
BADADDR if no such address exist.
idaman ea_t ida_export prev_addr ( ea_t  ea)

Get previous address in the program.

Returns
BADADDR if no such address exist.
idaman ea_t ida_export next_chunk ( ea_t  ea)

Get the first address of next contiguous chunk in the program.

Returns
BADADDR if next chunk doesn't exist.
idaman ea_t ida_export prev_chunk ( ea_t  ea)

Get the last address of previous contiguous chunk in the program.

Returns
BADADDR if previous chunk doesn't exist.
idaman ea_t ida_export chunk_start ( ea_t  ea)

Get start of the contiguous address block containing 'ea'.

Returns
BADADDR if 'ea' doesn't belong to the program.
idaman asize_t ida_export chunk_size ( ea_t  ea)

Get size of the contiguous address block containing 'ea'.

Returns
0 if 'ea' doesn't belong to the program.
idaman ea_t ida_export free_chunk ( ea_t  bottom,
asize_t  size,
int32  step 
)

Search for a hole in the addressing space of the program.

Parameters
bottomaddress to start searching
sizesize of desired block
stepbit mask for the start of hole (0xF would align hole to a paragraph). if 'step' is negative, the bottom address with be aligned. otherwise the kernel will try to use it as is and align it only when the hole is too small.
Returns
start of the hole or BADADDR
idaman ea_t ida_export next_that ( ea_t  ea,
ea_t  maxea,
testf_t testf,
void *  ud = NULL 
)

Find next address with a flag satisfying the function 'testf'.

Note
do not pass is_unknown() to this function to find unexplored bytes. It will fail under the debugger. To find unexplored bytes, use next_unknown().
Parameters
eastart searching at this address + 1
maxeanot included in the search range.
testftest function to find next address
uduser data - may point to anything. it will be passed to testf.
Returns
the found address or BADADDR.
idaman ea_t ida_export prev_that ( ea_t  ea,
ea_t  minea,
testf_t testf,
void *  ud = NULL 
)

Find previous address with a flag satisfying the function 'testf'.

Note
do not pass is_unknown() to this function to find unexplored bytes It will fail under the debugger. To find unexplored bytes, use prev_unknown().
Parameters
eastart searching from this address - 1.
mineaincluded in the search range.
testftest function to find previous address
uduser data - may point to anything. it will be passed to testf.
Returns
the found address or BADADDR.
idaman ea_t ida_export prev_head ( ea_t  ea,
ea_t  minea 
)

Get start of previous defined item.

Parameters
eabegin search at this address
mineaincluded in the search range
Returns
BADADDR if none exists.
idaman ea_t ida_export next_head ( ea_t  ea,
ea_t  maxea 
)

Get start of next defined item.

Parameters
eabegin search at this address
maxeanot included in the search range
Returns
BADADDR if none exists.
idaman ea_t ida_export prev_not_tail ( ea_t  ea)

Get address of previous non-tail byte.

Returns
BADADDR if none exists.
idaman ea_t ida_export next_not_tail ( ea_t  ea)

Get address of next non-tail byte.

Returns
BADADDR if none exists.
ea_t adjust_visea ( ea_t  ea)

Adjust the address and get the nearest visible address.

(i.e. an address which will appear in the disassembly)

Returns
BADADDR only if no addresses are valid
idaman ea_t ida_export prev_visea ( ea_t  ea)

Get previous visible address.

Returns
BADADDR if none exists.
idaman ea_t ida_export next_visea ( ea_t  ea)

Get next visible address.

Returns
BADADDR if none exists.
ea_t idaapi get_item_head ( ea_t  ea)
inline

Get the start address of the item at 'ea'.

If there is no current item, then 'ea' will be returned (see definition at the end of bytes.hpp source)

idaman ea_t ida_export get_item_end ( ea_t  ea)

Get the end address of the item at 'ea'.

The returned address doesn't belong to the current item. Unexplored bytes are counted as 1 byte entities.

idaman ea_t ida_export calc_max_item_end ( ea_t  ea,
int  how = 15 
)

Calculate maximal reasonable end address of a new item.

This function will limit the item with the current segment bounds.

Parameters
ealinear address
howwhen to stop the search. A combination of Item end search flags
Returns
end of new item. If it is not possible to create an item, it will return 'ea'.
asize_t get_item_size ( ea_t  ea)
inline

Get size of item (instruction/data) in bytes.

Unexplored bytes have length of 1 byte. This function never returns 0.

flags_t idaapi get_flags ( ea_t  ea)
inline

get flags with FF_IVL & MS_VAL.

It is much slower under remote debugging because the kernel needs to read the process memory.

flags_t idaapi get_full_flags ( ea_t  ea)
inline

Get flags value for address 'ea'.

Returns
0 if address is not present in the program
idaman flags_t ida_export get_item_flag ( ea_t  from,
int  n,
ea_t  ea,
bool  appzero 
)

Get flag of the item at 'ea' even if it is a tail byte of some array or structure.

This function is used to get flags of structure members or array elements.

Parameters
fromlinear address of the instruction which refers to 'ea'
nnumber of operand which refers to 'ea'
eathe referenced address
appzeroappend a struct field name if the field offset is zero? meaningful only if the name refers to a structure.
Returns
flags or 0 (if failed)
idaman void ida_export del_value ( ea_t  ea)

Delete byte value from flags.

The corresponding byte becomes uninitialized.

idaman int ida_export nbits ( ea_t  ea)

Get number of bits in a byte at the given address.

Returns
processor_t::dnbits() if the address doesn't belong to a segment, otherwise the result depends on the segment type
idaman uchar ida_export get_byte ( ea_t  ea)

Get one byte (8-bit) of the program at 'ea'.

This function works only for 8bit byte processors.

idaman uchar ida_export get_db_byte ( ea_t  ea)

Get one byte (8-bit) of the program at 'ea' from the database.

Works even if the debugger is active. See also get_dbg_byte() to read the process memory directly. This function works only for 8bit byte processors.

idaman ushort ida_export get_word ( ea_t  ea)

Get one word (16-bit) of the program at 'ea'.

This function takes into account order of bytes specified in idainfo::is_be() This function works only for 8bit byte processors.

idaman uint32 ida_export get_dword ( ea_t  ea)

Get one dword (32-bit) of the program at 'ea'.

This function takes into account order of bytes specified in idainfo::is_be() This function works only for 8bit byte processors.

idaman uint64 ida_export get_qword ( ea_t  ea)

Get one qword (64-bit) of the program at 'ea'.

This function takes into account order of bytes specified in idainfo::is_be() This function works only for 8bit byte processors.

idaman uint64 ida_export get_wide_byte ( ea_t  ea)

Get one wide byte of the program at 'ea'.

Some processors may access more than 8bit quantity at an address. These processors have 32-bit byte organization from the IDA's point of view.

idaman uint64 ida_export get_wide_word ( ea_t  ea)

Get one wide word (2 'byte') of the program at 'ea'.

Some processors may access more than 8bit quantity at an address. These processors have 32-bit byte organization from the IDA's point of view. This function takes into account order of bytes specified in idainfo::is_be()

idaman uint64 ida_export get_wide_dword ( ea_t  ea)

Get two wide words (4 'bytes') of the program at 'ea'.

Some processors may access more than 8bit quantity at an address. These processors have 32-bit byte organization from the IDA's point of view. This function takes into account order of bytes specified in idainfo::is_be()

Note
this function works incorrectly if processor_t::nbits > 16
idaman uchar ida_export get_octet ( ea_t ea,
uint64 v,
int *  nbit 
)

Get 8 bits of the program at 'ea'.

The main usage of this function is to iterate range of bytes. Here is an example:

1 uint64 v;
2 int nbit = 0;
3 for ( ... ) {
4  uchar byte = get_octet(&ea, &v, &nbit);
5  ...
6 }

'ea' is incremented each time when a new byte is read. In the above example, it will be incremented in the first loop iteration.

idaman uint32 ida_export get_16bit ( ea_t  ea)

Get 16bits of the program at 'ea'.

Returns
1 byte (getFullByte()) if the current processor has 16-bit byte, otherwise return get_word()
idaman uint32 ida_export get_32bit ( ea_t  ea)

Get not more than 32bits of the program at 'ea'.

Returns
32 bit value, depending on processor_t::nbits:
  • if ( nbits <= 8 ) return get_dword(ea);
  • if ( nbits <= 16) return get_wide_word(ea);
  • return get_wide_byte(ea);
idaman uint64 ida_export get_64bit ( ea_t  ea)

Get not more than 64bits of the program at 'ea'.

Returns
64 bit value, depending on processor_t::nbits:
  • if ( nbits <= 8 ) return get_qword(ea);
  • if ( nbits <= 16) return get_wide_dword(ea);
  • return get_wide_byte(ea);
idaman bool ida_export get_data_value ( uval_t v,
ea_t  ea,
asize_t  size 
)

Get the value at of the item at 'ea'.

This function works with entities up to sizeof(ea_t) (bytes, word, etc)

Parameters
vpointer to the result. may be NULL
ealinear address
sizesize of data to read. If 0, then the item type at 'ea' will be used
Returns
success
idaman int ida_export visit_patched_bytes ( ea_t  ea1,
ea_t  ea2,
int(idaapi *)(ea_t ea, qoff64_t fpos, uint64 o, uint64 v, void *ud)  cb,
void *  ud = NULL 
)

Visit all the patched bytes one byte at a time.

Parameters
ea1start linear address
ea2end linear address
cbcallback called for each found byte. if the callback returns non-zero then that value will be returned to the caller and the enumeration will be interrupted.
uduser data passed to the callback
Returns
the return value returned by the callback (if any) or zero if the enumeration was completed.
idaman uint64 ida_export get_original_byte ( ea_t  ea)

Get original byte value (that was before patching).

This function works for wide byte processors too.

idaman uint64 ida_export get_original_word ( ea_t  ea)

Get original word value (that was before patching).

This function works for wide byte processors too. This function takes into account order of bytes specified in idainfo::is_be()

idaman uint64 ida_export get_original_dword ( ea_t  ea)

Get original dword (that was before patching) This function works for wide byte processors too.

This function takes into account order of bytes specified in idainfo::is_be()

idaman uint64 ida_export get_original_qword ( ea_t  ea)

Get original qword value (that was before patching) This function DOESN'T work for wide byte processors too.

This function takes into account order of bytes specified in idainfo::is_be()

idaman bool ida_export put_byte ( ea_t  ea,
uint64  x 
)

Set value of one byte of the program.

This function modifies the database. If the debugger is active then the debugged process memory is patched too.

Note
The original value of the byte is completely lost and can't be recovered by the get_original_byte() function. See also put_dbg_byte() to write to the process memory directly when the debugger is active. This function can handle wide byte processors.
Parameters
ealinear address
xbyte value
Returns
true if the database has been modified
idaman void ida_export put_word ( ea_t  ea,
uint64  x 
)

Set value of one word of the program.

This function takes into account order of bytes specified in idainfo::is_be() This function works for wide byte processors too.

Note
The original value of the word is completely lost and can't be recovered by the get_original_word() function. ea - linear address x - word value
idaman void ida_export put_dword ( ea_t  ea,
uint64  x 
)

Set value of one dword of the program.

This function takes into account order of bytes specified in idainfo::is_be() This function works for wide byte processors too.

Parameters
ealinear address
xdword value
Note
the original value of the dword is completely lost and can't be recovered by the get_original_dword() function.
idaman void ida_export put_qword ( ea_t  ea,
uint64  x 
)

Set value of one qword (8 bytes) of the program.

This function takes into account order of bytes specified in idainfo::is_be() This function DOESN'T works for wide byte processors.

Parameters
ealinear address
xqword value
idaman bool ida_export patch_byte ( ea_t  ea,
uint64  x 
)

Patch a byte of the program.

The original value of the byte is saved and can be obtained by get_original_byte(). This function works for wide byte processors too.

Return values
truethe database has been modified,
falsethe debugger is running and the process' memory has value 'x' at address 'ea', or the debugger is not running, and the IDB has value 'x' at address 'ea already.
idaman bool ida_export patch_word ( ea_t  ea,
uint64  x 
)

Patch a word of the program.

The original value of the word is saved and can be obtained by get_original_word(). This function works for wide byte processors too. This function takes into account order of bytes specified in idainfo::is_be()

Return values
truethe database has been modified,
falsethe debugger is running and the process' memory has value 'x' at address 'ea', or the debugger is not running, and the IDB has value 'x' at address 'ea already.
idaman bool ida_export patch_dword ( ea_t  ea,
uint64  x 
)

Patch a dword of the program.

The original value of the dword is saved and can be obtained by get_original_dword(). This function DOESN'T work for wide byte processors. This function takes into account order of bytes specified in idainfo::is_be()

Return values
truethe database has been modified,
falsethe debugger is running and the process' memory has value 'x' at address 'ea', or the debugger is not running, and the IDB has value 'x' at address 'ea already.
idaman bool ida_export patch_qword ( ea_t  ea,
uint64  x 
)

Patch a qword of the program.

The original value of the qword is saved and can be obtained by get_original_qword(). This function DOESN'T work for wide byte processors. This function takes into account order of bytes specified in idainfo::is_be()

Return values
truethe database has been modified,
falsethe debugger is running and the process' memory has value 'x' at address 'ea', or the debugger is not running, and the IDB has value 'x' at address 'ea already.
idaman bool ida_export revert_byte ( ea_t  ea)

Revert patched byte.

Return values
truebyte was patched before and reverted now
idaman void ida_export add_byte ( ea_t  ea,
uint32  value 
)

Add a value to one byte of the program.

This function works for wide byte processors too.

Parameters
ealinear address
valuebyte value
idaman void ida_export add_word ( ea_t  ea,
uint64  value 
)

Add a value to one word of the program.

This function works for wide byte processors too. This function takes into account order of bytes specified in idainfo::is_be()

Parameters
ealinear address
valuebyte value
idaman void ida_export add_dword ( ea_t  ea,
uint64  value 
)

Add a value to one dword of the program.

This function works for wide byte processors too. This function takes into account order of bytes specified in idainfo::is_be()

Note
this function works incorrectly if processor_t::nbits > 16
Parameters
ealinear address
valuebyte value
idaman void ida_export add_qword ( ea_t  ea,
uint64  value 
)

Add a value to one qword of the program.

This function does not work for wide byte processors. This function takes into account order of bytes specified in idainfo::is_be()

Parameters
ealinear address
valuebyte value
idaman bool ida_export get_zero_ranges ( rangeset_t *  zranges,
const range_t *  range 
)

Return set of ranges with zero initialized bytes.

The returned set includes only big zero initialized ranges (at least >1KB). Some zero initialized byte ranges may be not included. Only zero bytes that use the sparse storage method (STT_MM) are reported.

Parameters
zrangespointer to the return value. can not be NULL
rangethe range of addresses to verify. can be NULL - means all ranges
Returns
true if the result is a non-empty set
idaman ssize_t ida_export get_bytes ( void *  buf,
ssize_t  size,
ea_t  ea,
int  gmb_flags = 0,
void *  mask = NULL 
)

Get the specified number of bytes of the program into the buffer.

If mask was specified it will contain a bitmap of initialized / uninitialized database bytes.

Parameters
ealinear address
bufbuffer to hold bytes
sizesize of buffer in normal 8-bit bytes (sizeof(buf))
gmb_flagscombination of flags for get_bytes() bits
maskbitmap of initialize/uninitialized bytes (may be NULL; must be at least (size+7)/8)
Returns
if the user cancelled, return -1; otherwise number of read bytes.
idaman void ida_export put_bytes ( ea_t  ea,
const void *  buf,
size_t  size 
)

Modify the specified number of bytes of the program.

This function does not save the original values of bytes. See also patch_bytes().

Parameters
ealinear address
bufbuffer with new values of bytes
sizesize of buffer in normal 8-bit bytes (sizeof(buf))
idaman void ida_export patch_bytes ( ea_t  ea,
const void *  buf,
size_t  size 
)

Patch the specified number of bytes of the program.

Original values of bytes are saved and are available with get_original...() functions. See also put_bytes().

Parameters
ealinear address
bufbuffer with new values of bytes
sizesize of buffer in normal 8-bit bytes (sizeof(buf))
idaman bool ida_export del_items ( ea_t  ea,
int  flags = 0,
asize_t  nbytes = 1,
may_destroy_cb_t may_destroy = NULL 
)

Convert item (instruction/data) to unexplored bytes.

The whole item (including the head and tail bytes) will be destroyed. It is allowed to pass any address in the item to this function

Parameters
eaany address within the first item to delete
flagscombination of Unexplored byte conversion flags
nbytesnumber of bytes in the range to be undefined
may_destroyoptional routine invoked before deleting a head item. If callback returns false then item has not to be deleted and operation fails
Returns
true on sucessful operation, otherwise false
idaman bool ida_export is_manual_insn ( ea_t  ea)

Is the instruction overridden?

Parameters
ealinear address of the instruction or data item
idaman ssize_t ida_export get_manual_insn ( qstring buf,
ea_t  ea 
)

Retrieve the user-specified string for the manual instruction.

Parameters
bufoutput buffer
ealinear address of the instruction or data item
Returns
size of manual instruction or -1
idaman void ida_export set_manual_insn ( ea_t  ea,
const char *  manual_insn 
)

Set manual instruction string.

Parameters
ealinear address of the instruction or data item
manual_insn"" - delete manual string. NULL - do nothing
idaman size_t ida_export get_max_strlit_length ( ea_t  ea,
int32  strtype,
int  options = 0 
)

Determine maximum length of string literal.

Parameters
eastarting address
strtypestring type. one of String type codes
optionscombination of string literal length options
Returns
length of the string in bytes, including the terminating character(s), if any

Note: 'bytes' in this context means host, 8-bit bytes (not IDB bytes, which could be larger than 8 bits)

idaman ssize_t ida_export get_strlit_contents ( qstring utf8,
ea_t  ea,
size_t  len,
int32  type,
size_t *  maxcps = NULL,
int  flags = 0 
)

Get contents of string literal, as UTF-8-encoded codepoints.

This function returns the displayed part of the string It works even if the string has not been created in the database yet.

If 'len' is size_t(-1), it will be computed like so:

  • if a string literal is present at 'ea', get_item_size() will be used
  • otherwise, get_max_strlit_length(..., ALOPT_IGNHEADS) will be used

About 'maxcps': this specifies a limit to the number of codepoints, not bytes in the UTF-8 output buffer. So for example although U+4e12 will use 3 bytes in the output buffer, it still counts as only 1 character – unless STRCONV_ESCAPE is used. If 'STRCONV_ESCAPE' is used, U+4e12 will be converted to the string "\u4E12", and will use 6 bytes in the output buffer and also count as 6 codepoints.

If 'STRCONV_REPLCHAR', any undecodable byte will re represented as U+FFFD, occupy 3 bytes in the output buffer, and count for 1 codepoint.

Parameters
[out]utf8output buffer
[in]ealinear address of the string
[in]lenlength of the string in bytes
[in]typetype of the string. one of String type codes
[in,out]maxcpsmaximum length of codepoints, after possible escaping, in output buffer (not counting terminating zero) on exit, will be set to 0 if string got truncated can be NULL if not needed
[in]flagscombination of string conversion flags
Returns
length of generated text (in bytes) or -1

Note: 'bytes' in this context means host, 8-bit bytes (not IDB bytes, which could be larger than 8 bits)

idaman bool ida_export create_strlit ( ea_t  start,
size_t  len,
int32  strtype 
)

Convert to string literal and give a meaningful name.

'start' may be higher than 'end', the kernel will swap them in this case

Parameters
startstarting address
lenlength of the string in bytes. if 0, then get_max_strlit_length() will be used to determine the length
strtypestring type. one of String type codes
Returns
success
idaman bool ida_export print_strlit_type ( qstring out,
int32  strtype,
qstring out_tooltip = NULL,
int  flags = 0 
)

Get string type information: the string type name (possibly decorated with hotkey markers), and the tooltip.

Parameters
outthe output buffer
strtypethe string type
out_tooltipan optional output buffer for the tooltip
flagsor'ed PSTF_* constants
Returns
length of generated text
idaman opinfo_t* ida_export get_opinfo ( opinfo_t buf,
ea_t  ea,
int  n,
flags_t  flags 
)

Get additional information about an operand representation.

Parameters
bufbuffer to receive the result. may not be NULL
ealinear address of item
nnumber of operand, 0 or 1
flagsflags of the item
Returns
NULL if no additional representation information
idaman bool ida_export set_opinfo ( ea_t  ea,
int  n,
flags_t  flag,
const opinfo_t ti,
bool  suppress_events = false 
)

Set additional information about an operand representation.

This function is a low level one. Only the kernel should use it.

Parameters
ealinear address of the item
nnumber of operand, 0 or 1
flagflags of the item
tiadditional representation information
suppress_eventsdo not generate changing_op_type and op_type_changed events
Returns
success
void del_one_opinfo ( ea_t  ea,
int  n,
flags_t  flag 
)

Delete additional information about an operand representation.

This function is a low level one. Only the kernel should use it.

Parameters
ealinear address of the item
nnumber of operand, 0 or 1
flagflags of the item
idaman asize_t ida_export get_data_elsize ( ea_t  ea,
flags_t  F,
const opinfo_t ti = NULL 
)

Get size of data type specified in flags 'F'.

Parameters
ealinear address of the item
Fflags
tiadditional information about the data type. For example, if the current item is a structure instance, then ti->tid is structure id. Otherwise is ignored (may be NULL). If specified as NULL, will be automatically retrieved from the database
Returns
  • byte : 1
  • word : 2
  • etc...

If flags doesn't specify a data, then return 1

asize_t get_full_data_elsize ( ea_t  ea,
flags_t  F,
const opinfo_t ti = NULL 
)
inline

Get full size of data type specified in flags 'F'.

takes into account processors with wide bytes e.g. returns 2 for a byte element with 16-bit bytes

idaman int ida_export is_varsize_item ( ea_t  ea,
flags_t  F,
const opinfo_t ti = NULL,
asize_t itemsize = NULL 
)

Is the item at 'ea' variable size?.

Parameters
ealinear address of the item
Fflags
tiadditional information about the data type. For example, if the current item is a structure instance, then ti->tid is structure id. Otherwise is ignored (may be NULL). If specified as NULL, will be automatically retrieved from the database
itemsizeif not NULL and the item is varsize, itemsize will contain the calculated item size (for struct types, the minimal size is returned)
Return values
1varsize item
0fixed item
-1error (bad data definition)
idaman bool ida_export can_define_item ( ea_t  ea,
asize_t  length,
flags_t  flags 
)

Can define item (instruction/data) of the specified 'length', starting at 'ea'?

Note
if there is an item starting at 'ea', this function ignores it
this function converts to unexplored all encountered data items with fixup information. Should be fixed in the future.
Parameters
flagsif not 0, then the kernel will ignore the data types specified by the flags and destroy them. For example:
                 1000 dw 5
                 1002 db 5 ; undef
                 1003 db 5 ; undef
                 1004 dw 5
                 1006 dd 5
                 
can_define_item(1000, 6, 0) - false because of dw at 1004
can_define_item(1000, 6, word_flag()) - true, word at 1004 is destroyed
Returns
1-yes, 0-no

This function may return 0 if:

  • a new item would cross segment boundaries
  • a new item would overlap with existing items (except items specified by 'flags')
idaman int ida_export register_custom_data_type ( const data_type_t dtinfo)

Register a new data type.

Parameters
dtinfodescription of the new data type
Returns
> 0 : id of the new custom data type, < 0 : error when the custom data type with the same name has already been registered
Note
dtid 0 is reserved for built-in data types.
idaman bool ida_export unregister_custom_data_type ( int  dtid)

Unregister a data type.

When the idb is closed, all custom data types are automatically unregistered, but since it happens too late (plugin modules could already be unloaded) one has to unregister custom data types explicitly. The ids of unregistered custom data types remain allocated and when the same name is reused to register a custom data type, it will get assigned the same id.

Parameters
dtiddata type to unregister
Return values
trueok
falseno such dtid
idaman int ida_export register_custom_data_format ( const data_format_t dtform)

Register a new data format.

Parameters
dtformdescription of the new data format
Returns
> 0 : id of the new custom data format, < 0 : error when the custom data format with the same name has already been registered to the data type
Note
dfid 0 is unused.
idaman bool ida_export unregister_custom_data_format ( int  dfid)

Unregister a data format.

See also
unregister_custom_data_type()
Parameters
dfiddata format to unregister
Return values
trueok
falseno such dfid
idaman const data_type_t* ida_export get_custom_data_type ( int  dtid)

Get definition of a registered custom data type.

Parameters
dtiddata type id
Returns
data type definition or NULL
idaman const data_format_t* ida_export get_custom_data_format ( int  dfid)

Get definition of a registered custom data format.

Parameters
dfiddata format id
Returns
data format definition or NULL
idaman bool ida_export attach_custom_data_format ( int  dtid,
int  dfid 
)

Attach the data format to the data type.

Parameters
dtiddata type id that can use the data format. 0 means all standard data types. Such data formats can be applied to any data item or instruction operands. For instruction operands, the data_format_t::value_size check is not performed by the kernel.
dfiddata format id
Return values
trueok
falseno such `dtid', or no such `dfid', or the data format has already been attached to the data type
idaman bool ida_export detach_custom_data_format ( int  dtid,
int  dfid 
)

Detach the data format from the data type.

Unregistering a custom data type detaches all attached data formats, no need to detach them explicitly. You still need unregister them. Unregistering a custom data format detaches it from all attached data types.

Parameters
dtiddata type id to detach data format from
dfiddata format id to detach
Return values
trueok
falseno such `dtid', or no such `dfid', or the data format was not attached to the data type
idaman int ida_export get_custom_data_types ( intvec_t out,
asize_t  min_size = 0,
asize_t  max_size = BADADDR 
)

Get list of registered custom data type ids.

Parameters
outbuffer for the output. may be NULL
min_sizeminimum value size
max_sizemaximum value size
Returns
number of custom data types with the specified size limits
idaman int ida_export get_custom_data_formats ( intvec_t out,
int  dtid 
)

Get list of attached custom data formats for the specified data type.

Parameters
outbuffer for the output. may be NULL
dtiddata type id
Returns
number of returned custom data formats. if error, returns -1
idaman int ida_export find_custom_data_type ( const char *  name)

Get id of a custom data type.

Parameters
namename of the custom data type
Returns
id or -1
idaman int ida_export find_custom_data_format ( const char *  name)

Get id of a custom data format.

Parameters
namename of the custom data format
Returns
id or -1
idaman bool ida_export set_cmt ( ea_t  ea,
const char *  comm,
bool  rptble 
)

Set an indented comment.

Parameters
ealinear address
commcomment string
  • NULL: do nothing (return 0)
  • "" : delete comment
rptbleis repeatable?
Returns
success
idaman ssize_t ida_export get_cmt ( qstring buf,
ea_t  ea,
bool  rptble 
)

Get an indented comment.

Parameters
bufoutput buffer, may be NULL
ealinear address. may point to tail byte, the function will find start of the item
rptbleget repeatable comment?
Returns
size of comment or -1
ssize_t get_repeatable_cmt ( qstring buf,
ea_t  ea 
)

Get a repeatable comment of any type (indented or function comment).

This function is used to display an indented comment if no regular (non-repeatable) comment is present.

Parameters
bufbuffer for the comment
ealinear address. may point to tail byte, the function will find start of the item
Returns
size of comment or -1
ssize_t get_any_indented_cmt ( qstring buf,
ea_t  ea,
color_t cmttype 
)

Get any indented comment (regular or repeatable indented or function).

This function is used to display an indented comment for an item. It looks for a regular comment and calls get_repeatable_cmt() if it is not found.

Parameters
bufbuffer for the comment
ealinear address
cmttypewill contain color of the comment. The color depends on the type of the comment.
Returns
size of comment or -1
idaman bool ida_export append_cmt ( ea_t  ea,
const char *  str,
bool  rptble 
)

Append to an indented comment.

Creates a new comment if none exists. Appends a newline character and the specified string otherwise.

Parameters
ealinear address
strcomment string to append
rptbleappend to repeatable comment?
Returns
success
idaman ssize_t ida_export get_predef_insn_cmt ( qstring buf,
const insn_t ins 
)

Get predefined comment.

Parameters
bufbuffer for the comment
inscurrent instruction information
Returns
size of comment or -1
idaman ea_t ida_export find_byte ( ea_t  sEA,
asize_t  size,
uchar  value,
int  bin_search_flags 
)

Find forward a byte with the specified value (only 8-bit value from the database).

example: ea=4 size=3 will inspect addresses 4, 5, and 6

Parameters
sEAlinear address
sizenumber of bytes to inspect
valuevalue to find
bin_search_flagscombination of Search flags
Returns
address of byte or BADADDR
idaman ea_t ida_export find_byter ( ea_t  sEA,
asize_t  size,
uchar  value,
int  bin_search_flags 
)

Find reverse a byte with the specified value (only 8-bit value from the database).

example: ea=4 size=3 will inspect addresses 6, 5, and 4

Parameters
sEAthe lower address of the search range
sizenumber of bytes to inspect
valuevalue to find
bin_search_flagscombination of Search flags
Returns
address of byte or BADADDR
idaman bool ida_export parse_binpat_str ( compiled_binpat_vec_t out,
ea_t  ea,
const char *  in,
int  radix,
int  strlits_encoding = PBSENC_DEF1BPU,
qstring errbuf = NULL 
)

Convert user-specified binary string to internal representation.

Parameters
[out]outa vector of compiled binary patterns, for use with bin_search2()
ealinear address to convert for (the conversion depends on the address, because the number of bits in a byte depend on the segment type)
ininput text string. contains space-separated:
  • numbers (numeric base is determined by 'radix')
    • if value of number fits a byte, it is considered as a byte
    • if value of number fits a word, it is considered as 2 bytes
    • if value of number fits a dword,it is considered as 4 bytes
  • "..." string constants
  • 'x' single-character constants
  • ? variable bytes
Note
Examples of search strings (assuming base 16): CD 21 - bytes 0xCD, 0x21 21CD - bytes 0xCD, 0x21 (little endian ) or 0x21, 0xCD (big-endian) "Hello", 0 - the null terminated string "Hello" L"Hello" - 'H', 0, 'e', 0, 'l', 0, 'l', 0, 'o', 0 B8 ? ? ? ? 90 - byte 0xB8, 4 bytes with any value, byte 0x90
Parameters
radixnumeric base of numbers (8,10,16)
strlits_encodingthe target encoding into which the string literals present in 'in', should be encoded. Can be any from [1, get_encoding_qty()), or the special values PBSENC_*
errbuferror buffer (can be NULL)
Returns
false either in case of parsing error, or if at least one requested target encoding couldn't encode the string literals present in "in".
idaman ea_t ida_export bin_search2 ( ea_t  start_ea,
ea_t  end_ea,
const compiled_binpat_vec_t data,
int  flags 
)

Search for a string in the program.

Parameters
start_ealinear address, start of range to search
end_ealinear address, end of range to search (exclusive)
datathe prepared data to search for (see parse_binpat_str())
flagscombination of Search flags
Returns
BADADDR (if pressed Ctrl-Break or not found) or string address.
idaman bool ida_export equal_bytes ( ea_t  ea,
const uchar image,
const uchar mask,
size_t  len,
bool  sense_case 
)

Compare 'len' bytes of the program starting from 'ea' with 'image'.

Parameters
ealinear address
imagebytes to compare with
maskarray of 1/0 bytes, it's length is 'len'. 1 means to perform the comparison of the corresponding byte. 0 means not to perform. if mask == NULL, then all bytes of 'image' will be compared. if mask == SKIP_FF_MASK then 0xFF bytes will be skipped
lenlength of block to compare in bytes.
sense_casecase-sensitive comparison?
Return values
1equal
0not equal
idaman bool ida_export update_hidden_range ( const hidden_range_t ha)

Update hidden range information in the database.

You can not use this function to change the range boundaries

Parameters
harange to update
Returns
success
idaman bool ida_export add_hidden_range ( ea_t  ea1,
ea_t  ea2,
const char *  description,
const char *  header,
const char *  footer,
bgcolor_t  color 
)

Mark a range of addresses as hidden.

The range will be created in the invisible state with the default color

Parameters
ea1linear address of start of the address range
ea2linear address of end of the address range
description,header,footerrange parameters
Returns
success
idaman hidden_range_t* ida_export get_hidden_range ( ea_t  ea)

Get pointer to hidden range structure, in: linear address.

Parameters
eaany address in the hidden range
idaman hidden_range_t* ida_export getn_hidden_range ( int  n)

Get pointer to hidden range structure, in: number of hidden range.

Parameters
nnumber of hidden range, is in range 0..get_hidden_range_qty()-1
idaman int ida_export get_hidden_range_num ( ea_t  ea)

Get number of a hidden range.

Parameters
eaany address in the hidden range
Returns
number of hidden range (0..get_hidden_range_qty()-1)
idaman hidden_range_t* ida_export get_prev_hidden_range ( ea_t  ea)

Get pointer to previous hidden range.

Parameters
eaany address in the program
Returns
ptr to hidden range or NULL if previous hidden range doesn't exist
idaman hidden_range_t* ida_export get_next_hidden_range ( ea_t  ea)

Get pointer to next hidden range.

Parameters
eaany address in the program
Returns
ptr to hidden range or NULL if next hidden range doesn't exist
idaman hidden_range_t* ida_export get_first_hidden_range ( void  )

Get pointer to the first hidden range.

Returns
ptr to hidden range or NULL
idaman hidden_range_t* ida_export get_last_hidden_range ( void  )

Get pointer to the last hidden range.

Returns
ptr to hidden range or NULL
idaman bool ida_export del_hidden_range ( ea_t  ea)

Delete hidden range.

Parameters
eaany address in the hidden range
Returns
success
idaman bool ida_export add_mapping ( ea_t  from,
ea_t  to,
asize_t  size 
)

IDA supports memory mapping.

References to the addresses from the mapped range use data and meta-data from the mapping range.

Note
You should set flag PR2_MAPPING in ph.flag2 to use memory mapping Add memory mapping range.
Parameters
fromstart of the mapped range (nonexistent address)
tostart of the mapping range (existent address)
sizesize of the range
Returns
success
idaman void ida_export del_mapping ( ea_t  ea)

Delete memory mapping range.

Parameters
eaany address in the mapped range
idaman ea_t ida_export use_mapping ( ea_t  ea)

Translate address according to current mappings.

Parameters
eaaddress to translate
Returns
translated address
idaman bool ida_export get_mapping ( ea_t from,
ea_t to,
asize_t size,
size_t  n 
)

Get memory mapping range by its number.

Parameters
fromstart of the mapped range
tostart of the mapping range
sizesize of the range
nnumber of mapping range (0..get_mappings_qty()-1)
Returns
false if the specified range doesn't exist, otherwise returns `from', `to', `size'