funcs.hpp File Reference

Routines for working with functions within the disassembled program. More...

Classes
struct	regarg_t
	Register argument description. More...
class	func_t
	A function is a set of continuous ranges of addresses with characteristics. More...
class	lock_func
	Helper class to lock a function pointer so it stays valid. More...
class	func_tail_iterator_t
	Class to enumerate all function tails sorted by addresses. More...
class	func_item_iterator_t
	Class to enumerate all function instructions and data sorted by addresses. More...
class	func_parent_iterator_t
	Class to enumerate all function parents sorted by addresses. More...

Macros
#define	FUNC_NORET   0x00000001
	Function doesn't return.
#define	FUNC_FAR   0x00000002
	Far function.
#define	FUNC_LIB   0x00000004
	Library function.
#define	FUNC_STATICDEF   0x00000008
	Static function.
#define	FUNC_FRAME   0x00000010
	Function uses frame pointer (BP)
#define	FUNC_USERFAR   0x00000020
	User has specified far-ness of the function.
#define	FUNC_HIDDEN   0x00000040
	A hidden function chunk.
#define	FUNC_THUNK   0x00000080
	Thunk (jump) function.
#define	FUNC_BOTTOMBP   0x00000100
	BP points to the bottom of the stack frame.
#define	FUNC_NORET_PENDING   0x00200
	Function 'non-return' analysis must be performed. More...
#define	FUNC_SP_READY   0x00000400
	SP-analysis has been performed. More...
#define	FUNC_FUZZY_SP   0x00000800
	Function changes SP in untraceable way, for example: and esp, 0FFFFFFF0h.
#define	FUNC_PROLOG_OK   0x00001000
	Prolog analysis has been performed by last SP-analysis.
#define	FUNC_PURGED_OK   0x00004000
	'argsize' field has been validated. More...
#define	FUNC_TAIL   0x00008000
	This is a function tail. More...
#define	FUNC_LUMINA   0x00010000
	Function info is provided by Lumina.
#define	FUNC_OUTLINE   0x00020000
	Outlined code, not a real function.
#define	FUNC_REANALYZE   0x00040000
	Function frame changed, request to reanalyze the function after the last insn is analyzed. More...
#define	FUNC_RESERVED   0x8000000000000000LL
	Reserved (for internal usage)
#define	MOVE_FUNC_OK   0
	ok
#define	MOVE_FUNC_NOCODE   1
	no instruction at 'newstart'
#define	MOVE_FUNC_BADSTART   2
	bad new start address
#define	MOVE_FUNC_NOFUNC   3
	no function at 'ea'
#define	MOVE_FUNC_REFUSED   4
	a plugin refused the action
#define	FIND_FUNC_NORMAL   0x0000
	stop processing if undefined byte is encountered
#define	FIND_FUNC_DEFINE   0x0001
	create instruction if undefined byte is encountered
#define	FIND_FUNC_IGNOREFN   0x0002
	ignore existing function boundaries. More...
#define	FIND_FUNC_KEEPBD   0x0004
	do not modify incoming function boundaries, just create instructions inside the boundaries. More...
#define	FIND_FUNC_UNDEF   0
	function has instructions that pass execution flow to unexplored bytes. More...
#define	FIND_FUNC_OK   1
	ok, 'nfn' is ready for add_func()
#define	FIND_FUNC_EXIST   2
	function exists already. More...
#define	DECLARE_FUNC_ITERATORS(prefix)
	Declare helper functions for func_item_iterator_t. More...

Functions
idaman void ida_export	free_regarg (struct regarg_t *v)
bool	is_func_entry (const func_t *pfn)
	Does function describe a function entry chunk?
bool	is_func_tail (const func_t *pfn)
	Does function describe a function tail chunk?
idaman void ida_export	lock_func_range (const func_t *pfn, bool lock)
	Lock function pointer Locked pointers are guaranteed to remain valid until they are unlocked. More...
idaman bool ida_export	is_func_locked (const func_t *pfn)
	Is the function pointer locked?
idaman func_t *ida_export	get_func (ea_t ea)
	Get pointer to function structure by address. More...
idaman int ida_export	get_func_chunknum (func_t *pfn, ea_t ea)
	Get the containing tail chunk of 'ea'. More...
bool	func_contains (func_t *pfn, ea_t ea)
	Does the given function contain the given address?
bool	is_same_func (ea_t ea1, ea_t ea2)
	Do two addresses belong to the same function?
idaman func_t *ida_export	getn_func (size_t n)
	Get pointer to function structure by number. More...
idaman size_t ida_export	get_func_qty (void)
	Get total number of functions in the program.
idaman int ida_export	get_func_num (ea_t ea)
	Get ordinal number of a function. More...
idaman func_t *ida_export	get_prev_func (ea_t ea)
	Get pointer to the previous function. More...
idaman func_t *ida_export	get_next_func (ea_t ea)
	Get pointer to the next function. More...
idaman ea_t ida_export	get_func_ranges (rangeset_t *ranges, func_t *pfn)
	Get function ranges. More...
idaman ssize_t ida_export	get_func_cmt (qstring *buf, const func_t *pfn, bool repeatable)
	Get function comment. More...
idaman bool ida_export	set_func_cmt (const func_t *pfn, const char *cmt, bool repeatable)
	Set function comment. More...
idaman bool ida_export	update_func (func_t *pfn)
	Update information about a function in the database (func_t). More...
idaman bool ida_export	add_func_ex (func_t *pfn)
	Add a new function. More...
bool	add_func (ea_t ea1, ea_t ea2=BADADDR)
	Add a new function. More...
idaman bool ida_export	del_func (ea_t ea)
	Delete a function. More...
idaman int ida_export	set_func_start (ea_t ea, ea_t newstart)
	Move function chunk start address. More...
idaman bool ida_export	set_func_end (ea_t ea, ea_t newend)
	Move function chunk end address. More...
idaman void ida_export	reanalyze_function (func_t *pfn, ea_t ea1=0, ea_t ea2=BADADDR, bool analyze_parents=false)
	Reanalyze a function. More...
idaman int ida_export	find_func_bounds (func_t *nfn, int flags)
	Determine the boundaries of a new function. More...
idaman ssize_t ida_export	get_func_name (qstring *out, ea_t ea)
	Get function name. More...
idaman asize_t ida_export	calc_func_size (func_t *pfn)
	Calculate function size. More...
idaman int ida_export	get_func_bitness (const func_t *pfn)
	Get function bitness (which is equal to the function segment bitness). More...
int idaapi	get_func_bits (const func_t *pfn)
	Get number of bits in the function addressing.
int idaapi	get_func_bytes (const func_t *pfn)
	Get number of bytes in the function addressing.
bool	is_visible_func (func_t *pfn)
	Is the function visible (not hidden)?
bool	is_finally_visible_func (func_t *pfn)
	Is the function visible (event after considering SCF_SHHID_FUNC)?
idaman void ida_export	set_visible_func (func_t *pfn, bool visible)
	Set visibility of function.
idaman int ida_export	set_func_name_if_jumpfunc (func_t *pfn, const char *oldname)
	Give a meaningful name to function if it consists of only 'jump' instruction. More...
idaman ea_t ida_export	calc_thunk_func_target (func_t *pfn, ea_t *fptr)
	Calculate target of a thunk function. More...
idaman bool ida_export	func_does_return (ea_t callee)
	Does the function return?. More...
idaman bool ida_export	reanalyze_noret_flag (ea_t ea)
	Plan to reanalyze noret flag. More...
idaman bool ida_export	set_noret_insn (ea_t insn_ea, bool noret)
	Signal a non-returning instruction. More...
idaman func_t *ida_export	get_fchunk (ea_t ea)
	Get pointer to function chunk structure by address. More...
idaman func_t *ida_export	getn_fchunk (int n)
	Get pointer to function chunk structure by number. More...
idaman size_t ida_export	get_fchunk_qty (void)
	Get total number of function chunks in the program.
idaman int ida_export	get_fchunk_num (ea_t ea)
	Get ordinal number of a function chunk in the global list of function chunks. More...
idaman func_t *ida_export	get_prev_fchunk (ea_t ea)
	Get pointer to the previous function chunk in the global list. More...
idaman func_t *ida_export	get_next_fchunk (ea_t ea)
	Get pointer to the next function chunk in the global list. More...
idaman bool ida_export	append_func_tail (func_t *pfn, ea_t ea1, ea_t ea2)
	Append a new tail chunk to the function definition. More...
idaman bool ida_export	remove_func_tail (func_t *pfn, ea_t tail_ea)
	Remove a function tail. More...
idaman bool ida_export	set_tail_owner (func_t *fnt, ea_t new_owner)
	Set a new owner of a function tail. More...
THREAD_SAFE bool idaapi	f_any (flags64_t, void *)
	Helper function to accept any address.
idaman void ida_export	iterate_func_chunks (func_t *pfn, void(idaapi *func)(ea_t ea1, ea_t ea2, void *ud), void *ud=nullptr, bool include_parents=false)
	Function to iterate function chunks (all of them including the entry chunk) More...
Get prev/next address in function
Unlike func_item_iterator_t which always enumerates the main function chunk first, these functions respect linear address ordering.
idaman ea_t ida_export	get_prev_func_addr (func_t *pfn, ea_t ea)
idaman ea_t ida_export	get_next_func_addr (func_t *pfn, ea_t ea)
Functions to work with temporary register argument definitions
#define	IDASGN_OK   0
	ok
#define	IDASGN_BADARG   1
	bad number of signature
#define	IDASGN_APPLIED   2
	signature is already applied
#define	IDASGN_CURRENT   3
	signature is currently being applied
#define	IDASGN_PLANNED   4
	signature is planned to be applied
#define	LIBFUNC_FOUND   0
	ok, library function is found
#define	LIBFUNC_NONE   1
	no, this is not a library function
#define	LIBFUNC_DELAY   2
	no decision because of lack of information
idaman void ida_export	read_regargs (func_t *pfn)
idaman void ida_export	add_regarg (func_t *pfn, int reg, const tinfo_t &tif, const char *name)
idaman int ida_export	plan_to_apply_idasgn (const char *fname)
	Add a signature file to the list of planned signature files. More...
idaman int ida_export	apply_idasgn_to (const char *signame, ea_t ea, bool is_startup)
	Apply a signature file to the specified address. More...
idaman int ida_export	get_idasgn_qty (void)
	Get number of signatures in the list of planned and applied signatures. More...
idaman int ida_export	get_current_idasgn (void)
	Get number of the the current signature. More...
idaman int ida_export	calc_idasgn_state (int n)
	Get state of a signature in the list of planned signatures. More...
idaman int ida_export	del_idasgn (int n)
	Remove signature from the list of planned signatures. More...
idaman int32 ida_export	get_idasgn_desc (qstring *signame, qstring *optlibs, int n)
	Get information about a signature in the list. More...
idaman idasgn_t *ida_export	get_idasgn_header_by_short_name (const char *name)
	Get idasgn header by a short signature name. More...
idaman ssize_t ida_export	get_idasgn_title (qstring *buf, const char *name)
	Get full description of the signature by its short name. More...
idaman void ida_export	determine_rtl (void)
	Determine compiler/vendor using the startup signatures. More...
idaman bool ida_export	apply_startup_sig (ea_t ea, const char *startup)
	Apply a startup signature file to the specified address. More...
idaman int ida_export	try_to_add_libfunc (ea_t ea)
	Apply the currently loaded signature file to the specified address. More...

Detailed Description

Routines for working with functions within the disassembled program.

This file also contains routines for working with library signatures (e.g. FLIRT).

Each function consists of function chunks. At least one function chunk must be present in the function definition - the function entry chunk. Other chunks are called function tails. There may be several of them for a function.

A function tail is a continuous range of addresses. It can be used in the definition of one or more functions. One function using the tail is singled out and called the tail owner. This function is considered as 'possessing' the tail. get_func() on a tail address will return the function possessing the tail. You can enumerate the functions using the tail by using func_parent_iterator_t.

Each function chunk in the disassembly is represented as an "range" (a range of addresses, see range.hpp for details) with characteristics.

A function entry must start with an instruction (code) byte.

Macro Definition Documentation

FUNC_NORET_PENDING

#define FUNC_NORET_PENDING   0x00200

Function 'non-return' analysis must be performed.

This flag is verified upon func_does_return()

FUNC_SP_READY

#define FUNC_SP_READY   0x00000400

SP-analysis has been performed.

If this flag is on, the stack change points should not be not modified anymore. Currently this analysis is performed only for PC

FUNC_PURGED_OK

#define FUNC_PURGED_OK   0x00004000

'argsize' field has been validated.

If this bit is clear and 'argsize' is 0, then we do not known the real number of bytes removed from the stack. This bit is handled by the processor module.

FUNC_TAIL

#define FUNC_TAIL   0x00008000

This is a function tail.

Other bits must be clear (except FUNC_HIDDEN).

FUNC_REANALYZE

#define FUNC_REANALYZE   0x00040000

Function frame changed, request to reanalyze the function after the last insn is analyzed.

FIND_FUNC_IGNOREFN

#define FIND_FUNC_IGNOREFN   0x0002

ignore existing function boundaries.

by default the function returns function boundaries if ea belongs to a function.

FIND_FUNC_KEEPBD

#define FIND_FUNC_KEEPBD   0x0004

do not modify incoming function boundaries, just create instructions inside the boundaries.

FIND_FUNC_UNDEF

#define FIND_FUNC_UNDEF   0

function has instructions that pass execution flow to unexplored bytes.

nfn->end_ea will have the address of the unexplored byte.

FIND_FUNC_EXIST

#define FIND_FUNC_EXIST   2

function exists already.

its bounds are returned in 'nfn'.

DECLARE_FUNC_ITERATORS

#define DECLARE_FUNC_ITERATORS

(

prefix

)

Value:

prefix bool ida_export func_tail_iterator_set(func_tail_iterator_t *fti, func_t *pfn, ea_t ea);\
prefix bool ida_export func_tail_iterator_set_ea(func_tail_iterator_t *fti, ea_t ea);\
prefix bool ida_export func_parent_iterator_set(func_parent_iterator_t *fpi, func_t *pfn);\
prefix bool ida_export func_item_iterator_next(func_item_iterator_t *fii, testf_t *testf, void *ud);\
prefix bool ida_export func_item_iterator_prev(func_item_iterator_t *fii, testf_t *testf, void *ud);\
prefix bool ida_export func_item_iterator_decode_prev_insn(func_item_iterator_t *fii, insn_t *out); \
prefix bool ida_export func_item_iterator_decode_preceding_insn(func_item_iterator_t *fii, eavec_t *visited, bool *p_farref, insn_t *out); \
prefix bool ida_export func_item_iterator_succ(func_item_iterator_t *fii, testf_t *testf, void *ud);

Declare helper functions for func_item_iterator_t.

Function Documentation

lock_func_range()

idaman void ida_export lock_func_range	(	const func_t *	pfn,
		bool	lock
	)

Lock function pointer Locked pointers are guaranteed to remain valid until they are unlocked.

Ranges with locked pointers cannot be deleted or moved.

get_func()

idaman func_t *ida_export get_func

(

ea_t

ea

)

Get pointer to function structure by address.

Parameters

ea	any address in a function

Returns

ptr to a function or nullptr. This function returns a function entry chunk.

get_func_chunknum()

idaman int ida_export get_func_chunknum	(	func_t *	pfn,
		ea_t	ea
	)

Get the containing tail chunk of 'ea'.

Return values

-1	means 'does not contain ea'
0	means the 'pfn' itself contains ea
>0	the number of the containing function tail chunk

getn_func()

idaman func_t *ida_export getn_func

(

size_t

n

)

Get pointer to function structure by number.

Parameters

n	number of function, is in range 0..get_func_qty()-1

Returns

ptr to a function or nullptr. This function returns a function entry chunk.

get_func_num()

idaman int ida_export get_func_num

(

ea_t

ea

)

Get ordinal number of a function.

Parameters

ea	any address in the function

Returns

number of function (0..get_func_qty()-1). -1 means 'no function at the specified address'.

get_prev_func()

idaman func_t *ida_export get_prev_func

(

ea_t

ea

)

Get pointer to the previous function.

Parameters

ea	any address in the program

Returns

ptr to function or nullptr if previous function doesn't exist

get_next_func()

idaman func_t *ida_export get_next_func

(

ea_t

ea

)

Get pointer to the next function.

Parameters

ea	any address in the program

Returns

ptr to function or nullptr if next function doesn't exist

get_func_ranges()

idaman ea_t ida_export get_func_ranges	(	rangeset_t *	ranges,
		func_t *	pfn
	)

Get function ranges.

Parameters

ranges	buffer to receive the range info
pfn	ptr to function structure

Returns

end address of the last function range (BADADDR-error)

get_func_cmt()

idaman ssize_t ida_export get_func_cmt	(	qstring *	buf,
		const func_t *	pfn,
		bool	repeatable
	)

Get function comment.

Parameters

buf	buffer for the comment
pfn	ptr to function structure
repeatable	get repeatable comment?

Returns

size of comment or -1 In fact this function works with function chunks too.

set_func_cmt()

idaman bool ida_export set_func_cmt	(	const func_t *	pfn,
		const char *	cmt,
		bool	repeatable
	)

Set function comment.

This function works with function chunks too.

Parameters

pfn	ptr to function structure
cmt	comment string, may be multiline (with ' '). Use empty str ("") to delete comment
repeatable	set repeatable comment?

update_func()

idaman bool ida_export update_func

(

func_t *

pfn

)

Update information about a function in the database (func_t).

You must not change the function start and end addresses using this function. Use set_func_start() and set_func_end() for it.

Parameters

pfn	ptr to function structure

Returns

success

add_func_ex()

idaman bool ida_export add_func_ex

(

func_t *

pfn

)

Add a new function.

If the fn->end_ea is BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(..., FIND_FUNC_DEFINE).

Parameters

pfn	ptr to filled function structure

Returns

success

add_func()

bool add_func ( ea_t  ea1, ea_t  ea2 = BADADDR  )

inline

Add a new function.

If the function end address is BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(..., FIND_FUNC_DEFINE).

Parameters

ea1	start address
ea2	end address

Returns

success

del_func()

idaman bool ida_export del_func

(

ea_t

ea

)

Delete a function.

Parameters

ea	any address in the function entry chunk

Returns

success

set_func_start()

idaman int ida_export set_func_start	(	ea_t	ea,
		ea_t	newstart
	)

Move function chunk start address.

Parameters

ea	any address in the function
newstart	new end address of the function

Returns

Function move result codes

set_func_end()

idaman bool ida_export set_func_end	(	ea_t	ea,
		ea_t	newend
	)

Move function chunk end address.

Parameters

ea	any address in the function
newend	new end address of the function

Returns

success

reanalyze_function()

idaman void ida_export reanalyze_function	(	func_t *	pfn,
		ea_t	ea1 = 0,
		ea_t	ea2 = BADADDR,
		bool	analyze_parents = false
	)

Reanalyze a function.

This function plans to analyzes all chunks of the given function. Optional parameters (ea1, ea2) may be used to narrow the analyzed range.

Parameters

pfn	pointer to a function
ea1	start of the range to analyze
ea2	end of range to analyze
analyze_parents	meaningful only if pfn points to a function tail. if true, all tail parents will be reanalyzed. if false, only the given tail will be reanalyzed.

find_func_bounds()

idaman int ida_export find_func_bounds	(	func_t *	nfn,
		int	flags
	)

Determine the boundaries of a new function.

This function tries to find the start and end addresses of a new function. It calls the module with processor_t::func_bounds in order to fine tune the function boundaries.

Parameters

nfn	structure to fill with information \ nfn->start_ea points to the start address of the new function.
flags	Find function bounds flags

Returns

Find function bounds result codes

get_func_name()

idaman ssize_t ida_export get_func_name	(	qstring *	out,
		ea_t	ea
	)

Get function name.

Parameters

out	buffer for the answer
ea	any address in the function

Returns

length of the function name

calc_func_size()

idaman asize_t ida_export calc_func_size

(

func_t *

pfn

)

Calculate function size.

This function takes into account all fragments of the function.

Parameters

pfn	ptr to function structure

get_func_bitness()

idaman int ida_export get_func_bitness

(

const func_t *

pfn

)

Get function bitness (which is equal to the function segment bitness).

pfn==nullptr => returns 0

Return values

0	16
1	32
2	64

set_func_name_if_jumpfunc()

idaman int ida_export set_func_name_if_jumpfunc	(	func_t *	pfn,
		const char *	oldname
	)

Give a meaningful name to function if it consists of only 'jump' instruction.

Parameters

pfn	pointer to function (may be nullptr)
oldname	old name of function. if old name was in "j_..." form, then we may discard it and set a new name. if oldname is not known, you may pass nullptr.

Returns

success

calc_thunk_func_target()

idaman ea_t ida_export calc_thunk_func_target	(	func_t *	pfn,
		ea_t *	fptr
	)

Calculate target of a thunk function.

Parameters

pfn	pointer to function (may not be nullptr)
fptr	out: will hold address of a function pointer (if indirect jump)

Returns

the target function or BADADDR

func_does_return()

idaman bool ida_export func_does_return

(

ea_t

callee

)

Does the function return?.

To calculate the answer, FUNC_NORET flag and is_noret() are consulted The latter is required for imported functions in the .idata section. Since in .idata we have only function pointers but not functions, we have to introduce a special flag for them.

reanalyze_noret_flag()

idaman bool ida_export reanalyze_noret_flag

(

ea_t

ea

)

Plan to reanalyze noret flag.

This function does not remove FUNC_NORET if it is already present. It just plans to reanalysis.

set_noret_insn()

idaman bool ida_export set_noret_insn	(	ea_t	insn_ea,
		bool	noret
	)

Signal a non-returning instruction.

This function can be used by the processor module to tell the kernel about non-returning instructions (like call exit). The kernel will perform the global function analysis and find out if the function returns at all. This analysis will be done at the first call to func_does_return()

Returns

true if the instruction 'noret' flag has been changed

get_fchunk()

idaman func_t *ida_export get_fchunk

(

ea_t

ea

)

Get pointer to function chunk structure by address.

Parameters

ea	any address in a function chunk

Returns

ptr to a function chunk or nullptr. This function may return a function entry as well as a function tail.

getn_fchunk()

idaman func_t *ida_export getn_fchunk

(

int

n

)

Get pointer to function chunk structure by number.

Parameters

n	number of function chunk, is in range 0..get_fchunk_qty()-1

Returns

ptr to a function chunk or nullptr. This function may return a function entry as well as a function tail.

get_fchunk_num()

idaman int ida_export get_fchunk_num

(

ea_t

ea

)

Get ordinal number of a function chunk in the global list of function chunks.

Parameters

ea	any address in the function chunk

Returns

number of function chunk (0..get_fchunk_qty()-1). -1 means 'no function chunk at the specified address'.

get_prev_fchunk()

idaman func_t *ida_export get_prev_fchunk

(

ea_t

ea

)

Get pointer to the previous function chunk in the global list.

Parameters

ea	any address in the program

Returns

ptr to function chunk or nullptr if previous function chunk doesn't exist

get_next_fchunk()

idaman func_t *ida_export get_next_fchunk

(

ea_t

ea

)

Get pointer to the next function chunk in the global list.

Parameters

ea	any address in the program

Returns

ptr to function chunk or nullptr if next function chunk doesn't exist

append_func_tail()

idaman bool ida_export append_func_tail	(	func_t *	pfn,
		ea_t	ea1,
		ea_t	ea2
	)

Append a new tail chunk to the function definition.

If the tail already exists, then it will simply be added to the function tail list Otherwise a new tail will be created and its owner will be set to be our function If a new tail cannot be created, then this function will fail.

Parameters

pfn	pointer to the function
ea1	start of the tail. If a tail already exists at the specified address it must start at 'ea1'
ea2	end of the tail. If a tail already exists at the specified address it must end at 'ea2'. If specified as BADADDR, IDA will determine the end address itself.

remove_func_tail()

idaman bool ida_export remove_func_tail	(	func_t *	pfn,
		ea_t	tail_ea
	)

Remove a function tail.

If the tail belongs only to one function, it will be completely removed. Otherwise if the function was the tail owner, the first function using this tail becomes the owner of the tail.

Parameters

pfn	pointer to the function
tail_ea	any address inside the tail to remove

set_tail_owner()

idaman bool ida_export set_tail_owner	(	func_t *	fnt,
		ea_t	new_owner
	)

Set a new owner of a function tail.

The new owner function must be already referring to the tail (after append_func_tail).

Parameters

fnt	pointer to the function tail
new_owner	the entry point of the new owner function

iterate_func_chunks()

idaman void ida_export iterate_func_chunks	(	func_t *	pfn,
		void(idaapi *)(ea_t ea1, ea_t ea2, void *ud)	func,
		void *	ud = nullptr,
		bool	include_parents = false
	)

Function to iterate function chunks (all of them including the entry chunk)

Parameters

pfn	pointer to the function
func	function to call for each chunk
ud	user data for 'func'
include_parents	meaningful only if pfn points to a function tail. if true, all tail parents will be iterated. if false, only the given tail will be iterated.

plan_to_apply_idasgn()

idaman int ida_export plan_to_apply_idasgn

(

const char *

fname

)

Add a signature file to the list of planned signature files.

Parameters

fname

file name. should not contain directory part.

Returns

0 if failed, otherwise number of planned (and applied) signatures

apply_idasgn_to()

idaman int ida_export apply_idasgn_to	(	const char *	signame,
		ea_t	ea,
		bool	is_startup
	)

Apply a signature file to the specified address.

Parameters

signame	short name of signature file (the file name without path)
ea	address to apply the signature
is_startup	if set, then the signature is treated as a startup one for startup signature ida doesn't rename the first function of the applied module.

Returns

Library function codes

get_idasgn_qty()

idaman int ida_export get_idasgn_qty

(

void

)

Get number of signatures in the list of planned and applied signatures.

Returns

0..n

get_current_idasgn()

idaman int ida_export get_current_idasgn

(

void

)

Get number of the the current signature.

Returns

0..n-1

calc_idasgn_state()

idaman int ida_export calc_idasgn_state

(

int

n

)

Get state of a signature in the list of planned signatures.

Parameters

n	number of signature in the list (0..get_idasgn_qty()-1)

Returns

state of signature or IDASGN_BADARG

del_idasgn()

idaman int ida_export del_idasgn

(

int

n

)

Remove signature from the list of planned signatures.

Parameters

n	number of signature in the list (0..get_idasgn_qty()-1)

Returns

IDASGN_OK, IDASGN_BADARG, IDASGN_APPLIED

get_idasgn_desc()

idaman int32 ida_export get_idasgn_desc	(	qstring *	signame,
		qstring *	optlibs,
		int	n
	)

Get information about a signature in the list.

Parameters

signame	buffer for the name of the signature. (short form, only base name without the directory part will be stored). if signame == nullptr, then the name won't be returned.
optlibs	buffer for the names of the optional libraries if optlibs == nullptr, then the optional libraries are not returned
n	number of signature in the list (0..get_idasgn_qty()-1)

Returns

number of successfully recognized modules using this signature. -1 means the 'n' is a bad argument, i.e. no signature with this number exists..

get_idasgn_header_by_short_name()

idaman idasgn_t *ida_export get_idasgn_header_by_short_name

(

const char *

name

)

Get idasgn header by a short signature name.

Parameters

name	short name of a signature

Returns

nullptr if can't find the signature

get_idasgn_title()

idaman ssize_t ida_export get_idasgn_title	(	qstring *	buf,
		const char *	name
	)

Get full description of the signature by its short name.

Parameters

buf	the output buffer
name	short name of a signature

Returns

size of signature description or -1

determine_rtl()

idaman void ida_export determine_rtl

(

void

)

Determine compiler/vendor using the startup signatures.

If determined, then appropriate signature files are included into the list of planned signature files.

apply_startup_sig()

idaman bool ida_export apply_startup_sig	(	ea_t	ea,
		const char *	startup
	)

Apply a startup signature file to the specified address.

Parameters

ea	address to apply the signature to; usually idainfo::start_ea
startup	the name of the signature file without path and extension

Returns

true if successfully applied the signature

try_to_add_libfunc()

idaman int ida_export try_to_add_libfunc

(

ea_t

ea

)

Apply the currently loaded signature file to the specified address.

If a library function is found, then create a function and name it accordingly.

Parameters

ea	any address in the program

Returns

Library function codes