Latest available version: IDA and decompilers v8.4.240320sp1 see all releases
Hex-Rays logo State-of-the-art binary code analysis tools
email icon
Debugger memory functions for UI

Inspect debugged process memory. More...

Functions

idaman void ida_export set_dbgmem_source (range_t *(idaapi *dbg_get_memory_config)(int *n), int(idaapi *memory_read)(ea_t ea, void *buffer, int size), int(idaapi *memory_write)(ea_t ea, const void *buffer, int size))
 Set the memory information source for IDA kernel. More...
 
idaman void ida_export invalidate_dbgmem_config (void)
 Invalidate the debugged process memory configuration. More...
 
idaman void ida_export invalidate_dbgmem_contents (ea_t ea, asize_t size)
 Invalidate the debugged process memory contents. More...
 
idaman bool ida_export is_debugger_on (void)
 Is the debugger currently running?
 
idaman bool ida_export is_debugger_memory (ea_t ea)
 Is the address mapped to debugger memory?
 

Detailed Description

Inspect debugged process memory.

Function Documentation

◆ set_dbgmem_source()

idaman void ida_export set_dbgmem_source ( range_t *(idaapi *)(int *n)  dbg_get_memory_config,
int(idaapi *)(ea_t ea, void *buffer, int size)  memory_read,
int(idaapi *)(ea_t ea, const void *buffer, int size)  memory_write 
)

Set the memory information source for IDA kernel.

This function allows the kernel to use information coming from somewhere other than the database (from the debugger, for example)

Parameters
dbg_get_memory_configreturns current memory configuration in the dynamic memory allocated by qalloc(). The kernel will qfree() it automatically. If this argument is nullptr, then the debugged process memory is not used.
  • n: number of range_t elements in the answer
memory_readread bytes from the debugged process memory
memory_writewrite bytes to the debugged process memory (don't forget to call invalidate_dbgmem_contents() from it)

◆ invalidate_dbgmem_config()

idaman void ida_export invalidate_dbgmem_config ( void  )

Invalidate the debugged process memory configuration.

Call this function if the debugged process might have changed its memory layout (allocated more memory, for example)

◆ invalidate_dbgmem_contents()

idaman void ida_export invalidate_dbgmem_contents ( ea_t  ea,
asize_t  size 
)

Invalidate the debugged process memory contents.

Call this function each time the process has been stopped or the process memory is modified. If ea == BADADDR, then the whole memory contents will be invalidated