IDA SDK
Classes | Functions | Macros | Typedefs | Enumerations | Variables
ida.hpp File Reference

Detailed Description

Contains the inf structure definition and some functions common to the whole IDA project.

The inf structure is saved in the database and contains information specific to the current program being disassembled. Initially it is filled with values from ida.cfg.

Although it is not a good idea to change values in inf structure (because you will overwrite values taken from ida.cfg), you are allowed to do it if you feel it necessary.

Classes

struct  compiler_info_t
 Information about the target compiler. More...
 
struct  idainfo
 The database parameters. More...
 
struct  post_event_visitor_t
 Implements action to take when the event was processed by the notification callback (i.e. More...
 

Functions

bool idaapi show_repeatables (void)
 Is IDA configured to show all repeatable comments?
 
bool idaapi show_all_comments (void)
 Is IDA configured to show all comment lines?
 
bool idaapi show_comments (void)
 Is IDA configured to show any comments at all?
 
bool idaapi should_trace_sp (void)
 Is IDA configured to trace the stack pointer?
 
bool idaapi should_create_stkvars (void)
 Is IDA configured to create stack variables?
 
int calc_default_idaplace_flags (void)
 Get default disassembly line options (see Disassembly line options)
 
ea_t idaapi to_ea (sel_t reg_cs, ea_t reg_ip)
 Convert (seg,off) value to a linear address.
 
idaman bool ida_export hook_to_notification_point (hook_type_t hook_type, hook_cb_t *cb, void *user_data=NULL)
 Register a callback for a class of events in IDA.
 
idaman int ida_export unhook_from_notification_point (hook_type_t hook_type, hook_cb_t *cb, void *user_data=NULL)
 Unregister a callback (also see hook_to_notification_point()). More...
 
idaman ssize_t ida_export invoke_callbacks (hook_type_t hook_type, int notification_code, va_list va)
 Generate event notification. More...
 
idaman bool ida_export register_post_event_visitor (hook_type_t hook_type, post_event_visitor_t &visitor, const plugin_t *owner)
 Register the post-event visitor. More...
 
idaman bool ida_export unregister_post_event_visitor (hook_type_t hook_type, post_event_visitor_t &visitor)
 Unregister the post-event visitor. More...
 

Macros

#define EA64_ALIGN(n)
 Maintain 64-bit alignments in 64-bit mode.
 
#define INFFL_AUTO   0x01
 Autoanalysis is enabled?
 
#define INFFL_ALLASM   0x02
 may use constructs not supported by More...
 
#define INFFL_LOADIDC   0x04
 loading an idc file that contains database info
 
#define INFFL_NOUSER   0x08
 do not store user info in the database
 
#define INFFL_READONLY   0x10
 (internal) temporary interdiction to modify the database
 
#define INFFL_CHKOPS   0x20
 check manual operands? (unused)
 
#define INFFL_NMOPS   0x40
 allow non-matched operands? (unused)
 
#define INFFL_GRAPH_VIEW   0x80
 currently using graph options ( text_options_t::graph)
 
#define LFLG_PC_FPP   0x00000001
 decode floating point processor instructions?
 
#define LFLG_PC_FLAT   0x00000002
 32-bit program?
 
#define LFLG_64BIT   0x00000004
 64-bit program?
 
#define LFLG_IS_DLL   0x00000008
 Is dynamic library?
 
#define LFLG_FLAT_OFF32   0x00000010
 treat REF_OFF32 as 32-bit offset for 16bit segments (otherwise try SEG16:OFF16)
 
#define LFLG_MSF   0x00000020
 Byte order: is MSB first?
 
#define LFLG_WIDE_HBF   0x00000040
 Bit order of wide bytes: high byte first? More...
 
#define LFLG_DBG_NOPATH   0x00000080
 do not store input full path in debugger process options
 
#define LFLG_SNAPSHOT   0x00000100
 memory snapshot was taken?
 
#define LFLG_PACK   0x00000200
 pack the database?
 
#define LFLG_COMPRESS   0x00000400
 compress the database?
 
#define LFLG_KERNMODE   0x00000800
 is kernel mode binary?
 
#define IDB_UNPACKED   0
 leave database components unpacked
 
#define IDB_PACKED   1
 pack database components into .idb
 
#define IDB_COMPRESSED   2
 compress & pack database components
 
#define AF_CODE   0x00000001
 Trace execution flow.
 
#define AF_MARKCODE   0x00000002
 Mark typical code sequences as code.
 
#define AF_JUMPTBL   0x00000004
 Locate and create jump tables.
 
#define AF_PURDAT   0x00000008
 Control flow to data segment is ignored.
 
#define AF_USED   0x00000010
 Analyze and create all xrefs.
 
#define AF_UNK   0x00000020
 Delete instructions with no xrefs.
 
#define AF_PROCPTR   0x00000040
 Create function if data xref data->code32 exists.
 
#define AF_PROC   0x00000080
 Create functions if call is present.
 
#define AF_FTAIL   0x00000100
 Create function tails.
 
#define AF_LVAR   0x00000200
 Create stack variables.
 
#define AF_STKARG   0x00000400
 Propagate stack argument information.
 
#define AF_REGARG   0x00000800
 Propagate register argument information.
 
#define AF_TRACE   0x00001000
 Trace stack pointer.
 
#define AF_VERSP   0x00002000
 Perform full SP-analysis. ( processor_t::verify_sp)
 
#define AF_ANORET   0x00004000
 Perform 'no-return' analysis.
 
#define AF_MEMFUNC   0x00008000
 Try to guess member function types.
 
#define AF_TRFUNC   0x00010000
 Truncate functions upon code deletion.
 
#define AF_STRLIT   0x00020000
 Create string literal if data xref exists.
 
#define AF_CHKUNI   0x00040000
 Check for unicode strings.
 
#define AF_FIXUP   0x00080000
 Create offsets and segments using fixup info.
 
#define AF_DREFOFF   0x00100000
 Create offset if data xref to seg32 exists.
 
#define AF_IMMOFF   0x00200000
 Convert 32bit instruction operand to offset.
 
#define AF_DATOFF   0x00400000
 Automatically convert data to offsets.
 
#define AF_FLIRT   0x00800000
 Use flirt signatures.
 
#define AF_SIGCMT   0x01000000
 Append a signature name comment for recognized anonymous library functions.
 
#define AF_SIGMLT   0x02000000
 Allow recognition of several copies of the same function.
 
#define AF_HFLIRT   0x04000000
 Automatically hide library functions.
 
#define AF_JFUNC   0x08000000
 Rename jump functions as j_...
 
#define AF_NULLSUB   0x10000000
 Rename empty functions as nullsub_...
 
#define AF_DODATA   0x20000000
 Coagulate data segs at the final pass.
 
#define AF_DOCODE   0x40000000
 Coagulate code segs at the final pass.
 
#define AF_FINAL   0x80000000
 Final pass of analysis.
 
#define AF2_DOEH   0x00000001
 Handle EH information.
 
#define AF2_DORTTI   0x00000002
 Handle RTTI information.
 
#define SW_SEGXRF   0x01
 show segments in xrefs?
 
#define SW_XRFMRK   0x02
 show xref type marks?
 
#define SW_XRFFNC   0x04
 show function offsets?
 
#define SW_XRFVAL   0x08
 show xref values? (otherwise-"...")
 
#define NM_REL_OFF   0
 
#define NM_PTR_OFF   1
 
#define NM_NAM_OFF   2
 
#define NM_REL_EA   3
 
#define NM_PTR_EA   4
 
#define NM_NAM_EA   5
 
#define NM_EA   6
 
#define NM_EA4   7
 
#define NM_EA8   8
 
#define NM_SHORT   9
 
#define NM_SERIAL   10
 
#define DEMNAM_MASK   3
 mask for name form
 
#define DEMNAM_CMNT   0
 display demangled names as comments
 
#define DEMNAM_NAME   1
 display demangled names as regular names
 
#define DEMNAM_NONE   2
 don't display demangled names
 
#define DEMNAM_GCC3   4
 assume gcc3 names (valid for gnu compiler)
 
#define DEMNAM_FIRST   8
 override type info
 
#define LN_NORMAL   0x01
 include normal names
 
#define LN_PUBLIC   0x02
 include public names
 
#define LN_AUTO   0x04
 include autogenerated names
 
#define LN_WEAK   0x08
 include weak names
 
#define OFLG_SHOW_VOID   0x002
 Display void marks?
 
#define OFLG_SHOW_AUTO   0x004
 Display autoanalysis indicator?
 
#define OFLG_GEN_NULL   0x010
 Generate empty lines?
 
#define OFLG_SHOW_PREF   0x020
 Show line prefixes?
 
#define OFLG_PREF_SEG   0x040
 line prefixes with segment name?
 
#define OFLG_LZERO   0x080
 generate leading zeroes in numbers
 
#define OFLG_GEN_ORG   0x100
 Generate 'org' directives?
 
#define OFLG_GEN_ASSUME   0x200
 Generate 'assume' directives?
 
#define OFLG_GEN_TRYBLKS   0x400
 Generate try/catch directives?
 
#define SW_RPTCMT   0x01
 show repeatable comments?
 
#define SW_ALLCMT   0x02
 comment all lines?
 
#define SW_NOCMT   0x04
 no comments at all
 
#define SW_LINNUM   0x08
 show source line numbers
 
#define SW_TESTMODE   0x10
 testida.idc is running
 
#define SW_SHHID_ITEM   0x20
 show hidden instructions
 
#define SW_SHHID_FUNC   0x40
 show hidden functions
 
#define SW_SHHID_SEGM   0x80
 show hidden segments
 
#define LMT_THIN   0x01
 thin borders
 
#define LMT_THICK   0x02
 thick borders
 
#define LMT_EMPTY   0x04
 empty lines at the end of basic blocks
 
#define PREF_SEGADR   0x01
 show segment addresses?
 
#define PREF_FNCOFF   0x02
 show function offsets?
 
#define PREF_STACK   0x04
 show stack pointer?
 
#define STRF_GEN   0x01
 generate names?
 
#define STRF_AUTO   0x02
 names have 'autogenerated' bit?
 
#define STRF_SERIAL   0x04
 generate serial names?
 
#define STRF_UNICODE   0x08
 unicode strings are present?
 
#define STRF_COMMENT   0x10
 generate auto comment for string references?
 
#define STRF_SAVECASE   0x20
 preserve case of strings for identifiers
 
#define ABI_8ALIGN4   0x00000001
 4 byte alignment for 8byte scalars (__int64/double) inside structures?
 
#define ABI_PACK_STKARGS   0x00000002
 do not align stack arguments to stack slots
 
#define ABI_BIGARG_ALIGN   0x00000004
 use natural type alignment for argument if the alignment exceeds native word size More...
 
#define ABI_STACK_LDBL   0x00000008
 long double areuments are passed on stack
 
#define ABI_STACK_VARARGS   0x00000010
 varargs are always passed on stack (even when there are free registers)
 
#define ABI_HARD_FLOAT   0x00000020
 use the floating-point register set
 
#define ABI_SET_BY_USER   0x00000040
 compiler/abi were set by user flag and require SETCOMP_BY_USER flag to be changed
 
#define ABI_GCC_LAYOUT   0x00000080
 use gcc layout for udts (used for mingw)
 
#define UA_MAXOP   8
 max number of operands allowed for an instruction
 
#define IDAPLACE_STACK   0x0010
 produce 2/4/8 bytes per undefined item. More...
 
#define IDAPLACE_SEGADDR   0x0040
 display line prefixes with the segment part
 
#define MAXADDR   0xFF000000L
 
#define IDB_EXT32   "idb"
 Database file extension for 32-bit programs.
 
#define IDB_EXT64   "i64"
 Database file extension for 64-bit programs.
 
#define IDB_EXT   IDB_EXT32
 Database file extension.
 

Typedefs

typedef uchar comp_t
 target compiler id
 
typedef uchar cm_t
 calling convention and memory model
 
typedef ssize_t idaapi hook_cb_t(void *user_data, int notification_code, va_list va)
 Callback provided to hook_to_notification_point(). More...
 

Enumerations

enum  filetype_t {
  f_EXE_old, f_COM_old, f_BIN, f_DRV,
  f_WIN, f_HEX, f_MEX, f_LX,
  f_LE, f_NLM, f_COFF, f_PE,
  f_OMF, f_SREC, f_ZIP, f_OMFLIB,
  f_AR, f_LOADER, f_ELF, f_W32RUN,
  f_AOUT, f_PRC, f_EXE, f_COM,
  f_AIXAR, f_MACHO
}
 Known input file formats (kept in idainfo::filetype): More...
 
enum  storage_type_t { STT_CUR = -1, STT_VA = 0, STT_MM = 1, STT_DBG = 2 }
 Storage types for flag bits. More...
 
enum  hook_type_t {
  HT_IDP, HT_UI, HT_DBG, HT_IDB,
  HT_DEV, HT_VIEW, HT_OUTPUT, HT_GRAPH,
  HT_IDD, HT_LAST
}
 Types of events that be hooked to with hook_to_notification_point() More...
 

Variables

idaman idainfo ida_export_data inf
 program specific information
 

Typedef Documentation

typedef ssize_t idaapi hook_cb_t(void *user_data, int notification_code, va_list va)

Callback provided to hook_to_notification_point().

A plugin can hook to a notification point and receive notifications of all major events in IDA. The callback function will be called for each event.

Parameters
user_datadata supplied in call to hook_to_notification_point()
notification_codeprocessor_t::event_t or ui_notification_t or debugger_t::event_t, depending on the hook type
vaadditional parameters supplied with the notification. see the event descriptions for information
Return values
0ok, the event should be processed further
!=0the event is blocked and should be discarded. in the case of processor modules, the returned value is used as the return value of processor_t::notify()

Enumeration Type Documentation

enum filetype_t

Known input file formats (kept in idainfo::filetype):

Enumerator
f_EXE_old 

MS DOS EXE File.

f_COM_old 

MS DOS COM File.

f_BIN 

Binary File.

f_DRV 

MS DOS Driver.

f_WIN 

New Executable (NE)

f_HEX 

Intel Hex Object File.

f_MEX 

MOS Technology Hex Object File.

f_LX 

Linear Executable (LX)

f_LE 

Linear Executable (LE)

f_NLM 

Netware Loadable Module (NLM)

f_COFF 

Common Object File Format (COFF)

f_PE 

Portable Executable (PE)

f_OMF 

Object Module Format.

f_SREC 

R-records.

f_ZIP 

ZIP file (this file is never loaded to IDA database)

f_OMFLIB 

Library of OMF Modules.

f_AR 

ar library

f_LOADER 

file is loaded using LOADER DLL

f_ELF 

Executable and Linkable Format (ELF)

f_W32RUN 

Watcom DOS32 Extender (W32RUN)

f_AOUT 

Linux a.out (AOUT)

f_PRC 

PalmPilot program file.

f_EXE 

MS DOS EXE File.

f_COM 

MS DOS COM File.

f_AIXAR 

AIX ar library.

f_MACHO 

Mac OS X.

Storage types for flag bits.

Enumerator
STT_CUR 

use current storage type (may be used only as a function argument)

STT_VA 

regular storage: virtual arrays, an explicit flag for each byte

STT_MM 

memory map: sparse storage. useful for huge objects

STT_DBG 

memory map: temporary debugger storage. used internally

Types of events that be hooked to with hook_to_notification_point()

Enumerator
HT_IDP 

Hook to the processor module.

The callback will receive all processor_t::event_t events.

HT_UI 

Hook to the user interface.

The callback will receive all ui_notification_t events.

HT_DBG 

Hook to the debugger.

The callback will receive all dbg_notification_t events.

HT_IDB 

Hook to the database events.

These events are separated from the HT_IDP group to speed things up (there are too many plugins and modules hooking to the HT_IDP). Some essential events are still generated in th HT_IDP group: make_code, make_data This list is not exhaustive. A common trait of all events in this group: the kernel does not expect any reaction to the event and does not check the return code. For event names, see idb_event.

HT_DEV 

Internal debugger events.

Not stable and undocumented for the moment

HT_VIEW 

Custom/IDA views notifications.

Refer to view_notification_t for notification codes

HT_OUTPUT 

Output window notifications.

Refer to msg_notification_t (view_notification_t)

HT_GRAPH 

Handling graph operations (graph_notification_t)

HT_IDD 

Hook to the debugger plugin.

The callback will receive all debugger_t::event_t events.

Function Documentation

idaman int ida_export unhook_from_notification_point ( hook_type_t  hook_type,
hook_cb_t cb,
void *  user_data = NULL 
)

Unregister a callback (also see hook_to_notification_point()).

A plugin should unhook before being unloaded (preferably in its termination function). If different callbacks have the same callback function pointer and user_data is not NULL, only the callback whose associated user defined data matches will be removed.

Returns
number of unhooked functions.
idaman ssize_t ida_export invoke_callbacks ( hook_type_t  hook_type,
int  notification_code,
va_list  va 
)

Generate event notification.

Parameters
hook_typehook type
notification_codeevent code
vaadditional arguments
Returns
!=0: event processed
idaman bool ida_export register_post_event_visitor ( hook_type_t  hook_type,
post_event_visitor_t visitor,
const plugin_t owner 
)

Register the post-event visitor.

The kernel will not take ownership, nor delete the VISITOR instance. Therefore, it's up to the plugin to handle it. In addition, the post_event_visitor_t will be automatically unregistered when the owner plugin is unloaded from memory.

Parameters
hook_typehook type
visitorpost-event visitor
ownerthe owner plugin of the post_event_visitor_t type
Returns
success
idaman bool ida_export unregister_post_event_visitor ( hook_type_t  hook_type,
post_event_visitor_t visitor 
)

Unregister the post-event visitor.

Parameters
hook_typehook type
visitorpost-event visitor
Returns
success