IDA SDK
Enumerations
idb_event Namespace Reference

Detailed Description

IDB event group.

Some events are still in the processor group, so you will need to hook to both groups. These events do not return anything.

The callback function should return 0 but the kernel won't check it. Use the hook_to_notification_point() function to install your callback.

Enumerations

enum  event_code_t {
  closebase, savebase, upgraded, auto_empty,
  auto_empty_finally, determined_main, local_types_changed, extlang_changed,
  idasgn_loaded, kernel_config_loaded, loader_finished, flow_chart_created,
  compiler_changed, changing_ti, ti_changed, changing_op_ti,
  op_ti_changed, changing_op_type, op_type_changed, enum_created,
  deleting_enum, enum_deleted, renaming_enum, enum_renamed,
  changing_enum_bf, enum_bf_changed, changing_enum_cmt, enum_cmt_changed,
  enum_member_created, deleting_enum_member, enum_member_deleted, struc_created,
  deleting_struc, struc_deleted, changing_struc_align, struc_align_changed,
  renaming_struc, struc_renamed, expanding_struc, struc_expanded,
  struc_member_created, deleting_struc_member, struc_member_deleted, renaming_struc_member,
  struc_member_renamed, changing_struc_member, struc_member_changed, changing_struc_cmt,
  struc_cmt_changed, segm_added, deleting_segm, segm_deleted,
  changing_segm_start, segm_start_changed, changing_segm_end, segm_end_changed,
  changing_segm_name, segm_name_changed, changing_segm_class, segm_class_changed,
  segm_attrs_updated, segm_moved, allsegs_moved, func_added,
  func_updated, set_func_start, set_func_end, deleting_func,
  frame_deleted, thunk_func_created, func_tail_appended, deleting_func_tail,
  func_tail_deleted, tail_owner_changed, func_noret_changed, stkpnts_changed,
  updating_tryblks, tryblks_updated, deleting_tryblks, sgr_changed,
  make_code, make_data, destroyed_items, renamed,
  byte_patched, changing_cmt, cmt_changed, changing_range_cmt,
  range_cmt_changed, extra_cmt_changed
}
 IDB event codes. More...
 

Enumeration Type Documentation

IDB event codes.

Enumerator
closebase 

The database will be closed now.

savebase 

The database is being saved.

upgraded 

The database has been upgraded and the receiver can upgrade its info as well.

Parameters
from(int) - old IDB version
auto_empty 

Info: all analysis queues are empty.

This callback is called once when the initial analysis is finished. If the queue is not empty upon the return from this callback, it will be called later again.

auto_empty_finally 

Info: all analysis queues are empty definitively.

This callback is called only once.

determined_main 

The main() function has been determined.

Parameters
main(ea_t) address of the main() function
local_types_changed 

Local types have been changed.

extlang_changed 

The list of extlangs or the default extlang was changed.

Parameters
kind(int) 0: extlang installed 1: extlang removed 2: default extlang changed
el(extlang_t *) pointer to the extlang affected
idx(int) extlang index
idasgn_loaded 

FLIRT signature has been loaded for normal processing (not for recognition of startup sequences).

Parameters
short_sig_name(const char *)
kernel_config_loaded 

This event is issued when ida.cfg is parsed.

Parameters
none
loader_finished 

External file loader finished its work.

Use this event to augment the existing loader functionality.

Parameters
li(linput_t *)
neflags(uint16) Load file flags
filetypename(const char *)
flow_chart_created 

Gui has retrieved a function flow chart.

Plugins may modify the flow chart in this callback.

Parameters
fc(qflow_chart_t *)
compiler_changed 

The kernel has changed the compiler information.

( idainfo::cc structure; get_abi_name)

changing_ti 

An item typestring (c/c++ prototype) is to be changed.

Parameters
ea(ea_t)
new_type(const type_t *)
new_fnames(const p_list *)
ti_changed 

An item typestring (c/c++ prototype) has been changed.

Parameters
ea(ea_t)
type(const type_t *)
fnames(const p_list *)
changing_op_ti 

An operand typestring (c/c++ prototype) is to be changed.

Parameters
ea(ea_t)
n(int)
new_type(const type_t *)
new_fnames(const p_list *)
op_ti_changed 

An operand typestring (c/c++ prototype) has been changed.

Parameters
ea(ea_t)
n(int)
type(const type_t *)
fnames(const p_list *)
changing_op_type 

An operand type (offset, hex, etc...) is to be changed.

Parameters
ea(ea_t)
n(int) eventually or'ed with OPND_OUTER or OPND_ALL
opinfo(const opinfo_t *) additional operand info
op_type_changed 

An operand type (offset, hex, etc...) has been set or deleted.

Parameters
ea(ea_t)
n(int) eventually or'ed with OPND_OUTER or OPND_ALL
enum_created 

An enum type has been created.

Parameters
id(enum_t)
deleting_enum 

An enum type is to be deleted.

Parameters
id(enum_t)
enum_deleted 

An enum type has been deleted.

Parameters
id(enum_t)
renaming_enum 

An enum or enum member is to be renamed.

Parameters
id(tid_t)
is_enum(bool)
newname(const char *)
enum_renamed 

An enum or member has been renamed.

Parameters
id(tid_t)
changing_enum_bf 

An enum type 'bitfield' attribute is to be changed.

Parameters
id(enum_t)
new_bf(bool)
enum_bf_changed 

An enum type 'bitfield' attribute has been changed.

Parameters
id(enum_t)
changing_enum_cmt 

An enum or member type comment is to be changed.

Parameters
id(tid_t)
repeatable(bool)
newcmt(const char *)
enum_cmt_changed 

An enum or member type comment has been changed.

Parameters
id(tid_t)
repeatable(bool)
enum_member_created 

An enum member has been created.

Parameters
id(enum_t)
cid(const_t)
deleting_enum_member 

An enum member is to be deleted.

Parameters
id(enum_t)
cid(const_t)
enum_member_deleted 

An enum member has been deleted.

Parameters
id(enum_t)
cid(const_t)
struc_created 

A new structure type has been created.

Parameters
struc_id(tid_t)
deleting_struc 

A structure type is to be deleted.

Parameters
sptr(struc_t *)
struc_deleted 

A structure type has been deleted.

Parameters
struc_id(tid_t)
changing_struc_align 

A structure type is being changed (the struct alignment).

Parameters
sptr(struc_t *)
struc_align_changed 

A structure type has been changed (the struct alignment).

Parameters
sptr(struc_t *)
renaming_struc 

A structure type is to be renamed.

Parameters
id(tid_t)
oldname(const char *)
newname(const char *)
struc_renamed 

A structure type has been renamed.

Parameters
sptr(struc_t *)
expanding_struc 

A structure type is to be expanded/shrunk.

Parameters
sptr(struc_t *)
offset(ea_t)
delta(adiff_t)
struc_expanded 

A structure type has been expanded/shrank.

Parameters
sptr(struc_t *)
struc_member_created 

A structure member has been created.

Parameters
sptr(struc_t *)
mptr(member_t *)
deleting_struc_member 

A structure member is to be deleted.

Parameters
sptr(struc_t *)
mptr(member_t *)
struc_member_deleted 

A structure member has been deleted.

Parameters
sptr(struc_t *)
member_id(tid_t)
offset(ea_t)
renaming_struc_member 

A structure member is to be renamed.

Parameters
sptr(struc_t *)
mptr(member_t *)
newname(const char *)
struc_member_renamed 

A structure member has been renamed.

Parameters
sptr(struc_t *)
mptr(member_t *)
changing_struc_member 

A structure member is to be changed.

Parameters
sptr(struc_t *)
mptr(member_t *)
flag(flags_t)
ti(const opinfo_t *)
nbytes(asize_t)
struc_member_changed 

A structure member has been changed.

Parameters
sptr(struc_t *)
mptr(member_t *)
changing_struc_cmt 

A structure type comment is to be changed.

Parameters
struc_id(tid_t)
repeatable(bool)
newcmt(const char *)
struc_cmt_changed 

A structure type comment has been changed.

Parameters
struc_id(tid_t)
repeatable_cmt(bool)
segm_added 

A new segment has been created.

Parameters
s(segment_t *)
deleting_segm 

A segment is to be deleted.

Parameters
start_ea(ea_t)
segm_deleted 

A segment has been deleted.

Parameters
start_ea(ea_t)
end_ea(ea_t)
changing_segm_start 

Segment start address is to be changed.

Parameters
s(segment_t *)
new_start(ea_t)
segmod_flags(int)
segm_start_changed 

Segment start address has been changed.

Parameters
s(segment_t *)
oldstart(ea_t)
changing_segm_end 

Segment end address is to be changed.

Parameters
s(segment_t *)
new_end(ea_t)
segmod_flags(int)
segm_end_changed 

Segment end address has been changed.

Parameters
s(segment_t *)
oldend(ea_t)
changing_segm_name 

Segment name is being changed.

Parameters
s(segment_t *)
oldname(const char *)
segm_name_changed 

Segment name has been changed.

Parameters
s(segment_t *)
name(const char *)
changing_segm_class 

Segment class is being changed.

Parameters
s(segment_t *)
segm_class_changed 

Segment class has been changed.

Parameters
s(segment_t *)
sclass(const char *)
segm_attrs_updated 

Segment attributes has been changed.

Parameters
s(segment_t *) This event is generated for secondary segment attributes (examples: color, permissions, etc)
segm_moved 

Segment has been moved.

Parameters
from(ea_t)
to(ea_t)
size(asize_t)
changed_netmap(bool) See also idb_event::allsegs_moved
allsegs_moved 

Program rebasing is complete.

This event is generated after series of segm_moved events

Parameters
info(::segm_move_infos_t *)
func_added 

The kernel has added a function.

Parameters
pfn(func_t *)
func_updated 

The kernel has updated a function.

Parameters
pfn(func_t *)
set_func_start 

Function chunk start address will be changed.

Parameters
pfn(func_t *)
new_start(ea_t)
set_func_end 

Function chunk end address will be changed.

Parameters
pfn(func_t *)
new_end(ea_t)
deleting_func 

The kernel is about to delete a function.

Parameters
pfn(func_t *)
frame_deleted 

The kernel has deleted a function frame.

Parameters
pfn(func_t *)
thunk_func_created 

A thunk bit has been set for a function.

Parameters
pfn(func_t *)
func_tail_appended 

A function tail chunk has been appended.

Parameters
pfn(func_t *)
tail(func_t *)
deleting_func_tail 

A function tail chunk is to be removed.

Parameters
pfn(func_t *)
tail(const ::range_t *)
func_tail_deleted 

A function tail chunk has been removed.

Parameters
pfn(func_t *)
tail_ea(ea_t)
tail_owner_changed 

A tail chunk owner has been changed.

Parameters
tail(func_t *)
owner_func(ea_t)
old_owner(ea_t)
func_noret_changed 

FUNC_NORET bit has been changed.

Parameters
pfn(func_t *)
stkpnts_changed 

Stack change points have been modified.

Parameters
pfn(func_t *)
updating_tryblks 

About to update tryblk information.

Parameters
tbv(const ::tryblks_t *)
tryblks_updated 

Updated tryblk information.

Parameters
tbv(const ::tryblks_t *)
deleting_tryblks 

About to delete tryblk information in given range.

Parameters
range(const ::range_t *)
sgr_changed 

The kernel has changed a segment register value.

Parameters
start_ea(ea_t)
end_ea(ea_t)
regnum(int)
value(sel_t)
old_value(sel_t)
tag(uchar) SR_
make_code 

An instruction is being created.

Parameters
insn(const insn_t*)
make_data 

A data item is being created.

Parameters
ea(ea_t)
flags(flags_t)
tid(tid_t)
len(asize_t)
destroyed_items 

Instructions/data have been destroyed in [ea1,ea2).

Parameters
ea1(ea_t)
ea2(ea_t)
will_disable_range(bool)
renamed 

The kernel has renamed a byte.

See also the rename event

Parameters
ea(ea_t)
new_name(const char *)
local_name(bool)
byte_patched 

A byte has been patched.

Parameters
ea(ea_t)
old_value(uint32)
changing_cmt 

An item comment is to be changed.

Parameters
ea(ea_t)
repeatable_cmt(bool)
newcmt(const char *)
cmt_changed 

An item comment has been changed.

Parameters
ea(ea_t)
repeatable_cmt(bool)
changing_range_cmt 

Range comment is to be changed.

Parameters
kind(::range_kind_t)
a(const ::range_t *)
cmt(const char *)
repeatable(bool)
range_cmt_changed 

Range comment has been changed.

Parameters
kind(::range_kind_t)
a(const ::range_t *)
cmt(const char *)
repeatable(bool)
extra_cmt_changed 

An extra comment has been changed.

Parameters
ea(ea_t)
line_idx(int)
cmt(const char *)