Module ida_bytes

Add a value to one byte of the program. This function works for wide byte processors too.

Parameters:

• ea - linear address (C++: ea_t)
• value - byte value (C++: uint32)

Add a value to one dword of the program. This function works for wide byte processors too. This function takes into account order of bytes specified in \inf{is_be()}this function works incorrectly if \ph{nbits} > 16

Parameters:

• ea - linear address (C++: ea_t)
• value - byte value (C++: uint64)

Mark a range of addresses as hidden. The range will be created in the invisible state with the default color

Parameters:

• ea1 - linear address of start of the address range (C++: ea_t)
• ea2 - linear address of end of the address range (C++: ea_t)
• description - range parameters (C++: const char *)
• header - range parameters (C++: const char *)
• footer - range parameters (C++: const char *)
• color, (C++ - bgcolor_t)

Returns: bool

success

IDA supports memory mapping. References to the addresses from the mapped range use data and meta-data from the mapping range.You should set flag PR2_MAPPING in ph.flag2 to use memory mapping Add memory mapping range.

Parameters:

• _from - start of the mapped range (nonexistent address) (C++: ea_t)
• to - start of the mapping range (existent address) (C++: ea_t)
• size - size of the range (C++: asize_t)

Returns: bool

success

Add a value to one qword of the program. This function does not work for wide byte processors. This function takes into account order of bytes specified in \inf{is_be()}

Parameters:

• ea - linear address (C++: ea_t)
• value - byte value (C++: uint64)

Add a value to one word of the program. This function works for wide byte processors too. This function takes into account order of bytes specified in \inf{is_be()}

Parameters:

• ea - linear address (C++: ea_t)
• value - byte value (C++: uint64)

Append to an indented comment. Creates a new comment if none exists. Appends a newline character and the specified string otherwise.

Parameters:

• ea - linear address (C++: ea_t)
• str - comment string to append (C++: const char *)
• rptble - append to repeatable comment? (C++: bool)

Returns: bool

success

Attach the data format to the data type.

Parameters:

• dtid - data type id that can use the data format. 0 means all standard data types. Such data formats can be applied to any data item or instruction operands. For instruction operands, the data_format_t::value_size check is not performed by the kernel. (C++: int)
• dfid - data format id (C++: int)

Returns: bool

Get number of bytes required to store a byte at the given address.

Parameters:

• ea, (C++ - ea_t)

Returns: int

Calculate default alignment.

Parameters:

• ea, (C++ - ea_t)
• mina, (C++ - int)
• maxa, (C++ - int)

Returns: int

Returns: 0..32.

Parameters:

• endea, (C++ - ea_t)

Returns: int

Calculate maximal reasonable end address of a new item. This function will limit the item with the current segment bounds.

Parameters:

• ea - linear address (C++: ea_t)
• how - when to stop the search. A combination of Item end search flags (C++: int)

Returns: ea_t

end of new item. If it is not possible to create an item, it will return 'ea'.

Returns: 1..32.

Parameters:

• length, (C++ - asize_t)

Returns: int

Can define item (instruction/data) of the specified 'length', starting
at 'ea'?if there is an item starting at 'ea', this function ignores
itthis function converts to unexplored all encountered data items with
fixup information. Should be fixed in the future.a new item would
cross segment boundariesa new item would overlap with existing items
(except items specified by 'flags')

@param ea (C++: ea_t)
@param length (C++: asize_t)
@param flags: if not 0, then the kernel will ignore the data types
              specified by the flags and destroy them. For example:
              1000 dw 5                  1002 db 5 ; undef
              1003 db 5 ; undef                  1004 dw 5
              1006 dd 5                    can_define_item(1000, 6, 0)
              - false because of dw at 1004    can_define_item(1000,
              6, word_flag()) - true, word at 1004 is destroyed (C++:
              flags_t)
@return: 1-yes, 0-no

Returns: bool

Change flag storage type for address range.

Parameters:

• start_ea - should be lower than end_ea. (C++: ea_t)
• end_ea - does not belong to the range. (C++: ea_t)
• stt - storage_type_t (C++: storage_type_t)

Returns: error_t

error code

Get size of the contiguous address block containing 'ea'.

Parameters:

• ea, (C++ - ea_t)

Returns: asize_t

0 if 'ea' doesn't belong to the program.

Get start of the contiguous address block containing 'ea'.

Parameters:

• ea, (C++ - ea_t)

Returns: ea_t

BADADDR if 'ea' doesn't belong to the program.

Clear lzero bit.

Parameters:

• ea, (C++ - ea_t)
• n, (C++ - int)

Returns: bool

Remove operand representation information. (set operand representation to be 'undefined')

Parameters:

• ea - linear address (C++: ea_t)
• n - number of operand (0, 1, -1) (C++: int)

Returns: bool

success

Convert to 16-bit quantity (take byte size into account)

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)

Returns: bool

Convert to 32-bit quantity (take byte size into account)

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)

Returns: bool

Alignment: 0 or 2..32. If it is 0, is will be calculated.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• alignment, (C++ - int)

Returns: bool

Convert to byte.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to custom data type.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• dtid, (C++ - int)
• fid, (C++ - int)
• force, (C++ - bool)

Returns: bool

Convert to data (byte, word, dword, etc). This function may be used to create arrays.

Parameters:

• ea - linear address (C++: ea_t)
• dataflag - type of data. Value of function byte_flag() , word_flag() , etc. (C++: flags_t)
• size - size of array in bytes. should be divisible by the size of one item of the specified type. for variable sized items it can be specified as 0, and the kernel will try to calculate the size. (C++: asize_t)
• tid - type id. If the specified type is a structure, then tid is structure id. Otherwise should be BADNODE . (C++: tid_t)

Returns: bool

success

Convert to double.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to dword.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to float.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to octaword/xmm word.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to packed decimal real.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to quadword.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to string literal and give a meaningful name. 'start' may be higher than 'end', the kernel will swap them in this case

Parameters:

• start - starting address (C++: ea_t)
• len - length of the string in bytes. if 0, then get_max_strlit_length() will be used to determine the length (C++: size_t)
• strtype - string type. one of String type codes (C++: int32)

Returns: bool

success

Convert to struct.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• tid, (C++ - tid_t)
• force, (C++ - bool)

Returns: bool

Convert to tbyte.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to word.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to ymm word.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Convert to zmm word.

Parameters:

• ea, (C++ - ea_t)
• length, (C++ - asize_t)
• force, (C++ - bool)

Returns: bool

Delete hidden range.

Parameters:

• ea - any address in the hidden range (C++: ea_t)

Returns: bool

success

Convert item (instruction/data) to unexplored bytes. The whole item (including the head and tail bytes) will be destroyed. It is allowed to pass any address in the item to this function

Parameters:

• ea - any address within the first item to delete (C++: ea_t)
• flags - combination of Unexplored byte conversion flags (C++: int)
• nbytes - number of bytes in the range to be undefined (C++: asize_t)
• may_destroy - optional routine invoked before deleting a head item. If callback returns false then item has not to be deleted and operation fails (C++: may_destroy_cb_t *)

Returns: bool

true on sucessful operation, otherwise false

Delete memory mapping range.

Parameters:

• ea - any address in the mapped range (C++: ea_t)

Delete byte value from flags. The corresponding byte becomes uninitialized.

Parameters:

• ea, (C++ - ea_t)

Detach the data format from the data type. Unregistering a custom data type detaches all attached data formats, no need to detach them explicitly. You still need unregister them. Unregistering a custom data format detaches it from all attached data types.

Parameters:

• dtid - data type id to detach data format from (C++: int)
• dfid - data format id to detach (C++: int)

Returns: bool

Deallocate flags for address range. Exit with an error message if not enough disk space (this may occur too).

Parameters:

• start_ea - should be lower than end_ea. (C++: ea_t)
• end_ea - does not belong to the range. (C++: ea_t)

Returns: error_t

0 if ok, otherwise return error code

Allocate flags for address range. This function does not change the storage type of existing ranges. Exit with an error message if not enough disk space.

Parameters:

• start_ea - should be lower than end_ea. (C++: ea_t)
• end_ea - does not belong to the range. (C++: ea_t)
• stt - storage_type_t (C++: storage_type_t)

Returns: error_t

0 if ok, otherwise an error code

Compare 'len' bytes of the program starting from 'ea' with 'image'.

Parameters:

• ea - linear address (C++: ea_t)
• image - bytes to compare with (C++: const uchar *)
• mask - array of 1/0 bytes, it's length is 'len'. 1 means to perform the comparison of the corresponding byte. 0 means not to perform. if mask == NULL, then all bytes of 'image' will be compared. if mask == SKIP_FF_MASK then 0xFF bytes will be skipped (C++: const uchar *)
• len - length of block to compare in bytes. (C++: size_t)
• sense_case - case-sensitive comparison? (C++: bool)

Returns: bool

Does the current byte have dummy (auto-generated, with special prefix) name?

Parameters:

• f, (C++ - flags_t)

Returns: bool

Does the current byte have non-trivial (non-dummy) name?

Parameters:

• f, (C++ - flags_t)

Returns: bool

Does the current byte have user-specified name?

Parameters:

• F, (C++ - flags_t)

Returns: bool

Does the current byte have cross-references to it?

Parameters:

• f, (C++ - flags_t)

Returns: bool

See 'is_align()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_byte()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

Does flag denote start of an instruction?

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_custom()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

Does flag denote start of data?

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_double()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_dword()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_float()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

Does flag denote start of instruction OR data?

Parameters:

• F, (C++ - flags_t)

Returns: bool

Does flag denote tail byte?

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_oword()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_pack_real()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_qword()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_strlit()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_struct()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

Does flag denote tail byte?

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_tbyte()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_word()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

See 'is_yword()'

Parameters:

• F, (C++ - flags_t)

Returns: bool

Find forward a byte with the specified value (only 8-bit value from the database). example: ea=4 size=3 will inspect addresses 4, 5, and 6

Parameters:

• sEA - linear address (C++: ea_t)
• size - number of bytes to inspect (C++: asize_t)
• value - value to find (C++: uchar)
• bin_search_flags - combination of Search flags (C++: int)

Returns: ea_t

address of byte or BADADDR

Find reverse a byte with the specified value (only 8-bit value from the database). example: ea=4 size=3 will inspect addresses 6, 5, and 4

Parameters:

• sEA - the lower address of the search range (C++: ea_t)
• size - number of bytes to inspect (C++: asize_t)
• value - value to find (C++: uchar)
• bin_search_flags - combination of Search flags (C++: int)

Returns: ea_t

address of byte or BADADDR

Get id of a custom data format.

Parameters:

• name - name of the custom data format (C++: const char *)

Returns: int

id or -1

Get id of a custom data type.

Parameters:

• name - name of the custom data type (C++: const char *)

Returns: int

id or -1

Search for a hole in the addressing space of the program.

Parameters:

• bottom - address to start searching (C++: ea_t)
• size - size of desired block (C++: asize_t)
• step - bit mask for the start of hole (0xF would align hole to a paragraph). if 'step' is negative, the bottom address with be aligned. otherwise the kernel will try to use it as is and align it only when the hole is too small. (C++: int32)

Returns: ea_t

start of the hole or BADADDR

Get 16bits of the program at 'ea'.

Parameters:

• ea, (C++ - ea_t)

Returns: uint32

1 byte (getFullByte()) if the current processor has 16-bit byte, otherwise return get_word()

Get not more than 32bits of the program at 'ea'.

Parameters:

• ea, (C++ - ea_t)

Returns: uint32

32 bit value, depending on \ph{nbits}: if ( nbits <= 8 ) return get_dword(ea); if ( nbits <= 16) return get_wide_word(ea); return get_wide_byte(ea);

Get not more than 64bits of the program at 'ea'.

Parameters:

• ea, (C++ - ea_t)

Returns: uint64

64 bit value, depending on \ph{nbits}: if ( nbits <= 8 ) return get_qword(ea); if ( nbits <= 16) return get_wide_dword(ea); return get_wide_byte(ea);

Get one byte (8-bit) of the program at 'ea'. This function works only for 8bit byte processors.

Parameters:

• ea, (C++ - ea_t)

Returns: uchar

Get the specified number of bytes of the program.

Parameters:

• ea - program address
• size - number of bytes to return

Returns: PyObject *

the bytes (as a str), or None in case of failure

Get the specified number of bytes of the program, and a bitmask specifying what bytes are defined and what bytes are not.

Parameters:

• ea - program address
• size - number of bytes to return

Returns: PyObject *

a tuple (bytes, mask), or None in case of failure. Both 'bytes' and 'mask' are 'str' instances.

Get an indented comment.

Parameters:

• ea - linear address. may point to tail byte, the function will find start of the item (C++: ea_t)
• rptble - get repeatable comment? (C++: bool)

Returns: str

size of comment or -1

Get definition of a registered custom data format.

Parameters:

• dfid - data format id (C++: int)

Returns: data_format_t

data format definition or NULL

Get list of attached custom data formats for the specified data type.

Parameters:

• out - buffer for the output. may be NULL (C++: intvec_t *)
• dtid - data type id (C++: int)

Returns: int

number of returned custom data formats. if error, returns -1

Get definition of a registered custom data type.

Parameters:

• dtid - data type id (C++: int)

Returns: data_type_t

data type definition or NULL

Get list of registered custom data type ids.

Parameters:

• out - buffer for the output. may be NULL (C++: intvec_t *)
• min_size - minimum value size (C++: asize_t)
• max_size - maximum value size (C++: asize_t)

Returns: int

number of custom data types with the specified size limits

Get size of data type specified in flags 'F'.

Parameters:

• ea - linear address of the item (C++: ea_t)
• F - flags (C++: flags_t)
• ti - additional information about the data type. For example, if the current item is a structure instance, then ti->tid is structure id. Otherwise is ignored (may be NULL). If specified as NULL, will be automatically retrieved from the database (C++: const opinfo_t *)

Returns: asize_t

byte : 1 word : 2 etc...

Get the value at of the item at 'ea'. This function works with entities up to sizeof(ea_t) (bytes, word, etc)

Parameters:

• v - pointer to the result. may be NULL (C++: uval_t *)
• ea - linear address (C++: ea_t)
• size - size of data to read. If 0, then the item type at 'ea' will be used (C++: asize_t)

Returns: bool

success

Get one byte (8-bit) of the program at 'ea' from the database. Works even if the debugger is active. See also 'get_dbg_byte()' to read the process memory directly. This function works only for 8bit byte processors.

Parameters:

• ea, (C++ - ea_t)

Returns: uchar

Get default base of number for the current processor.

Returns: int

2, 8, 10, 16

Get one dword (32-bit) of the program at 'ea'. This function takes into account order of bytes specified in \inf{is_be()} This function works only for 8bit byte processors.

Parameters:

• ea, (C++ - ea_t)

Returns: uint32

Get enum id of 'enum' operand.

Parameters:

• ea - linear address (C++: ea_t)
• n - number of operand (0, 1, -1) (C++: int)

Returns: enum_t

id of enum or BADNODE

Get pointer to the first hidden range.

Returns: hidden_range_t

ptr to hidden range or NULL

get flags with 'FF_IVL' & 'MS_VAL' . It is much slower under remote debugging because the kernel needs to read the process memory.

Parameters:

• ea, (C++ - ea_t)

Returns: flags_t

Get flags from size (in bytes). Supported sizes: 1, 2, 4, 8, 16, 32. For other sizes returns 0

Parameters:

• size, (C++ - size_t)

Returns: flags_t

Get flags for the specified address, extended form.

Parameters:

• ea, (C++ - ea_t)
• how, (C++ - int)

Returns: flags_t

Get forced operand.

Parameters:

• ea - linear address (C++: ea_t)
• n - number of operand (0, 1, 2) (C++: int)

Returns: str

size of forced operand or -1

Get full size of data type specified in flags 'F'. takes into account processors with wide bytes e.g. returns 2 for a byte element with 16-bit bytes

Parameters:

• ea, (C++ - ea_t)
• F, (C++ - flags_t)
• ti, (C++ - const opinfo_t *)

Returns: asize_t

Get flags value for address 'ea'.

Parameters:

• ea, (C++ - ea_t)

Returns: flags_t

0 if address is not present in the program

Get pointer to hidden range structure, in: linear address.

Parameters:

• ea - any address in the hidden range (C++: ea_t)

Returns: hidden_range_t

Get number of a hidden range.

Parameters:

• ea - any address in the hidden range (C++: ea_t)

Returns: int

number of hidden range (0.. get_hidden_range_qty() -1)