Module ida_expr

Create a new IDC class.

Parameters:

• name - name of the new class (C++: const char *)
• super - the base class for the new class. if the new class is not based on any other class, pass NULL (C++: const idc_class_t *)

Returns: idc_class_t *

pointer to the created class. If such a class already exists, a pointer to it will be returned. Pointers to other existing classes may be invalidated by this call.

    Extends the IDC language by exposing a new IDC function that is backed up by a Python function

    @param name: IDC function name to expose
    @param fp: Python callable that will receive the arguments and return a tuple.
    @param args: Arguments. A tuple of idaapi.VT_XXX constants
    @param flags: IDC function flags. A combination of EXTFUN_XXX constants

    @return: Boolean


    Add an IDC function. This function does not modify the predefined
    kernel functions. Example:
    
    static error_t idaapi myfunc5(idc_value_t *argv, idc_value_t *res)
    {
      msg("myfunc is called with arg0=%a and arg1=%s
", argv[0].num, argv[1].str);
      res->num = 5;     // let's return 5
      return eOk;
    }
    static const char myfunc5_args[] = { VT_LONG, VT_STR, 0 };
    static const ext_idcfunc_t myfunc_desc = { "MyFunc5", myfunc5, myfunc5_args, NULL, 0, EXTFUN_BASE };
    
    // after this:
    add_idc_func(myfunc_desc);
    
    // there is a new IDC function which can be called like this:
    MyFunc5(0x123, "test");
    
    If the function already exists, it will be replaced by the new
    function
    
    @return: success
    

Add global IDC variable.

Parameters:

• name - name of the global variable (C++: const char *)

Returns: idc_value_t

pointer to the created variable or existing variable. NB: the returned pointer is valid until a new global var is added.

Compile text with IDC statements.

Parameters:

• func - name of the function to create out of the snippet (C++: const char *)
• text - text to compile (C++: const char *)
• resolver - callback object to get values of undefined variables This object will be called if IDC function contains references to undefined variables. May be NULL. (C++: idc_resolver_t *)
• only_safe_funcs - if true, any calls to functions without EXTFUN_SAFE flag will lead to a compilation error. (C++: bool)

Returns: str

Copy 'src' to 'dst'. For idc objects only a reference is copied.

Parameters:

• dst, (C++ - idc_value_t *)
• src, (C++ - const idc_value_t &)

Returns: error_t

Create a variable reference. Currently only references to global variables can be created.

Parameters:

• ref - ptr to the result (C++: idc_value_t *)
• v - variable to reference (C++: const idc_value_t *)

Returns: bool

success

Deep copy an IDC object. This function performs deep copy of idc objects. If 'src' is not an object, 'copy_idcv()' will be called

Parameters:

• dst, (C++ - idc_value_t *)
• src, (C++ - const idc_value_t &)

Returns: error_t

Unregisters the specified IDC function

Parameters:

• name - IDC function name to unregister

Returns:

Boolean

Delete an IDC function

Delete an object attribute.

Parameters:

• obj - variable that holds an object reference (C++: idc_value_t *)
• attr - attribute name (C++: const char *)

Returns: error_t

error code, eOk on success

Dereference a 'VT_REF' variable.

Parameters:

• v - variable to dereference (C++: idc_value_t *)
• vref_flags - Dereference IDC variable flags (C++: int)

Returns: idc_value_t

pointer to the dereference result or NULL. If returns NULL, qerrno is set to eExecBadRef "Illegal variable reference"

Compile and calculate an expression.

Parameters:

• rv - pointer to the result (C++: idc_value_t *)
• where - the current linear address in the addressing space of the program being disassembled. If will be used to resolve names of local variables etc. if not applicable, then should be BADADDR . (C++: ea_t)
• line - the expression to evaluate (C++: const char *)

Returns: str

Same as 'eval_expr()' , but will always use the IDC interpreter regardless of the currently installed extlang.

Parameters:

• rv, (C++ - idc_value_t *)
• where, (C++ - ea_t)

Returns: str

Compile and execute IDC function(s) from file.

Parameters:

• result - ptr to idc_value_t to hold result of the function. If execution fails, this variable will contain the exception information. You may pass NULL if you are not interested in the returned value. (C++: idc_value_t *)
• path - text file containing text of IDC functions (C++: const char *)
• func - function name to execute (C++: const char *)
• args - array of parameters (C++: const idc_value_t)
• argsnum - number of parameters to pass to 'fname' This number should be equal to number of parameters the function expects. (C++: size_t)

Returns: str

Compile and execute "main" function from system file.

Parameters:

• file - file name with IDC function(s). The file will be searched in the idc subdir of ida (C++: const char *)
• complain_if_no_file - 1: display warning if the file is not found 0: don't complain if file doesn't exist (C++: bool)

Returns: bool

Find an existing IDC class by its name.

Parameters:

• name - name of the class (C++: const char *)

Returns: idc_class_t *

pointer to the class or NULL. The returned pointer is valid until a new call to add_idc_class()

Find an existing global IDC variable by its name.

Parameters:

• name - name of the global variable (C++: const char *)

Returns: idc_value_t

pointer to the variable or NULL. NB: the returned pointer is valid until a new global var is added. FIXME: it is difficult to use this function in a thread safe manner

Free storage used by 'VT_STR' / 'VT_OBJ' IDC variables. After this call the variable has a numeric value 0

Parameters:

• v, (C++ - idc_value_t *)

Get full name of IDC file name. Search for file in list of include directories, IDCPATH directory and the current directory.

Parameters:

• file - file name without full path (C++: const char *)

Returns: str

NULL is file not found. otherwise returns pointer to buf

Get an object attribute.

Parameters:

• res - buffer for the attribute value (C++: idc_value_t *)
• obj - variable that holds an object reference. if obj is NULL it searches global variables, then user functions (C++: const idc_value_t *)
• attr - attribute name (C++: const char *)
• may_use_getattr - may call getattr functions to calculate the attribute if it does not exist (C++: bool)

Returns: error_t

error code, eOk on success

Retrieves the IDC object class name.

Parameters:

• obj - class instance variable (C++: const idc_value_t *)

Returns: str

error code, eOk on success

Get slice.

Parameters:

• res - output variable that will contain the slice (C++: idc_value_t *)
• v - input variable (string or object) (C++: const idc_value_t *)
• i1 - slice start index (C++: uval_t)
• i2 - slice end index (excluded) (C++: uval_t)
• flags - IDC variable slice flags or 0 (C++: int)

Returns: error_t

eOk if success

Convert IDC variable to a floating point.

Parameters:

• v, (C++ - idc_value_t *)

Returns: error_t

Convert IDC variable to a 64bit number.

Parameters:

• v, (C++ - idc_value_t *)

Returns: error_t

v = 0 if impossible to convert to int64

Convert IDC variable to a long (32/64bit) number.

Parameters:

• v, (C++ - idc_value_t *)

Returns: error_t

v = 0 if impossible to convert to long

Convert IDC variable to a long number.

Parameters:

• v, (C++ - idc_value_t *)

Returns: error_t

v = 0 if IDC variable = "false" string v = 1 if IDC variable = "true" string v = number if IDC variable is number or string containing a number eTypeConflict if IDC variable = empty string

Create an IDC object. The original value of 'v' is discarded (freed).

Parameters:

• v - variable to hold the object. any previous value will be cleaned (C++: idc_value_t *)
• icls - ptr to the desired class. NULL means "object" class this ptr must be returned by add_idc_class() or find_idc_class() (C++: const idc_class_t *)

Returns: error_t

always eOk

Convert IDC variable to a text string.

Parameters:

• v, (C++ - idc_value_t *)

Returns: error_t

Move 'src' to 'dst'. This function is more effective than copy_idcv since it never copies big amounts of data.

Parameters:

• dst, (C++ - idc_value_t *)
• src, (C++ - idc_value_t *)

Returns: error_t

Get text representation of 'idc_value_t' .

Parameters:

• v, (C++ - const idc_value_t &)
• name, (C++ - const char *)
• indent, (C++ - int)

Returns: str

Set or append a header path. IDA looks for the include files in the appended header paths, then in the ida executable directory.

Parameters:

• path - list of directories to add (separated by ';') may be NULL, in this case nothing is added (C++: const char *)
• add - true: append. false: remove old paths. (C++: bool)

Returns: bool

Set an object attribute.

Parameters:

• obj - variable that holds an object reference. if obj is NULL then it tries to modify a global variable with the attribute name (C++: idc_value_t *)
• attr - attribute name (C++: const char *)
• value - new attribute value (C++: const idc_value_t &)
• may_use_setattr - may call setattr functions for the class (C++: bool)

Returns: error_t

error code, eOk on success

Set slice.

Parameters:

• v - variable to modify (string or object) (C++: idc_value_t *)
• i1 - slice start index (C++: uval_t)
• i2 - slice end index (excluded) (C++: uval_t)
• flags - IDC variable slice flags or 0 (C++: int)

Returns: error_t

eOk on success

Swap 2 variables.

Parameters:

• v1, (C++ - idc_value_t *)
• v2, (C++ - idc_value_t *)

Create an idc execution exception object. This helper function can be used to return an exception from C++ code to IDC. In other words this function can be called from 'idc_func_t()' callbacks. Sample usage: if ( !ok ) return throw_idc_exception(r, "detailed error msg");

Parameters:

• r - object to hold the exception object (C++: idc_value_t *)
• desc - exception description (C++: const char *)

Returns: error_t

eExecThrow