| Trees | Indices | Help |
|
|---|
|
|
IDC compatibility module
This file contains IDA built-in function declarations and internal bit definitions. Each byte of the program has 32-bit flags (low 8 bits keep the byte value). These 32 bits are used in get_full_flags/get_flags functions.
This file is subject to change without any notice. Future versions of IDA may use other definitions.
| Classes | |
|
DeprecatedIDCError Exception for deprecated function calls |
|
| Functions | |||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
| Function Details |
Get linear address of a name
|
Get module size for debug event
|
Enable/disable batch mode of operation
|
Get modification of SP made by the instruction
|
Set segment attribute
Note: Please note that not all segment attributes are modifiable. Also some of them should be modified using special functions like set_segm_addressing, etc. |
Delete a hash element.
|
Get ID of function frame structure
|
Convert the current item to a word (2 bytes)
|
modifiable characteristics of a breakpoint
|
Get start address of a segment
|
Sets the string value of an array element.
|
qsleep the specified number of milliseconds This function suspends IDA for the specified amount of time
|
Get byte value from flags Get value of byte provided that the byte is initialized. This macro works ok only for 8-bit byte machines. |
Enable step tracing
|
Get value of segment register at the specified address
Note: The segment registers in 32bit program usually contain selectors, so to get paragraph pointed to by the segment register you need to call sel2para() function. |
Convert the current item to a structure instance
|
Retrieve a local type declaration
|
Get fixup target flags
|
Save from IDA database to file
|
Get exception code for EXCEPTION event
|
Delete array, by its ID.
|
Execute an OS command.
Note: IDA will wait for the started program to finish. In order to start the command in parallel, use OS methods. For example, you may start another program in parallel using "start" command. |
Delete structure member
Note: IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes. |
Is the debug event handled?
|
Convert the current item to a double floating point (8 bytes)
|
Change the function chunk owner
Note: The new owner must already have the chunk appended before the call |
Change combination of the segment
|
Is a structure a union?
Note: Unions are a special kind of structures |
Convert the current item to a ymm word (32 bytes/256 bits)
|
Get next offset in a structure
Notes:
|
Change function flags
|
Get comment of a member
|
Set bitmask comment (only for bitfields)
|
Get module name for debug event
|
Get info for EXCEPTION event
|
Change structure member type
Note: The remaining arguments are allowed only if is_off0(flag) and you want to specify a complex offset expression |
Force BL instruction to be a call
|
Get previous offset in a structure
Notes:
|
Get value of a floating point number (4 bytes) This function assumes number stored using IEEE format and in the same endianness as integers.
|
Get module base for debug event
|
Get fixup target selector
|
Generate a flow chart GDL file
Note: If ea2 == BADADDR then ea1 is treated as an address within a function. That function will be flow charted. |
Delete all segments, instructions, comments, i.e. everything except values of bytes. |
Get value of program double-word using the debugger memory
|
Get exit code for debug event
|
Get the next key in the hash.
|
Evaluate an IDC expression
Note: Python implementation evaluates IDC only, while IDC can call other registered languages |
Guess type of function/variable
|
Gets the string value of a hash element.
|
Convert the current item to a byte
|
Get process ID for debug event
|
Convert the current item to a tbyte (10 or 12 bytes)
|
Get string contents
|
Get number of members of a structure
Note: Union members are, in IDA's internals, located at subsequent byte offsets: member 0 -> offset 0x0, member 1 -> offset 0x1, etc... |
Get the disassembly line at the cursor
|
Get index of the next existing array element.
|
Get type information of function/variable as 'typeinfo' object
|
Delete a structure type
|
Invokes an IDA UI action by name
|
Get previous defined item (instruction or data) in the program
|
Get segment attribute
|
Write to debugger memory.
|
Get disassembly line
Note: this function may not return exactly the same mnemonics as you see on the screen. |
Ask the user to select a function Arguments:
|
Add a member of enum - a symbolic constant
|
Enumerate process modules
|
Return the specified number of bytes of the program
|
Get item color
|
Get a function attribute
|
Create a local variable
Note: For the stack variables the end address is ignored. If there is no function at 'start' then this function. will fail. |
Get number used in the operand This function returns an immediate number used in the operand
|
Get name of a member of a structure
|
Get offset of a member of a structure by the member name
Note: Union members are, in IDA's internals, located at subsequent byte offsets: member 0 -> offset 0x0, member 1 -> offset 0x1, etc... |
Get hardware address for BREAKPOINT event
|
Get the next function chunk of the specified function
Note: This function returns the next chunk of the specified function |
Get fixup target type
|
Set register value
Note: The debugger should be running It is not necessary to use this function to set register values. A register name in the left side of an assignment will do too. |
Parse one type declaration and store it in the specified slot
|
Change structure index
Note: See get_first_struc_idx() for the explanation of structure indices and IDs. |
Convert the current item to a quadro word (8 bytes)
|
Get prev constant in the enum
|
Get type of a member
|
Add automatical SP register change point
|
Get offset of the first member of a structure
Notes:
|
Set array representation format
|
Move a segment to a new address This function moves all information to the new address It fixes up address sensitive information in the kernel The total effect is equal to reloading the segment to the target address
|
demangle_name a name
|
Get array array_id, by name.
|
Delete a member of enum - a symbolic constant
|
Get name of a segment
|
Return type of the last xref obtained by [RD]first/next[B0] functions.
|
|
Get value of program byte using the debugger memory
|
Apply the specified type to the address
@param ea: the address of the object
@param py_type: typeinfo tuple (type, fields) as get_tinfo() returns
or tuple (name, type, fields) as parse_decl() returns
or None
if specified as None, then the
item associated with 'ea' will be deleted.
@param flags: combination of TINFO_... constants or 0
@return: Boolean
|
Get IDB full path This function returns full path of the current IDB database |
Get value of array element.
|
Convert the current item to an octa word (16 bytes/128 bits)
|
Get number of local types + 1
|
Set a function attribute
|
Sets the long value of a hash element.
|
Get end address of a segment
|
Get register value
Note: The debugger should be running. otherwise the function fails the register name should be valid. It is not necessary to use this function to get register values because a register name in the script will do too. |
Make function frame
|
Get value of program quadro-word using the debugger memory
|
Get index of last existing array element.
|
Change name of the segment
|
Delete an array element.
|
Generate an output file
|
Get a selector value
Note: selector values are always in paragraphs |
Set default segment register value for a segment
|
Get instruction mnemonics
Note: this function may not return exactly the same mnemonics as you see on the screen. |
Get next segment
|
Get breakpoint address
|
Get structure id of a member
|
Enumerate process modules
|
Get fixup target displacement
|
Convert operand to an offset (for the explanations of 'ea' and 'n' please see op_bin()) Example:seg000:2000 dw 1234h and there is a segment at paragraph 0x1000 and there is a data item within the segment at 0x1234: seg000:1234 MyString db 'Hello, world!',0 Then you need to specify a linear address of the segment base to create a proper offset: op_plain_offset(["seg000",0x2000],0,0x10000); and you will have: seg000:2000 dw offset MyString Motorola 680x0 processor have a concept of "outer offsets". If you want to create an outer offset, you need to combine number of the operand with the following bit: Please note that the outer offsets are meaningful only for Motorola 680x0.
|
Rename array, by its ID.
|
Rotate a value to the left (or right)
|
Gets the long value of a hash element.
|
Get disassembly line
Note: this function may not return exactly the same mnemonics as you see on the screen. |
Create an array.
Note: This function will create an array of the items with the same type as the type of the item at 'ea'. If the byte at 'ea' is undefined, then this function will create an array of bytes. |
check consistency of IDB name records
|
Get id of constant
|
Retrieve a local type name
|
Get first segment
|
Parse type declarations
|
Delete SP register change point
|
Convert the current item to a floating point (4 bytes)
|
Get ID of debug event
|
Print types in a format suitable for use in a header file
|
Expand or shrink a structure type
|
Convert operand to a high offset High offset is the upper 16bits of an offset. This type is used by TMS320C6 processors (and probably by other RISC processors too)
|
Get the last key in the hash.
|
Get address for EXCEPTION event
|
Convert the current item to a double word (4 bytes)
|
Load file into IDA database
|
Change alignment of the segment
|
Copy information from type library to database Copy structure, union, or enum definition from the type library to the IDA database.
|
Set segment type
|
Convert the current item to a packed real (10 or 12 bytes)
|
Remove a function chunk from the function
|
Returns the size of the type. It is equivalent to IDC's sizeof(). Use name, tp, fld = idc.parse_decl() ; SizeOf(tp) to retrieve the size
|
Perform full analysis of the range
|
Get segment selector by name
|
Get fixup target offset
|
Retrieve function flags
|
Get bitmask name (only for bitfields)
|
Define a new structure type
|
Get size of saved registers in function frame
|
Get end address of the selected range
|
Get type ID for debug event
|
Does the given function contain the given address?
|
Set fixup information
|
Parse type declaration
|
Get a function chunk attribute
|
Get the first function chunk of the specified function
Note: This function returns the first (main) chunk of the specified function |
Get name of a constant
|
Find previous function
|
Change segment boundaries
|
Retrieve function comment
|
Get last constant in the enum
|
Set value of a segment register.
Note: IDA keeps tracks of all the points where segment register change their values. This function allows you to specify the correct value of a segment register if IDA is not able to find the corrent value. |
Change structure member comment
|
Get ea for debug event
|
Get current delta for the stack pointer
|
Find a selector which has the specifed value
Note: selector values are always in paragraphs |
Convert address value to a string Return address in the form 'seg000:1234' (the same as in line prefixes)
|
Determine a new function boundaries
|
Get first constant in the enum
|
Get size of local variables in function frame
|
Add structure member
Note: The remaining arguments are allowed only if is_off0(flag) and you want to specify a complex offset expression |
Append a function chunk to the function
Note: If a chunk exists at the specified addresses, it must have exactly the specified boundaries |
Rename an address
|
Generate a function call graph GDL file
|
Get the first key in the hash.
|
Set item color
|
Return the address with the minimal spd (stack pointer delta) If there are no SP change points, then return BADADDR.
|
Get previous function chunk
Note: This function enumerates all chunks of all functions in the database |
Get index of the first existing array element.
|
Get next constant in the enum
|
Get size of a member
|
Change class of the segment
|
Get size of arguments in function frame which are purged upon return
|
Get local type information as 'typeinfo' object
|
Get value of a floating point number (8 bytes) This function assumes number stored using IEEE format and in the same endianness as integers.
|
Add a new enum type
|
Save current database to the specified idb file
|
Get IDA directory This function returns the directory where IDA.EXE resides |
Find next function
|
Get the previous key in the hash.
|
Check the result of eval_idc() for evaluation failures
|
Sets the long value of an array element.
|
Change segment addressing
|
Convert operand to an offset in a structure
|
Create a string. This function creates a string (the string type is determined by the value of get_inf_attr(INF_STRTYPE))
Note: The type of an existing string is returned by get_str_type() |
Create a new segment
|
Set breakpoint condition
|
Get value of program word using the debugger memory
|
Sends a command to the debugger module and returns the output string. An exception will be raised if the debugger is not running or the current debugger does not export the 'send_dbg_command' IDC command. |
Get bitmask comment (only for bitfields)
|
Get offset of the last member of a structure
Notes:
|
Get process module name
|
Set function comment
|
Change structure member name
|
Set bitmask name (only for bitfields)
|
Get size of instruction or data item in bytes
|
Get operand of an instruction or data
|
Convert address to 'funcname+offset' string
|
Get process module size
|
Mark the location as "variable"
Note: All that IDA does is to mark the location as "variable". Nothing else, no additional analysis is performed. This function may disappear in the future. |
Set type of function/variable
|
Get full size of function frame
|
Toggle the bitwise not operator for the operand
|
Get index of the previous existing array element.
|
Get comment of a constant
|
Get debug event info
|
Get next function chunk
Note: This function enumerates all chunks of all functions in the database |
Create array.
|
Set hidden range state
|
Get name at the specified address
|
Load a type library
|
Get next defined item (instruction or data) in the program
|
Get string type
|
Sets the string value of a hash element.
|
Get type of instruction operand
|
Set a function chunk attribute
|
Retrieve function name
|
Get segment by segment base
|
Get type of function/variable
|
Can it continue after EXCEPTION event?
|
Some ARM compilers in Thumb mode use BL (branch-and-link) instead of B (branch) for long jumps, since BL has more range. By default, IDA tries to determine if BL is a jump or a call. You can override IDA's decision using commands in Edit/Other menu (Force BL call/Force BL jump) or the following two functions. Force BL instruction to be a jump
|
Get the characteristics of a breakpoint
|
Parse one or more ida.cfg config directives
Note: If the directives are erroneous, a fatal error will be generated. The settings are permanent: effective for the current session and the next ones |
| Trees | Indices | Help |
|
|---|
| Generated by Epydoc 3.0.1 on Fri Oct 11 15:05:11 2019 | http://epydoc.sourceforge.net |