Module index

# Module `ida_idaapi`

## Global variables

`var NW_CLOSEIDB`

  Notify when the database is closed. Its callback is of the form: def notify_when_callback(nw_code)

`var NW_INITIDA`

  Notify when the IDA starts. Its callback is of the form: def notify_when_callback(nw_code)

`var NW_OPENIDB`

  Notify when the database is opened. Its callback is of the form: def notify_when_callback(nw_code, is_old_database)

`var NW_REMOVE`

  Use this flag with other flags to uninstall a notifywhen callback

`var NW_TERMIDA`

  Notify when the IDA terminates. Its callback is of the form: def notify_when_callback(nw_code)

`var PY_ICID_BYREF`

  byref object

`var PY_ICID_INT64`

  int64 object

`var PY_ICID_OPAQUE`

  opaque object

`var ST_OVER_DEBUG_SEG`

  step tracing will be disabled when IP is in a debugger segment

`var ST_OVER_LIB_FUNC`

  step tracing will be disabled when IP is in a library function

## Functions

`def IDAPython_ExecScript(path, g, print_error=True)`

  Run the specified script.

  This function is used by the low-level plugin code.

`def IDAPython_ExecSystem(cmd)`

  Executes a command with popen().

`def IDAPython_FormatExc(etype, value=None, tb=None, limit=None)`

  This function is used to format an exception given the values returned by a PyErr_Fetch()

`def IDAPython_GetDocstrings(obj)`
`def IDAPython_LoadProcMod(path, g, print_error=True)`

  Load processor module.

`def IDAPython_UnLoadProcMod(script, g, print_error=True)`

  Unload processor module.

`def TRUNC(ea)`

  Truncate EA for the current application bitness

`def as_UTF16(s)`

  Convenience function to convert a string into appropriate unicode format

`def as_cstr(val)`

  Returns a C str from the passed value. The passed value can be of type refclass (returned by a call to buffer() or byref()) It scans for the first \x00 and returns the string value up to that point.

`def as_int32(v)`

  Returns a number as a signed int32 number

`def as_signed(v, nbits=32)`

  Returns a number as signed. The number of bits are specified by the user. The MSB holds the sign.

`def as_uint32(v)`

  Returns a number as an unsigned int32 number

`def as_unicode(s)`

  Convenience function to convert a string into appropriate unicode format

`def copy_bits(v, s, e=-1)`

  Copy bits from a value @param v: the value @param s: starting bit (0-based) @param e: ending bit

`def disable_script_timeout()`

  disable_script_timeout() Disables the script timeout and hides the script wait box. Calling L{set_script_timeout} will not have any effects until the script is compiled and executed again

  @return: None

`def enable_extlang_python(enable: bool)`

  enable_extlang_python(enable) Enables or disables Python extlang. When enabled, all expressions will be evaluated by Python.

  @param enable: Set to True to enable, False otherwise

`def enable_python_cli(enable: bool)`

  enable_python_cli(enable)

  @param enable: bool

`def format_basestring(_in: PyObject *)`

  format_basestring(_in) -> str

  @param _in: PyObject *

`def notify_when(when, callback)`

  Register a callback that will be called when an event happens. @param when: one of NW_XXXX constants @param callback: This callback prototype varies depending on the 'when' parameter: The general callback format: def notify_when_callback(nw_code) In the case of NW_OPENIDB: def notify_when_callback(nw_code, is_old_database) @return: Boolean

`def parse_command_line3(cmdline: char const *)`

  parse_command_line3(cmdline) -> PyObject *

  @param cmdline: char const *

`def pycim_get_widget(_self: PyObject *)`

  pycim_get_widget(_self) -> TWidget *

  @param self: PyObject *

`def pycim_view_close(_self: PyObject *)`

  pycim_view_close(_self)

  @param self: PyObject *

`def pygc_create_groups(_self: PyObject *, groups_infos: PyObject *)`

  pygc_create_groups(_self, groups_infos) -> [int, …] or None

  @param self: PyObject * @param groups_infos: PyObject *

`def pygc_delete_groups(_self: PyObject *, groups: PyObject *, new_current: PyObject *)`

  pygc_delete_groups(_self, groups, new_current) -> bool

  @param self: PyObject * @param groups: PyObject * @param new_current: PyObject *

`def pygc_refresh(_self: PyObject *)`

  pygc_refresh(_self)

  @param self: PyObject *

`def pygc_set_groups_visibility(_self: PyObject *, groups: PyObject *, expand: PyObject *, new_current: PyObject *)`

  pygc_set_groups_visibility(_self, groups, expand, new_current) -> bool

  @param self: PyObject * @param groups: PyObject * @param expand: PyObject * @param new_current: PyObject *

`def replfun(func)`
`def require(modulename, package=None)`

  Load, or reload a module.

  When under heavy development, a user's tool might consist of multiple modules. If those are imported using the standard 'import' mechanism, there is no guarantee that the Python implementation will re-read and re-evaluate the module's Python code. In fact, it usually doesn't. What should be done instead is 'reload()'-ing that module.

  This is a simple helper function that will do just that: In case the module doesn't exist, it 'import's it, and if it does exist, 'reload()'s it.

  The importing module (i.e., the module calling require()) will have the loaded module bound to its globals(), under the name 'modulename'. (If require() is called from the command line, the importing module will be 'main'.)

  For more information, see: http://www.hexblog.com/?p=749.

`def set_script_timeout(timeout: int) ‑> int`

  set_script_timeout(timeout) -> int Changes the script timeout value. The script wait box dialog will be hidden and shown again when the timeout elapses. See also L{disable_script_timeout}.

  @param timeout: This value is in seconds. If this value is set to zero then the script will never timeout. @return: Returns the old timeout value

`def struct_unpack(buffer, signed=False, offs=0)`

  Unpack a buffer given its length and offset using struct.unpack_from(). This function will know how to unpack the given buffer by using the lookup table '__struct_unpack_table' If the buffer is of unknown length then None is returned. Otherwise the unpacked value is returned.

## Classes

`class IDAPython_displayhook`

  ### Methods

  `def displayhook(self, item)`
  `def format_item(self, num_printer, storage, item)`
  `def format_seq(self, num_printer, storage, item, opn, cls)`
`class PyIdc_cvt_int64__ (v)`

  Helper class for explicitly representing VT_INT64 values

  ### Ancestors

  - pyidc_cvt_helper__
`class PyIdc_cvt_refclass__ (v)`

  Helper class for representing references to immutable objects

  ### Ancestors

  - pyidc_cvt_helper__

  ### Methods

  `def cstr(self)`

    Returns the string as a C string (up to the zero termination)

`class loader_input_t (pycapsule: PyObject * = None)`

  A helper class to work with linput_t related functions. This class is also used by file loaders scripts.

  init(self, pycapsule=None) -> loader_input_t

  @param pycapsule: PyObject *

  ### Static methods

  `def from_capsule(pycapsule: PyObject *)`

    from_capsule(pycapsule) -> loader_input_t

    @param pycapsule: PyObject *

  `def from_fp(fp: FILE *)`

    from_fp(fp) -> loader_input_t A static method to construct an instance from a FILE*

    @param fp: FILE *

  `def from_linput(linput: linput_t *)`

    from_linput(linput) -> loader_input_t

    @param linput: linput_t *

  ### Instance variables

  `var thisown`

    The membership flag

  ### Methods

  `def close(self)`

    close(self) Closes the file

  `def file2base(self, pos: int64, ea1: ea_t, ea2: ea_t, patchable: int)`

    file2base(self, pos, ea1, ea2, patchable) -> int Load portion of file into the database This function will include (ea1..ea2) into the addressing space of the program (make it enabled)

    @param pos: position in the file @param ea1: ..ea2): range of destination linear addresses @param ea1: ..ea2): range of destination linear addresses @param patchable: should the kernel remember correspondance of file offsets to linear addresses. @return: 1-ok,0-read error, a warning is displayed

  `def filename(self)`

    filename(self) -> PyObject *

  `def get_byte(self)`

    get_byte(self) -> PyObject * Reads a single byte from the file. Returns None if EOF or the read byte

  `def get_linput(self)`

    get_linput(self) -> linput_t *

  `def gets(self, len: size_t)`

    gets(self, len) -> str Reads a line from the input file. Returns the read line or None

    @param len: size_t

  `def getz(self, sz: size_t, fpos: int64 = -1)`

    getz(self, sz, fpos=-1) -> PyObject Returns a zero terminated string at the given position

    @param sz: maximum size of the string @param fpos: if != -1 then seek will be performed before reading @return: The string or None on failure.

  `def open(self, filename: char const *, remote: bool = False)`

    open(self, filename, remote=False) -> bool Opens a file (or a remote file)

    @param filename: char const * @param remote: bool @return: Boolean

  `def open_memory(self, start: ea_t, size: asize_t = 0)`

    open_memory(self, start, size=0) -> bool Create a linput for process memory (By internally calling idaapi.create_memory_linput()) This linput will use dbg->read_memory() to read data

    @param start: starting address of the input @param size: size of the memory range to represent as linput if unknown, may be passed as 0

  `def opened(self) ‑> bool`

    opened(self) -> bool Checks if the file is opened or not

  `def read(self, *args)`

    read(self, size=size_t(-1)) -> PyObject Read up to size bytes (all data if size is negative). Return an empty bytes object on EOF.

    @param size: size_t

  `def readbytes(self, size: size_t, big_endian: bool)`

    readbytes(self, size, big_endian) -> PyObject * Similar to read() but it respect the endianness

    @param size: size_t @param big_endian: bool

  `def seek(self, *args)`

    seek(self, pos, whence=SEEK_SET) -> int64 Set input source position

    @param pos: int64 @param whence: int @return: the new position (not 0 as fseek!)

  `def set_linput(self, linput: linput_t *)`

    set_linput(self, linput) Links the current loader_input_t instance to a linput_t instance

    @param linput: linput_t *

  `def size(self)`

    size(self) -> int64

  `def tell(self)`

    tell(self) -> int64 Returns the current position

`class object_t (**kwds)`

  Helper class used to initialize empty objects

`class plugin_t`

  Base class for all scripted plugins.

  ### Ancestors

  - pyidc_opaque_object_t

  ### Methods

  `def run(self, arg)`
  `def term(self)`
`class plugmod_t`

  Base class for all scripted multi-plugins.

  ### Ancestors

  - pyidc_opaque_object_t
`class py_clinked_object_t (lnk=None)`

  This is a utility and base class for C linked objects

  ### Ancestors

  - pyidc_opaque_object_t

  ### Subclasses

  - textctrl_info_t
  - ida_pro._qstrvec_t

  ### Instance variables

  `var clink`

    Returns the C link as a PyObject

  `var clink_ptr`

    Returns the C link pointer as a number

  ### Methods

  `def assign(self, other)`

    Overwrite me. This method allows you to assign an instance contents to anothers @return: Boolean

  `def copy(self)`

    Returns a new copy of this class

`class pyidc_cvt_helper__ (cvt_id, value)`

  This is a special helper object that helps detect which kind of object is this python object wrapping and how to convert it back and from IDC. This object is characterized by its special attribute and its value

  ### Subclasses

  - PyIdc_cvt_int64__
  - PyIdc_cvt_refclass__

  ### Instance variables

  `var value`
`class pyidc_opaque_object_t`

  This is the base class for all Python<->IDC opaque objects

  ### Subclasses

  - plugin_t
  - plugmod_t
  - py_clinked_object_t
  - cli_t