Module `ida_funcs`

Routines for working with functions within the disassembled program.

This file also contains routines for working with library signatures (e.g. FLIRT).

Each function consists of function chunks. At least one function chunk must be present in the function definition - the function entry chunk. Other chunks are called function tails. There may be several of them for a function.

A function tail is a continuous range of addresses. It can be used in the definition of one or more functions. One function using the tail is singled out and called the tail owner. This function is considered as 'possessing' the tail. get_func() on a tail address will return the function possessing the tail. You can enumerate the functions using the tail by using func_parent_iterator_t.

Each function chunk in the disassembly is represented as an "range" (a range of addresses, see range.hpp for details) with characteristics.

A function entry must start with an instruction (code) byte.

Global variables

var FIND_FUNC_DEFINE: create instruction if undefined byte is encountered
var FIND_FUNC_EXIST: function exists already. its bounds are returned in 'nfn'.
var FIND_FUNC_IGNOREFN: ignore existing function boundaries. by default the function returns function boundaries if ea belongs to a function.
var FIND_FUNC_KEEPBD: do not modify incoming function boundaries, just create instructions inside the boundaries.
var FIND_FUNC_NORMAL: stop processing if undefined byte is encountered
var FIND_FUNC_OK: ok, 'nfn' is ready for add_func()
var FIND_FUNC_UNDEF: function has instructions that pass execution flow to unexplored bytes. nfn->end_ea will have the address of the unexplored byte.
var FUNC_BOTTOMBP: BP points to the bottom of the stack frame.
var FUNC_CATCH: function is an exception catch handler
var FUNC_FAR: Far function.
var FUNC_FRAME: Function uses frame pointer (BP)
var FUNC_FUZZY_SP: Function changes SP in untraceable way, for example: and esp, 0FFFFFFF0h
var FUNC_HIDDEN: A hidden function chunk.
var FUNC_LIB: Library function.
var FUNC_LUMINA: Function info is provided by Lumina.
var FUNC_NORET: Function doesn't return.
var FUNC_NORET_PENDING: Function 'non-return' analysis must be performed. This flag is verified upon func_does_return()
var FUNC_OUTLINE: Outlined code, not a real function.
var FUNC_PROLOG_OK: Prolog analysis has been performed by last SP-analysis
var FUNC_PURGED_OK: 'argsize' field has been validated. If this bit is clear and 'argsize' is 0, then we do not known the real number of bytes removed from the stack. This bit is handled by the processor module.
var FUNC_REANALYZE: Function frame changed, request to reanalyze the function after the last insn is analyzed.
var FUNC_SP_READY: SP-analysis has been performed. If this flag is on, the stack change points should not be not modified anymore. Currently this analysis is performed only for PC
var FUNC_STATICDEF: Static function.
var FUNC_TAIL: This is a function tail. Other bits must be clear (except FUNC_HIDDEN).
var FUNC_THUNK: Thunk (jump) function.
var FUNC_UNWIND: function is an exception unwind handler
var FUNC_USERFAR: User has specified far-ness of the function
var IDASGN_APPLIED: signature is already applied
var IDASGN_BADARG: bad number of signature
var IDASGN_CURRENT: signature is currently being applied
var IDASGN_OK: ok
var IDASGN_PLANNED: signature is planned to be applied
var LIBFUNC_DELAY: no decision because of lack of information
var LIBFUNC_FOUND: ok, library function is found
var LIBFUNC_NONE: no, this is not a library function
var MOVE_FUNC_BADSTART: bad new start address
var MOVE_FUNC_NOCODE: no instruction at 'newstart'
var MOVE_FUNC_NOFUNC: no function at 'ea'
var MOVE_FUNC_OK: ok
var MOVE_FUNC_REFUSED: a plugin refused the action

Functions

def add_func(*args) ‑> bool: add_func(ea1, ea2=BADADDR) -> bool Add a new function. If the function end address is BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(…, FIND_FUNC_DEFINE).

@param ea1: (C++: ea_t) start address @param ea2: (C++: ea_t) end address @return: success
def add_func_ex(pfn: func_t) ‑> bool: add_func_ex(pfn) -> bool Add a new function. If the fn->end_ea is BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(…, FIND_FUNC_DEFINE).

@param pfn: (C++: func_t *) ptr to filled function structure @return: success
def add_regarg(pfn: func_t, reg: int, tif: tinfo_t, name: char const *): add_regarg(pfn, reg, tif, name)

@param pfn: func_t * @param reg: int @param tif: tinfo_t const & @param name: char const *
def append_func_tail(pfn: func_t, ea1: ea_t, ea2: ea_t): append_func_tail(pfn, ea1, ea2) -> bool Append a new tail chunk to the function definition. If the tail already exists, then it will simply be added to the function tail list Otherwise a new tail will be created and its owner will be set to be our function If a new tail cannot be created, then this function will fail.

@param pfn: (C++: func_t *) pointer to the function @param ea1: (C++: ea_t) start of the tail. If a tail already exists at the specified address it must start at 'ea1' @param ea2: (C++: ea_t) end of the tail. If a tail already exists at the specified address it must end at 'ea2'. If specified as BADADDR, IDA will determine the end address itself.
def apply_idasgn_to(signame: char const *, ea: ea_t, is_startup: bool): apply_idasgn_to(signame, ea, is_startup) -> int Apply a signature file to the specified address.

@param signame: (C++: const char *) short name of signature file (the file name without path) @param ea: (C++: ea_t) address to apply the signature @param is_startup: (C++: bool) if set, then the signature is treated as a startup one for startup signature ida doesn't rename the first function of the applied module. @return: Library function codes
def apply_startup_sig(ea: ea_t, startup: char const *): apply_startup_sig(ea, startup) -> bool Apply a startup signature file to the specified address.

@param ea: (C++: ea_t) address to apply the signature to; usually idainfo::start_ea @param startup: (C++: const char *) the name of the signature file without path and extension @return: true if successfully applied the signature
def calc_func_size(pfn: func_t): calc_func_size(pfn) -> asize_t Calculate function size. This function takes into account all fragments of the function.

@param pfn: (C++: func_t *) ptr to function structure
def calc_idasgn_state(n: int) ‑> int: calc_idasgn_state(n) -> int Get state of a signature in the list of planned signatures

@param n: (C++: int) number of signature in the list (0..get_idasgn_qty()-1) @return: state of signature or IDASGN_BADARG
def calc_thunk_func_target(*args): calc_thunk_func_target(pfn) -> ea_t Calculate target of a thunk function.

@param pfn: (C++: func_t *) pointer to function (may not be nullptr) @return: the target function or BADADDR
def del_func(ea: ea_t): del_func(ea) -> bool Delete a function.

@param ea: (C++: ea_t) any address in the function entry chunk @return: success
def del_idasgn(n: int) ‑> int: del_idasgn(n) -> int Remove signature from the list of planned signatures.

@param n: (C++: int) number of signature in the list (0..get_idasgn_qty()-1) @return: IDASGN_OK, IDASGN_BADARG, IDASGN_APPLIED
def f_any(arg1: flags64_t, arg2: void *): f_any(arg1, arg2) -> bool Helper function to accept any address.

@param arg1: flags64_t @param arg2: void *
def find_func_bounds(nfn: func_t, flags: int) ‑> int: find_func_bounds(nfn, flags) -> int Determine the boundaries of a new function. This function tries to find the start and end addresses of a new function. It calls the module with processor_t::func_bounds in order to fine tune the function boundaries.

@param nfn: (C++: func_t *) structure to fill with information \ nfn->start_ea points to the start address of the new function. @param flags: (C++: int) Find function bounds flags @return: Find function bounds result codes
def free_regarg(v: regarg_t): free_regarg(v)

@param v: regarg_t *
def func_contains(pfn: func_t, ea: ea_t): func_contains(pfn, ea) -> bool Does the given function contain the given address?

@param pfn: (C++: func_t *) @param ea: (C++: ea_t)
def func_does_return(callee: ea_t): func_does_return(callee) -> bool Does the function return?. To calculate the answer, FUNC_NORET flag and is_noret() are consulted The latter is required for imported functions in the .idata section. Since in .idata we have only function pointers but not functions, we have to introduce a special flag for them.

@param callee: (C++: ea_t)
def func_parent_iterator_set(fpi: func_parent_iterator_t, pfn: func_t) ‑> bool: func_parent_iterator_set(fpi, pfn) -> bool

@param fpi: func_parent_iterator_t * @param pfn: func_t *
def func_t__from_ptrval__(ptrval: size_t): func_t__from_ptrval__(ptrval) -> func_t

@param ptrval: size_t
def func_tail_iterator_set(fti: func_tail_iterator_t, pfn: func_t, ea: ea_t): func_tail_iterator_set(fti, pfn, ea) -> bool

@param fti: func_tail_iterator_t * @param pfn: func_t * @param ea: ea_t
def func_tail_iterator_set_ea(fti: func_tail_iterator_t, ea: ea_t): func_tail_iterator_set_ea(fti, ea) -> bool

@param fti: func_tail_iterator_t * @param ea: ea_t
def get_current_idasgn() ‑> int: get_current_idasgn() -> int Get number of the the current signature.

@return: 0..n-1
def get_fchunk(ea: ea_t): get_fchunk(ea) -> func_t Get pointer to function chunk structure by address.

@param ea: (C++: ea_t) any address in a function chunk @return: ptr to a function chunk or nullptr. This function may return a function entry as well as a function tail.
def get_fchunk_num(ea: ea_t): get_fchunk_num(ea) -> int Get ordinal number of a function chunk in the global list of function chunks.

@param ea: (C++: ea_t) any address in the function chunk @return: number of function chunk (0..get_fchunk_qty()-1). -1 means 'no function chunk at the specified address'.
def get_fchunk_qty(): get_fchunk_qty() -> size_t Get total number of function chunks in the program.
def get_fchunk_referer(ea: ea_t, idx: size_t): get_fchunk_referer(ea, idx) -> ea_t

@param ea: ea_t @param idx: size_t
def get_func(ea: ea_t): get_func(ea) -> func_t Get pointer to function structure by address.

@param ea: (C++: ea_t) any address in a function @return: ptr to a function or nullptr. This function returns a function entry chunk.
def get_func_bitness(pfn: func_t) ‑> int: get_func_bitness(pfn) -> int Get function bitness (which is equal to the function segment bitness). pfn==nullptr => returns 0 @retval 0: 16 @retval 1: 32 @retval 2: 64

@param pfn: (C++: const func_t *) func_t const *
def get_func_bits(pfn: func_t) ‑> int: get_func_bits(pfn) -> int Get number of bits in the function addressing.

@param pfn: (C++: const func_t *) func_t const *
def get_func_bytes(pfn: func_t) ‑> int: get_func_bytes(pfn) -> int Get number of bytes in the function addressing.

@param pfn: (C++: const func_t *) func_t const *
def get_func_chunknum(pfn: func_t, ea: ea_t): get_func_chunknum(pfn, ea) -> int Get the containing tail chunk of 'ea'. @retval -1: means 'does not contain ea' @retval 0: means the 'pfn' itself contains ea @retval >0: the number of the containing function tail chunk

@param pfn: (C++: func_t *) @param ea: (C++: ea_t)
def get_func_cmt(pfn: func_t, repeatable: bool): get_func_cmt(pfn, repeatable) -> str Get function comment.

@param pfn: (C++: const func_t *) ptr to function structure @param repeatable: (C++: bool) get repeatable comment? @return: size of comment or -1 In fact this function works with function chunks too.
def get_func_name(ea: ea_t): get_func_name(ea) -> str Get function name.

@param ea: (C++: ea_t) any address in the function @return: length of the function name
def get_func_num(ea: ea_t): get_func_num(ea) -> int Get ordinal number of a function.

@param ea: (C++: ea_t) any address in the function @return: number of function (0..get_func_qty()-1). -1 means 'no function at the specified address'.
def get_func_qty(): get_func_qty() -> size_t Get total number of functions in the program.
def get_func_ranges(ranges: rangeset_t, pfn: func_t): get_func_ranges(ranges, pfn) -> ea_t Get function ranges.

@param ranges: (C++: rangeset_t ) buffer to receive the range info @param pfn: (C++: func_t ) ptr to function structure @return: end address of the last function range (BADADDR-error)
def get_idasgn_desc(n: int): get_idasgn_desc(n) -> (str, str) Get information about a signature in the list. It returns: (name of signature, names of optional libraries)

See also: get_idasgn_desc_with_matches

@param n: number of signature in the list (0..get_idasgn_qty()-1) @return: None on failure or tuple(signame, optlibs)
def get_idasgn_desc_with_matches(n: int): get_idasgn_desc_with_matches(n) -> (str, str, int) Get information about a signature in the list. It returns: (name of signature, names of optional libraries, number of matches)

@param n: number of signature in the list (0..get_idasgn_qty()-1) @return: None on failure or tuple(signame, optlibs, nmatches)
def get_idasgn_qty() ‑> int: get_idasgn_qty() -> int Get number of signatures in the list of planned and applied signatures.

@return: 0..n
def get_idasgn_title(name: char const *): get_idasgn_title(name) -> str Get full description of the signature by its short name.

@param name: (C++: const char *) short name of a signature @return: size of signature description or -1
def get_next_fchunk(ea: ea_t): get_next_fchunk(ea) -> func_t Get pointer to the next function chunk in the global list.

@param ea: (C++: ea_t) any address in the program @return: ptr to function chunk or nullptr if next function chunk doesn't exist
def get_next_func(ea: ea_t): get_next_func(ea) -> func_t Get pointer to the next function.

@param ea: (C++: ea_t) any address in the program @return: ptr to function or nullptr if next function doesn't exist
def get_next_func_addr(pfn: func_t, ea: ea_t): get_next_func_addr(pfn, ea) -> ea_t

@param pfn: func_t * @param ea: ea_t
def get_prev_fchunk(ea: ea_t): get_prev_fchunk(ea) -> func_t Get pointer to the previous function chunk in the global list.

@param ea: (C++: ea_t) any address in the program @return: ptr to function chunk or nullptr if previous function chunk doesn't exist
def get_prev_func(ea: ea_t): get_prev_func(ea) -> func_t Get pointer to the previous function.

@param ea: (C++: ea_t) any address in the program @return: ptr to function or nullptr if previous function doesn't exist
def get_prev_func_addr(pfn: func_t, ea: ea_t): get_prev_func_addr(pfn, ea) -> ea_t

@param pfn: func_t * @param ea: ea_t
def getn_fchunk(n: int): getn_fchunk(n) -> func_t Get pointer to function chunk structure by number.

@param n: (C++: int) number of function chunk, is in range 0..get_fchunk_qty()-1 @return: ptr to a function chunk or nullptr. This function may return a function entry as well as a function tail.
def getn_func(n: size_t): getn_func(n) -> func_t Get pointer to function structure by number.

@param n: (C++: size_t) number of function, is in range 0..get_func_qty()-1 @return: ptr to a function or nullptr. This function returns a function entry chunk.
def is_finally_visible_func(pfn: func_t) ‑> bool: is_finally_visible_func(pfn) -> bool Is the function visible (event after considering SCF_SHHID_FUNC)?

@param pfn: (C++: func_t *)
def is_func_entry(pfn: func_t) ‑> bool: is_func_entry(pfn) -> bool Does function describe a function entry chunk?

@param pfn: (C++: const func_t *) func_t const *
def is_func_locked(pfn: func_t) ‑> bool: is_func_locked(pfn) -> bool Is the function pointer locked?

@param pfn: (C++: const func_t *) func_t const *
def is_func_tail(pfn: func_t) ‑> bool: is_func_tail(pfn) -> bool Does function describe a function tail chunk?

@param pfn: (C++: const func_t *) func_t const *
def is_same_func(ea1: ea_t, ea2: ea_t): is_same_func(ea1, ea2) -> bool Do two addresses belong to the same function?

@param ea1: (C++: ea_t) @param ea2: (C++: ea_t)
def is_visible_func(pfn: func_t) ‑> bool: is_visible_func(pfn) -> bool Is the function visible (not hidden)?

@param pfn: (C++: func_t *)
def lock_func_range(pfn: func_t, lock: bool): lock_func_range(pfn, lock) Lock function pointer Locked pointers are guaranteed to remain valid until they are unlocked. Ranges with locked pointers cannot be deleted or moved.

@param pfn: (C++: const func_t *) func_t const * @param lock: (C++: bool)
def plan_to_apply_idasgn(fname: char const *): plan_to_apply_idasgn(fname) -> int Add a signature file to the list of planned signature files.

@param fname: (C++: const char *) file name. should not contain directory part. @return: 0 if failed, otherwise number of planned (and applied) signatures
def read_regargs(pfn: func_t): read_regargs(pfn)

@param pfn: func_t *
def reanalyze_function(*args): reanalyze_function(pfn, ea1=0, ea2=BADADDR, analyze_parents=False) Reanalyze a function. This function plans to analyzes all chunks of the given function. Optional parameters (ea1, ea2) may be used to narrow the analyzed range.

@param pfn: (C++: func_t *) pointer to a function @param ea1: (C++: ea_t) start of the range to analyze @param ea2: (C++: ea_t) end of range to analyze @param analyze_parents: (C++: bool) meaningful only if pfn points to a function tail. if true, all tail parents will be reanalyzed. if false, only the given tail will be reanalyzed.
def reanalyze_noret_flag(ea: ea_t): reanalyze_noret_flag(ea) -> bool Plan to reanalyze noret flag. This function does not remove FUNC_NORET if it is already present. It just plans to reanalysis.

@param ea: (C++: ea_t)
def remove_func_tail(pfn: func_t, tail_ea: ea_t): remove_func_tail(pfn, tail_ea) -> bool Remove a function tail. If the tail belongs only to one function, it will be completely removed. Otherwise if the function was the tail owner, the first function using this tail becomes the owner of the tail.

@param pfn: (C++: func_t *) pointer to the function @param tail_ea: (C++: ea_t) any address inside the tail to remove
def set_func_cmt(pfn: func_t, cmt: char const *, repeatable: bool): set_func_cmt(pfn, cmt, repeatable) -> bool Set function comment. This function works with function chunks too.

@param pfn: (C++: const func_t ) ptr to function structure @param cmt: (C++: const char ) comment string, may be multiline (with ' '). Use empty str ("") to delete comment @param repeatable: (C++: bool) set repeatable comment?
def set_func_end(ea: ea_t, newend: ea_t): set_func_end(ea, newend) -> bool Move function chunk end address.

@param ea: (C++: ea_t) any address in the function @param newend: (C++: ea_t) new end address of the function @return: success
def set_func_name_if_jumpfunc(pfn: func_t, oldname: char const *): set_func_name_if_jumpfunc(pfn, oldname) -> int Give a meaningful name to function if it consists of only 'jump' instruction.

@param pfn: (C++: func_t ) pointer to function (may be nullptr) @param oldname: (C++: const char ) old name of function. if old name was in "j_…" form, then we may discard it and set a new name. if oldname is not known, you may pass nullptr. @return: success
def set_func_start(ea: ea_t, newstart: ea_t): set_func_start(ea, newstart) -> int Move function chunk start address.

@param ea: (C++: ea_t) any address in the function @param newstart: (C++: ea_t) new end address of the function @return: Function move result codes
def set_noret_insn(insn_ea: ea_t, noret: bool): set_noret_insn(insn_ea, noret) -> bool Signal a non-returning instruction. This function can be used by the processor module to tell the kernel about non-returning instructions (like call exit). The kernel will perform the global function analysis and find out if the function returns at all. This analysis will be done at the first call to func_does_return()

@param insn_ea: (C++: ea_t) @param noret: (C++: bool) @return: true if the instruction 'noret' flag has been changed
def set_tail_owner(fnt: func_t, new_owner: ea_t): set_tail_owner(fnt, new_owner) -> bool Set a new owner of a function tail. The new owner function must be already referring to the tail (after append_func_tail).

@param fnt: (C++: func_t *) pointer to the function tail @param new_owner: (C++: ea_t) the entry point of the new owner function
def set_visible_func(pfn: func_t, visible: bool): set_visible_func(pfn, visible) Set visibility of function.

@param pfn: (C++: func_t *) @param visible: (C++: bool)
def try_to_add_libfunc(ea: ea_t): try_to_add_libfunc(ea) -> int Apply the currently loaded signature file to the specified address. If a library function is found, then create a function and name it accordingly.

@param ea: (C++: ea_t) any address in the program @return: Library function codes
def update_func(pfn: func_t) ‑> bool: update_func(pfn) -> bool Update information about a function in the database (func_t). You must not change the function start and end addresses using this function. Use set_func_start() and set_func_end() for it.

@param pfn: (C++: func_t *) ptr to function structure @return: success

Classes

class dyn_ea_array (_data: unsigned long long *, _count: size_t)

Proxy of C++ dynamic_wrapped_array_t< ea_t > class.

init(self, _data, _count) -> dyn_ea_array

@param _data: unsigned long long * @param _count: size_t

Instance variables

var count : size_t: count
var data : unsigned long long *: data
var thisown: The membership flag

class dyn_range_array (_data: range_t, _count: size_t)

Proxy of C++ dynamic_wrapped_array_t< range_t > class.

init(self, _data, _count) -> dyn_range_array

@param _data: range_t * @param _count: size_t

Instance variables

var count : size_t: count
var data : range_t *: data
var thisown: The membership flag

class dyn_regarg_array (_data: regarg_t, _count: size_t)

Proxy of C++ dynamic_wrapped_array_t< regarg_t > class.

init(self, _data, _count) -> dyn_regarg_array

@param _data: regarg_t * @param _count: size_t

Instance variables

var count : size_t: count
var data : regarg_t *: data
var thisown: The membership flag

class dyn_regvar_array (_data: regvar_t *, _count: size_t)

Proxy of C++ dynamic_wrapped_array_t< regvar_t > class.

init(self, _data, _count) -> dyn_regvar_array

@param _data: regvar_t * @param _count: size_t

Instance variables

var count : size_t: count
var data : regvar_t *: data
var thisown: The membership flag

class dyn_stkpnt_array (_data: stkpnt_t *, _count: size_t)

Proxy of C++ dynamic_wrapped_array_t< stkpnt_t > class.

init(self, _data, _count) -> dyn_stkpnt_array

@param _data: stkpnt_t * @param _count: size_t

Instance variables

var count : size_t: count
var data : stkpnt_t *: data
var thisown: The membership flag

class func_item_iterator_t (*args)

Proxy of C++ func_item_iterator_t class.

init(self) -> func_item_iterator_t init(self, pfn, _ea=BADADDR) -> func_item_iterator_t

@param pfn: func_t * @param _ea: ea_t

Instance variables

var thisown: The membership flag

Methods

def addresses(self): Provide an iterator on addresses contained within the function
def chunk(self): chunk(self) -> range_t
def code_items(self): Provide an iterator on code items contained within the function
def current(self): current(self) -> ea_t
def data_items(self): Provide an iterator on data items contained within the function
def decode_preceding_insn(self, visited: eavec_t *, p_farref: bool *, out: insn_t *): decode_preceding_insn(self, visited, p_farref, out) -> bool

@param visited: eavec_t * @param p_farref: bool * @param out: insn_t *
def decode_prev_insn(self, out: insn_t *): decode_prev_insn(self, out) -> bool

@param out: insn_t *
def first(self) ‑> bool: first(self) -> bool
def head_items(self): Provide an iterator on item heads contained within the function
def last(self) ‑> bool: last(self) -> bool
def next(self, func: testf_t *): next(self, func) -> bool

@param func: testf_t *
def next_addr(self) ‑> bool: next_addr(self) -> bool
def next_code(self) ‑> bool: next_code(self) -> bool
def next_data(self) ‑> bool: next_data(self) -> bool
def next_head(self) ‑> bool: next_head(self) -> bool
def next_not_tail(self) ‑> bool: next_not_tail(self) -> bool
def not_tails(self): Provide an iterator on non-tail addresses contained within the function
def prev(self, func: testf_t *): prev(self, func) -> bool

@param func: testf_t *
def prev_addr(self) ‑> bool: prev_addr(self) -> bool
def prev_code(self) ‑> bool: prev_code(self) -> bool
def prev_data(self) ‑> bool: prev_data(self) -> bool
def prev_head(self) ‑> bool: prev_head(self) -> bool
def prev_not_tail(self) ‑> bool: prev_not_tail(self) -> bool
def set(self, *args) ‑> bool: set(self, pfn, _ea=BADADDR) -> bool Set a function range. if pfn == nullptr then a segment range will be set.

@param pfn: (C++: func_t *) @param _ea: (C++: ea_t)
def set_ea(self, _ea: ea_t): set_ea(self, _ea) -> bool

@param _ea: ea_t
def set_range(self, ea1: ea_t, ea2: ea_t): set_range(self, ea1, ea2) -> bool Set an arbitrary range.

@param ea1: (C++: ea_t) @param ea2: (C++: ea_t)
def succ(self, func: testf_t *): succ(self, func) -> bool Similar to next(), but succ() iterates the chunks from low to high addresses, while next() iterates through chunks starting at the function entry chunk

@param func: (C++: testf_t *)
def succ_code(self) ‑> bool: succ_code(self) -> bool

class func_parent_iterator_t (*args)

Proxy of C++ func_parent_iterator_t class.

init(self) -> func_parent_iterator_t init(self, _fnt) -> func_parent_iterator_t

@param _fnt: func_t *

Instance variables

var thisown: The membership flag

Methods

def first(self) ‑> bool: first(self) -> bool
def last(self) ‑> bool: last(self) -> bool
def next(self) ‑> bool: next(self) -> bool
def parent(self): parent(self) -> ea_t
def prev(self) ‑> bool: prev(self) -> bool
def reset_fnt(self, _fnt: func_t): reset_fnt(self, _fnt)

@param _fnt: func_t *
def set(self, _fnt: func_t) ‑> bool: set(self, _fnt) -> bool

@param _fnt: func_t *

class func_t (start: ea_t = 0, end: ea_t = 0, f: flags64_t = 0)

Proxy of C++ func_t class.

init(self, start=0, end=0, f=0) -> func_t

@param start: ea_t @param end: ea_t @param f: flags64_t

Ancestors

range_t

Instance variables

var argsize : asize_t: number of bytes purged from the stack upon returning
var color : bgcolor_t: user defined function color
var flags : uint64: Function flags
var fpd : asize_t: frame pointer delta. (usually 0, i.e. realBP==typicalBP) use update_fpd() to modify it.
var frame : uval_t: netnode id of frame structure - see frame.hpp
var frregs : ushort: size of saved registers in frame. This range is immediately above the local variables range.
var frsize : asize_t: size of local variables part of frame in bytes. If FUNC_FRAME is set and fpd==0, the frame pointer (EBP) is assumed to point to the top of the local variables range.
var owner : ea_t: the address of the main function possessing this tail
var pntqty : uint32: number of SP change points
var points : dynamic_wrapped_array_t< stkpnt_t >: array of SP change points. use …stkpnt…() functions to access this array.
var referers : dynamic_wrapped_array_t< ea_t >: array of referers (function start addresses). use func_parent_iterator_t to access the referers.
var refqty : int: number of referers
var regargqty : int: number of register arguments. During analysis IDA tries to guess the register arguments. It stores store the guessing outcome in this field. As soon as it determines the final function prototype, regargqty is set to zero.
var regargs : dynamic_wrapped_array_t< regarg_t >: unsorted array of register arguments. use …regarg…() functions to access this array. regargs are destroyed when the full function type is determined.
var regvarqty : int: number of register variables (-1-not read in yet) use find_regvar() to read register variables
var regvars : dynamic_wrapped_array_t< regvar_t >: array of register variables. this array is sorted by: start_ea. use …regvar…() functions to access this array.
var tailqty : int: number of function tails
var tails : dynamic_wrapped_array_t< range_t >: array of tails, sorted by ea. use func_tail_iterator_t to access function tails.

Methods

def addresses(self): Alias for func_item_iterator_t(self).addresses()
def analyzed_sp(self) ‑> bool: analyzed_sp(self) -> bool Has SP-analysis been performed?
def code_items(self): Alias for func_item_iterator_t(self).code_items()
def data_items(self): Alias for func_item_iterator_t(self).data_items()
def does_return(self) ‑> bool: does_return(self) -> bool Does function return?
def head_items(self): Alias for func_item_iterator_t(self).head_items()
def is_far(self) ‑> bool: is_far(self) -> bool Is a far function?
def need_prolog_analysis(self) ‑> bool: need_prolog_analysis(self) -> bool Needs prolog analysis?
def not_tails(self): Alias for func_item_iterator_t(self).not_tails()

Inherited members

range_t:
- clear
- compare
- contains
- empty
- end_ea
- extend
- intersect
- overlaps
- size
- start_ea
- thisown

class func_tail_iterator_t (*args)

Proxy of C++ func_tail_iterator_t class.

init(self) -> func_tail_iterator_t init(self, _pfn, ea=BADADDR) -> func_tail_iterator_t

@param _pfn: func_t * @param ea: ea_t

Instance variables

var thisown: The membership flag

Methods

def chunk(self): chunk(self) -> range_t
def first(self) ‑> bool: first(self) -> bool
def last(self) ‑> bool: last(self) -> bool
def main(self) ‑> bool: main(self) -> bool
def next(self) ‑> bool: next(self) -> bool
def prev(self) ‑> bool: prev(self) -> bool
def set(self, *args) ‑> bool: set(self, _pfn, ea=BADADDR) -> bool

@param _pfn: func_t * @param ea: ea_t
def set_ea(self, ea: ea_t): set_ea(self, ea) -> bool

@param ea: ea_t
def set_range(self, ea1: ea_t, ea2: ea_t): set_range(self, ea1, ea2) -> bool

@param ea1: ea_t @param ea2: ea_t

class lock_func (_pfn: func_t)

Proxy of C++ lock_func class.

init(self, _pfn) -> lock_func

@param _pfn: func_t const *

Instance variables

var thisown: The membership flag

class lock_func_with_tails_t (pfn: func_t)

Proxy of C++ lock_func_with_tails_t class.

init(self, pfn) -> lock_func_with_tails_t

@param pfn: func_t *

Instance variables

var thisown: The membership flag

class regarg_t (*args)

Proxy of C++ regarg_t class.

init(self) -> regarg_t init(self, r) -> regarg_t

@param r: regarg_t const &

Instance variables

var name : char *: name
var reg : int: reg
var thisown: The membership flag
var type : type_t *: type

Methods

def swap(self, r: regarg_t): swap(self, r)

@param r: regarg_t &