Module ida_idd

Contains definition of the interface to IDD modules.

The interface consists of structures describing the target debugged processor and a debugging API.

Global variables

var APPCALL_DEBEV

Return debug event information.

var APPCALL_MANUAL

Only set up the appcall, do not run. debugger_t::cleanup_appcall will not be generated by ida!

var APPCALL_TIMEOUT

Appcall with timeout. If timed out, errbuf will contain "timeout". See SET_APPCALL_TIMEOUT and GET_APPCALL_TIMEOUT

var BBLK_TRACE

basic block tracing

var BPT_BAD_ADDR

ea is invalid

var BPT_BAD_ALIGN

alignment is invalid

var BPT_BAD_LEN

bpt len is invalid

var BPT_BAD_TYPE

bpt type is not supported

var BPT_DEFAULT

Choose bpt type automatically.

var BPT_EXEC

Execute instruction.

var BPT_INTERNAL_ERR

interr occurred when verifying breakpoint

var BPT_OK

breakpoint can be set

var BPT_PAGE_OK

update_bpts(): ok, added a page bpt

var BPT_RDWR

Read/write access.

var BPT_READ

Read access.

var BPT_READ_ERROR

failed to read memory at bpt ea

var BPT_SKIP

update_bpts(): do not process bpt

var BPT_SOFT

Software breakpoint.

var BPT_TOO_MANY

reached max number of supported breakpoints

var BPT_WRITE

Write access.

var BPT_WRITE_ERROR

failed to write memory at bpt ea

var BREAKPOINT

Breakpoint has been reached. IDA will complain about unknown breakpoints, they should be reported as exceptions.

var DBG_FLAG_ADD_ENVS

The debugger supports launching processes with environment variables.

var DBG_FLAG_ANYSIZE_HWBPT

The debugger supports arbitrary size hardware breakpoints.

var DBG_FLAG_CAN_CONT_BPT

Debugger knows to continue from a bpt. This flag also means that the debugger module hides breakpoints from ida upon read_memory

var DBG_FLAG_CLEAN_EXIT

IDA must suspend the application and remove all breakpoints before terminating the application. Usually this is not required because the application memory disappears upon termination.

var DBG_FLAG_CONNSTRING

Display "Connection string" instead of "Hostname" and hide the "Port" field.

var DBG_FLAG_DEBTHREAD

Supports creation of a separate thread in ida for the debugger (the debthread). Most debugger functions will be called from debthread (exceptions are marked below) The debugger module may directly call only THREAD_SAFE functions. To call other functions please use execute_sync(). The debthread significantly increases debugging speed, especially if debug events occur frequently.

var DBG_FLAG_DEBUG_DLL

Can debug standalone DLLs. For example, Bochs debugger can debug any snippet of code

var DBG_FLAG_DISABLE_ASLR

The debugger support ASLR disabling (Address space layout randomization)

var DBG_FLAG_DONT_DISTURB

Debugger can handle only get_debug_event(), request_pause(), exit_process() when the debugged process is running. The kernel may also call service functions (file I/O, map_address, etc)

var DBG_FLAG_EXITSHOTOK

IDA may take a memory snapshot at PROCESS_EXITED event.

var DBG_FLAG_FAKE_ATTACH

PROCESS_ATTACHED is a fake event and does not suspend the execution

var DBG_FLAG_FAKE_MEMORY

get_memory_info()/read_memory()/write_memory() work with the idb. (there is no real process to read from, as for the replayer module) the kernel will not call these functions if this flag is set. however, third party plugins may call them, they must be implemented.

var DBG_FLAG_FAST_STEP

Do not refresh memory layout info after single stepping.

var DBG_FLAG_HWDATBPT_ONE

Hardware data breakpoints are one byte size by default

var DBG_FLAG_LAZY_WATCHPTS

Watchpoints are triggered before the offending instruction is executed. The debugger must temporarily disable the watchpoint and single-step before resuming.

var DBG_FLAG_LOWCNDS

Low level breakpoint conditions are supported.

var DBG_FLAG_MANMEMINFO

If set, manual memory region manipulation commands will be available. Use this bit for debugger modules that cannot return memory layout information

var DBG_FLAG_MERGE_ENVS

The debugger supports merge or replace setting for environment variables (only makes sense if DBG_FLAG_ADD_ENVS is set)

var DBG_FLAG_NEEDPORT

Remote debugger requires port number (to be used with DBG_FLAG_NOHOST)

var DBG_FLAG_NOHOST

Remote debugger with does not require network params (host/port/pass). (a unique device connected to the machine)

var DBG_FLAG_NOPARAMETERS

Debugger module doesn't use commandline parameters.

var DBG_FLAG_NOPASSWORD

Remote debugger doesn't use password.

var DBG_FLAG_NOSTARTDIR

Debugger module doesn't use startup directory.

var DBG_FLAG_PREFER_SWBPTS

Prefer to use software breakpoints.

var DBG_FLAG_REMOTE

Remote debugger (requires remote host name unless DBG_FLAG_NOHOST)

var DBG_FLAG_SAFE

The debugger is safe (probably because it just emulates the application without really running it)

var DBG_FLAG_SMALLBLKS

If set, IDA uses 256-byte blocks for caching memory contents. Otherwise, 1024-byte blocks are used

var DBG_FLAG_TRACER_MODULE

The module is a tracer, not a full featured debugger module.

var DBG_FLAG_USE_SREGS

Take segment register values into account (non flat memory)

var DBG_FLAG_VIRTHREADS

Thread IDs may be shuffled after each debug event. (to be used for virtual threads that represent cpus for windbg kmode)

var DBG_HAS_APPCALL

supports ev_appcall, ev_cleanup_appcall

var DBG_HAS_ATTACH_PROCESS

supports ev_attach_process

var DBG_HAS_CHECK_BPT

supports ev_check_bpt

var DBG_HAS_DETACH_PROCESS

supports ev_detach_process

var DBG_HAS_GET_PROCESSES

supports ev_get_processes

var DBG_HAS_MAP_ADDRESS

supports ev_map_address. Avoid using this bit, especially together with DBG_FLAG_DEBTHREAD because it may cause big slow downs

var DBG_HAS_OPEN_FILE

supports ev_open_file, ev_close_file, ev_read_file, ev_write_file

var DBG_HAS_REQUEST_PAUSE

supports ev_request_pause

var DBG_HAS_REXEC

supports ev_rexec

var DBG_HAS_SET_EXCEPTION_INFO

supports ev_set_exception_info

var DBG_HAS_SET_RESUME_MODE

supports ev_set_resume_mode. Cannot be set inside the debugger_t::init_debugger()

var DBG_HAS_THREAD_CONTINUE

supports ev_thread_continue

var DBG_HAS_THREAD_GET_SREG_BASE

supports ev_thread_get_sreg_base

var DBG_HAS_THREAD_SUSPEND

supports ev_thread_suspend

var DBG_HAS_UPDATE_CALL_STACK

supports ev_update_call_stack

var DBG_HIDE_WINDOW

application should be hidden on startup (windows)

var DBG_NO_ASLR

disable ASLR (linux)

var DBG_NO_TRACE

do not trace the application (mac/linux)

var DBG_PROC_32BIT

application is 32-bit

var DBG_PROC_64BIT

application is 64-bit

var DBG_PROC_IS_DLL

database contains a dll (not exe)

var DBG_PROC_IS_GUI

using gui version of ida

var DBG_RESMOD_STEP_HANDLE

RESMOD_HANDLE is available

var DBG_RESMOD_STEP_INTO

RESMOD_INTO is available

var DBG_RESMOD_STEP_OUT

RESMOD_OUT is available

var DBG_RESMOD_STEP_OVER

RESMOD_OVER is available

var DBG_RESMOD_STEP_SRCINTO

RESMOD_SRCINTO is available

var DBG_RESMOD_STEP_SRCOUT

RESMOD_SRCOUT is available

var DBG_RESMOD_STEP_SRCOVER

RESMOD_SRCOVER is available

var DBG_RESMOD_STEP_USER

RESMOD_USER is available

var DBG_SUSPENDED

application should be suspended on startup (mac)

var DEBUGGER_ID_6811_EMULATOR

MC6812 emulator (beta)

var DEBUGGER_ID_ARM_IPHONE_USER

iPhone 1.x

var DEBUGGER_ID_ARM_LINUX_USER

Userland arm linux.

var DEBUGGER_ID_ARM_MACOS_USER

Userland arm MAC OS.

var DEBUGGER_ID_DALVIK_USER

Dalvik.

var DEBUGGER_ID_GDB_USER

GDB remote.

var DEBUGGER_ID_TRACE_REPLAYER

Fake debugger to replay recorded traces.

var DEBUGGER_ID_WINDBG

WinDBG using Microsoft Debug engine.

var DEBUGGER_ID_X86_DOSBOX_EMULATOR

Dosbox MS-DOS emulator.

var DEBUGGER_ID_X86_IA32_BOCHS

BochsDbg.exe 32.

var DEBUGGER_ID_X86_IA32_LINUX_USER

Userland linux processes (ptrace())

var DEBUGGER_ID_X86_IA32_MACOSX_USER

Userland MAC OS X processes.

var DEBUGGER_ID_X86_IA32_WIN32_USER

Userland win32 processes (win32 debugging APIs)

var DEBUGGER_ID_X86_PIN_TRACER

PIN Tracer module.

var DEBUGGER_ID_XNU_USER

XNU Kernel.

var DRC_CRC

success, but the input file crc does not match

var DRC_ERROR

unclassified error, may be complemented by errbuf

var DRC_EVENTS

success, there are pending events

var DRC_FAILED

failed or false

var DRC_IDBSEG

use idb segmentation

var DRC_NETERR

network error

var DRC_NOCHG

no changes

var DRC_NOFILE

file not found

var DRC_NONE

reaction to the event not implemented

var DRC_NOPROC

the process does not exist anymore

var DRC_OK

success

var EXCEPTION

Exception.

var EXC_BREAK

break on the exception

var EXC_HANDLE

should be handled by the debugger?

var EXC_MSG

instead of a warning, log the exception to the output window

var EXC_SILENT

do not warn or log to the output window

var FUNC_TRACE

function tracing

var IDD_INTERFACE_VERSION

The IDD interface version number.

var INFORMATION

User-defined information. This event can be used to return empty information This will cause IDA to call get_debug_event() immediately once more.

var INSN_TRACE

instruction tracing

var LIB_LOADED

New library has been loaded.

var LIB_UNLOADED

Library has been unloaded.

var NO_EVENT

Not an interesting event. This event can be used if the debugger module needs to return an event but there are no valid events.

var NO_PROCESS

No process.

var NO_THREAD

No thread. in PROCESS_STARTED this value can be used to specify that the main thread has not been created. It will be initialized later by a THREAD_STARTED event.

var PROCESS_ATTACHED

Successfully attached to running process.

var PROCESS_DETACHED

Successfully detached from process.

var PROCESS_EXITED

Process has been stopped.

var PROCESS_STARTED

New process has been started.

var PROCESS_SUSPENDED

Process has been suspended. This event can be used by the debugger module to signal if the process spontaneously gets suspended (not because of an exception, breakpoint, or single step). IDA will silently switch to the 'suspended process' mode without displaying any messages.

var REGISTER_ADDRESS

may contain an address

var REGISTER_CS

code segment

var REGISTER_CUSTFMT

register should be displayed using a custom data format. the format name is in bit_strings[0]; the corresponding regval_t will use bytevec_t

var REGISTER_FP

frame pointer

var REGISTER_IP

instruction pointer

var REGISTER_NOLF

displays this register without returning to the next line, allowing the next register to be displayed to its right (on the same line)

var REGISTER_READONLY

the user can't modify the current value of this register

var REGISTER_SP

stack pointer

var REGISTER_SS

stack segment

var RESMOD_HANDLE

step into the exception handler

var RESMOD_INTO

step into call (the most typical single stepping)

var RESMOD_NONE

no stepping, run freely

var RESMOD_OUT

step out of the current function (run until return)

var RESMOD_OVER

step over call

var RESMOD_SRCINTO

until control reaches a different source line

var RESMOD_SRCOUT

next source line in the previous stack frame

var RESMOD_SRCOVER

next source line in the current stack frame

var RESMOD_USER

step out to the user code

var RQ_IDAIDLE

handle_debug_event: ida is idle

var RQ_IGNWERR

ignore breakpoint write failures

var RQ_MASKING

masking step handler: unless errors, tmpbpt handlers won't be generated should be used only with request_internal_step()

var RQ_NOSUSP

running step handler: continues the app

var RQ_PROCEXIT

snapshots: the process is exiting

var RQ_RESMOD

resume_mode_t

var RQ_RESUME

handle_debug_event: resume application

var RQ_SILENT

all: no dialog boxes

var RQ_SUSPEND

suspending step handler: suspends the app handle_debug_event: suspends the app

var RQ_SUSPRUN

handle_debug_event: suspend at PROCESS_STARTED

var RQ_SWSCREEN

handle_debug_event: switch screens

var RQ_VERBOSE

all: display dialog boxes

var RQ__NOTHRRF

handle_debug_event: do not refresh threads

var RVT_FLOAT

floating point

var RVT_INT

integer

var RVT_UNAVAILABLE

unavailable; other values mean custom data type

var STEP

One instruction has been executed. Spurious events of this kind are silently ignored by IDA.

var STEP_TRACE

lowest level trace. trace buffers are not maintained

var THREAD_EXITED

Thread has been stopped.

var THREAD_STARTED

New thread has been started.

var TRACE_FULL

The trace buffer of the tracer module is full and IDA needs to read it before continuing

Functions

def appcall(func_ea: ea_t, tid: thid_t, _type_or_none: bytevec_t const &, _fields: bytevec_t const &, arg_list: PyObject *)

appcall(func_ea, tid, _type_or_none, _fields, arg_list) -> PyObject *

@param func_ea: ea_t @param tid: thid_t @param _type_or_none: bytevec_t const & @param _fields: bytevec_t const & @param arg_list: PyObject *

def can_exc_continue(ev: debug_event_t) ‑> bool

can_exc_continue(ev) -> bool

@param ev: debug_event_t const *

def cleanup_appcall(tid: thid_t)

cleanup_appcall(tid) -> error_t Cleanup after manual appcall.

@param tid: (C++: thid_t) thread to use. NO_THREAD means to use the current thread The application state is restored as it was before calling the last appcall(). Nested appcalls are supported. @return: eOk if successful, otherwise an error code

def cpu2ieee(ieee_out: fpvalue_t *, cpu_fpval: void const *, size: int)

cpu2ieee(ieee_out, cpu_fpval, size) -> int Convert a floating point number in CPU native format to IDA's internal format.

@param ieee_out: (C++: fpvalue_t ) output buffer @param cpu_fpval: (C++: const void ) floating point number in CPU native format @param size: (C++: int) size of cpu_fpval in bytes (size of the input buffer) @return: Floating point/IEEE Conversion codes

def dbg_appcall(retval: idc_value_t *, func_ea: ea_t, tid: thid_t, ptif: tinfo_t, argv: idc_value_t *, argnum: size_t)

dbg_appcall(retval, func_ea, tid, ptif, argv, argnum) -> error_t Call a function from the debugged application.

@param retval: (C++: idc_value_t ) function return value * for APPCALL_MANUAL, r will hold the new stack point value * for APPCALL_DEBEV, r will hold the exception information upon failure and the return code will be eExecThrow @param func_ea: (C++: ea_t) address to call @param tid: (C++: thid_t) thread to use. NO_THREAD means to use the current thread @param ptif: (C++: const tinfo_t ) pointer to type of the function to call @param argv: (C++: idc_value_t *) array of arguments @param argnum: (C++: size_t) number of actual arguments @return: eOk if successful, otherwise an error code

def dbg_get_memory_info()

dbg_get_memory_info() -> PyObject * This function returns the memory configuration of a debugged process.

@return: None if no debugger is active tuple(start_ea, end_ea, name, sclass, sbase, bitness, perm)

def dbg_get_name()

dbg_get_name() -> PyObject * This function returns the current debugger's name.

@return: Debugger name or None if no debugger is active

def dbg_get_registers()

dbg_get_registers() -> PyObject * This function returns the register definition from the currently loaded debugger. Basically, it returns an array of structure similar to to idd.hpp / register_info_t

@return: None if no debugger is loaded tuple(name, flags, class, dtype, bit_strings, default_bit_strings_mask) The bit_strings can be a tuple of strings or None (if the register does not have bit_strings)

def dbg_get_thread_sreg_base(tid: thid_t, sreg_value: int)

dbg_get_thread_sreg_base(tid, sreg_value) -> PyObject * Returns the segment register base value

@param tid: thread id @param sreg_value: segment register (selector) value @return: - The base as an 'ea' - Or None on failure

def dbg_read_memory(ea: ea_t, sz: size_t)

dbg_read_memory(ea, sz) -> PyObject * Reads from the debugee's memory at the specified ea

@param ea: ea_t @param sz: size_t @return: - The read buffer (as bytes) - Or None on failure

def dbg_write_memory(ea: ea_t, buf: bytevec_t const &)

dbg_write_memory(ea, buf) -> bool Writes a buffer to the debugee's memory

@param ea: ea_t @param buf: bytevec_t const & @return: Boolean

def get_dbg()

get_dbg() -> debugger_t

def get_event_bpt_hea(ev: debug_event_t)

get_event_bpt_hea(ev) -> ea_t

@param ev: debug_event_t const *

def get_event_exc_code(ev: debug_event_t)

get_event_exc_code(ev) -> uint

@param ev: debug_event_t const *

def get_event_exc_ea(ev: debug_event_t)

get_event_exc_ea(ev) -> ea_t

@param ev: debug_event_t const *

def get_event_exc_info(ev: debug_event_t)

get_event_exc_info(ev) -> str

@param ev: debug_event_t const *

def get_event_info(ev: debug_event_t)

get_event_info(ev) -> str

@param ev: debug_event_t const *

def get_event_module_base(ev: debug_event_t)

get_event_module_base(ev) -> ea_t

@param ev: debug_event_t const *

def get_event_module_name(ev: debug_event_t)

get_event_module_name(ev) -> str

@param ev: debug_event_t const *

def get_event_module_size(ev: debug_event_t)

get_event_module_size(ev) -> asize_t

@param ev: debug_event_t const *

def ieee2cpu(cpu_fpval_out: void *, ieee: fpvalue_t const &, size: int)

ieee2cpu(cpu_fpval_out, ieee, size) -> int Convert a floating point number in IDA's internal format to CPU native format.

@param cpu_fpval_out: (C++: void *) output buffer @param ieee: (C++: const fpvalue_t &) floating point number of IDA's internal format @param size: (C++: int) size of cpu_fpval in bytes (size of the output buffer) @return: Floating point/IEEE Conversion codes

def set_debug_event_code(ev: debug_event_t, id: event_id_t)

set_debug_event_code(ev, id)

@param ev: debug_event_t * @param id: enum event_id_t

Classes

class Appcall__

Class variables

var APPCALL_DEBEV

Return debug event information If this bit is set, exceptions during appcall will generate idc exceptions with full information about the exception

var APPCALL_MANUAL

Only set up the appcall, do not run it. you should call CleanupAppcall() when finished

var APPCALL_TIMEOUT

Appcall with timeout The timeout value in milliseconds is specified in the high 2 bytes of the 'options' argument: If timed out, errbuf will contain "timeout".

Static methods

def UTF16(s)

def array(type_name)

Defines an array type. Later you need to pack() / unpack()

def buffer(str=None, size=0, fill='\x00')

Creates a string buffer. The returned value (r) will be a byref object. Use r.value to get the contents and r.size to get the buffer's size

def byref(val)

Method to create references to immutable objects Currently we support references to int/strings Objects need not be passed by reference (this will be done automatically)

def cleanup_appcall(tid=0)

Equivalent to IDC's CleanupAppcall()

def cstr(val)

def get_appcall_options()

Return the global Appcall options

def int64(v)

Whenever a 64bit number is needed use this method to construct an object

def obj(**kwds)

Returns an empty object or objects with attributes as passed via its keywords arguments

def proto(name_or_ea, proto_or_tinfo, flags=None)

Allows you to instantiate an appcall (callable object) with the desired prototype @param name_or_ea: The name of the function (will be resolved with LocByName()) @param proto_or_tinfo: function prototype as a string or type of the function as tinfo_t object @return: - On failure it raises an exception if the prototype could not be parsed or the address is not resolvable - Returns a callbable Appcall instance with the given prototypes and flags

def set_appcall_options(opt)

Method to change the Appcall options globally (not per Appcall)

def typedobj(typedecl_or_tinfo, ea=None)

Returns an appcall object for a type (can be given as tinfo_t object or as a string declaration) One can then use retrieve() member method @param ea: Optional parameter that later can be used to retrieve the type @return: Appcall object or raises ValueError exception

def unicode(s)

def valueof(name, default=0)

Returns the numeric value of a given name string. If the name could not be resolved then the default value will be returned

Instance variables

var Consts

Use Appcall.Consts.CONST_NAME to access constants

class Appcall_array__ (tp)

This class is used with Appcall.array() method

Methods

def pack(self, L)

Packs a list or tuple into a byref buffer

def try_to_convert_to_list(self, obj)

Is this object a list? We check for the existance of attribute zero and attribute self.size-1

def unpack(self, buf, as_list=True)

Unpacks an array back into a list or an object

class Appcall_callable__ (ea, tinfo_or_typestr=None, fields=None)

Helper class to issue appcalls using a natural syntax: appcall.FunctionNameInTheDatabase(arguments, ....) or appcall"Function@8" or f8 = appcall["Function@8"] f8(arg1, arg2, …) or o = appcall.obj() i = byref(5) appcall.funcname(arg1, i, "hello", o)

Initializes an appcall with a given function ea

Instance variables

var ea

Returns or sets the EA associated with this object

var fields

Returns the field names

var options

Sets the Appcall options locally to this Appcall instance

var size

Returns the size of the type

var tif

Returns the tinfo_t object

var timeout

An Appcall instance can change its timeout value with this attribute

var type

Returns the typestring

Methods

def retrieve(self, src=None, flags=0)

Unpacks a typed object from the database if an ea is given or from a string if a string was passed @param src: the address of the object or a string @return: Returns a tuple of boolean and object or error number (Bool, Error | Object).

def store(self, obj, dest_ea=None, base_ea=0, flags=0)

Packs an object into a given ea if provided or into a string if no address was passed. @param obj: The object to pack @param dest_ea: If packing to idb this will be the store location @param base_ea: If packing to a buffer, this will be the base that will be used to relocate the pointers

@return: - If packing to a string then a Tuple(Boolean, packed_string or error code) - If packing to the database then a return code is returned (0 is success)

class Appcall_consts__ (default=None)

Helper class used by Appcall.Consts attribute It is used to retrieve constants via attribute access

class bptaddr_t

Proxy of C++ bptaddr_t class.

init(self) -> bptaddr_t

Instance variables

var hea : ea_t

Possible address referenced by hardware breakpoints.

var kea : ea_t

Address of the triggered bpt from the kernel's point of view. (for some systems with special memory mappings, the triggered ea might be different from event ea). Use to BADADDR for flat memory model.

var thisown

The membership flag

class call_stack_info_t

Proxy of C++ call_stack_info_t class.

init(self) -> call_stack_info_t

Instance variables

var callea : ea_t

the address of the call instruction. for the 0th frame this is usually just the current value of EIP.

var fp : ea_t

the value of the frame pointer of the called function

var funcea : ea_t

the address of the called function

var funcok : bool

is the function present?

var thisown

The membership flag

class call_stack_info_vec_t (*args)

Proxy of C++ qvector< call_stack_info_t > class.

init(self) -> call_stack_info_vec_t init(self, x) -> call_stack_info_vec_t

@param x: qvector< call_stack_info_t > const &

Subclasses

• call_stack_t

Instance variables

var thisown

The membership flag

Methods

def add_unique(self, x: call_stack_info_t) ‑> bool

add_unique(self, x) -> bool

@param x: call_stack_info_t const &

def at(self, _idx: size_t)

at(self, _idx) -> call_stack_info_t

@param _idx: size_t

def back(self)

def begin(self, *args)

begin(self) -> call_stack_info_t

def capacity(self)

capacity(self) -> size_t

def clear(self)

clear(self)

def empty(self) ‑> bool

empty(self) -> bool

def end(self, *args)

end(self) -> call_stack_info_t

def erase(self, *args)

erase(self, it) -> call_stack_info_t

@param it: qvector< call_stack_info_t >::iterator

erase(self, first, last) -> call_stack_info_t

@param first: qvector< call_stack_info_t >::iterator @param last: qvector< call_stack_info_t >::iterator

def extract(self)

extract(self) -> call_stack_info_t

def find(self, *args)

find(self, x) -> call_stack_info_t

@param x: call_stack_info_t const &

def front(self)

def grow(self, *args)

grow(self, x=call_stack_info_t())

@param x: call_stack_info_t const &

def has(self, x: call_stack_info_t) ‑> bool

has(self, x) -> bool

@param x: call_stack_info_t const &

def inject(self, s: call_stack_info_t, len: size_t)

inject(self, s, len)

@param s: call_stack_info_t * @param len: size_t

def insert(self, it: call_stack_info_t, x: call_stack_info_t)

insert(self, it, x) -> call_stack_info_t

@param it: qvector< call_stack_info_t >::iterator @param x: call_stack_info_t const &

def pop_back(self)

pop_back(self)

def push_back(self, *args)

push_back(self, x)

@param x: call_stack_info_t const &

push_back(self) -> call_stack_info_t

def qclear(self)

qclear(self)

def reserve(self, cnt: size_t)

reserve(self, cnt)

@param cnt: size_t

def resize(self, *args)

resize(self, _newsize, x)

@param _newsize: size_t @param x: call_stack_info_t const &

resize(self, _newsize)

@param _newsize: size_t

def size(self)

size(self) -> size_t

def swap(self, r: call_stack_info_vec_t)

swap(self, r)

@param r: qvector< call_stack_info_t > &

def truncate(self)

truncate(self)

class call_stack_t

Proxy of C++ call_stack_t class.

init(self) -> call_stack_t

Ancestors

• call_stack_info_vec_t

Inherited members

• call_stack_info_vec_t:
  • add_unique
  • at
  • begin
  • capacity
  • clear
  • empty
  • end
  • erase
  • extract
  • find
  • grow
  • has
  • inject
  • insert
  • pop_back
  • push_back
  • qclear
  • reserve
  • resize
  • size
  • swap
  • thisown
  • truncate

class debapp_attrs_t

Proxy of C++ debapp_attrs_t class.

init(self) -> debapp_attrs_t

Instance variables

var addrsize : int

address size of the process. Since 64-bit debuggers usually can debug 32-bit applications, we cannot rely on sizeof(ea_t) to detect the current address size. The following variable should be used instead. It is initialized with 8 for 64-bit debuggers but they should adjust it as soon as they learn that a 32-bit application is being debugged. For 32-bit debuggers it is initialized with 4.

var cbsize : int32

control field: size of this structure

var is_be : int

is_be

var platform : qstring

platform name process is running/debugging under. (is used as a key value in exceptions.cfg)

var thisown

The membership flag

class debug_event_t (*args)

Proxy of C++ debug_event_t class.

init(self) -> debug_event_t init(self, r) -> debug_event_t

@param r: debug_event_t const &

Instance variables

var ea : ea_t

Address where the event occurred.

var handled : bool

Is event handled by the debugger?. (from the system's point of view) Meaningful for EXCEPTION events

var pid : pid_t

Process where the event occurred.

var thisown

The membership flag

var tid : thid_t

Thread where the event occurred.

Methods

def bpt(self, *args)

bpt(self) -> bptaddr_t

def bpt_ea(self)

bpt_ea(self) -> ea_t On some systems with special memory mappings the triggered ea might be different from the actual ea. Calculate the address to use.

def clear(self)

clear(self) clear the dependent information (see below), set event code to NO_EVENT

def clear_all(self)

clear_all(self)

def copy(self, r: debug_event_t)

copy(self, r) -> debug_event_t

@param r: debug_event_t const &

def eid(self)

eid(self) -> event_id_t Event code.

def exc(self, *args)

exc(self) -> excinfo_t

def exit_code(self)

exit_code(self) -> int const &

def info(self, *args)

info(self) -> qstring info(self) -> qstring const &

def modinfo(self, *args)

modinfo(self) -> modinfo_t

def set_bpt(self)

set_bpt(self) -> bptaddr_t

def set_eid(self, id: event_id_t)

set_eid(self, id) Set event code. If the new event code is compatible with the old one then the dependent information (see below) will be preserved. Otherwise the event will be cleared and the new event code will be set.

@param id: (C++: event_id_t) enum event_id_t

def set_exception(self)

set_exception(self) -> excinfo_t

def set_exit_code(self, id: event_id_t, code: int)

set_exit_code(self, id, code)

@param id: enum event_id_t @param code: int

def set_info(self, id: event_id_t)

set_info(self, id) -> qstring &

@param id: enum event_id_t

def set_modinfo(self, id: event_id_t)

set_modinfo(self, id) -> modinfo_t

@param id: enum event_id_t

class debugger_t

Proxy of C++ debugger_t class.

init(self) -> debugger_t

Class variables

var ev_appcall

Call application function. This event calls a function from the debugged application. This event is generated in debthread Available if HAS_APPCALL is set @param blob_ea: (::ea_t ) ea of stkargs blob, BADADDR if failed and errbuf is filled @param func_ea: (::ea_t) address to call @param tid: (thid_t) thread to use @param fti: (const func_type_data_t ) type information for the generated event @param nargs: (int) number of actual arguments @param regargs: (const regobjs_t ) information about register arguments @param stkargs: (relobj_t ) memory blob to pass as stack arguments (usually contains pointed data) it must be relocated by the callback but not changed otherwise @param retregs: (regobjs_t ) event return registers. @param errbuf: (qstring ) the error message. if empty on failure, see EVENT. should not be filled if an appcall exception happened but APPCALL_DEBEV is set @param event: (debug_event_t *) the last debug event that occurred during appcall execution filled only if the appcall execution fails and APPCALL_DEBEV is set @param options: (int) appcall options, usually taken from idainfo::appcall_options. possible values: combination of Appcall options or 0 @retval DRC_NONE @retval DRC_OK,see: BLOB_EA

var ev_attach_process

Attach to an existing running process. event_id should be equal to -1 if not attaching to a crashed process. This event is generated in debthread. Available if DBG_HAS_ATTACH_PROCESS is set @param pid: (pid_t) process id to attach @param event_id: (int) event to trigger upon attaching @param dbg_proc_flags: (uint32) Debug process flags @param errbuf: (qstring *) may be nullptr @return: DRC_NONE, DRC_OK, DRC_FAILED, DRC_NETERR

var ev_bin_search

Search for a binary pattern in the program. @param out: (::ea_t ) binary pattern address @param start_ea: (::ea_t) linear address, start of range to search @param end_ea: (::ea_t) linear address, end of range to search (exclusive) @param data: (const ::compiled_binpat_vec_t ) the prepared data to search for (see parse_binpat_str()) @param srch_flags: (int) combination of Search flags @param errbuf: (qstring *) may be nullptr @return: DRC_OK EA contains the binary pattern address @retval DRC_FAILED: not found @retval DRC_NONE: not implemented @retval DRC_NETERR,DRC_ERROR

var ev_check_bpt

Is it possible to set breakpoint? This event is generated in debthread or in the main thread if debthread is not running yet. It is generated to verify hardware breakpoints. Available if DBG_HAS_CHECK_BPT is set @param bptvc: (int *) breakpoint verification codes Breakpoint verification codes @param type: (bpttype_t) Hardware breakpoint ids @param ea: (::ea_t) @param len: (int) @return: DRC_OK, DRC_NONE

var ev_cleanup_appcall

Cleanup after appcall(). The debugger module must keep the stack blob in the memory until this event is generated. It will be generated by the kernel for each successful appcall(). There is an exception: if APPCALL_MANUAL, IDA may not call cleanup_appcall. If the user selects to terminate a manual appcall, then cleanup_appcall will be generated. Otherwise, the debugger module should terminate the appcall when the generated event returns. This event is generated in debthread. Available if HAS_APPCALL is set @param tid: (thid_t) @retval DRC_EVENTS: success, there are pending events @retval DRC_OK: success @retval DRC_FAILED: failed @retval DRC_NETERR: network error

var ev_close_file

@param fn: (int) handle @return: ignored

var ev_dbg_enable_trace

Enable/Disable tracing. The kernel will generated this event if the debugger plugin set DBG_FLAG_TRACER_MODULE. TRACE_FLAGS can be a set of STEP_TRACE, INSN_TRACE, BBLK_TRACE or FUNC_TRACE. This event is generated in the main thread. @param tid: (thid_t) @param enable: (bool) @param trace_flags: (int) @return: DRC_OK, DRC_FAILED, DRC_NONE

var ev_detach_process

Detach from the debugged process. May be generated while the process is running or suspended. Must detach from the process in any case. The kernel will repeatedly call get_debug_event() until PROCESS_DETACHED is received. In this mode, all other events will be automatically handled and process will be resumed. This event is generated from debthread. Available if DBG_HAS_DETACH_PROCESS is set @return: DRC_NONE, DRC_OK, DRC_FAILED, DRC_NETERR

var ev_eval_lowcnd

Evaluate a low level breakpoint condition at 'ea'. Other evaluation errors are displayed in a dialog box. This call is used by IDA when the process has already been temporarily suspended for some reason and IDA has to decide whether the process should be resumed or definitely suspended because of a breakpoint with a low level condition. This event is generated in debthread. @param tid: (thid_t) @param ea: (::ea_t) @param errbuf: (qstring *) may be nullptr @retval DRC_OK: condition is satisfied @retval DRC_FAILED: not satisfied @retval DRC_NETERR: network error

var ev_exit_process

Stop the process. May be generated while the process is running or suspended. Must terminate the process in any case. The kernel will repeatedly call get_debug_event() until PROCESS_EXITED is received. In this mode, all other events will be automatically handled and process will be resumed. This event is generated in debthread. Must be implemented. @param errbuf: (qstring *) may be nullptr @return: DRC_NONE, DRC_OK, DRC_FAILED, DRC_NETERR

var ev_get_debapp_attrs

Retrieve process- and debugger-specific runtime attributes. This event is generated in the main thread. @param out_pattrs: (debapp_attrs_t *) @return: DRC_NONE, DRC_OK

var ev_get_debmod_extensions

Get pointer to debugger specific events. This event returns a pointer to a structure that holds pointers to debugger module specific events. For information on the structure layout, please check the corresponding debugger module. Most debugger modules return nullptr because they do not have any extensions. Available extensions may be generated from plugins. This event is generated in the main thread. @param ext: (void **) @return: DRC_NONE, DRC_OK see EXT

var ev_get_debug_event

Get a pending debug event and suspend the process. This event will be generated regularly by IDA. This event is generated in debthread. IMPORTANT: the BREAKPOINT/EXCEPTION/STEP events must be reported only after reporting other pending events for a thread. Must be implemented. @param code: (gdecode_t ) @param event: (debug_event_t ) @param timeout_ms: (int) @retval ignored

var ev_get_memory_info

Get information on the memory ranges. The debugger module fills 'ranges'. The returned vector must be sorted. This event is generated in debthread. Must be implemented. @param ranges: (meminfo_vec_t ) @param errbuf: (qstring ) may be nullptr @retval DRC_OK: new memory layout is returned @retval DRC_FAILED,DRC_NETERR,DRC_NOPROC,DRC_NOCHG,DRC_IDBSEG

var ev_get_processes

Return information about the running processes. This event is generated in the main thread. Available if DBG_HAS_GET_PROCESSES is set @param procs: (::procinfo_vec_t ) @param errbuf: (qstring ) may be nullptr @return: DRC_NONE, DRC_OK, DRC_FAILED, DRC_NETERR

var ev_get_srcinfo_path

Get the path to a file containing source debug info for the given module. This allows srcinfo providers to call into the debugger when looking for debug info. It is useful in certain cases like the iOS debugger, which is a remote debugger but the remote debugserver does not provide dwarf info. So, we allow the debugger client to decide where to look for debug info locally. @param path: (qstring *) output path (file might not exist) @param base: (::ea_t) base address of a module in the target process @return: DRC_NONE, DRC_OK result stored in PATH

var ev_init_debugger

Initialize debugger. This event is generated in the main thread. @param hostname: (const char ) @param portnum: (int) @param password: (const char ) @param errbuf: (qstring *) may be nullptr @return: DRC_OK, DRC_FAILED

var ev_is_tracing_enabled

Is tracing enabled? The kernel will generated this event if the debugger plugin set DBG_FLAG_TRACER_MODULE. TRACE_BIT can be one of the following: STEP_TRACE, INSN_TRACE, BBLK_TRACE or FUNC_TRACE @param tid: (thid_t) @param tracebit: (int) @retval DRC_OK: bit is set @retval DRC_NONE: bit is not set or not implemented

var ev_map_address

Map process address. The debugger module may ignore this event. This event is generated in debthread. IDA will generate this event only if DBG_HAS_MAP_ADDRESS is set. @param mapped: (::ea_t ) mapped address or BADADDR @param off: (::ea_t) offset to map @param regs: (const regval_t ) current register values. if regs == nullptr, then perform global mapping, which is independent on used registers usually such a mapping is a trivial identity mapping @param regnum: (int) required mapping. May be specified as a segment register number or a regular register number if the required mapping can be deduced from it. For example, esp implies that ss should be used. @return: DRC_NONE, DRC_OK see MAPPED

var ev_open_file

@param file: (const char ) @param fsize: (::uint64 ) @param readonly: (bool) @param errbuf: (qstring *) may be nullptr @retval (int): handle @retval -1: error

var ev_read_file

@param fn: (int) handle @param off: (qoff64_t) @param buf: (void ) @param size: (size_t) @param errbuf: (qstring ) may be nullptr @retval number: of read bytes

var ev_read_memory

Read process memory. This event is generated in debthread. @param nbytes: (size_t ) number of read bytes @param ea: (::ea_t) @param buffer: (void ) @param size: (::size_t) @param errbuf: (qstring *) may be nullptr @return: DRC_OK, DRC_FAILED, DRC_NOPROC

var ev_read_registers

Read thread registers. This event is generated in debthread. Must be implemented. @param tid: (thid_t) thread id @param clsmask: (int) bitmask of register classes to read @param values: (regval_t ) pointer to vector of regvals for all registers. regval must have debugger_t::nregisters elements @param errbuf: (qstring ) may be nullptr @return: DRC_OK, DRC_FAILED, DRC_NETERR

var ev_rebase_if_required_to

Rebase database if the debugged program has been rebased by the system. This event is generated in the main thread. @param new_base: (::ea_t) @return: DRC_NONE, DRC_OK

var ev_request_pause

Prepare to pause the process. Normally the next get_debug_event() will pause the process If the process is sleeping, then the pause will not occur until the process wakes up. If the debugger module does not react to this event, then it will be impossible to pause the program. This event is generated in debthread. Available if DBG_HAS_REQUEST_PAUSE is set @param errbuf: (qstring *) may be nullptr @return: DRC_NONE, DRC_OK, DRC_FAILED, DRC_NETERR

var ev_resume

Continue after handling the event. This event is generated in debthread. Must be implemented. @param event: (debug_event_t *) @return: DRC_OK, DRC_FAILED, DRC_NETERR

var ev_rexec

Execute a command on the remote computer. Available if DBG_HAS_REXEC is set @param cmdline: (const char *) @return: (int) exit code

var ev_send_ioctl

Perform a debugger-specific event. This event is generated in debthread @param fn: (int) @param buf: (const void ) @param size: (size_t) @param poutbuf: (void ) @param poutsize: (ssize_t ) @param errbuf: (qstring *) may be nullptr @retval DRC_…

var ev_set_exception_info

Set exception handling. This event is generated in debthread or the main thread. Available if DBG_HAS_SET_EXCEPTION_INFO is set @param info: (exception_info_t *) @param qty: (int) @return: DRC_NONE, DRC_OK

var ev_set_resume_mode

Specify resume action Available if DBG_HAS_SET_RESUME_MODE is set @param tid: (thid_t) @param resmod: (resume_mode_t)

var ev_start_process

Start an executable to debug. This event is generated in debthread. Must be implemented. @param path: (const char ) path to executable @param args: (const char ) arguments to pass to executable @param startdir: (const char ) initial working directory of new process @param dbg_proc_flags: (uint32) Debug process flags @param input_path: (const char ) path to the file that was used to create the idb file It is not always the same as 'path' - e.g. if we are analyzing a dll and want to launch an executable that loads it. @param input_file_crc32: (uint32) CRC value for 'input_path' @param errbuf: (qstring ) may be nullptr @param envs: (launch_env_t ) environment variables for debugged process @return: DRC_OK, DRC_CRC, DRC_FAILED, DRC_NETERR, DRC_NOFILE

var ev_suspended

This event will be generated by the kernel each time it has suspended the debuggee process and refreshed the database. The debugger module may add information to the database if necessary.

The reason for introducing this event is that when an event like LOAD_DLL happens, the database does not reflect the memory state yet and therefore we can't add information about the dll into the database in the get_debug_event() function. Only when the kernel has adjusted the database we can do it. Example: for loaded PE DLLs we can add the exported function names to the list of debug names (see set_debug_names()).

This event is generated in the main thread. @param dlls_added: (bool) @param thr_names: (thread_name_vec_t *) (for the kernel only, must be nullptr) @return: DRC_NONE, DRC_OK

var ev_term_debugger

Terminate debugger. This event is generated in the main thread. @return: DRC_OK, DRC_FAILED

var ev_thread_continue

Resume a suspended thread Available if DBG_HAS_THREAD_CONTINUE is set @param tid: (thid_t)

var ev_thread_get_sreg_base

Get information about the base of a segment register. Currently used by the IBM PC module to resolve references like fs:0. This event is generated in debthread. Available if DBG_HAS_THREAD_GET_SREG_BASE is set @param answer: (::ea_t ) pointer to the answer. can't be nullptr. @param tid: (thid_t) thread id @param sreg_value: (int) value of the segment register (returned by get_reg_val()) @param errbuf: (qstring ) may be nullptr @return: DRC_NONE, DRC_OK, DRC_FAILED, DRC_NETERR

var ev_thread_suspend

Suspend a running thread Available if DBG_HAS_THREAD_SUSPEND is set @param tid: (thid_t)

var ev_update_bpts

Add/del breakpoints. bpts array contains nadd bpts to add, followed by ndel bpts to del. This event is generated in debthread. @param nbpts: (int ) number of updated breakpoints @param bpts: (update_bpt_info_t ) @param nadd: (int) @param ndel: (int) @param errbuf: (qstring *) may be nullptr @return: DRC_OK, DRC_FAILED, DRC_NETERR

var ev_update_call_stack

Calculate the call stack trace for the given thread. This event is generated when the process is suspended and should fill the 'trace' object with the information about the current call stack. If this event returns DRC_NONE, IDA will try to invoke a processor-specific mechanism (see processor_t::ev_update_call_stack). If the current processor module does not implement stack tracing, then IDA will fall back to a generic algorithm (based on the frame pointer chain) to calculate the trace. This event is ideal if the debugging targets manage stack frames in a peculiar way, requiring special analysis. This event is generated in the main thread. Available if DBG_HAS_UPDATE_CALL_STACK is set @param tid: (thid_t) @param trace: (call_stack_t *) @retval DRC_NONE: false or not implemented @return: DRC_OK success

var ev_update_lowcnds

Update low-level (server side) breakpoint conditions. This event is generated in debthread. @param nupdated: (int ) number of updated conditions @param lowcnds: (const lowcnd_t ) @param nlowcnds: (int) @param errbuf: (qstring *) may be nullptr @return: DRC_OK, DRC_NETERR

var ev_write_file

@param fn: (int) handle @param off: (qoff64_t) @param buf: (const void ) @param size: (size_t) @param errbuf: (qstring ) may be nullptr @retval number: of written bytes

var ev_write_memory

Write process memory. This event is generated in debthread. @param nbytes: (size_t ) number of written bytes @param ea: (::ea_t) @param buffer: (const void ) @param size: (::size_t) @param errbuf: (qstring *) may be nullptr @retval DRC_OK,DRC_FAILED,DRC_NOPROC

var ev_write_register

Write one thread register. This event is generated in debthread. Must be implemented. @param tid: (thid_t) thread id @param regidx: (int) register index @param value: (const regval_t ) new value of the register @param errbuf: (qstring ) may be nullptr @return: DRC_OK, DRC_FAILED, DRC_NETERR

Instance variables

var bpt_bytes : bytevec_t

A software breakpoint instruction.

var bpt_size : uchar

Size of the software breakpoint instruction in bytes.

var default_regclasses : int

Mask of default printed register classes.

var filetype : uchar

Input file type for the instant debugger. This value will be used after attaching to a new process.

var flags : uint32

flags

var flags2 : uint32

Debugger module features

var id : int

one of Debugger API module id

var memory_page_size : int

Size of a memory page. Usually 4K.

var name : char const *

Short debugger name like win32 or linux.

var nregisters : int

Number of registers.

var processor : char const *

Required processor name. Used for instant debugging to load the correct processor module

var regclasses : PyObject *

Array of register class names.

var registers : dynamic_wrapped_array_t< register_info_t >

Array of registers. Use regs() to access it.

var resume_modes : ushort

Resume modes

var thisown

The membership flag

var version : int

Expected kernel version, should be IDD_INTERFACE_VERSION

Methods

def attach_process(self, pid: pid_t, event_id: int, dbg_proc_flags: uint32)

attach_process(self, pid, event_id, dbg_proc_flags) -> drc_t

@param pid: pid_t @param event_id: int @param dbg_proc_flags: uint32

def bin_search(self, start_ea: ea_t, end_ea: ea_t, data: compiled_binpat_vec_t const &, srch_flags: int)

bin_search(self, start_ea, end_ea, data, srch_flags) -> drc_t

@param start_ea: ea_t @param end_ea: ea_t @param data: compiled_binpat_vec_t const & @param srch_flags: int

def cache_block_size(self)

cache_block_size(self) -> size_t

def can_continue_from_bpt(self) ‑> bool

can_continue_from_bpt(self) -> bool

def can_debug_standalone_dlls(self) ‑> bool

can_debug_standalone_dlls(self) -> bool

def check_bpt(self, bptvc: int *, type: bpttype_t, ea: ea_t, len: int)

check_bpt(self, bptvc, type, ea, len) -> drc_t

@param bptvc: int * @param type: bpttype_t @param ea: ea_t @param len: int

def cleanup_appcall(self, tid: thid_t)

cleanup_appcall(self, tid) -> drc_t

@param tid: thid_t

def close_file(self, fn: int)

close_file(self, fn)

@param fn: int

def dbg_enable_trace(self, tid: thid_t, enable: bool, trace_flags: int)

dbg_enable_trace(self, tid, enable, trace_flags) -> bool

@param tid: thid_t @param enable: bool @param trace_flags: int

def detach_process(self)

detach_process(self) -> drc_t

def eval_lowcnd(self, tid: thid_t, ea: ea_t)

eval_lowcnd(self, tid, ea) -> drc_t

@param tid: thid_t @param ea: ea_t

def exit_process(self)

exit_process(self) -> drc_t

def fake_memory(self) ‑> bool

fake_memory(self) -> bool

def get_debapp_attrs(self, out_pattrs: debapp_attrs_t) ‑> bool

get_debapp_attrs(self, out_pattrs) -> bool

@param out_pattrs: debapp_attrs_t *

def get_debmod_extensions(self)

get_debmod_extensions(self) -> void const *

def get_debug_event(self, event: debug_event_t, timeout_ms: int)

get_debug_event(self, event, timeout_ms) -> gdecode_t

@param event: debug_event_t * @param timeout_ms: int

def get_memory_info(self, ranges: meminfo_vec_t)

get_memory_info(self, ranges) -> drc_t

@param ranges: meminfo_vec_t &

def get_processes(self, procs: procinfo_vec_t)

get_processes(self, procs) -> drc_t

@param procs: procinfo_vec_t *

def get_srcinfo_path(self, path: qstring *, base: ea_t)

get_srcinfo_path(self, path, base) -> bool

@param path: qstring * @param base: ea_t

def has_appcall(self) ‑> bool

has_appcall(self) -> bool

def has_attach_process(self) ‑> bool

has_attach_process(self) -> bool

def has_check_bpt(self) ‑> bool

has_check_bpt(self) -> bool

def has_detach_process(self) ‑> bool

has_detach_process(self) -> bool

def has_get_processes(self) ‑> bool

has_get_processes(self) -> bool

def has_map_address(self) ‑> bool

has_map_address(self) -> bool

def has_open_file(self) ‑> bool

has_open_file(self) -> bool

def has_request_pause(self) ‑> bool

has_request_pause(self) -> bool

def has_rexec(self) ‑> bool

has_rexec(self) -> bool

def has_set_exception_info(self) ‑> bool

has_set_exception_info(self) -> bool

def has_set_resume_mode(self) ‑> bool

has_set_resume_mode(self) -> bool

def has_soft_bpt(self) ‑> bool

has_soft_bpt(self) -> bool

def has_thread_continue(self) ‑> bool

has_thread_continue(self) -> bool

def has_thread_get_sreg_base(self) ‑> bool

has_thread_get_sreg_base(self) -> bool

def has_thread_suspend(self) ‑> bool

has_thread_suspend(self) -> bool

def has_update_call_stack(self) ‑> bool

has_update_call_stack(self) -> bool

def init_debugger(self, hostname: char const *, portnum: int, password: char const *)

init_debugger(self, hostname, portnum, password) -> bool

@param hostname: char const * @param portnum: int @param password: char const *

def is_remote(self) ‑> bool

is_remote(self) -> bool

def is_resmod_avail(self, resmod: int) ‑> bool

is_resmod_avail(self, resmod) -> bool

@param resmod: int

def is_safe(self) ‑> bool

is_safe(self) -> bool

def is_tracing_enabled(self, tid: thid_t, tracebit: int)

is_tracing_enabled(self, tid, tracebit) -> bool

@param tid: thid_t @param tracebit: int

def map_address(self, off: ea_t, regs: regval_t, regnum: int)

map_address(self, off, regs, regnum) -> ea_t

@param off: ea_t @param regs: regval_t const * @param regnum: int

def may_disturb(self) ‑> bool

may_disturb(self) -> bool

def may_take_exit_snapshot(self) ‑> bool

may_take_exit_snapshot(self) -> bool

def must_have_hostname(self) ‑> bool

must_have_hostname(self) -> bool

def open_file(self, file: char const *, fsize: uint64 *, readonly: bool)

open_file(self, file, fsize, readonly) -> int

@param file: char const * @param fsize: uint64 * @param readonly: bool

def read_file(self, fn: int, off: qoff64_t, buf: void *, size: size_t)

read_file(self, fn, off, buf, size) -> ssize_t

@param fn: int @param off: qoff64_t @param buf: void * @param size: size_t

def read_memory(self, nbytes: size_t *, ea: ea_t, buffer: void *, size: size_t)

read_memory(self, nbytes, ea, buffer, size) -> drc_t

@param nbytes: size_t * @param ea: ea_t @param buffer: void * @param size: size_t

def read_registers(self, tid: thid_t, clsmask: int, values: regval_t)

read_registers(self, tid, clsmask, values) -> drc_t

@param tid: thid_t @param clsmask: int @param values: regval_t *

def rebase_if_required_to(self, new_base: ea_t)

rebase_if_required_to(self, new_base)

@param new_base: ea_t

def regs(self, idx: int)

regs(self, idx) -> register_info_t

@param idx: int

def request_pause(self)

request_pause(self) -> drc_t

def resume(self, event: debug_event_t)

resume(self, event) -> drc_t

@param event: debug_event_t const *

def rexec(self, cmdline: char const *)

rexec(self, cmdline) -> int

@param cmdline: char const *

def send_ioctl(self, fn: int, buf: void const *, poutbuf: void **, poutsize: ssize_t *)

send_ioctl(self, fn, buf, poutbuf, poutsize) -> drc_t

@param fn: int @param buf: void const * @param poutbuf: void ** @param poutsize: ssize_t *

def set_exception_info(self, info: exception_info_t, qty: int)

set_exception_info(self, info, qty)

@param info: exception_info_t const * @param qty: int

def set_resume_mode(self, tid: thid_t, resmod: resume_mode_t)

set_resume_mode(self, tid, resmod) -> drc_t

@param tid: thid_t @param resmod: enum resume_mode_t

def start_process(self, path: char const *, args: char const *, envs: launch_env_t, startdir: char const *, dbg_proc_flags: uint32, input_path: char const *, input_file_crc32: uint32)

start_process(self, path, args, envs, startdir, dbg_proc_flags, input_path, input_file_crc32) -> drc_t

@param path: char const * @param args: char const * @param envs: launch_env_t * @param startdir: char const * @param dbg_proc_flags: uint32 @param input_path: char const * @param input_file_crc32: uint32

def supports_debthread(self) ‑> bool

supports_debthread(self) -> bool

def supports_lowcnds(self) ‑> bool

supports_lowcnds(self) -> bool

def suspended(self, dlls_added: bool, thr_names: thread_name_vec_t * = None)

suspended(self, dlls_added, thr_names=None)

@param dlls_added: bool @param thr_names: thread_name_vec_t *

def term_debugger(self) ‑> bool

term_debugger(self) -> bool

def thread_continue(self, tid: thid_t)

thread_continue(self, tid) -> drc_t

@param tid: thid_t

def thread_get_sreg_base(self, answer: ea_t *, tid: thid_t, sreg_value: int)

thread_get_sreg_base(self, answer, tid, sreg_value) -> drc_t

@param answer: ea_t * @param tid: thid_t @param sreg_value: int

def thread_suspend(self, tid: thid_t)

thread_suspend(self, tid) -> drc_t

@param tid: thid_t

def update_bpts(self, nbpts: int *, bpts: update_bpt_info_t *, nadd: int, ndel: int)

update_bpts(self, nbpts, bpts, nadd, ndel) -> drc_t

@param nbpts: int * @param bpts: update_bpt_info_t * @param nadd: int @param ndel: int

def update_call_stack(self, tid: thid_t, trace: call_stack_t)

update_call_stack(self, tid, trace) -> drc_t

@param tid: thid_t @param trace: call_stack_t *

def update_lowcnds(self, nupdated: int *, lowcnds: lowcnd_t const *, nlowcnds: int)

update_lowcnds(self, nupdated, lowcnds, nlowcnds) -> drc_t

@param nupdated: int * @param lowcnds: lowcnd_t const * @param nlowcnds: int

def use_memregs(self) ‑> bool

use_memregs(self) -> bool

def use_sregs(self) ‑> bool

use_sregs(self) -> bool

def virtual_threads(self) ‑> bool

virtual_threads(self) -> bool

def write_file(self, fn: int, off: qoff64_t, buf: void const *)

write_file(self, fn, off, buf) -> ssize_t

@param fn: int @param off: qoff64_t @param buf: void const *

def write_memory(self, nbytes: size_t *, ea: ea_t, buffer: void const *, size: size_t)

write_memory(self, nbytes, ea, buffer, size) -> drc_t

@param nbytes: size_t * @param ea: ea_t @param buffer: void const * @param size: size_t

def write_register(self, tid: thid_t, regidx: int, value: regval_t)

write_register(self, tid, regidx, value) -> drc_t

@param tid: thid_t @param regidx: int @param value: regval_t const *

class dyn_register_info_array (_data: register_info_t, _count: size_t)

Proxy of C++ dynamic_wrapped_array_t< register_info_t > class.

init(self, _data, _count) -> dyn_register_info_array

@param _data: register_info_t * @param _count: size_t

Instance variables

var count : size_t

count

var data : register_info_t *

data

var thisown

The membership flag

class exception_info_t (*args)

Proxy of C++ exception_info_t class.

init(self) -> exception_info_t init(self, _code, _flags, _name, _desc) -> exception_info_t

@param _code: uint @param _flags: uint32 @param _name: char const * @param _desc: char const *

Instance variables

var code : uint

exception code

var desc : qstring

Long message used to display info about the exception.

var flags : uint32

Exception info flags

var name : qstring

Exception standard name.

var thisown

The membership flag

Methods

def break_on(self) ‑> bool

break_on(self) -> bool Should we break on the exception?

def handle(self) ‑> bool

handle(self) -> bool Should we handle the exception?

class excinfo_t

Proxy of C++ excinfo_t class.

init(self) -> excinfo_t

Instance variables

var can_cont : bool

Execution of the process can continue after this exception?

var code : uint32

Exception code.

var ea : ea_t

Possible address referenced by the exception.

var info : qstring

Exception message.

var thisown

The membership flag

class excvec_t (*args)

Proxy of C++ qvector< exception_info_t > class.

init(self) -> excvec_t init(self, x) -> excvec_t

@param x: qvector< exception_info_t > const &

Instance variables

var thisown

The membership flag

Methods

def at(self, _idx: size_t)

at(self, _idx) -> exception_info_t

@param _idx: size_t

def back(self)

def begin(self, *args)

begin(self) -> exception_info_t

def capacity(self)

capacity(self) -> size_t

def clear(self)

clear(self)

def empty(self) ‑> bool

empty(self) -> bool

def end(self, *args)

end(self) -> exception_info_t

def erase(self, *args)

erase(self, it) -> exception_info_t

@param it: qvector< exception_info_t >::iterator

erase(self, first, last) -> exception_info_t

@param first: qvector< exception_info_t >::iterator @param last: qvector< exception_info_t >::iterator

def extract(self)

extract(self) -> exception_info_t

def front(self)

def grow(self, *args)

grow(self, x=exception_info_t())

@param x: exception_info_t const &

def inject(self, s: exception_info_t, len: size_t)

inject(self, s, len)

@param s: exception_info_t * @param len: size_t

def insert(self, it: exception_info_t, x: exception_info_t)

insert(self, it, x) -> exception_info_t

@param it: qvector< exception_info_t >::iterator @param x: exception_info_t const &

def pop_back(self)

pop_back(self)

def push_back(self, *args)

push_back(self, x)

@param x: exception_info_t const &

push_back(self) -> exception_info_t

def qclear(self)

qclear(self)

def reserve(self, cnt: size_t)

reserve(self, cnt)

@param cnt: size_t

def resize(self, *args)

resize(self, _newsize, x)

@param _newsize: size_t @param x: exception_info_t const &

resize(self, _newsize)

@param _newsize: size_t

def size(self)

size(self) -> size_t

def swap(self, r: excvec_t)

swap(self, r)

@param r: qvector< exception_info_t > &

def truncate(self)

truncate(self)

class launch_env_t

Proxy of C++ launch_env_t class.

init(self) -> launch_env_t

Instance variables

var merge : bool

merge

var thisown

The membership flag

class meminfo_vec_t

Proxy of C++ meminfo_vec_t class.

init(self) -> meminfo_vec_t

Ancestors

• meminfo_vec_template_t

Inherited members

• meminfo_vec_template_t:
  • add_unique
  • at
  • begin
  • capacity
  • clear
  • empty
  • end
  • erase
  • extract
  • find
  • grow
  • has
  • inject
  • insert
  • pop_back
  • push_back
  • qclear
  • reserve
  • resize
  • size
  • swap
  • thisown
  • truncate

class meminfo_vec_template_t (*args)

Proxy of C++ qvector< memory_info_t > class.

init(self) -> meminfo_vec_template_t init(self, x) -> meminfo_vec_template_t

@param x: qvector< memory_info_t > const &

Subclasses

• meminfo_vec_t

Instance variables

var thisown

The membership flag

Methods

def add_unique(self, x: memory_info_t) ‑> bool

add_unique(self, x) -> bool

@param x: memory_info_t const &

def at(self, _idx: size_t)

at(self, _idx) -> memory_info_t

@param _idx: size_t

def back(self)

def begin(self, *args)

begin(self) -> memory_info_t

def capacity(self)

capacity(self) -> size_t

def clear(self)

clear(self)

def empty(self) ‑> bool

empty(self) -> bool

def end(self, *args)

end(self) -> memory_info_t

def erase(self, *args)

erase(self, it) -> memory_info_t

@param it: qvector< memory_info_t >::iterator

erase(self, first, last) -> memory_info_t

@param first: qvector< memory_info_t >::iterator @param last: qvector< memory_info_t >::iterator

def extract(self)

extract(self) -> memory_info_t

def find(self, *args)

find(self, x) -> memory_info_t

@param x: memory_info_t const &

def front(self)

def grow(self, *args)

grow(self, x=memory_info_t())

@param x: memory_info_t const &

def has(self, x: memory_info_t) ‑> bool

has(self, x) -> bool

@param x: memory_info_t const &

def inject(self, s: memory_info_t, len: size_t)

inject(self, s, len)

@param s: memory_info_t * @param len: size_t

def insert(self, it: memory_info_t, x: memory_info_t)

insert(self, it, x) -> memory_info_t

@param it: qvector< memory_info_t >::iterator @param x: memory_info_t const &

def pop_back(self)

pop_back(self)

def push_back(self, *args)

push_back(self, x)

@param x: memory_info_t const &

push_back(self) -> memory_info_t

def qclear(self)

qclear(self)

def reserve(self, cnt: size_t)

reserve(self, cnt)

@param cnt: size_t

def resize(self, *args)

resize(self, _newsize, x)

@param _newsize: size_t @param x: memory_info_t const &

resize(self, _newsize)

@param _newsize: size_t

def size(self)

size(self) -> size_t

def swap(self, r: meminfo_vec_template_t)

swap(self, r)

@param r: qvector< memory_info_t > &

def truncate(self)

truncate(self)

class memory_info_t

Proxy of C++ memory_info_t class.

init(self) -> memory_info_t

Ancestors

• range_t

Instance variables

var bitness : uchar

Number of bits in segment addresses (0-16bit, 1-32bit, 2-64bit)

var name : qstring

Memory range name.

var perm : uchar

Memory range permissions (0-no information): see segment.hpp.

var sbase : ea_t

Segment base (meaningful only for segmented architectures, e.g. 16-bit x86) The base is specified in paragraphs (i.e. shifted to the right by 4)

var sclass : qstring

Memory range class name.

Inherited members

• range_t:
  • clear
  • compare
  • contains
  • empty
  • end_ea
  • extend
  • intersect
  • overlaps
  • size
  • start_ea
  • thisown

class modinfo_t

Proxy of C++ modinfo_t class.

init(self) -> modinfo_t

Instance variables

var base : ea_t

module base address. if unknown pass BADADDR

var name : qstring

full name of the module

var rebase_to : ea_t

if not BADADDR, then rebase the program to the specified address

var size : asize_t

module size. if unknown pass 0

var thisown

The membership flag

class process_info_t

Proxy of C++ process_info_t class.

init(self) -> process_info_t

Instance variables

var name : qstring

process name

var pid : pid_t

process id

var thisown

The membership flag

class procinfo_vec_t (*args)

Proxy of C++ qvector< process_info_t > class.

init(self) -> procinfo_vec_t init(self, x) -> procinfo_vec_t

@param x: qvector< process_info_t > const &

Instance variables

var thisown

The membership flag

Methods

def at(self, _idx: size_t)

at(self, _idx) -> process_info_t

@param _idx: size_t

def back(self)

def begin(self, *args)

begin(self) -> process_info_t

def capacity(self)

capacity(self) -> size_t

def clear(self)

clear(self)

def empty(self) ‑> bool

empty(self) -> bool

def end(self, *args)

end(self) -> process_info_t

def erase(self, *args)

erase(self, it) -> process_info_t

@param it: qvector< process_info_t >::iterator

erase(self, first, last) -> process_info_t

@param first: qvector< process_info_t >::iterator @param last: qvector< process_info_t >::iterator

def extract(self)

extract(self) -> process_info_t

def front(self)

def grow(self, *args)

grow(self, x=process_info_t())

@param x: process_info_t const &

def inject(self, s: process_info_t, len: size_t)

inject(self, s, len)

@param s: process_info_t * @param len: size_t

def insert(self, it: process_info_t, x: process_info_t)

insert(self, it, x) -> process_info_t

@param it: qvector< process_info_t >::iterator @param x: process_info_t const &

def pop_back(self)

pop_back(self)

def push_back(self, *args)

push_back(self, x)

@param x: process_info_t const &

push_back(self) -> process_info_t

def qclear(self)

qclear(self)

def reserve(self, cnt: size_t)

reserve(self, cnt)

@param cnt: size_t

def resize(self, *args)

resize(self, _newsize, x)

@param _newsize: size_t @param x: process_info_t const &

resize(self, _newsize)

@param _newsize: size_t

def size(self)

size(self) -> size_t

def swap(self, r: procinfo_vec_t)

swap(self, r)

@param r: qvector< process_info_t > &

def truncate(self)

truncate(self)

class register_info_t

Proxy of C++ register_info_t class.

init(self) -> register_info_t

Instance variables

var bit_strings : PyObject *

strings corresponding to each bit of the register. (nullptr = no bit, same name = multi-bits mask)

var default_bit_strings_mask : uval_t

mask of default bits

var dtype : op_dtype_t

Register size (see Operand value types)

var flags : uint32

Register info attribute flags

var name : char const *

Register name.

var register_class : register_class_t

segment, mmx, etc.

var thisown

The membership flag

class regval_t (*args)

Proxy of C++ regval_t class.

init(self) -> regval_t init(self, r) -> regval_t

@param r: regval_t const &

Instance variables

var ival : uint64

RVT_INT.

var rvtype : int32

one of Register value types

var thisown

The membership flag

Methods

def bytes(self, *args)

bytes(self) -> bytevec_t Get const custom value. bytes(self) -> bytevec_t const &

def clear(self)

clear(self) Clear register value.

def get_data(self, *args)

get_data(self) Get const pointer to value. get_data(self) -> void const *

def get_data_size(self)

get_data_size(self) -> size_t Get size of value.

def pyval(self, dtype: op_dtype_t)

pyval(self, dtype) -> PyObject *

@param dtype: op_dtype_t

def set_bytes(self, *args)

set_bytes(self, data, size, _rvtype=0) Initialize this regval to an empty custom value.

@param data: uchar const * @param size: size_t @param _rvtype: (C++: int)

set_bytes(self, v, _rvtype=0)

@param v: bytevec_t const & @param _rvtype: int

set_bytes(self, _rvtype) -> bytevec_t &

@param _rvtype: int

def set_float(self, v: bytevec_t const &)

set_float(self, v) Set float value.

@param v: (C++: const bytevec_t &) bytevec_t const &

def set_int(self, x: uint64)

set_int(self, x)

@param x: uint64

def set_pyval(self, o: PyObject *, dtype: op_dtype_t)

set_pyval(self, o, dtype) -> bool

@param o: PyObject * @param dtype: op_dtype_t

def set_unavailable(self)

set_unavailable(self) Mark as unavailable.

def swap(self, r: regval_t)

swap(self, r) Set this = r and r = this.

@param r: (C++: regval_t &)

def use_bytevec(self) ‑> bool

use_bytevec(self) -> bool

class regvals_t (*args)

Proxy of C++ qvector< regval_t > class.

init(self) -> regvals_t init(self, x) -> regvals_t

@param x: qvector< regval_t > const &

Instance variables

var thisown

The membership flag

Methods

def add_unique(self, x: regval_t) ‑> bool

add_unique(self, x) -> bool

@param x: regval_t const &

def at(self, _idx: size_t)

at(self, _idx) -> regval_t

@param _idx: size_t

def back(self)

def begin(self, *args)

begin(self) -> regval_t

def capacity(self)

capacity(self) -> size_t

def clear(self)

clear(self)

def empty(self) ‑> bool

empty(self) -> bool

def end(self, *args)

end(self) -> regval_t

def erase(self, *args)

erase(self, it) -> regval_t

@param it: qvector< regval_t >::iterator

erase(self, first, last) -> regval_t

@param first: qvector< regval_t >::iterator @param last: qvector< regval_t >::iterator

def extract(self)

extract(self) -> regval_t

def find(self, *args)

find(self, x) -> regval_t

@param x: regval_t const &

def front(self)

def grow(self, *args)

grow(self, x=regval_t())

@param x: regval_t const &

def has(self, x: regval_t) ‑> bool

has(self, x) -> bool

@param x: regval_t const &

def inject(self, s: regval_t, len: size_t)

inject(self, s, len)

@param s: regval_t * @param len: size_t

def insert(self, it: regval_t, x: regval_t)

insert(self, it, x) -> regval_t

@param it: qvector< regval_t >::iterator @param x: regval_t const &

def pop_back(self)

pop_back(self)

def push_back(self, *args)

push_back(self, x)

@param x: regval_t const &

push_back(self) -> regval_t

def qclear(self)

qclear(self)

def reserve(self, cnt: size_t)

reserve(self, cnt)

@param cnt: size_t

def resize(self, *args)

resize(self, _newsize, x)

@param _newsize: size_t @param x: regval_t const &

resize(self, _newsize)

@param _newsize: size_t

def size(self)

size(self) -> size_t

def swap(self, r: regvals_t)

swap(self, r)

@param r: qvector< regval_t > &

def truncate(self)

truncate(self)

class scattered_segm_t

Proxy of C++ scattered_segm_t class.

init(self) -> scattered_segm_t

Ancestors

• range_t

Instance variables

var name : qstring

name of the segment

Inherited members

• range_t:
  • clear
  • compare
  • contains
  • empty
  • end_ea
  • extend
  • intersect
  • overlaps
  • size
  • start_ea
  • thisown

class thread_name_t

Proxy of C++ thread_name_t class.

init(self) -> thread_name_t

Instance variables

var name : qstring

new thread name

var thisown

The membership flag

var tid : thid_t

thread