Module index

Module ida_idp

Contains definition of the interface to IDP modules.

The interface consists of two structures: * definition of target assembler: ::ash * definition of current processor: ::ph

These structures contain information about target processor and assembler features.

It also defines two groups of kernel events: * processor_t::event_t processor related events * idb_event:event_code_t database related events

The processor related events are used to communicate with the processor module. The database related events are used to inform any interested parties, like plugins or processor modules, about the changes in the database.

Global variables

var AS2_BRACE

Use braces for all expressions.

var AS2_BYTE1CHAR

One symbol per processor byte. Meaningful only for wide byte processors

var AS2_COLONSUF

addresses may have ":xx" suffix; this suffix must be ignored when extracting the address under the cursor

var AS2_IDEALDSCR

Description of struc/union is in the 'reverse' form (keyword before name), the same as in borland tasm ideal

var AS2_STRINV

Invert meaning of idainfo::wide_high_byte_first for text strings (for processors with bytes bigger than 8 bits)

var AS2_TERSESTR

'terse' structure initialization form; NAME is supported

var AS2_YWORD

a_yword field is present and valid

var AS2_ZWORD

a_zword field is present and valid

var ASB_BINF0

010101b

var ASB_BINF1

^B010101

var ASB_BINF2

%010101

var ASB_BINF3

0b1010101

var ASB_BINF4

b'1010101

var ASB_BINF5

b'1010101'

var ASD_DECF0

34

var ASD_DECF1

34

var ASD_DECF2

34.

var ASD_DECF3

.34

var ASH_HEXF0

34h

var ASH_HEXF1

h'34

var ASH_HEXF2

34

var ASH_HEXF3

0x34

var ASH_HEXF4

$34

var ASH_HEXF5

<^R > (radix)

var ASO_OCTF0

123o

var ASO_OCTF1

0123

var ASO_OCTF2

123

var ASO_OCTF3

@123

var ASO_OCTF4

o'123

var ASO_OCTF5

123q

var ASO_OCTF6

~123

var ASO_OCTF7

q'123

var AS_1TEXT

1 text per line, no bytes

var AS_2CHRE

double char constants are: "xy

var AS_ALIGN2

.align directive expects an exponent rather than a power of 2 (.align 5 means to align at 32byte boundary)

var AS_ASCIIC

ascii directive accepts C-like escape sequences (\n,\x01 and similar)

var AS_ASCIIZ

ascii directive inserts implicit zero byte at the end

var AS_BINFM

mask - binary number format

var AS_COLON

create colons after data names ?

var AS_DECFM

mask - decimal number format

var AS_HEXFM

mask - hex number format

var AS_LALIGN

Labels at "align" keyword are supported.

var AS_N2CHR

can't have 2 byte char consts

var AS_NCHRE

char constants are: 'x

var AS_NCMAS

no commas in ascii directives

var AS_NHIAS

no characters with high bit

var AS_NOCODECLN

don't create colons after code names

var AS_NOSPACE

No spaces in expressions.

var AS_NOXRF

Disable xrefs during the output file generation.

var AS_OCTFM

mask - octal number format

var AS_OFFST

offsets are 'offset xxx' ?

var AS_ONEDUP

One array definition per line.

var AS_RELSUP

Checkarg: 'and','or','xor' operations with addresses are possible.

var AS_UDATA

can use '?' in data directives

var AS_UNEQU

replace undefined data items with EQU (for ANTA's A80)

var AS_XTRNTYPE

Assembler understands type of extern symbols as ":type" suffix.

var CF_CALL

CALL instruction (should make a procedure here)

var CF_CHG1

The instruction modifies the first operand.

var CF_CHG2

The instruction modifies the second operand.

var CF_CHG3

The instruction modifies the third operand.

var CF_CHG4

The instruction modifies the fourth operand.

var CF_CHG5

The instruction modifies the fifth operand.

var CF_CHG6

The instruction modifies the sixth operand.

var CF_CHG7

The instruction modifies the seventh operand.

var CF_CHG8

The instruction modifies the eighth operand.

var CF_HLL

Instruction may be present in a high level language function

var CF_JUMP

The instruction passes execution using indirect jump or call (thus needs additional analysis)

var CF_SHFT

Bit-shift instruction (shl,shr…)

var CF_STOP

Instruction doesn't pass execution to the next instruction

var CF_USE1

The instruction uses value of the first operand.

var CF_USE2

The instruction uses value of the second operand.

var CF_USE3

The instruction uses value of the third operand.

var CF_USE4

The instruction uses value of the fourth operand.

var CF_USE5

The instruction uses value of the fifth operand.

var CF_USE6

The instruction uses value of the sixth operand.

var CF_USE7

The instruction uses value of the seventh operand.

var CF_USE8

The instruction uses value of the eighth operand.

var CUSTOM_INSN_ITYPE

Custom instruction codes defined by processor extension plugins must be greater than or equal to this

var HKCB_GLOBAL

is global event listener? if true, the listener will survive database closing and opening. it will stay in the memory until explicitly unhooked. otherwise the kernel will delete it as soon as the owner is unloaded. should be used only with PLUGIN_FIX plugins.

var IDP_INTERFACE_VERSION

The interface version number. @note: see also IDA_SDK_VERSION from pro.h

var IRI_EXTENDED

Is the instruction a "return"?

include instructions like "leave" that begin the function epilog

var IRI_RET_LITERALLY

report only 'ret' instructions

var IRI_SKIP_RETTARGET

exclude 'ret' instructions that have special targets (see set_ret_target in PC)

var LTC_ADDED

added a local type

var LTC_ALIASED

added a type alias

var LTC_COMPILER

changed the compiler and calling convention

var LTC_DELETED

deleted a local type

var LTC_EDITED

edited a local type

var LTC_NONE

no event (internal use)

var LTC_TIL_COMPACTED

numbered types have been compacted compact_numbered_types()

var LTC_TIL_LOADED

loaded a til file

var LTC_TIL_UNLOADED

unloaded a til file

var OP_FP_BASED

operand is FP based

var OP_SP_ADD

operand value is added to the pointer

var OP_SP_BASED

operand is SP based

var OP_SP_SUB

operand value is subtracted from the pointer

var PLFM_386

Intel 80x86.

var PLFM_6502

6502

var PLFM_65C816

65802/65816

var PLFM_6800

Motorola 68xx.

var PLFM_68K

Motorola 680x0.

var PLFM_80196

Intel 80196.

var PLFM_8051

8051

var PLFM_AD2106X

Analog Devices ADSP 2106X.

var PLFM_AD218X

Analog Devices ADSP 218X.

var PLFM_ALPHA

DEC Alpha.

var PLFM_ARC

Argonaut RISC Core.

var PLFM_ARM

Advanced RISC Machines.

var PLFM_AVR

Atmel 8-bit RISC processor(s)

var PLFM_C166

Siemens C166 family.

var PLFM_C39

Rockwell C39.

var PLFM_CR16

NSC CR16.

var PLFM_DALVIK

Android Dalvik Virtual Machine.

var PLFM_DSP56K

Motorola DSP5600x.

var PLFM_DSP96K

Motorola DSP96000.

var PLFM_EBC

EFI Bytecode.

var PLFM_F2MC

Fujistu F2MC-16.

var PLFM_FR

Fujitsu FR Family.

var PLFM_H8

Hitachi H8/300, H8/2000.

var PLFM_H8500

Hitachi H8/500.

var PLFM_HPPA

Hewlett-Packard PA-RISC.

var PLFM_I860

Intel 860.

var PLFM_I960

Intel 960.

var PLFM_IA64

Intel Itanium IA64.

var PLFM_JAVA

Java.

var PLFM_KR1878

Angstrem KR1878.

var PLFM_M16C

Renesas M16C.

var PLFM_M32R

Mitsubishi 32bit RISC.

var PLFM_M740

Mitsubishi 8bit.

var PLFM_M7700

Mitsubishi 16bit.

var PLFM_M7900

Mitsubishi 7900.

var PLFM_MC6812

Motorola 68HC12.

var PLFM_MC6816

Motorola 68HC16.

var PLFM_MIPS

MIPS.

var PLFM_MN102L00

Panasonic MN10200.

var PLFM_MSP430

Texas Instruments MSP430.

var PLFM_NEC_78K0

NEC 78K0.

var PLFM_NEC_78K0S

NEC 78K0S.

var PLFM_NEC_V850X

NEC V850 and V850ES/E1/E2.

var PLFM_NET

Microsoft Visual Studio.Net.

var PLFM_OAKDSP

Atmel OAK DSP.

var PLFM_PDP

PDP11.

var PLFM_PIC

Microchip's PIC.

var PLFM_PIC16

Microchip's 16-bit PIC.

var PLFM_PPC

PowerPC.

var PLFM_RISCV

RISC-V.

var PLFM_RL78

Renesas RL78.

var PLFM_RX

Renesas RX.

var PLFM_S390

IBM's S390.

var PLFM_SCR_ADPT

Processor module adapter for processor modules written in scripting languages.

var PLFM_SH

Renesas (formerly Hitachi) SuperH.

var PLFM_SPARC

SPARC.

var PLFM_SPC700

Sony SPC700.

var PLFM_SPU

Cell Broadband Engine Synergistic Processor Unit.

var PLFM_ST20

SGS-Thomson ST20.

var PLFM_ST7

SGS-Thomson ST7.

var PLFM_ST9

ST9+.

var PLFM_TLCS900

Toshiba TLCS-900.

var PLFM_TMS

Texas Instruments TMS320C5x.

var PLFM_TMS320C1X

Texas Instruments TMS320C1x.

var PLFM_TMS320C28

Texas Instruments TMS320C28x.

var PLFM_TMS320C3

Texas Instruments TMS320C3.

var PLFM_TMS320C54

Texas Instruments TMS320C54xx.

var PLFM_TMS320C55

Texas Instruments TMS320C55xx.

var PLFM_TMSC6

Texas Instruments TMS320C6x.

var PLFM_TRICORE

Tasking Tricore.

var PLFM_TRIMEDIA

Trimedia.

var PLFM_UNSP

SunPlus unSP.

var PLFM_WASM

WASM.

var PLFM_XTENSA

Tensilica Xtensa.

var PLFM_Z8

Z8.

var PLFM_Z80

8085, Z80

var PR2_CODE16_BIT

low bit of code addresses has special meaning e.g. ARM Thumb, MIPS16

var PR2_FORCE_16BIT

use 16-bit basic types despite of 32-bit segments (used by c166)

var PR2_IDP_OPTS

the module has processor-specific configuration options

var PR2_MACRO

processor supports macro instructions

var PR2_MAPPINGS

the processor module uses memory mapping

var PR2_REL_BITS

(Lumina) calcrel info has bits granularity, not bytes - construction flag only

var PR2_USE_CALCREL

(Lumina) the module supports calcrel info

var PRN_BIN

binary

var PRN_DEC

decimal

var PRN_HEX

hex

var PRN_OCT

octal

var PR_ADJSEGS

IDA may adjust segments' starting/ending addresses.

var PR_ALIGN

All data items should be aligned properly.

var PR_ALIGN_INSN

allow ida to create alignment instructions arbitrarily. Since these instructions might lead to other wrong instructions and spoil the listing, IDA does not create them by default anymore

var PR_ASSEMBLE

Module has a built-in assembler and will react to ev_assemble.

var PR_BINMEM

the processor module provides correct segmentation for binary files (i.e. it creates additional segments). The kernel will not ask the user to specify the RAM/ROM sizes

var PR_CHK_XREF

don't allow near xrefs between segments with different bases

var PR_CNDINSNS

has conditional instructions

var PR_DEFNUM

mask - default number representation

var PR_DEFSEG32

segments are 32-bit by default

var PR_DEFSEG64

segments are 64-bit by default

var PR_DELAYED

has delayed jumps and calls. If this flag is set, processor_t::is_basic_block_end, processor_t::delay_slot_insn should be implemented

var PR_NOCHANGE

The user can't change segments and code/data attributes (display only)

var PR_NO_SEGMOVE

the processor module doesn't support move_segm() (i.e. the user can't move segments)

var PR_OUTER

has outer operands (currently only mc68k)

var PR_PURGING

there are calling conventions which may purge bytes from the stack

var PR_RNAMESOK

allow user register names for location names

var PR_SCALE_STKVARS

use processor_t::get_stkvar_scale callback

var PR_SEGS

has segment registers?

var PR_SEGTRANS

the processor module supports the segment translation feature (meaning it calculates the code addresses using the map_code_ea() function)

var PR_SGROTHER

the segment registers don't contain the segment selectors.

var PR_STACK_UP

the stack grows up

var PR_TYPEINFO

the processor module fully supports type information callbacks; without full support, function argument locations and other things will probably be wrong.

var PR_USE32

supports 32-bit addressing?

var PR_USE64

supports 64-bit addressing?

var PR_USE_ARG_TYPES

use processor_t::use_arg_types callback

var PR_USE_TBYTE

BTMT_SPECFLT means _TBYTE type

var PR_WORD_INS

instruction codes are grouped 2bytes in binary line prefix

var REG_SPOIL

processor_t::use_regarg_type uses this bit in the return value to indicate that the register value has been spoiled

var SETPROC_IDB

set processor type for old idb

var SETPROC_LOADER

set processor type for new idb; if the user has specified a compatible processor, return success without changing it. if failure, call loader_failure()

var SETPROC_LOADER_NON_FATAL

the same as SETPROC_LOADER but non-fatal failures.

var SETPROC_USER

set user-specified processor used for -p and manual processor change at later time

Functions

def AssembleLine(ea: ea_t, cs: ea_t, ip: ea_t, use32: bool, nonnul_line: char const *)

AssembleLine(ea, cs, ip, use32, nonnul_line) -> bytes Assemble an instruction to a string (display a warning if an error is found)

@param ea: linear address of instruction @param cs: cs of instruction @param ip: ip of instruction @param use32: is 32bit segment @param nonnul_line: char const * @return: - None on failure - or a string containing the assembled instruction

def assemble(ea: ea_t, cs: ea_t, ip: ea_t, use32: bool, line: char const *)

assemble(ea, cs, ip, use32, line) -> bool Assemble an instruction into the database (display a warning if an error is found)

@param ea: linear address of instruction @param cs: cs of instruction @param ip: ip of instruction @param use32: is 32bit segment? @param line: line to assemble

@return: Boolean. True on success.

def cfg_get_cc_header_path(compid: comp_t)

cfg_get_cc_header_path(compid) -> char const *

@param compid: comp_t

def cfg_get_cc_parm(compid: comp_t, name: char const *)

cfg_get_cc_parm(compid, name) -> char const *

@param compid: comp_t @param name: char const *

def cfg_get_cc_predefined_macros(compid: comp_t)

cfg_get_cc_predefined_macros(compid) -> char const *

@param compid: comp_t

def delay_slot_insn(ea: ea_t *, bexec: bool *, fexec: bool *)

delay_slot_insn(ea, bexec, fexec) -> bool

@param ea: ea_t * @param bexec: bool * @param fexec: bool *

def gen_idb_event(*args)

gen_idb_event(code) the kernel will use this function to generate idb_events

@param code: (C++: idb_event::event_code_t) enum idb_event::event_code_t

def get_ash()

get_ash() -> asm_t

def get_config_value(key: char const *)

get_config_value(key) -> bool

@param key: char const *

def get_idb_notifier_addr(arg1: PyObject *)

get_idb_notifier_addr(arg1) -> PyObject *

@param arg1: PyObject *

def get_idb_notifier_ud_addr(hooks: IDB_Hooks)

get_idb_notifier_ud_addr(hooks) -> PyObject *

@param hooks: IDB_Hooks *

def get_idp_name()

get_idp_name() -> str Get name of the current processor module. The name is derived from the file name. For example, for IBM PC the module is named "pc.w32" (windows version), then the module name is "PC" (uppercase). If no processor module is loaded, this function will return nullptr

def get_idp_notifier_addr(arg1: PyObject *)

get_idp_notifier_addr(arg1) -> PyObject *

@param arg1: PyObject *

def get_idp_notifier_ud_addr(hooks: IDP_Hooks)

get_idp_notifier_ud_addr(hooks) -> PyObject *

@param hooks: IDP_Hooks *

def get_ph()

get_ph() -> _processor_t

def get_reg_info(regname: char const *, bitrange: bitrange_t)

get_reg_info(regname, bitrange) -> char const *

@param regname: char const * @param bitrange: bitrange_t *

def get_reg_name(reg: int, width: size_t, reghi: int = -1)

get_reg_name(reg, width, reghi=-1) -> ssize_t Get text representation of a register. For most processors this function will just return processor_t::reg_names[reg]. If the processor module has implemented processor_t::get_reg_name, it will be used instead

@param reg: (C++: int) internal register number as defined in the processor module @param width: (C++: size_t) register width in bytes @param reghi: (C++: int) if specified, then this function will return the register pair @return: length of register name in bytes or -1 if failure

def has_cf_chg(feature: uint32, opnum: uint)

has_cf_chg(feature, opnum) -> bool Does an instruction with the specified feature modify the i-th operand?

@param feature: (C++: uint32) @param opnum: (C++: uint)

def has_cf_use(feature: uint32, opnum: uint)

has_cf_use(feature, opnum) -> bool Does an instruction with the specified feature use a value of the i-th operand?

@param feature: (C++: uint32) @param opnum: (C++: uint)

def has_insn_feature(icode: uint16, bit: uint32)

has_insn_feature(icode, bit) -> bool Does the specified instruction have the specified feature?

@param icode: (C++: uint16) @param bit: (C++: uint32)

def is_align_insn(ea: ea_t)

is_align_insn(ea) -> int If the instruction at 'ea' looks like an alignment instruction, return its length in bytes. Otherwise return 0.

@param ea: (C++: ea_t)

def is_basic_block_end(insn: insn_t const &, call_insn_stops_block: bool)

is_basic_block_end(insn, call_insn_stops_block) -> bool Is the instruction the end of a basic block?

@param insn: (C++: const insn_t &) an ida_ua.insn_t, or an address (C++: const insn_t &) @param call_insn_stops_block: (C++: bool)

def is_call_insn(insn: insn_t const &)

is_call_insn(insn) -> bool Is the instruction a "call"?

@param insn: (C++: const insn_t &) an ida_ua.insn_t, or an address (C++: const insn_t &)

def is_indirect_jump_insn(insn: insn_t const &)

is_indirect_jump_insn(insn) -> bool Is the instruction an indirect jump?

@param insn: (C++: const insn_t &) an ida_ua.insn_t, or an address (C++: const insn_t &)

def is_ret_insn(*args) ‑> bool

is_ret_insn(insn, flags=(0x01|0x02)) -> bool

@param insn: an ida_ua.insn_t, or an address (C++: const insn_t &) @param flags: uchar

def parse_reg_name(ri: reg_info_t, regname: char const *)

parse_reg_name(ri, regname) -> bool Get register info by name.

@param ri: (C++: reg_info_t ) result @param regname: (C++: const char ) name of register @return: success

def ph_calcrel(ea: ea_t)

ph_calcrel(ea)

@param ea: ea_t

def ph_find_op_value(insn: insn_t const &, op: int)

ph_find_op_value(insn, op) -> ssize_t

@param insn: an ida_ua.insn_t, or an address (C++: const insn_t &) @param op: int

def ph_find_reg_value(insn: insn_t const &, reg: int)

ph_find_reg_value(insn, reg) -> ssize_t

@param insn: an ida_ua.insn_t, or an address (C++: const insn_t &) @param reg: int

def ph_get_cnbits()

ph_get_cnbits() -> size_t Returns the 'ph.cnbits'

def ph_get_dnbits()

ph_get_dnbits() -> size_t Returns the 'ph.dnbits'

def ph_get_flag()

ph_get_flag() -> size_t Returns the 'ph.flag'

def ph_get_icode_return()

ph_get_icode_return() -> size_t Returns the 'ph.icode_return'

def ph_get_id()

ph_get_id() -> size_t Returns the 'ph.id' field

def ph_get_instruc()

ph_get_instruc() -> [(str, int), …] Returns a list of tuples (instruction_name, instruction_feature) containing the instructions list as defined in he processor module

def ph_get_instruc_end()

ph_get_instruc_end() -> size_t Returns the 'ph.instruc_end'

def ph_get_instruc_start()

ph_get_instruc_start() -> size_t Returns the 'ph.instruc_start'

def ph_get_operand_info(ea: ea_t, n: int)

ph_get_operand_info(ea, n) -> (int, int, int, int, int) or None Returns the operand information given an ea and operand number.

@param ea: address @param n: operand number

@return: Returns an idd_opinfo_t as a tuple: (modified, ea, reg_ival, regidx, value_size). Please refer to idd_opinfo_t structure in the SDK.

def ph_get_reg_accesses(accvec: reg_accesses_t, insn: insn_t const &, flags: int)

ph_get_reg_accesses(accvec, insn, flags) -> ssize_t

@param accvec: reg_accesses_t * @param insn: an ida_ua.insn_t, or an address (C++: const insn_t &) @param flags: int

def ph_get_reg_code_sreg()

ph_get_reg_code_sreg() -> size_t Returns the 'ph.reg_code_sreg'

def ph_get_reg_data_sreg()

ph_get_reg_data_sreg() -> size_t Returns the 'ph.reg_data_sreg'

def ph_get_reg_first_sreg()

ph_get_reg_first_sreg() -> size_t Returns the 'ph.reg_first_sreg'

def ph_get_reg_last_sreg()

ph_get_reg_last_sreg() -> size_t Returns the 'ph.reg_last_sreg'

def ph_get_regnames()

ph_get_regnames() -> [str, …] Returns the list of register names as defined in the processor module

def ph_get_segreg_size()

ph_get_segreg_size() -> size_t Returns the 'ph.segreg_size'

def ph_get_tbyte_size()

ph_get_tbyte_size() -> size_t Returns the 'ph.tbyte_size' field as defined in he processor module

def ph_get_version()

ph_get_version() -> size_t Returns the 'ph.version'

def process_config_directive(directive: char const *, priority: int = 2)

process_config_directive(directive, priority=2)

@param directive: char const * @param priority: int

def register_cfgopts(opts: cfgopt_t const [], nopts: size_t, cb: config_changed_cb_t * = None, obj: void * = None)

register_cfgopts(opts, nopts, cb=None, obj=None) -> bool

@param opts: cfgopt_t const [] @param nopts: size_t @param cb: config_changed_cb_t * @param obj: void *

def set_processor_type(procname: char const *, level: setproc_level_t)

set_processor_type(procname, level) -> bool Set target processor type. Once a processor module is loaded, it cannot be replaced until we close the idb.

@param procname: (C++: const char *) name of processor type (one of names present in processor_t::psnames) @param level: (C++: setproc_level_t) SETPROC_ @return: success

def set_target_assembler(asmnum: int) ‑> bool

set_target_assembler(asmnum) -> bool Set target assembler.

@param asmnum: (C++: int) number of assembler in the current processor module @return: success

def sizeof_ldbl()

sizeof_ldbl() -> size_t

def str2reg(p: char const *)

str2reg(p) -> int Get any reg number (-1 on error)

@param p: (C++: const char *) char const *

Classes

class IDB_Hooks

Proxy of C++ IDB_Hooks class.

init(self, _flags=0, _hkcb_flags=0x0001) -> IDB_Hooks

@param _flags: uint32 @param _hkcb_flags: uint32

Subclasses

  • core.idahelper.SigHooks
  • ida_idp._notify_when_dispatcher_t._IDB_Hooks
  • ida_idp._processor_t_Trampoline_IDB_Hooks

Instance variables

var thisown

The membership flag

Methods

def adding_segm(self, s: segment_t *)

adding_segm(self, s) A segment is being created.

@param s: (segment_t *)

def allsegs_moved(self, info: segm_move_infos_t *)

allsegs_moved(self, info) Program rebasing is complete. This event is generated after series of segm_moved events

@param info: (segm_move_infos_t *)

def auto_empty(self)

auto_empty(self)

def auto_empty_finally(self)

auto_empty_finally(self)

def bookmark_changed(self, index: uint32, pos: lochist_entry_t const *, desc: char const *, operation: int)

bookmark_changed(self, index, pos, desc, operation) Boomarked position changed.

@param index: (uint32) @param pos: (::const lochist_entry_t ) @param desc: (::const char ) @param operation: (int) 0-added, 1-updated, 2-deleted if desc==nullptr, then the bookmark was deleted.

def byte_patched(self, ea: ea_t, old_value: uint32)

byte_patched(self, ea, old_value) A byte has been patched.

@param ea: (::ea_t) @param old_value: (uint32)

def callee_addr_changed(self, ea: ea_t, callee: ea_t)

callee_addr_changed(self, ea, callee) Callee address has been updated by the user.

@param ea: (::ea_t) @param callee: (::ea_t)

def changing_cmt(self, ea: ea_t, repeatable_cmt: bool, newcmt: char const *)

changing_cmt(self, ea, repeatable_cmt, newcmt) An item comment is to be changed.

@param ea: (::ea_t) @param repeatable_cmt: (bool) @param newcmt: (const char *)

def changing_op_ti(self, ea: ea_t, n: int, new_type: type_t const *, new_fnames: p_list const *)

changing_op_ti(self, ea, n, new_type, new_fnames) An operand typestring (c/c++ prototype) is to be changed.

@param ea: (::ea_t) @param n: (int) @param new_type: (const type_t ) @param new_fnames: (const p_list )

def changing_op_type(self, ea: ea_t, n: int, opinfo: opinfo_t)

changing_op_type(self, ea, n, opinfo) An operand type (offset, hex, etc…) is to be changed.

@param ea: (::ea_t) @param n: (int) eventually or'ed with OPND_OUTER or OPND_ALL @param opinfo: (const opinfo_t *) additional operand info

def changing_range_cmt(self, kind: range_kind_t, a: range_t, cmt: char const *, repeatable: bool)

changing_range_cmt(self, kind, a, cmt, repeatable) Range comment is to be changed.

@param kind: (range_kind_t) @param a: (const range_t ) @param cmt: (const char ) @param repeatable: (bool)

def changing_segm_class(self, s: segment_t *)

changing_segm_class(self, s) Segment class is being changed.

@param s: (segment_t *)

def changing_segm_end(self, s: segment_t *, new_end: ea_t, segmod_flags: int)

changing_segm_end(self, s, new_end, segmod_flags) Segment end address is to be changed.

@param s: (segment_t *) @param new_end: (::ea_t) @param segmod_flags: (int)

def changing_segm_name(self, s: segment_t *, oldname: char const *)

changing_segm_name(self, s, oldname) Segment name is being changed.

@param s: (segment_t ) @param oldname: (const char )

def changing_segm_start(self, s: segment_t *, new_start: ea_t, segmod_flags: int)

changing_segm_start(self, s, new_start, segmod_flags) Segment start address is to be changed.

@param s: (segment_t *) @param new_start: (::ea_t) @param segmod_flags: (int)

def changing_ti(self, ea: ea_t, new_type: type_t const *, new_fnames: p_list const *)

changing_ti(self, ea, new_type, new_fnames) An item typestring (c/c++ prototype) is to be changed.

@param ea: (::ea_t) @param new_type: (const type_t ) @param new_fnames: (const p_list )

def closebase(self)

closebase(self) The database will be closed now.

def cmt_changed(self, ea: ea_t, repeatable_cmt: bool)

cmt_changed(self, ea, repeatable_cmt) An item comment has been changed.

@param ea: (::ea_t) @param repeatable_cmt: (bool)

def compiler_changed(self, adjust_inf_fields: bool)

compiler_changed(self, adjust_inf_fields) The kernel has changed the compiler information. ( idainfo::cc structure; get_abi_name)

@param adjust_inf_fields: (::bool) may change inf fields?

def deleting_func(self, pfn: func_t *)

deleting_func(self, pfn) The kernel is about to delete a function.

@param pfn: (func_t *)

def deleting_func_tail(self, pfn: func_t *, tail: range_t)

deleting_func_tail(self, pfn, tail) A function tail chunk is to be removed.

@param pfn: (func_t ) @param tail: (const range_t )

def deleting_segm(self, start_ea: ea_t)

deleting_segm(self, start_ea) A segment is to be deleted.

@param start_ea: (::ea_t)

def deleting_tryblks(self, range: range_t)

deleting_tryblks(self, range) About to delete tryblk information in given range

@param range: (const range_t *)

def destroyed_items(self, ea1: ea_t, ea2: ea_t, will_disable_range: bool)

destroyed_items(self, ea1, ea2, will_disable_range) Instructions/data have been destroyed in [ea1,ea2).

@param ea1: (::ea_t) @param ea2: (::ea_t) @param will_disable_range: (bool)

def determined_main(self, main: ea_t)

determined_main(self, main) The main() function has been determined.

@param main: (::ea_t) address of the main() function

dirtree_link(self, dt, path, link)

@param dt: (dirtree_t ) @param path: (::const char ) @param link: (::bool)

def dirtree_mkdir(self, dt: dirtree_t *, path: char const *)

dirtree_mkdir(self, dt, path)

@param dt: (dirtree_t ) @param path: (::const char )

def dirtree_move(self, dt: dirtree_t *, _from: char const *, to: char const *)

dirtree_move(self, dt, _from, to)

@param dt: (dirtree_t ) @param from: (::const char ) @param to: (::const char *)

def dirtree_rank(self, dt: dirtree_t *, path: char const *, rank: size_t)

dirtree_rank(self, dt, path, rank)

@param dt: (dirtree_t ) @param path: (::const char ) @param rank: (::size_t)

def dirtree_rmdir(self, dt: dirtree_t *, path: char const *)

dirtree_rmdir(self, dt, path)

@param dt: (dirtree_t ) @param path: (::const char )

def dirtree_rminode(self, dt: dirtree_t *, inode: inode_t)

dirtree_rminode(self, dt, inode)

@param dt: (dirtree_t *) @param inode: (inode_t)

def dirtree_segm_moved(self, dt: dirtree_t *)

dirtree_segm_moved(self, dt)

@param dt: (dirtree_t *)

def extlang_changed(self, kind: int, el: extlang_t *, idx: int)

extlang_changed(self, kind, el, idx) The list of extlangs or the default extlang was changed.

@param kind: (int) 0: extlang installed 1: extlang removed 2: default extlang changed @param el: (extlang_t *) pointer to the extlang affected @param idx: (int) extlang index

def extra_cmt_changed(self, ea: ea_t, line_idx: int, cmt: char const *)

extra_cmt_changed(self, ea, line_idx, cmt) An extra comment has been changed.

@param ea: (::ea_t) @param line_idx: (int) @param cmt: (const char *)

def flow_chart_created(self, fc: qflow_chart_t)

flow_chart_created(self, fc) Gui has retrieved a function flow chart. Plugins may modify the flow chart in this callback.

@param fc: (qflow_chart_t *)

def frame_created(self, func_ea: ea_t)

frame_created(self, func_ea) A function frame has been created.

@param func_ea: (::ea_t) idb_event::frame_deleted

def frame_deleted(self, pfn: func_t *)

frame_deleted(self, pfn) The kernel has deleted a function frame.

@param pfn: (func_t *) idb_event::frame_created

def frame_expanded(self, func_ea: ea_t, udm_tid: tid_t, delta: adiff_t)

frame_expanded(self, func_ea, udm_tid, delta) A frame type has been expanded/shrank.

@param func_ea: (::ea_t) @param udm_tid: (tid_t) the gap was added/removed before this member @param delta: (::adiff_t) number of added/removed bytes

def frame_udm_changed(self, func_ea: ea_t, udm_tid: tid_t, udmold: udm_t, udmnew: udm_t)

frame_udm_changed(self, func_ea, udm_tid, udmold, udmnew) Frame member has been changed.

@param func_ea: (::ea_t) @param udm_tid: (tid_t) @param udmold: (::const udm_t ) @param udmnew: (::const udm_t )

def frame_udm_created(self, func_ea: ea_t, udm: udm_t)

frame_udm_created(self, func_ea, udm) Frame member has been added.

@param func_ea: (::ea_t) @param udm: (::const udm_t *)

def frame_udm_deleted(self, func_ea: ea_t, udm_tid: tid_t, udm: udm_t)

frame_udm_deleted(self, func_ea, udm_tid, udm) Frame member has been deleted.

@param func_ea: (::ea_t) @param udm_tid: (tid_t) @param udm: (::const udm_t *)

def frame_udm_renamed(self, func_ea: ea_t, udm: udm_t, oldname: char const *)

frame_udm_renamed(self, func_ea, udm, oldname) Frame member has been renamed.

@param func_ea: (::ea_t) @param udm: (::const udm_t ) @param oldname: (::const char )

def func_added(self, pfn: func_t *)

func_added(self, pfn) The kernel has added a function.

@param pfn: (func_t *)

def func_deleted(self, func_ea: ea_t)

func_deleted(self, func_ea) A function has been deleted.

@param func_ea: (::ea_t)

def func_noret_changed(self, pfn: func_t *)

func_noret_changed(self, pfn) FUNC_NORET bit has been changed.

@param pfn: (func_t *)

def func_tail_appended(self, pfn: func_t *, tail: func_t *)

func_tail_appended(self, pfn, tail) A function tail chunk has been appended.

@param pfn: (func_t ) @param tail: (func_t )

def func_tail_deleted(self, pfn: func_t *, tail_ea: ea_t)

func_tail_deleted(self, pfn, tail_ea) A function tail chunk has been removed.

@param pfn: (func_t *) @param tail_ea: (::ea_t)

def func_updated(self, pfn: func_t *)

func_updated(self, pfn) The kernel has updated a function.

@param pfn: (func_t *)

def hook(self) ‑> bool

hook(self) -> bool

def idasgn_loaded(self, short_sig_name: char const *)

idasgn_loaded(self, short_sig_name) FLIRT signature has been loaded for normal processing (not for recognition of startup sequences).

@param short_sig_name: (const char *)

def item_color_changed(self, ea: ea_t, color: bgcolor_t)

item_color_changed(self, ea, color) An item color has been changed.

@param ea: (::ea_t) @param color: (bgcolor_t) if color==DEFCOLOR, the the color is deleted.

def kernel_config_loaded(self, pass_number: int)

kernel_config_loaded(self, pass_number) This event is issued when ida.cfg is parsed.

@param pass_number: (int)

def loader_finished(self, li: linput_t *, neflags: uint16, filetypename: char const *)

loader_finished(self, li, neflags, filetypename) External file loader finished its work. Use this event to augment the existing loader functionality.

@param li: (linput_t ) @param neflags: (uint16) Load file flags @param filetypename: (const char )

def local_types_changed(self, ltc: local_type_change_t, ordinal: uint32, name: char const *)

local_types_changed(self, ltc, ordinal, name) Local types have been changed

@param ltc: (local_type_change_t) @param ordinal: (uint32) 0 means ordinal is unknown @param name: (const char *) nullptr means name is unknown

def lt_udm_changed(self, udtname: char const *, udm_tid: tid_t, udmold: udm_t, udmnew: udm_t)

lt_udm_changed(self, udtname, udm_tid, udmold, udmnew) local type udt member has been changed

@param udtname: (::const char ) @param udm_tid: (tid_t) @param udmold: (::const udm_t ) @param udmnew: (::const udm_t *) @note: udm_t::offset may not be calculated yet except of the fixed udt

def lt_udm_created(self, udtname: char const *, udm: udm_t)

lt_udm_created(self, udtname, udm) local type udt member has been added

@param udtname: (::const char ) @param udm: (::const udm_t ) @note: udm_t::offset may not be calculated yet except of the fixed udt

def lt_udm_deleted(self, udtname: char const *, udm_tid: tid_t, udm: udm_t)

lt_udm_deleted(self, udtname, udm_tid, udm) local type udt member has been deleted

@param udtname: (::const char ) @param udm_tid: (tid_t) @param udm: (::const udm_t )

def lt_udm_renamed(self, udtname: char const *, udm: udm_t, oldname: char const *)

lt_udm_renamed(self, udtname, udm, oldname) local type udt member has been renamed

@param udtname: (::const char ) @param udm: (::const udm_t ) @param oldname: (::const char *)

def lt_udt_expanded(self, udtname: char const *, udm_tid: tid_t, delta: adiff_t)

lt_udt_expanded(self, udtname, udm_tid, delta) A structure type has been expanded/shrank.

@param udtname: (::const char *) @param udm_tid: (tid_t) the gap was added/removed before this member @param delta: (::adiff_t) number of added/removed bytes

def make_code(self, insn: insn_t const *)

make_code(self, insn) An instruction is being created.

@param insn: (const insn_t*)

def make_data(self, ea: ea_t, flags: flags64_t, tid: tid_t, len: asize_t)

make_data(self, ea, flags, tid, len) A data item is being created.

@param ea: (::ea_t) @param flags: (flags64_t) @param tid: (tid_t) @param len: (::asize_t)

def op_ti_changed(self, ea: ea_t, n: int, type: type_t const *, fnames: p_list const *)

op_ti_changed(self, ea, n, type, fnames) An operand typestring (c/c++ prototype) has been changed.

@param ea: (::ea_t) @param n: (int) @param type: (const type_t ) @param fnames: (const p_list )

def op_type_changed(self, ea: ea_t, n: int)

op_type_changed(self, ea, n) An operand type (offset, hex, etc…) has been set or deleted.

@param ea: (::ea_t) @param n: (int) eventually or'ed with OPND_OUTER or OPND_ALL

def range_cmt_changed(self, kind: range_kind_t, a: range_t, cmt: char const *, repeatable: bool)

range_cmt_changed(self, kind, a, cmt, repeatable) Range comment has been changed.

@param kind: (range_kind_t) @param a: (const range_t ) @param cmt: (const char ) @param repeatable: (bool)

def renamed(self, ea: ea_t, new_name: char const *, local_name: bool, old_name: char const *)

renamed(self, ea, new_name, local_name, old_name) The kernel has renamed a byte. See also the rename event

@param ea: (::ea_t) @param new_name: (const char ) can be nullptr @param local_name: (bool) @param old_name: (const char ) can be nullptr

def savebase(self)

savebase(self) The database is being saved.

def segm_added(self, s: segment_t *)

segm_added(self, s) A new segment has been created.

@param s: (segment_t *) See also adding_segm

def segm_attrs_updated(self, s: segment_t *)

segm_attrs_updated(self, s) Segment attributes has been changed.

@param s: (segment_t *) This event is generated for secondary segment attributes (examples: color, permissions, etc)

def segm_class_changed(self, s: segment_t *, sclass: char const *)

segm_class_changed(self, s, sclass) Segment class has been changed.

@param s: (segment_t ) @param sclass: (const char )

def segm_deleted(self, start_ea: ea_t, end_ea: ea_t, flags: int)

segm_deleted(self, start_ea, end_ea, flags) A segment has been deleted.

@param start_ea: (::ea_t) @param end_ea: (::ea_t) @param flags: (int)

def segm_end_changed(self, s: segment_t *, oldend: ea_t)

segm_end_changed(self, s, oldend) Segment end address has been changed.

@param s: (segment_t *) @param oldend: (::ea_t)

def segm_moved(self, _from: ea_t, to: ea_t, size: asize_t, changed_netmap: bool)

segm_moved(self, _from, to, size, changed_netmap) Segment has been moved.

@param from: (::ea_t) @param to: (::ea_t) @param size: (::asize_t) @param changed_netmap: (bool) See also idb_event::allsegs_moved

def segm_name_changed(self, s: segment_t *, name: char const *)

segm_name_changed(self, s, name) Segment name has been changed.

@param s: (segment_t ) @param name: (const char )

def segm_start_changed(self, s: segment_t *, oldstart: ea_t)

segm_start_changed(self, s, oldstart) Segment start address has been changed.

@param s: (segment_t *) @param oldstart: (::ea_t)

def set_func_end(self, pfn: func_t *, new_end: ea_t)

set_func_end(self, pfn, new_end) Function chunk end address will be changed.

@param pfn: (func_t *) @param new_end: (::ea_t)

def set_func_start(self, pfn: func_t *, new_start: ea_t)

set_func_start(self, pfn, new_start) Function chunk start address will be changed.

@param pfn: (func_t *) @param new_start: (::ea_t)

def sgr_changed(self, start_ea: ea_t, end_ea: ea_t, regnum: int, value: sel_t, old_value: sel_t, tag: uchar)

sgr_changed(self, start_ea, end_ea, regnum, value, old_value, tag) The kernel has changed a segment register value.

@param start_ea: (::ea_t) @param end_ea: (::ea_t) @param regnum: (int) @param value: (::sel_t) @param old_value: (::sel_t) @param tag: (uchar) Segment register range tags

def sgr_deleted(self, start_ea: ea_t, end_ea: ea_t, regnum: int)

sgr_deleted(self, start_ea, end_ea, regnum) The kernel has deleted a segment register value.

@param start_ea: (::ea_t) @param end_ea: (::ea_t) @param regnum: (int)

def stkpnts_changed(self, pfn: func_t *)

stkpnts_changed(self, pfn) Stack change points have been modified.

@param pfn: (func_t *)

def tail_owner_changed(self, tail: func_t *, owner_func: ea_t, old_owner: ea_t)

tail_owner_changed(self, tail, owner_func, old_owner) A tail chunk owner has been changed.

@param tail: (func_t *) @param owner_func: (::ea_t) @param old_owner: (::ea_t)

def thunk_func_created(self, pfn: func_t *)

thunk_func_created(self, pfn) A thunk bit has been set for a function.

@param pfn: (func_t *)

def ti_changed(self, ea: ea_t, type: type_t const *, fnames: p_list const *)

ti_changed(self, ea, type, fnames) An item typestring (c/c++ prototype) has been changed.

@param ea: (::ea_t) @param type: (const type_t ) @param fnames: (const p_list )

def tryblks_updated(self, tbv: tryblks_t const *)

tryblks_updated(self, tbv) Updated tryblk information

@param tbv: (const ::tryblks_t *)

def unhook(self) ‑> bool

unhook(self) -> bool

def updating_tryblks(self, tbv: tryblks_t const *)

updating_tryblks(self, tbv) About to update tryblk information

@param tbv: (const ::tryblks_t *)

def upgraded(self, _from: int)

upgraded(self, _from) The database has been upgraded and the receiver can upgrade its info as well

@param from: (int) - old IDB version

class IDP_Hooks

Proxy of C++ IDP_Hooks class.

init(self, _flags=0, _hkcb_flags=0x0001) -> IDP_Hooks

@param _flags: uint32 @param _hkcb_flags: uint32

Subclasses

  • ida_idp._notify_when_dispatcher_t._IDP_Hooks
  • processor_t

Instance variables

var thisown

The membership flag

Methods

def ev_add_cref(self, _from: ea_t, to: ea_t, type: cref_t)

ev_add_cref(self, _from, to, type) -> int A code reference is being created.

@param from: (::ea_t) @param to: (::ea_t) @param type: (cref_t) @retval <0: cancel cref creation @retval 0: not implemented or continue

def ev_add_dref(self, _from: ea_t, to: ea_t, type: dref_t)

ev_add_dref(self, _from, to, type) -> int A data reference is being created.

@param from: (::ea_t) @param to: (::ea_t) @param type: (dref_t) @retval <0: cancel dref creation @retval 0: not implemented or continue

def ev_adjust_argloc(self, argloc: argloc_t, optional_type: tinfo_t, size: int)

ev_adjust_argloc(self, argloc, optional_type, size) -> int Adjust argloc according to its type/size and platform endianess

@param argloc: (argloc_t ), inout @param type: (const tinfo_t ), may be nullptr nullptr means primitive type of given size @param size: (int) 'size' makes no sense if type != nullptr (type->get_size() should be used instead) @retval 0: not implemented @retval 1: ok @retval -1: error

def ev_adjust_libfunc_ea(self, sig: idasgn_t const *, libfun: libfunc_t const *, ea: ea_t *)

ev_adjust_libfunc_ea(self, sig, libfun, ea) -> int Called when a signature module has been matched against bytes in the database. This is used to compute the offset at which a particular module's libfunc should be applied.

@param sig: (const idasgn_t ) @param libfun: (const libfunc_t ) @param ea: (::ea_t *) @note: 'ea' initially contains the ea_t of the start of the pattern match @retval 1: the ea_t pointed to by the third argument was modified. @retval <=0: not modified. use default algorithm.

def ev_adjust_refinfo(self, ri: refinfo_t, ea: ea_t, n: int, fd: fixup_data_t const *)

ev_adjust_refinfo(self, ri, ea, n, fd) -> int Called from apply_fixup before converting operand to reference. Can be used for changing the reference info. (e.g. the PPC module adds REFINFO_NOBASE for some references)

@param ri: (refinfo_t ) @param ea: (::ea_t) instruction address @param n: (int) operand number @param fd: (const fixup_data_t ) @retval <0: do not create an offset @retval 0: not implemented or refinfo adjusted

def ev_ana_insn(self, out: insn_t *)

ev_ana_insn(self, out) -> bool Analyze one instruction and fill 'out' structure. This function shouldn't change the database, flags or anything else. All these actions should be performed only by emu_insn() function. insn_t::ea contains address of instruction to analyze.

@param out: (insn_t *) @return: length of the instruction in bytes, 0 if instruction can't be decoded. @retval 0: if instruction can't be decoded.

def ev_analyze_prolog(self, ea: ea_t)

ev_analyze_prolog(self, ea) -> int Analyzes function prolog, epilog, and updates purge, and function attributes

@param ea: (::ea_t) start of function @retval 1: ok @retval 0: not implemented

def ev_arch_changed(self) ‑> int

ev_arch_changed(self) -> int The loader is done parsing arch-related information, which the processor module might want to use to finish its initialization. @retval 1: if success @retval 0: not implemented or failed

def ev_arg_addrs_ready(self, caller: ea_t, n: int, tif: tinfo_t, addrs: ea_t *)

ev_arg_addrs_ready(self, caller, n, tif, addrs) -> int Argument address info is ready.

@param caller: (::ea_t) @param n: (int) number of formal arguments @param tif: (tinfo_t ) call prototype @param addrs: (::ea_t ) argument intilization addresses @retval <0: do not save into idb; other values mean "ok to save"

def ev_asm_installed(self, asmnum: int) ‑> int

ev_asm_installed(self, asmnum) -> int After setting a new assembler

@param asmnum: (int) See also ev_newasm

def ev_assemble(self, ea: ea_t, cs: ea_t, ip: ea_t, use32: bool, line: char const *)

ev_assemble(self, ea, cs, ip, use32, line) -> PyObject * Assemble an instruction. (display a warning if an error is found).

@param ea: (::ea_t) linear address of instruction @param cs: (::ea_t) cs of instruction @param ip: (::ea_t) ip of instruction @param use32: (bool) is 32bit segment? @param line: (const char *) line to assemble @return: size of the instruction in bytes

def ev_auto_queue_empty(self, type: atype_t)

ev_auto_queue_empty(self, type) -> int One analysis queue is empty.

@param type: (atype_t) @retval void: see also idb_event::auto_empty_finally

def ev_calc_arglocs(self, fti: func_type_data_t)

ev_calc_arglocs(self, fti) -> int Calculate function argument locations. This callback should fill retloc, all arglocs, and stkargs. This callback is never called for CM_CC_SPECIAL functions.

@param fti: (func_type_data_t *) points to the func type info @retval 0: not implemented @retval 1: ok @retval -1: error

def ev_calc_cdecl_purged_bytes(self, ea: ea_t)

ev_calc_cdecl_purged_bytes(self, ea) -> int Calculate number of purged bytes after call.

@param ea: (::ea_t) address of the call instruction @return: number of purged bytes (usually add sp, N)

def ev_calc_next_eas(self, res: eavec_t *, insn: insn_t const *, over: bool)

ev_calc_next_eas(self, res, insn, over) -> int Calculate list of addresses the instruction in 'insn' may pass control to. This callback is required for source level debugging.

@param res: (eavec_t ), out: array for the results. @param insn: (const insn_t) the instruction @param over: (bool) calculate for step over (ignore call targets) @retval <0: incalculable (indirect jumps, for example) @retval >=0: number of addresses of called functions in the array. They must be put at the beginning of the array (0 if over=true)

def ev_calc_purged_bytes(self, p_purged_bytes: int *, fti: func_type_data_t)

ev_calc_purged_bytes(self, p_purged_bytes, fti) -> int Calculate number of purged bytes by the given function type.

@param p_purged_bytes: (int ) ptr to output @param fti: (const func_type_data_t ) func type details @retval 1 @retval 0: not implemented

def ev_calc_retloc(self, retloc: argloc_t, rettype: tinfo_t, cc: cm_t)

ev_calc_retloc(self, retloc, rettype, cc) -> int Calculate return value location.

@param retloc: (argloc_t ) @param rettype: (const tinfo_t ) @param cc: (cm_t) @retval 0: not implemented @retval 1: ok, @retval -1: error

def ev_calc_spdelta(self, spdelta: sval_t *, insn: insn_t const *)

ev_calc_spdelta(self, spdelta, insn) -> int Calculate amount of change to sp for the given insn. This event is required to decompile code snippets.

@param spdelta: (sval_t ) @param insn: (const insn_t ) @retval 1: ok @retval 0: not implemented

def ev_calc_step_over(self, target: ea_t *, ip: ea_t)

ev_calc_step_over(self, target, ip) -> int Calculate the address of the instruction which will be executed after "step over". The kernel will put a breakpoint there. If the step over is equal to step into or we cannot calculate the address, return BADADDR.

@param target: (::ea_t *) pointer to the answer @param ip: (::ea_t) instruction address @retval 0: unimplemented @retval 1: implemented

def ev_calc_switch_cases(self, casevec: casevec_t *, targets: eavec_t *, insn_ea: ea_t, si: switch_info_t)

ev_calc_switch_cases(self, casevec, targets, insn_ea, si) -> int Calculate case values and targets for a custom jump table.

@param casevec: (::casevec_t ) vector of case values (may be nullptr) @param targets: (eavec_t ) corresponding target addresses (my be nullptr) @param insn_ea: (::ea_t) address of the 'indirect jump' instruction @param si: (switch_info_t *) switch information @retval 1: ok @retval <=0: failed

def ev_calc_varglocs(self, ftd: func_type_data_t, aux_regs: regobjs_t, aux_stkargs: relobj_t, nfixed: int)

ev_calc_varglocs(self, ftd, aux_regs, aux_stkargs, nfixed) -> int Calculate locations of the arguments that correspond to '…'.

@param ftd: (func_type_data_t ), inout: info about all arguments (including varargs) @param aux_regs: (regobjs_t ) buffer for hidden register arguments, may be nullptr @param aux_stkargs: (relobj_t *) buffer for hidden stack arguments, may be nullptr @param nfixed: (int) number of fixed arguments @retval 0: not implemented @retval 1: ok @retval -1: error On some platforms variadic calls require passing additional information: for example, number of floating variadic arguments must be passed in rax on gcc-x64. The locations and values that constitute this additional information are returned in the buffers pointed by aux_regs and aux_stkargs

def ev_calcrel(self) ‑> int

ev_calcrel(self) -> int Reserved.

def ev_can_have_type(self, op: op_t const *)

ev_can_have_type(self, op) -> int Can the operand have a type as offset, segment, decimal, etc? (for example, a register AX can't have a type, meaning that the user can't change its representation. see bytes.hpp for information about types and flags)

@param op: (const op_t *) @retval 0: unknown @retval <0: no @retval 1: yes

def ev_clean_tbit(self, ea: ea_t, getreg: processor_t::regval_getter_t *, regvalues: regval_t)

ev_clean_tbit(self, ea, getreg, regvalues) -> int Clear the TF bit after an insn like pushf stored it in memory.

@param ea: (::ea_t) instruction address @param getreg: (::processor_t::regval_getter_t ) function to get register values @param regvalues: (const regval_t ) register values array @retval 1: ok @retval 0: failed

def ev_cmp_operands(self, op1: op_t const *, op2: op_t const *)

ev_cmp_operands(self, op1, op2) -> int Compare instruction operands

@param op1: (const op_t) @param op2: (const op_t) @retval 1: equal @retval -1: not equal @retval 0: not implemented

def ev_coagulate(self, start_ea: ea_t)

ev_coagulate(self, start_ea) -> int Try to define some unexplored bytes. This notification will be called if the kernel tried all possibilities and could not find anything more useful than to convert to array of bytes. The module can help the kernel and convert the bytes into something more useful.

@param start_ea: (::ea_t) @return: number of converted bytes

def ev_coagulate_dref(self, _from: ea_t, to: ea_t, may_define: bool, code_ea: ea_t *)

ev_coagulate_dref(self, _from, to, may_define, code_ea) -> int Data reference is being analyzed. plugin may correct 'code_ea' (e.g. for thumb mode refs, we clear the last bit)

@param from: (::ea_t) @param to: (::ea_t) @param may_define: (bool) @param code_ea: (::ea_t *) @retval <0: failed dref analysis, >0 done dref analysis @retval 0: not implemented or continue

def ev_create_flat_group(self, image_base: ea_t, bitness: int, dataseg_sel: sel_t)

ev_create_flat_group(self, image_base, bitness, dataseg_sel) -> int Create special segment representing the flat group.

@param image_base: (::ea_t) @param bitness: (int) @param dataseg_sel: (::sel_t) return value is ignored

def ev_create_func_frame(self, pfn: func_t *)

ev_create_func_frame(self, pfn) -> int Create a function frame for a newly created function Set up frame size, its attributes etc

@param pfn: (func_t *) @retval 1: ok @retval 0: not implemented

def ev_create_merge_handlers(self, md: merge_data_t *)

ev_create_merge_handlers(self, md) -> int Create merge handlers, if needed

@param md: (merge_data_t *) This event is generated immediately after opening idbs. @return: must be 0

def ev_create_switch_xrefs(self, jumpea: ea_t, si: switch_info_t)

ev_create_switch_xrefs(self, jumpea, si) -> int Create xrefs for a custom jump table.

@param jumpea: (::ea_t) address of the jump insn @param si: (const switch_info_t *) switch information @return: must return 1 Must be implemented if module uses custom jump tables, SWI_CUSTOM

def ev_creating_segm(self, seg: segment_t *)

ev_creating_segm(self, seg) -> int A new segment is about to be created.

@param seg: (segment_t *) @retval 1: ok @retval <0: segment should not be created

def ev_cvt64_hashval(self, node: nodeidx_t, tag: uchar, name: char const *, data: uchar const *)

ev_cvt64_hashval(self, node, tag, name, data) -> int perform 32-64 conversion for a hash value

@param node: (::nodeidx_t) @param tag: (uchar) @param name: (const ::char ) @param data: (const uchar ) @return: 0 nothing was done 1 converted successfully -1 error (and message in errbuf)

def ev_cvt64_supval(self, node: nodeidx_t, tag: uchar, idx: nodeidx_t, data: uchar const *)

ev_cvt64_supval(self, node, tag, idx, data) -> int perform 32-64 conversion for a netnode array element

@param node: (::nodeidx_t) @param tag: (uchar) @param idx: (::nodeidx_t) @param data: (const uchar *) @return: 0 nothing was done 1 converted successfully -1 error (and message in errbuf)

def ev_decorate_name(self, name: char const *, mangle: bool, cc: int, optional_type: tinfo_t)

ev_decorate_name(self, name, mangle, cc, optional_type) -> PyObject * Decorate/undecorate a C symbol name.

@param name: (const char *) name of symbol @param mangle: (bool) true-mangle, false-unmangle @param cc: (cm_t) calling convention @param optional_type: tinfo_t const * @retval 1: if success @retval 0: not implemented or failed

def ev_del_cref(self, _from: ea_t, to: ea_t, expand: bool)

ev_del_cref(self, _from, to, expand) -> int A code reference is being deleted.

@param from: (::ea_t) @param to: (::ea_t) @param expand: (bool) @retval <0: cancel cref deletion @retval 0: not implemented or continue

def ev_del_dref(self, _from: ea_t, to: ea_t)

ev_del_dref(self, _from, to) -> int A data reference is being deleted.

@param from: (::ea_t) @param to: (::ea_t) @retval <0: cancel dref deletion @retval 0: not implemented or continue

def ev_delay_slot_insn(self, ea: ea_t, bexec: bool, fexec: bool)

ev_delay_slot_insn(self, ea, bexec, fexec) -> PyObject * Get delay slot instruction

@param ea: (::ea_t ) in: instruction address in question, out: (if the answer is positive) if the delay slot contains valid insn: the address of the delay slot insn else: BADADDR (invalid insn, e.g. a branch) @param bexec: (bool ) execute slot if jumping, initially set to 'true' @param fexec: (bool *) execute slot if not jumping, initally set to 'true' @retval 1: positive answer @retval <=0: ordinary insn @note: Input EA may point to the instruction with a delay slot or to the delay slot instruction itself.

def ev_demangle_name(self, name: char const *, disable_mask: uint32, demreq: int)

ev_demangle_name(self, name, disable_mask, demreq) -> PyObject * Demangle a C++ (or another language) name into a user-readable string. This event is called by demangle_name()

@param name: (const char *) mangled name @param disable_mask: (uint32) flags to inhibit parts of output or compiler info/other (see MNG_) @param demreq: (demreq_type_t) operation to perform @retval 1: if success @retval 0: not implemented @note: if you call demangle_name() from the handler, protect against recursion!

def ev_emu_insn(self, insn: insn_t const *)

ev_emu_insn(self, insn) -> bool Emulate instruction, create cross-references, plan to analyze subsequent instructions, modify flags etc. Upon entrance to this function, all information about the instruction is in 'insn' structure.

@param insn: (const insn_t *) @retval 1: ok @retval -1: the kernel will delete the instruction

def ev_endbinary(self, ok: bool) ‑> int

ev_endbinary(self, ok) -> int IDA has loaded a binary file.

@param ok: (bool) file loaded successfully?

def ev_ending_undo(self, action_name: char const *, is_undo: bool)

ev_ending_undo(self, action_name, is_undo) -> int Ended undoing/redoing an action

@param action_name: (const char *) action that we finished undoing/redoing. is not nullptr. @param is_undo: (bool) true if performing undo, false if performing redo

def ev_equal_reglocs(self, a1: argloc_t, a2: argloc_t)

ev_equal_reglocs(self, a1, a2) -> int Are 2 register arglocs the same?. We need this callback for the pc module.

@param a1: (argloc_t ) @param a2: (argloc_t ) @retval 1: yes @retval -1: no @retval 0: not implemented

def ev_extract_address(self, out_ea: ea_t *, screen_ea: ea_t, string: char const *, position: size_t)

ev_extract_address(self, out_ea, screen_ea, string, position) -> int Extract address from a string.

@param out_ea: (ea_t ), out @param screen_ea: (ea_t) @param string: (const char ) @param position: (size_t) @retval 1: ok @retval 0: kernel should use the standard algorithm @retval -1: error

def ev_find_op_value(self, pinsn: insn_t const *, opn: int)

ev_find_op_value(self, pinsn, opn) -> PyObject * Find operand value via a register tracker. The returned value in 'out' is valid before executing the instruction.

@param pinsn: (const insn_t *) instruction @param opn: (int) operand index @retval 1: if implemented, and value was found @retval 0: not implemented, -1 decoding failed, or no value found

def ev_find_reg_value(self, pinsn: insn_t const *, reg: int)

ev_find_reg_value(self, pinsn, reg) -> PyObject * Find register value via a register tracker. The returned value in 'out' is valid before executing the instruction.

@param pinsn: (const insn_t *) instruction @param reg: (int) register index @retval 1: if implemented, and value was found @retval 0: not implemented, -1 decoding failed, or no value found

def ev_func_bounds(self, possible_return_code: int *, pfn: func_t *, max_func_end_ea: ea_t)

ev_func_bounds(self, possible_return_code, pfn, max_func_end_ea) -> int find_func_bounds() finished its work. The module may fine tune the function bounds

@param possible_return_code: (int ), in/out @param pfn: (func_t ) @param max_func_end_ea: (::ea_t) (from the kernel's point of view) @retval void

def ev_gen_asm_or_lst(self, starting: bool, fp: FILE *, is_asm: bool, flags: int, outline: html_line_cb_t **)

ev_gen_asm_or_lst(self, starting, fp, is_asm, flags, outline) -> int

@param starting: (bool) beginning listing generation @param fp: (FILE ) output file @param is_asm: (bool) true:assembler, false:listing @param flags: (int) flags passed to gen_file() @param outline: (html_line_cb_t *) ptr to ptr to outline callback. if this callback is defined for this code, it will be used by the kernel to output the generated lines @retval void

def ev_gen_map_file(self, nlines: int *, fp: FILE *)

ev_gen_map_file(self, nlines, fp) -> int Generate map file. If not implemented the kernel itself will create the map file.

@param nlines: (int ) number of lines in map file (-1 means write error) @param fp: (FILE ) output file @retval 0: not implemented @retval 1: ok @retval -1: write error

def ev_gen_regvar_def(self, outctx: outctx_t *, v: regvar_t *)

ev_gen_regvar_def(self, outctx, v) -> int Generate register variable definition line.

@param outctx: (outctx_t ) @param v: (regvar_t ) @retval >0: ok, generated the definition text @retval 0: not implemented

def ev_gen_src_file_lnnum(self, outctx: outctx_t *, file: char const *, lnnum: size_t)

ev_gen_src_file_lnnum(self, outctx, file, lnnum) -> int

@param outctx: (outctx_t ) output context @param file: (const char ) source file (may be nullptr) @param lnnum: (size_t) line number @retval 1: directive has been generated @retval 0: not implemented

def ev_gen_stkvar_def(self, outctx: outctx_t *, stkvar: udm_t, v: sval_t, tid: tid_t)

ev_gen_stkvar_def(self, outctx, stkvar, v, tid) -> int Generate stack variable definition line Default line is varname = type ptr value, where 'type' is one of byte,word,dword,qword,tbyte

@param outctx: (outctx_t ) @param stkvar: (const udm_t ) @param v: (sval_t) @param tid: (tid_t) stkvar TID @retval 1: ok @retval 0: not implemented

def ev_get_abi_info(self, abi_names: qstrvec_t *, abi_opts: qstrvec_t *, comp: comp_t)

ev_get_abi_info(self, abi_names, abi_opts, comp) -> int Get all possible ABI names and optional extensions for given compiler abiname/option is a string entirely consisting of letters, digits and underscore

@param abi_names: (qstrvec_t ) - all possible ABis each in form abiname- opt1-opt2-… @param abi_opts: (qstrvec_t ) - array of all possible options in form "opt:description" or opt:hint-line#description @param comp: (comp_t) - compiler ID @retval 0: not implemented @retval 1: ok

def ev_get_autocmt(self, insn: insn_t const *)

ev_get_autocmt(self, insn) -> PyObject *

@param insn: (const insn_t*) the instruction @retval 1: new comment has been generated @retval 0: callback has not been handled. the buffer must not be changed in this case

def ev_get_bg_color(self, color: bgcolor_t *, ea: ea_t)

ev_get_bg_color(self, color, ea) -> int Get item background color. Plugins can hook this callback to color disassembly lines dynamically

@param color: (bgcolor_t *), out @param ea: (::ea_t) @retval 0: not implemented @retval 1: color set

def ev_get_cc_regs(self, regs: callregs_t, cc: cm_t)

ev_get_cc_regs(self, regs, cc) -> int Get register allocation convention for given calling convention

@param regs: (callregs_t *), out @param cc: (cm_t) @retval 1 @retval 0: not implemented

def ev_get_code16_mode(self, ea: ea_t)

ev_get_code16_mode(self, ea) -> int Get ISA 16-bit mode

@param ea: (ea_t) address to get the ISA mode @retval 1: 16-bit mode @retval 0: not implemented or 32-bit mode

def ev_get_dbr_opnum(self, opnum: int *, insn: insn_t const *)

ev_get_dbr_opnum(self, opnum, insn) -> int Get the number of the operand to be displayed in the debugger reference view (text mode).

@param opnum: (int ) operand number (out, -1 means no such operand) @param insn: (const insn_t) the instruction @retval 0: unimplemented @retval 1: implemented

def ev_get_default_enum_size(self) ‑> int

ev_get_default_enum_size(self) -> int Get default enum size. Not generated anymore. inf_get_cc_size_e() is used instead

def ev_get_frame_retsize(self, frsize: int *, pfn: func_t const *)

ev_get_frame_retsize(self, frsize, pfn) -> int Get size of function return address in bytes If this event is not implemented, the kernel will assume * 8 bytes for 64-bit function * 4 bytes for 32-bit function * 2 bytes otherwise

@param frsize: (int ) frame size (out) @param pfn: (const func_t ), can't be nullptr @retval 1: ok @retval 0: not implemented

def ev_get_macro_insn_head(self, head: ea_t *, ip: ea_t)

ev_get_macro_insn_head(self, head, ip) -> int Calculate the start of a macro instruction. This notification is called if IP points to the middle of an instruction

@param head: (::ea_t *), out: answer, BADADDR means normal instruction @param ip: (::ea_t) instruction address @retval 0: unimplemented @retval 1: implemented

def ev_get_operand_string(self, insn: insn_t const *, opnum: int)

ev_get_operand_string(self, insn, opnum) -> PyObject * Request text string for operand (cli, java, …).

@param insn: (const insn_t*) the instruction @param opnum: (int) operand number, -1 means any string operand @retval 0: no string (or empty string) @retval >0: original string length without terminating zero

def ev_get_procmod(self) ‑> int

ev_get_procmod(self) -> int Get pointer to the processor module object. All processor modules must implement this. The pointer is returned as size_t.

def ev_get_reg_accesses(self, accvec: reg_accesses_t, insn: insn_t const *, flags: int)

ev_get_reg_accesses(self, accvec, insn, flags) -> int Get info about the registers that are used/changed by an instruction.

@param accvec: (reg_accesses_t) out: info about accessed registers @param insn: (const insn_t ) instruction in question @param flags: (int) reserved, must be 0 @retval -1: if accvec is nullptr @retval 1: found the requested access (and filled accvec) @retval 0: not implemented

def ev_get_reg_info(self, main_regname: char const **, bitrange: bitrange_t, regname: char const *)

ev_get_reg_info(self, main_regname, bitrange, regname) -> int Get register information by its name. example: "ah" returns: * main_regname="eax" * bitrange_t = { offset==8, nbits==8 }

This callback may be unimplemented if the register names are all present in processor_t::reg_names and they all have the same size

@param main_regname: (const char ), out @param bitrange: (bitrange_t ), out: position and size of the value within 'main_regname' (empty bitrange == whole register) @param regname: (const char ) @retval 1: ok @retval -1: failed (not found) @retval 0: unimplemented

def ev_get_reg_name(self, reg: int, width: size_t, reghi: int)

ev_get_reg_name(self, reg, width, reghi) -> PyObject * Generate text representation of a register. Most processor modules do not need to implement this callback. It is useful only if processor_t::reg_names[reg] does not provide the correct register name.

@param reg: (int) internal register number as defined in the processor module @param width: (size_t) register width in bytes @param reghi: (int) if not -1 then this function will return the register pair @retval -1: if error @retval strlen(buf): if success

def ev_get_simd_types(self, out: simd_info_vec_t *, simd_attrs: simd_info_t, argloc: argloc_t, create_tifs: bool)

ev_get_simd_types(self, out, simd_attrs, argloc, create_tifs) -> int Get SIMD-related types according to given attributes ant/or argument location

@param out: (::simd_info_vec_t ) @param simd_attrs: (const simd_info_t ), may be nullptr @param argloc: (const argloc_t *), may be nullptr @param create_tifs: (bool) return valid tinfo_t objects, create if neccessary @retval number: of found types @retval -1: error If name==nullptr, initialize all SIMD types

def ev_get_stkarg_area_info(self, out: stkarg_area_info_t, cc: cm_t)

ev_get_stkarg_area_info(self, out, cc) -> int Get some metrics of the stack argument area.

@param out: (stkarg_area_info_t *) ptr to stkarg_area_info_t @param cc: (cm_t) calling convention @retval 1: if success @retval 0: not implemented

def ev_get_stkvar_scale_factor(self) ‑> int

ev_get_stkvar_scale_factor(self) -> int Should stack variable references be multiplied by a coefficient before being used in the stack frame?. Currently used by TMS320C55 because the references into the stack should be multiplied by 2

@return: scaling factor @retval 0: not implemented @note: PR_SCALE_STKVARS should be set to use this callback

def ev_getreg(self, regval: uval_t *, regnum: int)

ev_getreg(self, regval, regnum) -> int IBM PC only internal request, should never be used for other purpose Get register value by internal index

@param regval: (uval_t *), out @param regnum: (int) @retval 1: ok @retval 0: not implemented @retval -1: failed (undefined value or bad regnum)

def ev_init(self, idp_modname: char const *)

ev_init(self, idp_modname) -> int The IDP module is just loaded.

@param idp_modname: (const char *) processor module name @retval <0: on failure

def ev_insn_reads_tbit(self, insn: insn_t const *, getreg: processor_t::regval_getter_t *, regvalues: regval_t)

ev_insn_reads_tbit(self, insn, getreg, regvalues) -> int Check if insn will read the TF bit.

@param insn: (const insn_t) the instruction @param getreg: (::processor_t::regval_getter_t ) function to get register values @param regvalues: (const regval_t *) register values array @retval 2: yes, will generate 'step' exception @retval 1: yes, will store the TF bit in memory @retval 0: no

def ev_is_align_insn(self, ea: ea_t)

ev_is_align_insn(self, ea) -> int Is the instruction created only for alignment purposes?. Do not directly call this function, use is_align_insn()

@param ea: (ea_t) - instruction address @retval number: of bytes in the instruction

def ev_is_alloca_probe(self, ea: ea_t)

ev_is_alloca_probe(self, ea) -> int Does the function at 'ea' behave as __alloca_probe?

@param ea: (::ea_t) @retval 1: yes @retval 0: no

def ev_is_basic_block_end(self, insn: insn_t const *, call_insn_stops_block: bool)

ev_is_basic_block_end(self, insn, call_insn_stops_block) -> int Is the current instruction end of a basic block?. This function should be defined for processors with delayed jump slots.

@param insn: (const insn_t*) the instruction @param call_insn_stops_block: (bool) @retval 0: unknown @retval <0: no @retval 1: yes

def ev_is_call_insn(self, insn: insn_t const *)

ev_is_call_insn(self, insn) -> int Is the instruction a "call"?

@param insn: (const insn_t *) instruction @retval 0: unknown @retval <0: no @retval 1: yes

def ev_is_cond_insn(self, insn: insn_t const *)

ev_is_cond_insn(self, insn) -> int Is conditional instruction?

@param insn: (const insn_t *) instruction address @retval 1: yes @retval -1: no @retval 0: not implemented or not instruction

def ev_is_control_flow_guard(self, p_reg: int *, insn: insn_t const *)

ev_is_control_flow_guard(self, p_reg, insn) -> int Detect if an instruction is a "thunk call" to a flow guard function (equivalent to call reg/return/nop)

@param p_reg: (int ) indirect register number, may be -1 @param insn: (const insn_t ) call/jump instruction @retval -1: no thunk detected @retval 1: indirect call @retval 2: security check routine call (NOP) @retval 3: return thunk @retval 0: not implemented

def ev_is_far_jump(self, icode: int) ‑> int

ev_is_far_jump(self, icode) -> int is indirect far jump or call instruction? meaningful only if the processor has 'near' and 'far' reference types

@param icode: (int) @retval 0: not implemented @retval 1: yes @retval -1: no

def ev_is_indirect_jump(self, insn: insn_t const *)

ev_is_indirect_jump(self, insn) -> int Determine if instruction is an indirect jump. If CF_JUMP bit cannot describe all jump types jumps, please define this callback.

@param insn: (const insn_t*) the instruction @retval 0: use CF_JUMP @retval 1: no @retval 2: yes

def ev_is_insn_table_jump(self) ‑> int

ev_is_insn_table_jump(self) -> int Reserved.

def ev_is_jump_func(self, pfn: func_t *, jump_target: ea_t *, func_pointer: ea_t *)

ev_is_jump_func(self, pfn, jump_target, func_pointer) -> int Is the function a trivial "jump" function?.

@param pfn: (func_t ) @param jump_target: (::ea_t ) @param func_pointer: (::ea_t *) @retval <0: no @retval 0: don't know @retval 1: yes, see 'jump_target' and 'func_pointer'

def ev_is_ret_insn(self, insn: insn_t const *, flags: uchar)

ev_is_ret_insn(self, insn, flags) -> int Is the instruction a "return"?

@param insn: (const insn_t *) instruction @param flags: (uchar), combination of IRI_… flags (see above) @retval 0: unknown @retval <0: no @retval 1: yes

def ev_is_sane_insn(self, insn: insn_t const *, no_crefs: int)

ev_is_sane_insn(self, insn, no_crefs) -> int Is the instruction sane for the current file type?.

@param insn: (const insn_t*) the instruction @param no_crefs: (int) 1: the instruction has no code refs to it. ida just tries to convert unexplored bytes to an instruction (but there is no other reason to convert them into an instruction) 0: the instruction is created because of some coderef, user request or another weighty reason. @retval >=0: ok @retval <0: no, the instruction isn't likely to appear in the program

def ev_is_sp_based(self, mode: int *, insn: insn_t const *, op: op_t const *)

ev_is_sp_based(self, mode, insn, op) -> int Check whether the operand is relative to stack pointer or frame pointer This event is used to determine how to output a stack variable If not implemented, then all operands are sp based by default. Implement this event only if some stack references use frame pointer instead of stack pointer.

@param mode: (int ) out, combination of SP/FP operand flags @param insn: (const insn_t ) @param op: (const op_t *) @retval 0: not implemented @retval 1: ok

def ev_is_switch(self, si: switch_info_t, insn: insn_t const *)

ev_is_switch(self, si, insn) -> int Find 'switch' idiom or override processor module's decision. It will be called for instructions marked with CF_JUMP.

@param si: (switch_info_t ), out @param insn: (const insn_t ) instruction possibly belonging to a switch @retval 1: switch is found, 'si' is filled. IDA will create the switch using the filled 'si' @retval -1: no switch found. This value forbids switch creation by the processor module @retval 0: not implemented

def ev_last_cb_before_loader(self) ‑> int

ev_last_cb_before_loader(self) -> int

def ev_loader(self) ‑> int

ev_loader(self) -> int This code and higher ones are reserved for the loaders. The arguments and the return values are defined by the loaders

def ev_lower_func_type(self, argnums: intvec_t *, fti: func_type_data_t)

ev_lower_func_type(self, argnums, fti) -> int Get function arguments which should be converted to pointers when lowering function prototype. The processor module can also modify 'fti' in order to make non-standard conversion of some arguments.

@param argnums: (intvec_t ), out - numbers of arguments to be converted to pointers in acsending order @param fti: (func_type_data_t ), inout func type details @retval 0: not implemented @retval 1: argnums was filled @retval 2: argnums was filled and made substantial changes to fti argnums[0] can contain a special negative value indicating that the return value should be passed as a hidden 'retstr' argument: -1 this argument is passed as the first one and the function returns a pointer to the argument, -2 this argument is passed as the last one and the function returns a pointer to the argument, -3 this argument is passed as the first one and the function returns 'void'.

def ev_max_ptr_size(self) ‑> int

ev_max_ptr_size(self) -> int Get maximal size of a pointer in bytes.

@return: max possible size of a pointer

def ev_may_be_func(self, insn: insn_t const *, state: int)

ev_may_be_func(self, insn, state) -> int Can a function start here?

@param insn: (const insn_t*) the instruction @param state: (int) autoanalysis phase 0: creating functions 1: creating chunks @return: probability 1..100 @note: Actually IDA uses 3 intervals of a probability: 0..50 not a function, 51..99 a function (IDA needs another proof), 100 a function (no other proofs needed)

def ev_may_show_sreg(self, current_ea: ea_t)

ev_may_show_sreg(self, current_ea) -> int The kernel wants to display the segment registers in the messages window.

@param current_ea: (::ea_t) @retval <0: if the kernel should not show the segment registers. (assuming that the module has done it) @retval 0: not implemented

def ev_moving_segm(self, seg: segment_t *, to: ea_t, flags: int)

ev_moving_segm(self, seg, to, flags) -> int May the kernel move the segment?

@param seg: (segment_t *) segment to move @param to: (::ea_t) new segment start address @param flags: (int) combination of Move segment flags @retval 0: yes @retval <0: the kernel should stop

def ev_newasm(self, asmnum: int) ‑> int

ev_newasm(self, asmnum) -> int Before setting a new assembler.

@param asmnum: (int) See also ev_asm_installed

def ev_newbinary(self, filename: char *, fileoff: qoff64_t, basepara: ea_t, binoff: ea_t, nbytes: uint64)

ev_newbinary(self, filename, fileoff, basepara, binoff, nbytes) -> int IDA is about to load a binary file.

@param filename: (char *) binary file name @param fileoff: (qoff64_t) offset in the file @param basepara: (::ea_t) base loading paragraph @param binoff: (::ea_t) loader offset @param nbytes: (::uint64) number of bytes to load

def ev_newfile(self, fname: char *)

ev_newfile(self, fname) -> int A new file has been loaded.

@param fname: (char *) input file name

def ev_newprc(self, pnum: int, keep_cfg: bool) ‑> int

ev_newprc(self, pnum, keep_cfg) -> int Before changing processor type.

@param pnum: (int) processor number in the array of processor names @param keep_cfg: (bool) true: do not modify kernel configuration @retval 1: ok @retval <0: prohibit

def ev_next_exec_insn(self, target: ea_t *, ea: ea_t, tid: int, getreg: processor_t::regval_getter_t *, regvalues: regval_t)

ev_next_exec_insn(self, target, ea, tid, getreg, regvalues) -> int Get next address to be executed This function must return the next address to be executed. If the instruction following the current one is executed, then it must return BADADDR Usually the instructions to consider are: jumps, branches, calls, returns. This function is essential if the 'single step' is not supported in hardware.

@param target: (::ea_t ), out: pointer to the answer @param ea: (::ea_t) instruction address @param tid: (int) current therad id @param getreg: (::processor_t::regval_getter_t ) function to get register values @param regvalues: (const regval_t *) register values array @retval 0: unimplemented @retval 1: implemented

def ev_oldfile(self, fname: char *)

ev_oldfile(self, fname) -> int An old file has been loaded.

@param fname: (char *) input file name

def ev_out_assumes(self, outctx: outctx_t *)

ev_out_assumes(self, outctx) -> int Function to produce assume directives when segment register value changes.

@param outctx: (outctx_t *) @retval 1: ok @retval 0: not implemented

def ev_out_data(self, outctx: outctx_t *, analyze_only: bool)

ev_out_data(self, outctx, analyze_only) -> int Generate text representation of data items This function may change the database and create cross-references if analyze_only is set

@param outctx: (outctx_t *) @param analyze_only: (bool) @retval 1: ok @retval 0: not implemented

ev_out_footer(self, outctx) -> int Function to produce end of disassembled text

@param outctx: (outctx_t *) @retval void

def ev_out_header(self, outctx: outctx_t *)

ev_out_header(self, outctx) -> int Function to produce start of disassembled text

@param outctx: (outctx_t *) @retval void

def ev_out_insn(self, outctx: outctx_t *)

ev_out_insn(self, outctx) -> bool Generate text representation of an instruction in 'ctx.insn' outctx_t provides functions to output the generated text. This function shouldn't change the database, flags or anything else. All these actions should be performed only by emu_insn() function.

@param outctx: (outctx_t *) @retval void

def ev_out_label(self, outctx: outctx_t *, colored_name: char const *)

ev_out_label(self, outctx, colored_name) -> int The kernel is going to generate an instruction label line or a function header.

@param outctx: (outctx_t ) @param colored_name: (const char ) @retval <0: if the kernel should not generate the label @retval 0: not implemented or continue

def ev_out_mnem(self, outctx: outctx_t *)

ev_out_mnem(self, outctx) -> int Generate instruction mnemonics. This callback should append the colored mnemonics to ctx.outbuf Optional notification, if absent, out_mnem will be called.

@param outctx: (outctx_t *) @retval 1: if appended the mnemonics @retval 0: not implemented

def ev_out_operand(self, outctx: outctx_t *, op: op_t const *)

ev_out_operand(self, outctx, op) -> bool Generate text representation of an instruction operand outctx_t provides functions to output the generated text. All these actions should be performed only by emu_insn() function.

@param outctx: (outctx_t ) @param op: (const op_t ) @retval 1: ok @retval -1: operand is hidden

def ev_out_segend(self, outctx: outctx_t *, seg: segment_t *)

ev_out_segend(self, outctx, seg) -> int Function to produce end of segment

@param outctx: (outctx_t ) @param seg: (segment_t ) @retval 1: ok @retval 0: not implemented

def ev_out_segstart(self, outctx: outctx_t *, seg: segment_t *)

ev_out_segstart(self, outctx, seg) -> int Function to produce start of segment

@param outctx: (outctx_t ) @param seg: (segment_t ) @retval 1: ok @retval 0: not implemented

def ev_out_special_item(self, outctx: outctx_t *, segtype: uchar)

ev_out_special_item(self, outctx, segtype) -> int Generate text representation of an item in a special segment i.e. absolute symbols, externs, communal definitions etc

@param outctx: (outctx_t *) @param segtype: (uchar) @retval 1: ok @retval 0: not implemented @retval -1: overflow

def ev_privrange_changed(self, old_privrange: range_t, delta: adiff_t)

ev_privrange_changed(self, old_privrange, delta) -> int Privrange interval has been moved to a new location. Most common actions to be done by module in this case: fix indices of netnodes used by module

@param old_privrange: (const range_t *) - old privrange interval @param delta: (::adiff_t) @return: 0 Ok -1 error (and message in errbuf)

def ev_realcvt(self, m: void *, e: fpvalue_t *, swt: uint16)

ev_realcvt(self, m, e, swt) -> int Floating point -> IEEE conversion

@param m: (void ) ptr to processor-specific floating point value @param e: (fpvalue_t ) IDA representation of a floating point value @param swt: (uint16) operation (see realcvt() in ieee.h) @retval 0: not implemented @retval unknown

def ev_rename(self, ea: ea_t, new_name: char const *)

ev_rename(self, ea, new_name) -> int The kernel is going to rename a byte.

@param ea: (::ea_t) @param new_name: (const char *) @retval <0: if the kernel should not rename it. @retval 2: to inhibit the notification. I.e., the kernel should not rename, but 'set_name()' should return 'true'. also see renamed the return value is ignored when kernel is going to delete name

def ev_replaying_undo(self, action_name: char const *, vec: undo_records_t const *, is_undo: bool)

ev_replaying_undo(self, action_name, vec, is_undo) -> int Replaying an undo/redo buffer

@param action_name: (const char ) action that we perform undo/redo for. may be nullptr for intermediary buffers. @param vec: (const undo_records_t ) @param is_undo: (bool) true if performing undo, false if performing redo This event may be generated multiple times per undo/redo

def ev_set_code16_mode(self, ea: ea_t, code16: bool)

ev_set_code16_mode(self, ea, code16) -> int Some processors have ISA 16-bit mode e.g. ARM Thumb mode, PPC VLE, MIPS16 Set ISA 16-bit mode

@param ea: (ea_t) address to set new ISA mode @param code16: (bool) true for 16-bit mode, false for 32-bit mode

def ev_set_idp_options(self, keyword: char const *, value_type: int, value: void const *, idb_loaded: bool)

ev_set_idp_options(self, keyword, value_type, value, idb_loaded) -> int Set IDP-specific configuration option Also see set_options_t in config.hpp

@param keyword: (const char ) @param value_type: (int) @param value: (const void ) @param idb_loaded: (bool) true if the ev_oldfile/ev_newfile events have been generated @retval 1: ok @retval 0: not implemented @retval -1: error (and message in errbuf)

def ev_set_proc_options(self, options: char const *, confidence: int)

ev_set_proc_options(self, options, confidence) -> int Called if the user specified an option string in the command line: -p:. Can be used for setting a processor subtype. Also called if option string is passed to set_processor_type() and IDC's SetProcessorType().

@param options: (const char *) @param confidence: (int) 0: loader's suggestion 1: user's decision @retval <0: if bad option string

def ev_setup_til(self) ‑> int

ev_setup_til(self) -> int Setup default type libraries. (called after loading a new file into the database). The processor module may load tils, setup memory model and perform other actions required to set up the type system. This is an optional callback. @retval void

def ev_str2reg(self, regname: char const *)

ev_str2reg(self, regname) -> int Convert a register name to a register number. The register number is the register index in the processor_t::reg_names array Most processor modules do not need to implement this callback It is useful only if processor_t::reg_names[reg] does not provide the correct register names

@param regname: (const char *) @retval register: number + 1 @retval 0: not implemented or could not be decoded

def ev_term(self) ‑> int

ev_term(self) -> int The IDP module is being unloaded.

def ev_treat_hindering_item(self, hindering_item_ea: ea_t, new_item_flags: flags64_t, new_item_ea: ea_t, new_item_length: asize_t)

ev_treat_hindering_item(self, hindering_item_ea, new_item_flags, new_item_ea, new_item_length) -> int An item hinders creation of another item.

@param hindering_item_ea: (::ea_t) @param new_item_flags: (flags64_t) (0 for code) @param new_item_ea: (::ea_t) @param new_item_length: (::asize_t) @retval 0: no reaction @retval !=0: the kernel may delete the hindering item

def ev_undefine(self, ea: ea_t)

ev_undefine(self, ea) -> int An item in the database (insn or data) is being deleted.

@param ea: (ea_t) @retval 1: do not delete srranges at the item end @retval 0: srranges can be deleted

def ev_update_call_stack(self, stack: call_stack_t, tid: int, getreg: processor_t::regval_getter_t *, regvalues: regval_t)

ev_update_call_stack(self, stack, tid, getreg, regvalues) -> int Calculate the call stack trace for the given thread. This callback is invoked when the process is suspended and should fill the 'trace' object with the information about the current call stack. Note that this callback is NOT invoked if the current debugger backend implements stack tracing via debugger_t::event_t::ev_update_call_stack. The debugger-specific algorithm takes priority. Implementing this callback in the processor module is useful when multiple debugging platforms follow similar patterns, and thus the same processor-specific algorithm can be used for different platforms.

@param stack: (call_stack_t ) result @param tid: (int) thread id @param getreg: (::processor_t::regval_getter_t ) function to get register values @param regvalues: (const regval_t *) register values array @retval 1: ok @retval -1: failed @retval 0: unimplemented

def ev_use_arg_types(self, ea: ea_t, fti: func_type_data_t, rargs: funcargvec_t *)

ev_use_arg_types(self, ea, fti, rargs) -> int Use information about callee arguments.

@param ea: (::ea_t) address of the call instruction @param fti: (func_type_data_t ) info about function type @param rargs: (funcargvec_t ) array of register arguments @retval 1: (and removes handled arguments from fti and rargs) @retval 0: not implemented

def ev_use_regarg_type(self, ea: ea_t, rargs: funcargvec_t const *)

ev_use_regarg_type(self, ea, rargs) -> PyObject * Use information about register argument.

@param ea: (::ea_t) address of the instruction @param rargs: (const funcargvec_t *) vector of register arguments (including regs extracted from scattered arguments) @retval 1 @retval 0: not implemented

def ev_use_stkarg_type(self, ea: ea_t, arg: funcarg_t)

ev_use_stkarg_type(self, ea, arg) -> int Use information about a stack argument.

@param ea: (::ea_t) address of the push instruction which pushes the function argument into the stack @param arg: (const funcarg_t *) argument info @retval 1: ok @retval <=0: failed, the kernel will create a comment with the argument name or type for the instruction

def ev_validate_flirt_func(self, start_ea: ea_t, funcname: char const *)

ev_validate_flirt_func(self, start_ea, funcname) -> int Flirt has recognized a library function. This callback can be used by a plugin or proc module to intercept it and validate such a function.

@param start_ea: (::ea_t) @param funcname: (const char *) @retval -1: do not create a function, @retval 0: function is validated

def ev_verify_noreturn(self, pfn: func_t *)

ev_verify_noreturn(self, pfn) -> int The kernel wants to set 'noreturn' flags for a function.

@param pfn: (func_t *) @retval 0: ok. any other value: do not set 'noreturn' flag

def ev_verify_sp(self, pfn: func_t *)

ev_verify_sp(self, pfn) -> int All function instructions have been analyzed. Now the processor module can analyze the stack pointer for the whole function

@param pfn: (func_t *) @retval 0: ok @retval <0: bad stack pointer

def hook(self) ‑> bool

hook(self) -> bool

def unhook(self) ‑> bool

unhook(self) -> bool

class asm_t

Proxy of C++ asm_t class.

init(self) -> asm_t

Instance variables

var a_align : char const *

"align" keyword

var a_ascii : char const *

string literal directive

var a_band : char const *

& bit and assembler time operation

var a_bnot : char const *

~ bit not assembler time operation

var a_bor : char const *

| bit or assembler time operation

var a_bss : char const *

uninitialized data directive should include 's' for the size of data

var a_byte : char const *

byte directive

var a_comdef : char const *

"comm" (communal variable)

var a_curip : char const *

current IP (instruction pointer) symbol in assembler

var a_double : char const *

double; 8bytes; nullptr if not allowed

var a_dups : char const *

array keyword. the following sequences may appear: * #h header * #d size * #v value * #s(b,w,l,q,f,d,o) size specifiers for byte,word, dword,qword, float,double,oword

var a_dword : char const *

nullptr if not allowed

var a_equ : char const *

'equ' Used if AS_UNEQU is set

var a_extrn : char const *

"extern" name keyword

var a_float : char const *

float; 4bytes; nullptr if not allowed

var a_include_fmt : char const *

the include directive (format string)

var a_mod : char const *

% mod assembler time operation

var a_oword : char const *

nullptr if not allowed

var a_packreal : char const *

packed decimal real nullptr if not allowed

var a_public : char const *

"public" name keyword. nullptr-use default, ""-do not generate

var a_qword : char const *

nullptr if not allowed

var a_rva : char const *

'rva' keyword for image based offsets (see REFINFO_RVAOFF)

var a_seg : char const *

'seg ' prefix (example: push seg seg001)

var a_shl : char const *

<< shift left assembler time operation

var a_shr : char const *

shift right assembler time operation

var a_sizeof_fmt : char const *

size of type (format string)

var a_tbyte : char const *

long double; nullptr if not allowed

var a_vstruc_fmt : char const *

if a named item is a structure and displayed in the verbose (multiline) form then display the name as printf(a_strucname_fmt, typename) (for asms with type checking, e.g. tasm ideal)

var a_weak : char const *

"weak" name keyword. nullptr-use default, ""-do not generate

var a_word : char const *

word directive

var a_xor : char const *

^ bit xor assembler time operation

var a_yword : char const *

32-byte (256-bit) data; nullptr if not allowed requires AS2_YWORD

var a_zword : char const *

64-byte (512-bit) data; nullptr if not allowed requires AS2_ZWORD

var accsep : char

char constant delimiter

var ascsep : char

string literal delimiter

var cmnt : char const *

comment string (see also cmnt2)

var cmnt2 : char const *

comment close string (usually nullptr) this is used to denote a string which closes comments, for example, if the comments are represented with () then cmnt = "(" and cmnt2 = ")"

var end : char const *

end directive

var esccodes : char const *

special chars that cannot appear as is in string and char literals

var flag : uint32

Assembler feature bits

var flag2 : uint32

Secondary assembler feature bits

var header : char const *const *

array of automatically generated header lines they appear at the start of disassembled text

var help : help_t

Help screen number, 0 - no help.

var high16 : char const *

high16

var high8 : char const *

high8

var lbrace : char

left brace used in complex expressions

var low16 : char const *

low16

var low8 : char const *

low8 operation, should contain s for the operand

var name : char const *

Assembler name (displayed in menus)

var origin : char const *

org directive

var rbrace : char

right brace used in complex expressions

var thisown

The membership flag

var uflag : uint16

user defined flags (local only for IDP) you may define and use your own bits

class num_range_t (_min: int64, _max: int64)

Proxy of C++ cfgopt_t::num_range_t class.

init(self, _min, _max) -> num_range_t

@param _min: int64 @param _max: int64

Instance variables

var maxval : int64

maxval

var minval : int64

minval

var thisown

The membership flag

class params_t (_p1: int64, _p2: int64)

Proxy of C++ cfgopt_t::params_t class.

init(self, _p1, _p2) -> params_t

@param _p1: int64 @param _p2: int64

Instance variables

var p1 : int64

p1

var p2 : int64

p2

var thisown

The membership flag

class processor_t

Proxy of C++ IDP_Hooks class.

init(self, _flags=0, _hkcb_flags=0x0001) -> IDP_Hooks

@param _flags: uint32 @param _hkcb_flags: uint32

Ancestors

Methods

def auto_empty(self, *args)
def auto_empty_finally(self, *args)
def closebase(self, *args)
def compiler_changed(self, *args)
def deleting_func(self, pfn)
def determined_main(self, *args)
def func_added(self, pfn)
def get_auxpref(self, insn)

This function returns insn.auxpref value

def get_idpdesc(self)

This function must be present and should return the list of short processor names similar to the one in ph.psnames. This method can be overridden to return to the kernel a different IDP description.

def idasgn_loaded(self, *args)
def kernel_config_loaded(self, *args)
def make_code(self, *args)
def make_data(self, *args)
def renamed(self, *args)
def savebase(self, *args)
def segm_moved(self, from_ea, to_ea, size, changed_netmap)
def set_func_end(self, *args)
def set_func_start(self, *args)
def sgr_changed(self, *args)

Inherited members

class reg_access_t

Proxy of C++ reg_access_t class.

init(self) -> reg_access_t

Instance variables

var access_type : access_type_t

access_type

var opnum : uchar

operand number

var range : bitrange_t

bitrange inside the register

var regnum : int

register number (only entire registers)

var thisown

The membership flag

Methods

def have_common_bits(self, r: reg_access_t) ‑> bool

have_common_bits(self, r) -> bool

@param r: reg_access_t const &

class reg_access_vec_t (*args)

Proxy of C++ qvector< reg_access_t > class.

init(self) -> reg_access_vec_t init(self, x) -> reg_access_vec_t

@param x: qvector< reg_access_t > const &

Subclasses

Instance variables

var thisown

The membership flag

Methods

def add_unique(self, x: reg_access_t) ‑> bool

add_unique(self, x) -> bool

@param x: reg_access_t const &

def at(self, _idx: size_t)

at(self, _idx) -> reg_access_t

@param _idx: size_t

def back(self)
def begin(self, *args)

begin(self) -> reg_access_t

def capacity(self)

capacity(self) -> size_t

def clear(self)

clear(self)

def empty(self) ‑> bool

empty(self) -> bool

def end(self, *args)

end(self) -> reg_access_t

def erase(self, *args)

erase(self, it) -> reg_access_t

@param it: qvector< reg_access_t >::iterator

erase(self, first, last) -> reg_access_t

@param first: qvector< reg_access_t >::iterator @param last: qvector< reg_access_t >::iterator

def extract(self)

extract(self) -> reg_access_t

def find(self, *args)

find(self, x) -> reg_access_t

@param x: reg_access_t const &

def front(self)
def grow(self, *args)

grow(self, x=reg_access_t())

@param x: reg_access_t const &

def has(self, x: reg_access_t) ‑> bool

has(self, x) -> bool

@param x: reg_access_t const &

def inject(self, s: reg_access_t, len: size_t)

inject(self, s, len)

@param s: reg_access_t * @param len: size_t

def insert(self, it: reg_access_t, x: reg_access_t)

insert(self, it, x) -> reg_access_t

@param it: qvector< reg_access_t >::iterator @param x: reg_access_t const &

def pop_back(self)

pop_back(self)

def push_back(self, *args)

push_back(self, x)

@param x: reg_access_t const &

push_back(self) -> reg_access_t

def qclear(self)

qclear(self)

def reserve(self, cnt: size_t)

reserve(self, cnt)

@param cnt: size_t

def resize(self, *args)

resize(self, _newsize, x)

@param _newsize: size_t @param x: reg_access_t const &

resize(self, _newsize)

@param _newsize: size_t

def size(self)

size(self) -> size_t

def swap(self, r: reg_access_vec_t)

swap(self, r)

@param r: qvector< reg_access_t > &

def truncate(self)

truncate(self)

class reg_accesses_t

Proxy of C++ reg_accesses_t class.

init(self) -> reg_accesses_t

Ancestors

Inherited members

class reg_info_t

Proxy of C++ reg_info_t class.

init(self) -> reg_info_t

Instance variables

var reg : int

register number

var size : int

register size

var thisown

The membership flag

Methods

def compare(self, r: reg_info_t) ‑> int

compare(self, r) -> int

@param r: reg_info_t const &