 |
IDAPython 9.0
|
|
IDAPython 9.0
|
Proxy of C++ IDP_Hooks class.
Public Member Functions | |
| __init__ (self, "uint32" _flags=0, "uint32" _hkcb_flags=0x0001) | |
| init(self, _flags=0, _hkcb_flags=0x0001) -> IDP_Hooks | |
| "bool" | hook (self) |
| hook(self) -> bool | |
| "bool" | unhook (self) |
| unhook(self) -> bool | |
| "int" | ev_init (self, "char const *" idp_modname) |
| ev_init(self, idp_modname) -> int The IDP module is just loaded. | |
| "int" | ev_term (self) |
| ev_term(self) -> int The IDP module is being unloaded. | |
| "int" | ev_newprc (self, "int" pnum, "bool" keep_cfg) |
| ev_newprc(self, pnum, keep_cfg) -> int Before changing processor type. | |
| "int" | ev_newasm (self, "int" asmnum) |
| ev_newasm(self, asmnum) -> int Before setting a new assembler. | |
| "int" | ev_newfile (self, "char *" fname) |
| ev_newfile(self, fname) -> int A new file has been loaded. | |
| "int" | ev_oldfile (self, "char *" fname) |
| ev_oldfile(self, fname) -> int An old file has been loaded. | |
| "int" | ev_newbinary (self, "char *" filename, "qoff64_t" fileoff, "ea_t" basepara, "ea_t" binoff, "uint64" nbytes) |
| ev_newbinary(self, filename, fileoff, basepara, binoff, nbytes) -> int IDA is about to load a binary file. | |
| "int" | ev_endbinary (self, "bool" ok) |
| ev_endbinary(self, ok) -> int IDA has loaded a binary file. | |
| "int" | ev_set_idp_options (self, "char const *" keyword, "int" value_type, "void const *" value, "bool" idb_loaded) |
| ev_set_idp_options(self, keyword, value_type, value, idb_loaded) -> int Set IDP-specific configuration option Also see set_options_t in config.hpp | |
| "int" | ev_set_proc_options (self, "char const *" options, "int" confidence) |
| ev_set_proc_options(self, options, confidence) -> int Called if the user specified an option string in the command line: -p<processor
name>:<options>. | |
| "bool" | ev_ana_insn (self, "insn_t *" out) |
| ev_ana_insn(self, out) -> bool Analyze one instruction and fill 'out' structure. | |
| "bool" | ev_emu_insn (self, "insn_t const *" insn) |
| ev_emu_insn(self, insn) -> bool Emulate instruction, create cross-references, plan to analyze subsequent instructions, modify flags etc. | |
| "int" | ev_out_header (self, "outctx_t *" outctx) |
| ev_out_header(self, outctx) -> int Function to produce start of disassembled text | |
| "int" | ev_out_footer (self, "outctx_t *" outctx) |
| ev_out_footer(self, outctx) -> int Function to produce end of disassembled text | |
| "int" | ev_out_segstart (self, "outctx_t *" outctx, "segment_t *" seg) |
| ev_out_segstart(self, outctx, seg) -> int Function to produce start of segment | |
| "int" | ev_out_segend (self, "outctx_t *" outctx, "segment_t *" seg) |
| ev_out_segend(self, outctx, seg) -> int Function to produce end of segment | |
| "int" | ev_out_assumes (self, "outctx_t *" outctx) |
| ev_out_assumes(self, outctx) -> int Function to produce assume directives when segment register value changes. | |
| "bool" | ev_out_insn (self, "outctx_t *" outctx) |
| ev_out_insn(self, outctx) -> bool Generate text representation of an instruction in 'ctx.insn' outctx_t provides functions to output the generated text. | |
| "int" | ev_out_mnem (self, "outctx_t *" outctx) |
| ev_out_mnem(self, outctx) -> int Generate instruction mnemonics. | |
| "bool" | ev_out_operand (self, "outctx_t *" outctx, "op_t const *" op) |
| ev_out_operand(self, outctx, op) -> bool Generate text representation of an instruction operand outctx_t provides functions to output the generated text. | |
| "int" | ev_out_data (self, "outctx_t *" outctx, "bool" analyze_only) |
| ev_out_data(self, outctx, analyze_only) -> int Generate text representation of data items This function may change the database and create cross-references if analyze_only is set | |
| "int" | ev_out_label (self, "outctx_t *" outctx, "char const *" colored_name) |
| ev_out_label(self, outctx, colored_name) -> int The kernel is going to generate an instruction label line or a function header. | |
| "int" | ev_out_special_item (self, "outctx_t *" outctx, "uchar" segtype) |
| ev_out_special_item(self, outctx, segtype) -> int Generate text representation of an item in a special segment i.e. | |
| "int" | ev_gen_regvar_def (self, "outctx_t *" outctx, "regvar_t *" v) |
| ev_gen_regvar_def(self, outctx, v) -> int Generate register variable definition line. | |
| "int" | ev_gen_src_file_lnnum (self, "outctx_t *" outctx, "char const *" file, "size_t" lnnum) |
| ev_gen_src_file_lnnum(self, outctx, file, lnnum) -> int | |
| "int" | ev_creating_segm (self, "segment_t *" seg) |
| ev_creating_segm(self, seg) -> int A new segment is about to be created. | |
| "int" | ev_moving_segm (self, "segment_t *" seg, "ea_t" to, "int" flags) |
| ev_moving_segm(self, seg, to, flags) -> int May the kernel move the segment? | |
| "int" | ev_coagulate (self, "ea_t" start_ea) |
| ev_coagulate(self, start_ea) -> int Try to define some unexplored bytes. | |
| "int" | ev_undefine (self, "ea_t" ea) |
| ev_undefine(self, ea) -> int An item in the database (insn or data) is being deleted. | |
| "int" | ev_treat_hindering_item (self, "ea_t" hindering_item_ea, "flags64_t" new_item_flags, "ea_t" new_item_ea, "asize_t" new_item_length) |
| ev_treat_hindering_item(self, hindering_item_ea, new_item_flags, new_item_ea, new_item_length) -> int An item hinders creation of another item. | |
| "int" | ev_rename (self, "ea_t" ea, "char const *" new_name) |
| ev_rename(self, ea, new_name) -> int The kernel is going to rename a byte. | |
| "int" | ev_is_far_jump (self, "int" icode) |
| ev_is_far_jump(self, icode) -> int is indirect far jump or call instruction? meaningful only if the processor has 'near' and 'far' reference types | |
| "int" | ev_is_sane_insn (self, "insn_t const *" insn, "int" no_crefs) |
| ev_is_sane_insn(self, insn, no_crefs) -> int Is the instruction sane for the current file type?. | |
| "int" | ev_is_cond_insn (self, "insn_t const *" insn) |
| ev_is_cond_insn(self, insn) -> int Is conditional instruction? | |
| "int" | ev_is_call_insn (self, "insn_t const *" insn) |
| ev_is_call_insn(self, insn) -> int Is the instruction a "call"? | |
| "int" | ev_is_ret_insn (self, "insn_t const *" insn, "uchar" flags) |
| ev_is_ret_insn(self, insn, flags) -> int Is the instruction a "return"? | |
| "int" | ev_may_be_func (self, "insn_t const *" insn, "int" state) |
| ev_may_be_func(self, insn, state) -> int Can a function start here? | |
| "int" | ev_is_basic_block_end (self, "insn_t const *" insn, "bool" call_insn_stops_block) |
| ev_is_basic_block_end(self, insn, call_insn_stops_block) -> int Is the current instruction end of a basic block?. | |
| "int" | ev_is_indirect_jump (self, "insn_t const *" insn) |
| ev_is_indirect_jump(self, insn) -> int Determine if instruction is an indirect jump. | |
| "int" | ev_is_insn_table_jump (self) |
| ev_is_insn_table_jump(self) -> int Reserved. | |
| "int" | ev_is_switch (self, "switch_info_t" si, "insn_t const *" insn) |
| ev_is_switch(self, si, insn) -> int Find 'switch' idiom or override processor module's decision. | |
| "int" | ev_calc_switch_cases (self, "casevec_t *" casevec, "eavec_t *" targets, "ea_t" insn_ea, "switch_info_t" si) |
| ev_calc_switch_cases(self, casevec, targets, insn_ea, si) -> int Calculate case values and targets for a custom jump table. | |
| "int" | ev_create_switch_xrefs (self, "ea_t" jumpea, "switch_info_t" si) |
| ev_create_switch_xrefs(self, jumpea, si) -> int Create xrefs for a custom jump table. | |
| "int" | ev_is_align_insn (self, "ea_t" ea) |
| ev_is_align_insn(self, ea) -> int Is the instruction created only for alignment purposes?. | |
| "int" | ev_is_alloca_probe (self, "ea_t" ea) |
| ev_is_alloca_probe(self, ea) -> int Does the function at 'ea' behave as __alloca_probe? | |
| "PyObject *" | ev_delay_slot_insn (self, "ea_t" ea, "bool" bexec, "bool" fexec) |
| ev_delay_slot_insn(self, ea, bexec, fexec) -> PyObject * Get delay slot instruction | |
| "int" | ev_is_sp_based (self, "int *" mode, "insn_t const *" insn, "op_t const *" op) |
| ev_is_sp_based(self, mode, insn, op) -> int Check whether the operand is relative to stack pointer or frame pointer This event is used to determine how to output a stack variable If not implemented, then all operands are sp based by default. | |
| "int" | ev_can_have_type (self, "op_t const *" op) |
| ev_can_have_type(self, op) -> int Can the operand have a type as offset, segment, decimal, etc? (for example, a register AX can't have a type, meaning that the user can't change its representation. | |
| "int" | ev_cmp_operands (self, "op_t const *" op1, "op_t const *" op2) |
| ev_cmp_operands(self, op1, op2) -> int Compare instruction operands | |
| "int" | ev_adjust_refinfo (self, "refinfo_t" ri, "ea_t" ea, "int" n, "fixup_data_t const *" fd) |
| ev_adjust_refinfo(self, ri, ea, n, fd) -> int Called from apply_fixup before converting operand to reference. | |
| "PyObject *" | ev_get_operand_string (self, "insn_t const *" insn, "int" opnum) |
| ev_get_operand_string(self, insn, opnum) -> PyObject * Request text string for operand (cli, java, ...). | |
| "PyObject *" | ev_get_reg_name (self, "int" reg, "size_t" width, "int" reghi) |
| ev_get_reg_name(self, reg, width, reghi) -> PyObject * Generate text representation of a register. | |
| "int" | ev_str2reg (self, "char const *" regname) |
| ev_str2reg(self, regname) -> int Convert a register name to a register number. | |
| "PyObject *" | ev_get_autocmt (self, "insn_t const *" insn) |
| ev_get_autocmt(self, insn) -> PyObject * | |
| "int" | ev_get_bg_color (self, "bgcolor_t *" color, "ea_t" ea) |
| ev_get_bg_color(self, color, ea) -> int Get item background color. | |
| "int" | ev_is_jump_func (self, "func_t *" pfn, "ea_t *" jump_target, "ea_t *" func_pointer) |
| ev_is_jump_func(self, pfn, jump_target, func_pointer) -> int Is the function a trivial "jump" function?. | |
| "int" | ev_func_bounds (self, "int *" possible_return_code, "func_t *" pfn, "ea_t" max_func_end_ea) |
| ev_func_bounds(self, possible_return_code, pfn, max_func_end_ea) -> int find_func_bounds() finished its work. | |
| "int" | ev_verify_sp (self, "func_t *" pfn) |
| ev_verify_sp(self, pfn) -> int All function instructions have been analyzed. | |
| "int" | ev_verify_noreturn (self, "func_t *" pfn) |
| ev_verify_noreturn(self, pfn) -> int The kernel wants to set 'noreturn' flags for a function. | |
| "int" | ev_create_func_frame (self, "func_t *" pfn) |
| ev_create_func_frame(self, pfn) -> int Create a function frame for a newly created function Set up frame size, its attributes etc | |
| "int" | ev_get_frame_retsize (self, "int *" frsize, "func_t const *" pfn) |
| ev_get_frame_retsize(self, frsize, pfn) -> int Get size of function return address in bytes If this event is not implemented, the kernel will assume | |
| "int" | ev_get_stkvar_scale_factor (self) |
| ev_get_stkvar_scale_factor(self) -> int Should stack variable references be multiplied by a coefficient before being used in the stack frame?. | |
| "PyObject *" | ev_demangle_name (self, "char const *" name, "uint32" disable_mask, "int" demreq) |
| ev_demangle_name(self, name, disable_mask, demreq) -> PyObject * Demangle a C++ (or another language) name into a user-readable string. | |
| "int" | ev_add_cref (self, "ea_t" _from, "ea_t" to, "cref_t" type) |
| ev_add_cref(self, _from, to, type) -> int A code reference is being created. | |
| "int" | ev_add_dref (self, "ea_t" _from, "ea_t" to, "dref_t" type) |
| ev_add_dref(self, _from, to, type) -> int A data reference is being created. | |
| "int" | ev_del_cref (self, "ea_t" _from, "ea_t" to, "bool" expand) |
| ev_del_cref(self, _from, to, expand) -> int A code reference is being deleted. | |
| "int" | ev_del_dref (self, "ea_t" _from, "ea_t" to) |
| ev_del_dref(self, _from, to) -> int A data reference is being deleted. | |
| "int" | ev_coagulate_dref (self, "ea_t" _from, "ea_t" to, "bool" may_define, "ea_t *" code_ea) |
| ev_coagulate_dref(self, _from, to, may_define, code_ea) -> int Data reference is being analyzed. | |
| "int" | ev_may_show_sreg (self, "ea_t" current_ea) |
| ev_may_show_sreg(self, current_ea) -> int The kernel wants to display the segment registers in the messages window. | |
| "int" | ev_auto_queue_empty (self, "atype_t" type) |
| ev_auto_queue_empty(self, type) -> int One analysis queue is empty. | |
| "int" | ev_validate_flirt_func (self, "ea_t" start_ea, "char const *" funcname) |
| ev_validate_flirt_func(self, start_ea, funcname) -> int Flirt has recognized a library function. | |
| "int" | ev_adjust_libfunc_ea (self, "idasgn_t const *" sig, "libfunc_t const *" libfun, "ea_t *" ea) |
| ev_adjust_libfunc_ea(self, sig, libfun, ea) -> int Called when a signature module has been matched against bytes in the database. | |
| "PyObject *" | ev_assemble (self, "ea_t" ea, "ea_t" cs, "ea_t" ip, "bool" use32, "char const *" line) |
| ev_assemble(self, ea, cs, ip, use32, line) -> PyObject * Assemble an instruction. | |
| "int" | ev_extract_address (self, "ea_t *" out_ea, "ea_t" screen_ea, "char const *" string, "size_t" position) |
| ev_extract_address(self, out_ea, screen_ea, string, position) -> int Extract address from a string. | |
| "int" | ev_realcvt (self, "void *" m, "fpvalue_t *" e, "uint16" swt) |
| ev_realcvt(self, m, e, swt) -> int Floating point -> IEEE conversion | |
| "int" | ev_gen_asm_or_lst (self, "bool" starting, "FILE *" fp, "bool" is_asm, "int" flags, "html_line_cb_t **" outline) |
| ev_gen_asm_or_lst(self, starting, fp, is_asm, flags, outline) -> int | |
| "int" | ev_gen_map_file (self, "int *" nlines, "FILE *" fp) |
| ev_gen_map_file(self, nlines, fp) -> int Generate map file. | |
| "int" | ev_create_flat_group (self, "ea_t" image_base, "int" bitness, "sel_t" dataseg_sel) |
| ev_create_flat_group(self, image_base, bitness, dataseg_sel) -> int Create special segment representing the flat group. | |
| "int" | ev_getreg (self, "uval_t *" regval, "int" regnum) |
| ev_getreg(self, regval, regnum) -> int IBM PC only internal request, should never be used for other purpose Get register value by internal index | |
| "int" | ev_analyze_prolog (self, "ea_t" ea) |
| ev_analyze_prolog(self, ea) -> int Analyzes function prolog, epilog, and updates purge, and function attributes | |
| "int" | ev_calc_spdelta (self, "sval_t *" spdelta, "insn_t const *" insn) |
| ev_calc_spdelta(self, spdelta, insn) -> int Calculate amount of change to sp for the given insn. | |
| "int" | ev_calcrel (self) |
| ev_calcrel(self) -> int Reserved. | |
| "PyObject *" | ev_find_reg_value (self, "insn_t const *" pinsn, "int" reg) |
| ev_find_reg_value(self, pinsn, reg) -> PyObject * Find register value via a register tracker. | |
| "PyObject *" | ev_find_op_value (self, "insn_t const *" pinsn, "int" opn) |
| ev_find_op_value(self, pinsn, opn) -> PyObject * Find operand value via a register tracker. | |
| "int" | ev_replaying_undo (self, "char const *" action_name, "undo_records_t const *" vec, "bool" is_undo) |
| ev_replaying_undo(self, action_name, vec, is_undo) -> int Replaying an undo/redo buffer | |
| "int" | ev_ending_undo (self, "char const *" action_name, "bool" is_undo) |
| ev_ending_undo(self, action_name, is_undo) -> int Ended undoing/redoing an action | |
| "int" | ev_set_code16_mode (self, "ea_t" ea, "bool" code16) |
| ev_set_code16_mode(self, ea, code16) -> int Some processors have ISA 16-bit mode e.g. | |
| "int" | ev_get_code16_mode (self, "ea_t" ea) |
| ev_get_code16_mode(self, ea) -> int Get ISA 16-bit mode | |
| "int" | ev_get_procmod (self) |
| ev_get_procmod(self) -> int Get pointer to the processor module object. | |
| "int" | ev_asm_installed (self, "int" asmnum) |
| ev_asm_installed(self, asmnum) -> int After setting a new assembler | |
| "int" | ev_get_reg_accesses (self, "reg_accesses_t" accvec, "insn_t const *" insn, "int" flags) |
| ev_get_reg_accesses(self, accvec, insn, flags) -> int Get info about the registers that are used/changed by an instruction. | |
| "int" | ev_is_control_flow_guard (self, "int *" p_reg, "insn_t const *" insn) |
| ev_is_control_flow_guard(self, p_reg, insn) -> int Detect if an instruction is a "thunk call" to a flow guard function (equivalent to call reg/return/nop) | |
| "int" | ev_create_merge_handlers (self, "merge_data_t *" md) |
| ev_create_merge_handlers(self, md) -> int Create merge handlers, if needed | |
| "int" | ev_privrange_changed (self, "range_t" old_privrange, "adiff_t" delta) |
| ev_privrange_changed(self, old_privrange, delta) -> int Privrange interval has been moved to a new location. | |
| "int" | ev_cvt64_supval (self, "nodeidx_t" node, "uchar" tag, "nodeidx_t" idx, "uchar const *" data) |
| ev_cvt64_supval(self, node, tag, idx, data) -> int perform 32-64 conversion for a netnode array element | |
| "int" | ev_cvt64_hashval (self, "nodeidx_t" node, "uchar" tag, "char const *" name, "uchar const *" data) |
| ev_cvt64_hashval(self, node, tag, name, data) -> int perform 32-64 conversion for a hash value | |
| "int" | ev_gen_stkvar_def (self, "outctx_t *" outctx, "udm_t" stkvar, "sval_t" v, "tid_t" tid) |
| ev_gen_stkvar_def(self, outctx, stkvar, v, tid) -> int Generate stack variable definition line Default line is varname = type ptr value, where 'type' is one of byte,word,dword,qword,tbyte | |
| "int" | ev_next_exec_insn (self, "ea_t *" target, "ea_t" ea, "int" tid, "processor_t::regval_getter_t *" getreg, "regval_t" regvalues) |
| ev_next_exec_insn(self, target, ea, tid, getreg, regvalues) -> int Get next address to be executed This function must return the next address to be executed. | |
| "int" | ev_calc_step_over (self, "ea_t *" target, "ea_t" ip) |
| ev_calc_step_over(self, target, ip) -> int Calculate the address of the instruction which will be executed after "step
over". | |
| "int" | ev_calc_next_eas (self, "eavec_t *" res, "insn_t const *" insn, "bool" over) |
| ev_calc_next_eas(self, res, insn, over) -> int Calculate list of addresses the instruction in 'insn' may pass control to. | |
| "int" | ev_get_macro_insn_head (self, "ea_t *" head, "ea_t" ip) |
| ev_get_macro_insn_head(self, head, ip) -> int Calculate the start of a macro instruction. | |
| "int" | ev_get_dbr_opnum (self, "int *" opnum, "insn_t const *" insn) |
| ev_get_dbr_opnum(self, opnum, insn) -> int Get the number of the operand to be displayed in the debugger reference view (text mode). | |
| "int" | ev_insn_reads_tbit (self, "insn_t const *" insn, "processor_t::regval_getter_t *" getreg, "regval_t" regvalues) |
| ev_insn_reads_tbit(self, insn, getreg, regvalues) -> int Check if insn will read the TF bit. | |
| "int" | ev_clean_tbit (self, "ea_t" ea, "processor_t::regval_getter_t *" getreg, "regval_t" regvalues) |
| ev_clean_tbit(self, ea, getreg, regvalues) -> int Clear the TF bit after an insn like pushf stored it in memory. | |
| "int" | ev_get_reg_info (self, "char const **" main_regname, "bitrange_t" bitrange, "char const *" regname) |
| ev_get_reg_info(self, main_regname, bitrange, regname) -> int Get register information by its name. | |
| "int" | ev_update_call_stack (self, "call_stack_t" stack, "int" tid, "processor_t::regval_getter_t *" getreg, "regval_t" regvalues) |
| ev_update_call_stack(self, stack, tid, getreg, regvalues) -> int Calculate the call stack trace for the given thread. | |
| "int" | ev_setup_til (self) |
| ev_setup_til(self) -> int Setup default type libraries. | |
| "int" | ev_get_abi_info (self, "comp_t" comp) |
| ev_get_abi_info(self, comp) -> int Get all possible ABI names and optional extensions for given compiler abiname/option is a string entirely consisting of letters, digits and underscore | |
| "int" | ev_max_ptr_size (self) |
| ev_max_ptr_size(self) -> int Get maximal size of a pointer in bytes. | |
| "int" | ev_get_default_enum_size (self) |
| ev_get_default_enum_size(self) -> int Get default enum size. | |
| "int" | ev_get_cc_regs (self, "callregs_t" regs, "cm_t" cc) |
| ev_get_cc_regs(self, regs, cc) -> int Get register allocation convention for given calling convention | |
| "int" | ev_get_simd_types (self, "simd_info_vec_t *" out, "simd_info_t" simd_attrs, "argloc_t" argloc, "bool" create_tifs) |
| ev_get_simd_types(self, out, simd_attrs, argloc, create_tifs) -> int Get SIMD-related types according to given attributes ant/or argument location | |
| "int" | ev_calc_cdecl_purged_bytes (self, "ea_t" ea) |
| ev_calc_cdecl_purged_bytes(self, ea) -> int Calculate number of purged bytes after call. | |
| "int" | ev_calc_purged_bytes (self, "int *" p_purged_bytes, "func_type_data_t" fti) |
| ev_calc_purged_bytes(self, p_purged_bytes, fti) -> int Calculate number of purged bytes by the given function type. | |
| "int" | ev_calc_retloc (self, "argloc_t" retloc, "tinfo_t" rettype, "cm_t" cc) |
| ev_calc_retloc(self, retloc, rettype, cc) -> int Calculate return value location. | |
| "int" | ev_calc_arglocs (self, "func_type_data_t" fti) |
| ev_calc_arglocs(self, fti) -> int Calculate function argument locations. | |
| "int" | ev_calc_varglocs (self, "func_type_data_t" ftd, "regobjs_t" aux_regs, "relobj_t" aux_stkargs, "int" nfixed) |
| ev_calc_varglocs(self, ftd, aux_regs, aux_stkargs, nfixed) -> int Calculate locations of the arguments that correspond to '...'. | |
| "int" | ev_adjust_argloc (self, "argloc_t" argloc, "tinfo_t" optional_type, "int" size) |
| ev_adjust_argloc(self, argloc, optional_type, size) -> int Adjust argloc according to its type/size and platform endianess | |
| "int" | ev_lower_func_type (self, "intvec_t *" argnums, "func_type_data_t" fti) |
| ev_lower_func_type(self, argnums, fti) -> int Get function arguments which should be converted to pointers when lowering function prototype. | |
| "int" | ev_equal_reglocs (self, "argloc_t" a1, "argloc_t" a2) |
| ev_equal_reglocs(self, a1, a2) -> int Are 2 register arglocs the same?. | |
| "int" | ev_use_stkarg_type (self, "ea_t" ea, "funcarg_t" arg) |
| ev_use_stkarg_type(self, ea, arg) -> int Use information about a stack argument. | |
| "PyObject *" | ev_use_regarg_type (self, "ea_t" ea, "funcargvec_t const *" rargs) |
| ev_use_regarg_type(self, ea, rargs) -> PyObject * Use information about register argument. | |
| "int" | ev_use_arg_types (self, "ea_t" ea, "func_type_data_t" fti, "funcargvec_t *" rargs) |
| ev_use_arg_types(self, ea, fti, rargs) -> int Use information about callee arguments. | |
| "int" | ev_arg_addrs_ready (self, "ea_t" caller, "int" n, "tinfo_t" tif, "ea_t *" addrs) |
| ev_arg_addrs_ready(self, caller, n, tif, addrs) -> int Argument address info is ready. | |
| "PyObject *" | ev_decorate_name (self, "char const *" name, "bool" mangle, "int" cc, "tinfo_t" optional_type) |
| ev_decorate_name(self, name, mangle, cc, optional_type) -> PyObject * Decorate/undecorate a C symbol name. | |
| "int" | ev_arch_changed (self) |
| ev_arch_changed(self) -> int The loader is done parsing arch-related information, which the processor module might want to use to finish its initialization. | |
| "int" | ev_get_stkarg_area_info (self, "stkarg_area_info_t" out, "cm_t" cc) |
| ev_get_stkarg_area_info(self, out, cc) -> int Get some metrics of the stack argument area. | |
| "int" | ev_last_cb_before_loader (self) |
| ev_last_cb_before_loader(self) -> int | |
| "int" | ev_loader (self) |
| ev_loader(self) -> int This code and higher ones are reserved for the loaders. | |
| __disown__ (self) | |
Properties | |
| thisown = property(lambda x: x.this.own(), lambda x, v: x.this.own(v), doc="The membership flag") | |
| __init__ | ( | self, | |
| "uint32" | _flags = 0, | ||
| "uint32" | _hkcb_flags = 0x0001 ) |
| _flags | uint32 |
| _hkcb_flags | uint32 |
Reimplemented in _notify_when_dispatcher_t._IDP_Hooks, and processor_t.
| __disown__ | ( | self | ) |
| "int" ev_add_cref | ( | self, | |
| "ea_t" | _from, | ||
| "ea_t" | to, | ||
| "cref_t" | type ) |
| from | (::ea_t) |
| to | (::ea_t) |
| type | (cref_t) |
| <0 | cancel cref creation |
| 0 | not implemented or continue |
| "int" ev_add_dref | ( | self, | |
| "ea_t" | _from, | ||
| "ea_t" | to, | ||
| "dref_t" | type ) |
| from | (::ea_t) |
| to | (::ea_t) |
| type | (dref_t) |
| <0 | cancel dref creation |
| 0 | not implemented or continue |
| "int" ev_adjust_argloc | ( | self, | |
| "argloc_t" | argloc, | ||
| "tinfo_t" | optional_type, | ||
| "int" | size ) |
| argloc | (argloc_t *), inout |
| type | (const tinfo_t *), may be nullptr nullptr means primitive type of given size |
| size | (int) 'size' makes no sense if type != nullptr (type->get_size() should be used instead) |
| 0 | not implemented |
| 1 | ok |
| -1 | error |
| "int" ev_adjust_libfunc_ea | ( | self, | |
| "idasgn_t const *" | sig, | ||
| "libfunc_t const *" | libfun, | ||
| "ea_t *" | ea ) |
This is used to compute the offset at which a particular module's libfunc should be applied.
| sig | (const idasgn_t *) |
| libfun | (const libfunc_t *) |
| ea | (::ea_t *) |
| 1 | the ea_t pointed to by the third argument was modified. |
| <=0 | not modified. use default algorithm. |
| "int" ev_adjust_refinfo | ( | self, | |
| "refinfo_t" | ri, | ||
| "ea_t" | ea, | ||
| "int" | n, | ||
| "fixup_data_t const *" | fd ) |
Can be used for changing the reference info. (e.g. the PPC module adds REFINFO_NOBASE for some references)
| ri | (refinfo_t *) |
| ea | (::ea_t) instruction address |
| n | (int) operand number |
| fd | (const fixup_data_t *) |
| <0 | do not create an offset |
| 0 | not implemented or refinfo adjusted |
| "bool" ev_ana_insn | ( | self, | |
| "insn_t *" | out ) |
This function shouldn't change the database, flags or anything else. All these actions should be performed only by emu_insn() function. insn_t::ea contains address of instruction to analyze.
| out | (insn_t *) |
| 0 | if instruction can't be decoded. |
Reimplemented in processor_t.
| "int" ev_analyze_prolog | ( | self, | |
| "ea_t" | ea ) |
| ea | (::ea_t) start of function |
| 1 | ok |
| 0 | not implemented |
| "int" ev_arch_changed | ( | self | ) |
| 1 | if success |
| 0 | not implemented or failed |
| "int" ev_arg_addrs_ready | ( | self, | |
| "ea_t" | caller, | ||
| "int" | n, | ||
| "tinfo_t" | tif, | ||
| "ea_t *" | addrs ) |
| caller | (::ea_t) |
| n | (int) number of formal arguments |
| tif | (tinfo_t *) call prototype |
| addrs | (::ea_t *) argument intilization addresses |
| <0 | do not save into idb; other values mean "ok to save" |
| "int" ev_asm_installed | ( | self, | |
| "int" | asmnum ) |
| asmnum | (int) See also ev_newasm |
| "PyObject *" ev_assemble | ( | self, | |
| "ea_t" | ea, | ||
| "ea_t" | cs, | ||
| "ea_t" | ip, | ||
| "bool" | use32, | ||
| "char const *" | line ) |
(display a warning if an error is found).
| ea | (::ea_t) linear address of instruction |
| cs | (::ea_t) cs of instruction |
| ip | (::ea_t) ip of instruction |
| use32 | (bool) is 32bit segment? |
| line | (const char *) line to assemble |
Reimplemented in processor_t.
| "int" ev_auto_queue_empty | ( | self, | |
| "atype_t" | type ) |
| type | (atype_t) |
| void | see also idb_event::auto_empty_finally |
Reimplemented in processor_t.
| "int" ev_calc_arglocs | ( | self, | |
| "func_type_data_t" | fti ) |
This callback should fill retloc, all arglocs, and stkargs. This callback is never called for CM_CC_SPECIAL functions.
| fti | (func_type_data_t *) points to the func type info |
| 0 | not implemented |
| 1 | ok |
| -1 | error |
| "int" ev_calc_cdecl_purged_bytes | ( | self, | |
| "ea_t" | ea ) |
| ea | (::ea_t) address of the call instruction |
| "int" ev_calc_next_eas | ( | self, | |
| "eavec_t *" | res, | ||
| "insn_t const *" | insn, | ||
| "bool" | over ) |
This callback is required for source level debugging.
| res | (eavec_t *), out: array for the results. |
| insn | (const insn_t*) the instruction |
| over | (bool) calculate for step over (ignore call targets) |
| <0 | incalculable (indirect jumps, for example) |
| >=0 | number of addresses of called functions in the array. They must be put at the beginning of the array (0 if over=true) |
| "int" ev_calc_purged_bytes | ( | self, | |
| "int *" | p_purged_bytes, | ||
| "func_type_data_t" | fti ) |
| p_purged_bytes | (int *) ptr to output |
| fti | (const func_type_data_t *) func type details |
| 1 | |
| 0 | not implemented |
| "int" ev_calc_retloc | ( | self, | |
| "argloc_t" | retloc, | ||
| "tinfo_t" | rettype, | ||
| "cm_t" | cc ) |
| retloc | (argloc_t *) |
| rettype | (const tinfo_t *) |
| cc | (cm_t) |
| 0 | not implemented |
| 1 | ok, |
| -1 | error |
| "int" ev_calc_spdelta | ( | self, | |
| "sval_t *" | spdelta, | ||
| "insn_t const *" | insn ) |
This event is required to decompile code snippets.
| spdelta | (sval_t *) |
| insn | (const insn_t *) |
| 1 | ok |
| 0 | not implemented |
| "int" ev_calc_step_over | ( | self, | |
| "ea_t *" | target, | ||
| "ea_t" | ip ) |
The kernel will put a breakpoint there. If the step over is equal to step into or we cannot calculate the address, return BADADDR.
| target | (::ea_t *) pointer to the answer |
| ip | (::ea_t) instruction address |
| 0 | unimplemented |
| 1 | implemented |
Reimplemented in processor_t.
| "int" ev_calc_switch_cases | ( | self, | |
| "casevec_t *" | casevec, | ||
| "eavec_t *" | targets, | ||
| "ea_t" | insn_ea, | ||
| "switch_info_t" | si ) |
| casevec | (::casevec_t *) vector of case values (may be nullptr) |
| targets | (eavec_t *) corresponding target addresses (my be nullptr) |
| insn_ea | (::ea_t) address of the 'indirect jump' instruction |
| si | (switch_info_t *) switch information |
| 1 | ok |
| <=0 | failed |
| "int" ev_calc_varglocs | ( | self, | |
| "func_type_data_t" | ftd, | ||
| "regobjs_t" | aux_regs, | ||
| "relobj_t" | aux_stkargs, | ||
| "int" | nfixed ) |
| ftd | (func_type_data_t *), inout: info about all arguments (including varargs) |
| aux_regs | (regobjs_t *) buffer for hidden register arguments, may be nullptr |
| aux_stkargs | (relobj_t *) buffer for hidden stack arguments, may be nullptr |
| nfixed | (int) number of fixed arguments |
| 0 | not implemented |
| 1 | ok |
| -1 | error On some platforms variadic calls require passing additional information: for example, number of floating variadic arguments must be passed in rax on gcc-x64. The locations and values that constitute this additional information are returned in the buffers pointed by aux_regs and aux_stkargs |
| "int" ev_calcrel | ( | self | ) |
| "int" ev_can_have_type | ( | self, | |
| "op_t const *" | op ) |
see bytes.hpp for information about types and flags)
| op | (const op_t *) |
| 0 | unknown |
| <0 | no |
| 1 | yes |
Reimplemented in processor_t.
| "int" ev_clean_tbit | ( | self, | |
| "ea_t" | ea, | ||
| "processor_t.regval_getter_t *" | getreg, | ||
| "regval_t" | regvalues ) |
| ea | (::ea_t) instruction address |
| getreg | (::processor_t::regval_getter_t *) function to get register values |
| regvalues | (const regval_t *) register values array |
| 1 | ok |
| 0 | failed |
| "int" ev_cmp_operands | ( | self, | |
| "op_t const *" | op1, | ||
| "op_t const *" | op2 ) |
| op1 | (const op_t*) |
| op2 | (const op_t*) |
| 1 | equal |
| -1 | not equal |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_coagulate | ( | self, | |
| "ea_t" | start_ea ) |
This notification will be called if the kernel tried all possibilities and could not find anything more useful than to convert to array of bytes. The module can help the kernel and convert the bytes into something more useful.
| start_ea | (::ea_t) |
Reimplemented in processor_t.
| "int" ev_coagulate_dref | ( | self, | |
| "ea_t" | _from, | ||
| "ea_t" | to, | ||
| "bool" | may_define, | ||
| "ea_t *" | code_ea ) |
plugin may correct 'code_ea' (e.g. for thumb mode refs, we clear the last bit)
| from | (::ea_t) |
| to | (::ea_t) |
| may_define | (bool) |
| code_ea | (::ea_t *) |
| <0 | failed dref analysis, >0 done dref analysis |
| 0 | not implemented or continue |
Reimplemented in processor_t.
| "int" ev_create_flat_group | ( | self, | |
| "ea_t" | image_base, | ||
| "int" | bitness, | ||
| "sel_t" | dataseg_sel ) |
| image_base | (::ea_t) |
| bitness | (int) |
| dataseg_sel | (::sel_t) return value is ignored |
| "int" ev_create_func_frame | ( | self, | |
| "func_t *" | pfn ) |
| "int" ev_create_merge_handlers | ( | self, | |
| "merge_data_t *" | md ) |
| md | (merge_data_t *) This event is generated immediately after opening idbs. |
| "int" ev_create_switch_xrefs | ( | self, | |
| "ea_t" | jumpea, | ||
| "switch_info_t" | si ) |
| jumpea | (::ea_t) address of the jump insn |
| si | (const switch_info_t *) switch information |
Reimplemented in processor_t.
| "int" ev_creating_segm | ( | self, | |
| "segment_t *" | seg ) |
| seg | (segment_t *) |
| 1 | ok |
| <0 | segment should not be created |
Reimplemented in processor_t.
| "int" ev_cvt64_hashval | ( | self, | |
| "nodeidx_t" | node, | ||
| "uchar" | tag, | ||
| "char const *" | name, | ||
| "uchar const *" | data ) |
| node | (::nodeidx_t) |
| tag | (uchar) |
| name | (const ::char *) |
| data | (const uchar *) |
| "int" ev_cvt64_supval | ( | self, | |
| "nodeidx_t" | node, | ||
| "uchar" | tag, | ||
| "nodeidx_t" | idx, | ||
| "uchar const *" | data ) |
| node | (::nodeidx_t) |
| tag | (uchar) |
| idx | (::nodeidx_t) |
| data | (const uchar *) |
| "PyObject *" ev_decorate_name | ( | self, | |
| "char const *" | name, | ||
| "bool" | mangle, | ||
| "int" | cc, | ||
| "tinfo_t" | optional_type ) |
| name | (const char *) name of symbol |
| mangle | (bool) true-mangle, false-unmangle |
| cc | (cm_t) calling convention |
| optional_type | tinfo_t const * |
| 1 | if success |
| 0 | not implemented or failed |
| "int" ev_del_cref | ( | self, | |
| "ea_t" | _from, | ||
| "ea_t" | to, | ||
| "bool" | expand ) |
| from | (::ea_t) |
| to | (::ea_t) |
| expand | (bool) |
| <0 | cancel cref deletion |
| 0 | not implemented or continue |
| "int" ev_del_dref | ( | self, | |
| "ea_t" | _from, | ||
| "ea_t" | to ) |
| from | (::ea_t) |
| to | (::ea_t) |
| <0 | cancel dref deletion |
| 0 | not implemented or continue |
| "PyObject *" ev_delay_slot_insn | ( | self, | |
| "ea_t" | ea, | ||
| "bool" | bexec, | ||
| "bool" | fexec ) |
| ea | (::ea_t *) in: instruction address in question, out: (if the answer is positive) if the delay slot contains valid insn: the address of the delay slot insn else: BADADDR (invalid insn, e.g. a branch) |
| bexec | (bool *) execute slot if jumping, initially set to 'true' |
| fexec | (bool *) execute slot if not jumping, initally set to 'true' |
| 1 | positive answer |
| <=0 | ordinary insn |
| "PyObject *" ev_demangle_name | ( | self, | |
| "char const *" | name, | ||
| "uint32" | disable_mask, | ||
| "int" | demreq ) |
This event is called by demangle_name()
| name | (const char *) mangled name |
| disable_mask | (uint32) flags to inhibit parts of output or compiler info/other (see MNG_) |
| demreq | (demreq_type_t) operation to perform |
| 1 | if success |
| 0 | not implemented |
| "bool" ev_emu_insn | ( | self, | |
| "insn_t const *" | insn ) |
Upon entrance to this function, all information about the instruction is in 'insn' structure.
| insn | (const insn_t *) |
| 1 | ok |
| -1 | the kernel will delete the instruction |
Reimplemented in processor_t.
| "int" ev_endbinary | ( | self, | |
| "bool" | ok ) |
| ok | (bool) file loaded successfully? |
Reimplemented in processor_t.
| "int" ev_ending_undo | ( | self, | |
| "char const *" | action_name, | ||
| "bool" | is_undo ) |
| action_name | (const char *) action that we finished undoing/redoing. is not nullptr. |
| is_undo | (bool) true if performing undo, false if performing redo |
| "int" ev_equal_reglocs | ( | self, | |
| "argloc_t" | a1, | ||
| "argloc_t" | a2 ) |
We need this callback for the pc module.
| a1 | (argloc_t *) |
| a2 | (argloc_t *) |
| 1 | yes |
| -1 | no |
| 0 | not implemented |
| "int" ev_extract_address | ( | self, | |
| "ea_t *" | out_ea, | ||
| "ea_t" | screen_ea, | ||
| "char const *" | string, | ||
| "size_t" | position ) |
| out_ea | (ea_t *), out |
| screen_ea | (ea_t) |
| string | (const char *) |
| position | (size_t) |
| 1 | ok |
| 0 | kernel should use the standard algorithm |
| -1 | error |
| "PyObject *" ev_find_op_value | ( | self, | |
| "insn_t const *" | pinsn, | ||
| "int" | opn ) |
The returned value in 'out' is valid before executing the instruction.
| pinsn | (const insn_t *) instruction |
| opn | (int) operand index |
| 1 | if implemented, and value was found |
| 0 | not implemented, -1 decoding failed, or no value found |
| "PyObject *" ev_find_reg_value | ( | self, | |
| "insn_t const *" | pinsn, | ||
| "int" | reg ) |
The returned value in 'out' is valid before executing the instruction.
| pinsn | (const insn_t *) instruction |
| reg | (int) register index |
| 1 | if implemented, and value was found |
| 0 | not implemented, -1 decoding failed, or no value found |
| "int" ev_func_bounds | ( | self, | |
| "int *" | possible_return_code, | ||
| "func_t *" | pfn, | ||
| "ea_t" | max_func_end_ea ) |
The module may fine tune the function bounds
| possible_return_code | (int *), in/out |
| pfn | (func_t *) |
| max_func_end_ea | (::ea_t) (from the kernel's point of view) |
| void |
Reimplemented in processor_t.
| "int" ev_gen_asm_or_lst | ( | self, | |
| "bool" | starting, | ||
| "FILE *" | fp, | ||
| "bool" | is_asm, | ||
| "int" | flags, | ||
| "html_line_cb_t **" | outline ) |
| starting | (bool) beginning listing generation |
| fp | (FILE *) output file |
| is_asm | (bool) true:assembler, false:listing |
| flags | (int) flags passed to gen_file() |
| outline | (html_line_cb_t **) ptr to ptr to outline callback. if this callback is defined for this code, it will be used by the kernel to output the generated lines |
| void |
| "int" ev_gen_map_file | ( | self, | |
| "int *" | nlines, | ||
| "FILE *" | fp ) |
If not implemented the kernel itself will create the map file.
| nlines | (int *) number of lines in map file (-1 means write error) |
| fp | (FILE *) output file |
| 0 | not implemented |
| 1 | ok |
| -1 | write error |
Reimplemented in processor_t.
| "int" ev_gen_regvar_def | ( | self, | |
| "outctx_t *" | outctx, | ||
| "regvar_t *" | v ) |
| outctx | (outctx_t *) |
| v | (regvar_t *) |
| >0 | ok, generated the definition text |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_gen_src_file_lnnum | ( | self, | |
| "outctx_t *" | outctx, | ||
| "char const *" | file, | ||
| "size_t" | lnnum ) |
| outctx | (outctx_t *) output context |
| file | (const char *) source file (may be nullptr) |
| lnnum | (size_t) line number |
| 1 | directive has been generated |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_gen_stkvar_def | ( | self, | |
| "outctx_t *" | outctx, | ||
| "udm_t" | stkvar, | ||
| "sval_t" | v, | ||
| "tid_t" | tid ) |
| outctx | (outctx_t *) |
| stkvar | (const udm_t *) |
| v | (sval_t) |
| tid | (tid_t) stkvar TID |
| 1 | ok |
| 0 | not implemented |
| "int" ev_get_abi_info | ( | self, | |
| "comp_t" | comp ) |
| comp | (comp_t) - compiler ID |
| 0 | not implemented |
| 1 | ok |
| "PyObject *" ev_get_autocmt | ( | self, | |
| "insn_t const *" | insn ) |
| insn | (const insn_t*) the instruction |
| 1 | new comment has been generated |
| 0 | callback has not been handled. the buffer must not be changed in this case |
Reimplemented in processor_t.
| "int" ev_get_bg_color | ( | self, | |
| "bgcolor_t *" | color, | ||
| "ea_t" | ea ) |
Plugins can hook this callback to color disassembly lines dynamically
| color | (bgcolor_t *), out |
| ea | (::ea_t) |
| 0 | not implemented |
| 1 | color set |
| "int" ev_get_cc_regs | ( | self, | |
| "callregs_t" | regs, | ||
| "cm_t" | cc ) |
| regs | (callregs_t *), out |
| cc | (cm_t) |
| 1 | |
| 0 | not implemented |
| "int" ev_get_code16_mode | ( | self, | |
| "ea_t" | ea ) |
| ea | (ea_t) address to get the ISA mode |
| 1 | 16-bit mode |
| 0 | not implemented or 32-bit mode |
| "int" ev_get_dbr_opnum | ( | self, | |
| "int *" | opnum, | ||
| "insn_t const *" | insn ) |
| opnum | (int *) operand number (out, -1 means no such operand) |
| insn | (const insn_t*) the instruction |
| 0 | unimplemented |
| 1 | implemented |
| "int" ev_get_default_enum_size | ( | self | ) |
Not generated anymore. inf_get_cc_size_e() is used instead
| "int" ev_get_frame_retsize | ( | self, | |
| "int *" | frsize, | ||
| "func_t const *" | pfn ) |
| frsize | (int *) frame size (out) |
| pfn | (const func_t *), can't be nullptr |
| 1 | ok |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_get_macro_insn_head | ( | self, | |
| "ea_t *" | head, | ||
| "ea_t" | ip ) |
This notification is called if IP points to the middle of an instruction
| head | (::ea_t *), out: answer, BADADDR means normal instruction |
| ip | (::ea_t) instruction address |
| 0 | unimplemented |
| 1 | implemented |
| "PyObject *" ev_get_operand_string | ( | self, | |
| "insn_t const *" | insn, | ||
| "int" | opnum ) |
| insn | (const insn_t*) the instruction |
| opnum | (int) operand number, -1 means any string operand |
| 0 | no string (or empty string) |
| >0 | original string length without terminating zero |
Reimplemented in processor_t.
| "int" ev_get_procmod | ( | self | ) |
All processor modules must implement this. The pointer is returned as size_t.
| "int" ev_get_reg_accesses | ( | self, | |
| "reg_accesses_t" | accvec, | ||
| "insn_t const *" | insn, | ||
| "int" | flags ) |
| accvec | (reg_accesses_t*) out: info about accessed registers |
| insn | (const insn_t *) instruction in question |
| flags | (int) reserved, must be 0 |
| -1 | if accvec is nullptr |
| 1 | found the requested access (and filled accvec) |
| 0 | not implemented |
| "int" ev_get_reg_info | ( | self, | |
| "char const **" | main_regname, | ||
| "bitrange_t" | bitrange, | ||
| "char const *" | regname ) |
example: "ah" returns:
This callback may be unimplemented if the register names are all present in processor_t::reg_names and they all have the same size
| main_regname | (const char **), out |
| bitrange | (bitrange_t *), out: position and size of the value within 'main_regname' (empty bitrange == whole register) |
| regname | (const char *) |
| 1 | ok |
| -1 | failed (not found) |
| 0 | unimplemented |
| "PyObject *" ev_get_reg_name | ( | self, | |
| "int" | reg, | ||
| "size_t" | width, | ||
| "int" | reghi ) |
Most processor modules do not need to implement this callback. It is useful only if processor_t::reg_names[reg] does not provide the correct register name.
| reg | (int) internal register number as defined in the processor module |
| width | (size_t) register width in bytes |
| reghi | (int) if not -1 then this function will return the register pair |
| -1 | if error |
| strlen(buf) | if success |
| "int" ev_get_simd_types | ( | self, | |
| "simd_info_vec_t *" | out, | ||
| "simd_info_t" | simd_attrs, | ||
| "argloc_t" | argloc, | ||
| "bool" | create_tifs ) |
| out | (::simd_info_vec_t *) |
| simd_attrs | (const simd_info_t *), may be nullptr |
| argloc | (const argloc_t *), may be nullptr |
| create_tifs | (bool) return valid tinfo_t objects, create if neccessary |
| number | of found types |
| -1 | error If name==nullptr, initialize all SIMD types |
| "int" ev_get_stkarg_area_info | ( | self, | |
| "stkarg_area_info_t" | out, | ||
| "cm_t" | cc ) |
| out | (stkarg_area_info_t *) ptr to stkarg_area_info_t |
| cc | (cm_t) calling convention |
| 1 | if success |
| 0 | not implemented |
| "int" ev_get_stkvar_scale_factor | ( | self | ) |
Currently used by TMS320C55 because the references into the stack should be multiplied by 2
| 0 | not implemented |
| "int" ev_getreg | ( | self, | |
| "uval_t *" | regval, | ||
| "int" | regnum ) |
| regval | (uval_t *), out |
| regnum | (int) |
| 1 | ok |
| 0 | not implemented |
| -1 | failed (undefined value or bad regnum) |
| "int" ev_init | ( | self, | |
| "char const *" | idp_modname ) |
| idp_modname | (const char *) processor module name |
| <0 | on failure |
| "int" ev_insn_reads_tbit | ( | self, | |
| "insn_t const *" | insn, | ||
| "processor_t.regval_getter_t *" | getreg, | ||
| "regval_t" | regvalues ) |
| insn | (const insn_t*) the instruction |
| getreg | (::processor_t::regval_getter_t *) function to get register values |
| regvalues | (const regval_t *) register values array |
| 2 | yes, will generate 'step' exception |
| 1 | yes, will store the TF bit in memory |
| 0 | no |
| "int" ev_is_align_insn | ( | self, | |
| "ea_t" | ea ) |
Do not directly call this function, use is_align_insn()
| ea | (ea_t) - instruction address |
| number | of bytes in the instruction |
Reimplemented in processor_t.
| "int" ev_is_alloca_probe | ( | self, | |
| "ea_t" | ea ) |
| "int" ev_is_basic_block_end | ( | self, | |
| "insn_t const *" | insn, | ||
| "bool" | call_insn_stops_block ) |
This function should be defined for processors with delayed jump slots.
| insn | (const insn_t*) the instruction |
| call_insn_stops_block | (bool) |
| 0 | unknown |
| <0 | no |
| 1 | yes |
Reimplemented in processor_t.
| "int" ev_is_call_insn | ( | self, | |
| "insn_t const *" | insn ) |
| insn | (const insn_t *) instruction |
| 0 | unknown |
| <0 | no |
| 1 | yes |
Reimplemented in processor_t.
| "int" ev_is_cond_insn | ( | self, | |
| "insn_t const *" | insn ) |
| insn | (const insn_t *) instruction address |
| 1 | yes |
| -1 | no |
| 0 | not implemented or not instruction |
| "int" ev_is_control_flow_guard | ( | self, | |
| "int *" | p_reg, | ||
| "insn_t const *" | insn ) |
| p_reg | (int *) indirect register number, may be -1 |
| insn | (const insn_t *) call/jump instruction |
| -1 | no thunk detected |
| 1 | indirect call |
| 2 | security check routine call (NOP) |
| 3 | return thunk |
| 0 | not implemented |
| "int" ev_is_far_jump | ( | self, | |
| "int" | icode ) |
| "int" ev_is_indirect_jump | ( | self, | |
| "insn_t const *" | insn ) |
If CF_JUMP bit cannot describe all jump types jumps, please define this callback.
| insn | (const insn_t*) the instruction |
| 0 | use CF_JUMP |
| 1 | no |
| 2 | yes |
Reimplemented in processor_t.
| "int" ev_is_insn_table_jump | ( | self | ) |
Reimplemented in processor_t.
| "int" ev_is_jump_func | ( | self, | |
| "func_t *" | pfn, | ||
| "ea_t *" | jump_target, | ||
| "ea_t *" | func_pointer ) |
| pfn | (func_t *) |
| jump_target | (::ea_t *) |
| func_pointer | (::ea_t *) |
| <0 | no |
| 0 | don't know |
| 1 | yes, see 'jump_target' and 'func_pointer' |
| "int" ev_is_ret_insn | ( | self, | |
| "insn_t const *" | insn, | ||
| "uchar" | flags ) |
| insn | (const insn_t *) instruction |
| flags | (uchar), combination of IRI_... flags (see above) |
| 0 | unknown |
| <0 | no |
| 1 | yes |
Reimplemented in processor_t.
| "int" ev_is_sane_insn | ( | self, | |
| "insn_t const *" | insn, | ||
| "int" | no_crefs ) |
| insn | (const insn_t*) the instruction |
| no_crefs | (int) 1: the instruction has no code refs to it. ida just tries to convert unexplored bytes to an instruction (but there is no other reason to convert them into an instruction) 0: the instruction is created because of some coderef, user request or another weighty reason. |
| >=0 | ok |
| <0 | no, the instruction isn't likely to appear in the program |
Reimplemented in processor_t.
| "int" ev_is_sp_based | ( | self, | |
| "int *" | mode, | ||
| "insn_t const *" | insn, | ||
| "op_t const *" | op ) |
Implement this event only if some stack references use frame pointer instead of stack pointer.
| mode | (int *) out, combination of SP/FP operand flags |
| insn | (const insn_t *) |
| op | (const op_t *) |
| 0 | not implemented |
| 1 | ok |
Reimplemented in processor_t.
| "int" ev_is_switch | ( | self, | |
| "switch_info_t" | si, | ||
| "insn_t const *" | insn ) |
It will be called for instructions marked with CF_JUMP.
| si | (switch_info_t *), out |
| insn | (const insn_t *) instruction possibly belonging to a switch |
| 1 | switch is found, 'si' is filled. IDA will create the switch using the filled 'si' |
| -1 | no switch found. This value forbids switch creation by the processor module |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_last_cb_before_loader | ( | self | ) |
| "int" ev_loader | ( | self | ) |
The arguments and the return values are defined by the loaders
| "int" ev_lower_func_type | ( | self, | |
| "intvec_t *" | argnums, | ||
| "func_type_data_t" | fti ) |
The processor module can also modify 'fti' in order to make non-standard conversion of some arguments.
| argnums | (intvec_t *), out - numbers of arguments to be converted to pointers in acsending order |
| fti | (func_type_data_t *), inout func type details |
| 0 | not implemented |
| 1 | argnums was filled |
| 2 | argnums was filled and made substantial changes to fti argnums[0] can contain a special negative value indicating that the return value should be passed as a hidden 'retstr' argument: -1 this argument is passed as the first one and the function returns a pointer to the argument, -2 this argument is passed as the last one and the function returns a pointer to the argument, -3 this argument is passed as the first one and the function returns 'void'. |
| "int" ev_max_ptr_size | ( | self | ) |
| "int" ev_may_be_func | ( | self, | |
| "insn_t const *" | insn, | ||
| "int" | state ) |
| insn | (const insn_t*) the instruction |
| state | (int) autoanalysis phase 0: creating functions 1: creating chunks |
Reimplemented in processor_t.
| "int" ev_may_show_sreg | ( | self, | |
| "ea_t" | current_ea ) |
| current_ea | (::ea_t) |
| <0 | if the kernel should not show the segment registers. (assuming that the module has done it) |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_moving_segm | ( | self, | |
| "segment_t *" | seg, | ||
| "ea_t" | to, | ||
| "int" | flags ) |
| seg | (segment_t *) segment to move |
| to | (::ea_t) new segment start address |
| flags | (int) combination of Move segment flags |
| 0 | yes |
| <0 | the kernel should stop |
Reimplemented in processor_t.
| "int" ev_newasm | ( | self, | |
| "int" | asmnum ) |
| asmnum | (int) See also ev_asm_installed |
| "int" ev_newbinary | ( | self, | |
| "char *" | filename, | ||
| "qoff64_t" | fileoff, | ||
| "ea_t" | basepara, | ||
| "ea_t" | binoff, | ||
| "uint64" | nbytes ) |
| filename | (char *) binary file name |
| fileoff | (qoff64_t) offset in the file |
| basepara | (::ea_t) base loading paragraph |
| binoff | (::ea_t) loader offset |
| nbytes | (::uint64) number of bytes to load |
Reimplemented in processor_t.
| "int" ev_newfile | ( | self, | |
| "char *" | fname ) |
| fname | (char *) input file name |
Reimplemented in _notify_when_dispatcher_t._IDP_Hooks, and processor_t.
| "int" ev_newprc | ( | self, | |
| "int" | pnum, | ||
| "bool" | keep_cfg ) |
| pnum | (int) processor number in the array of processor names |
| keep_cfg | (bool) true: do not modify kernel configuration |
| 1 | ok |
| <0 | prohibit |
Reimplemented in processor_t.
| "int" ev_next_exec_insn | ( | self, | |
| "ea_t *" | target, | ||
| "ea_t" | ea, | ||
| "int" | tid, | ||
| "processor_t.regval_getter_t *" | getreg, | ||
| "regval_t" | regvalues ) |
If the instruction following the current one is executed, then it must return BADADDR Usually the instructions to consider are: jumps, branches, calls, returns. This function is essential if the 'single step' is not supported in hardware.
| target | (::ea_t *), out: pointer to the answer |
| ea | (::ea_t) instruction address |
| tid | (int) current therad id |
| getreg | (::processor_t::regval_getter_t *) function to get register values |
| regvalues | (const regval_t *) register values array |
| 0 | unimplemented |
| 1 | implemented |
| "int" ev_oldfile | ( | self, | |
| "char *" | fname ) |
| fname | (char *) input file name |
Reimplemented in _notify_when_dispatcher_t._IDP_Hooks, and processor_t.
| "int" ev_out_assumes | ( | self, | |
| "outctx_t *" | outctx ) |
| "int" ev_out_data | ( | self, | |
| "outctx_t *" | outctx, | ||
| "bool" | analyze_only ) |
| outctx | (outctx_t *) |
| analyze_only | (bool) |
| 1 | ok |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_out_footer | ( | self, | |
| "outctx_t *" | outctx ) |
| "int" ev_out_header | ( | self, | |
| "outctx_t *" | outctx ) |
| "bool" ev_out_insn | ( | self, | |
| "outctx_t *" | outctx ) |
This function shouldn't change the database, flags or anything else. All these actions should be performed only by emu_insn() function.
| outctx | (outctx_t *) |
| void |
Reimplemented in processor_t.
| "int" ev_out_label | ( | self, | |
| "outctx_t *" | outctx, | ||
| "char const *" | colored_name ) |
| outctx | (outctx_t *) |
| colored_name | (const char *) |
| <0 | if the kernel should not generate the label |
| 0 | not implemented or continue |
Reimplemented in processor_t.
| "int" ev_out_mnem | ( | self, | |
| "outctx_t *" | outctx ) |
This callback should append the colored mnemonics to ctx.outbuf Optional notification, if absent, out_mnem will be called.
| outctx | (outctx_t *) |
| 1 | if appended the mnemonics |
| 0 | not implemented |
Reimplemented in processor_t.
| "bool" ev_out_operand | ( | self, | |
| "outctx_t *" | outctx, | ||
| "op_t const *" | op ) |
All these actions should be performed only by emu_insn() function.
| outctx | (outctx_t *) |
| op | (const op_t *) |
| 1 | ok |
| -1 | operand is hidden |
Reimplemented in processor_t.
| "int" ev_out_segend | ( | self, | |
| "outctx_t *" | outctx, | ||
| "segment_t *" | seg ) |
| outctx | (outctx_t *) |
| seg | (segment_t *) |
| 1 | ok |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_out_segstart | ( | self, | |
| "outctx_t *" | outctx, | ||
| "segment_t *" | seg ) |
| outctx | (outctx_t *) |
| seg | (segment_t *) |
| 1 | ok |
| 0 | not implemented |
Reimplemented in processor_t.
| "int" ev_out_special_item | ( | self, | |
| "outctx_t *" | outctx, | ||
| "uchar" | segtype ) |
absolute symbols, externs, communal definitions etc
| outctx | (outctx_t *) |
| segtype | (uchar) |
| 1 | ok |
| 0 | not implemented |
| -1 | overflow |
Reimplemented in processor_t.
| "int" ev_privrange_changed | ( | self, | |
| "range_t" | old_privrange, | ||
| "adiff_t" | delta ) |
Most common actions to be done by module in this case: fix indices of netnodes used by module
| old_privrange | (const range_t *) - old privrange interval |
| delta | (::adiff_t) |
| "int" ev_realcvt | ( | self, | |
| "void *" | m, | ||
| "fpvalue_t *" | e, | ||
| "uint16" | swt ) |
| m | (void *) ptr to processor-specific floating point value |
| e | (fpvalue_t *) IDA representation of a floating point value |
| swt | (uint16) operation (see realcvt() in ieee.h) |
| 0 | not implemented |
| unknown |
| "int" ev_rename | ( | self, | |
| "ea_t" | ea, | ||
| "char const *" | new_name ) |
| ea | (::ea_t) |
| new_name | (const char *) |
| <0 | if the kernel should not rename it. |
| 2 | to inhibit the notification. I.e., the kernel should not rename, but 'set_name()' should return 'true'. also see renamed the return value is ignored when kernel is going to delete name |
Reimplemented in processor_t.
| "int" ev_replaying_undo | ( | self, | |
| "char const *" | action_name, | ||
| "undo_records_t const *" | vec, | ||
| "bool" | is_undo ) |
| action_name | (const char *) action that we perform undo/redo for. may be nullptr for intermediary buffers. |
| vec | (const undo_records_t *) |
| is_undo | (bool) true if performing undo, false if performing redo This event may be generated multiple times per undo/redo |
| "int" ev_set_code16_mode | ( | self, | |
| "ea_t" | ea, | ||
| "bool" | code16 ) |
ARM Thumb mode, PPC VLE, MIPS16 Set ISA 16-bit mode
| ea | (ea_t) address to set new ISA mode |
| code16 | (bool) true for 16-bit mode, false for 32-bit mode |
| "int" ev_set_idp_options | ( | self, | |
| "char const *" | keyword, | ||
| "int" | value_type, | ||
| "void const *" | value, | ||
| "bool" | idb_loaded ) |
| keyword | (const char *) |
| value_type | (int) |
| value | (const void *) |
| idb_loaded | (bool) true if the ev_oldfile/ev_newfile events have been generated |
| 1 | ok |
| 0 | not implemented |
| -1 | error (and message in errbuf) |
Reimplemented in processor_t.
| "int" ev_set_proc_options | ( | self, | |
| "char const *" | options, | ||
| "int" | confidence ) |
Can be used for setting a processor subtype. Also called if option string is passed to set_processor_type() and IDC's SetProcessorType().
| options | (const char *) |
| confidence | (int) 0: loader's suggestion 1: user's decision |
| <0 | if bad option string |
Reimplemented in processor_t.
| "int" ev_setup_til | ( | self | ) |
(called after loading a new file into the database). The processor module may load tils, setup memory model and perform other actions required to set up the type system. This is an optional callback.
| void |
| "int" ev_str2reg | ( | self, | |
| "char const *" | regname ) |
The register number is the register index in the processor_t::reg_names array Most processor modules do not need to implement this callback It is useful only if processor_t::reg_names[reg] does not provide the correct register names
| regname | (const char *) |
| register | number + 1 |
| 0 | not implemented or could not be decoded |
Reimplemented in processor_t.
| "int" ev_term | ( | self | ) |
| "int" ev_treat_hindering_item | ( | self, | |
| "ea_t" | hindering_item_ea, | ||
| "flags64_t" | new_item_flags, | ||
| "ea_t" | new_item_ea, | ||
| "asize_t" | new_item_length ) |
| hindering_item_ea | (::ea_t) |
| new_item_flags | (flags64_t) (0 for code) |
| new_item_ea | (::ea_t) |
| new_item_length | (::asize_t) |
| 0 | no reaction |
| !=0 | the kernel may delete the hindering item |
Reimplemented in processor_t.
| "int" ev_undefine | ( | self, | |
| "ea_t" | ea ) |
| ea | (ea_t) |
| 1 | do not delete srranges at the item end |
| 0 | srranges can be deleted |
Reimplemented in processor_t.
| "int" ev_update_call_stack | ( | self, | |
| "call_stack_t" | stack, | ||
| "int" | tid, | ||
| "processor_t.regval_getter_t *" | getreg, | ||
| "regval_t" | regvalues ) |
This callback is invoked when the process is suspended and should fill the 'trace' object with the information about the current call stack. Note that this callback is NOT invoked if the current debugger backend implements stack tracing via debugger_t::event_t::ev_update_call_stack. The debugger-specific algorithm takes priority. Implementing this callback in the processor module is useful when multiple debugging platforms follow similar patterns, and thus the same processor-specific algorithm can be used for different platforms.
| stack | (call_stack_t *) result |
| tid | (int) thread id |
| getreg | (::processor_t::regval_getter_t *) function to get register values |
| regvalues | (const regval_t *) register values array |
| 1 | ok |
| -1 | failed |
| 0 | unimplemented |
| "int" ev_use_arg_types | ( | self, | |
| "ea_t" | ea, | ||
| "func_type_data_t" | fti, | ||
| "funcargvec_t *" | rargs ) |
| ea | (::ea_t) address of the call instruction |
| fti | (func_type_data_t *) info about function type |
| rargs | (funcargvec_t *) array of register arguments |
| 1 | (and removes handled arguments from fti and rargs) |
| 0 | not implemented |
| "PyObject *" ev_use_regarg_type | ( | self, | |
| "ea_t" | ea, | ||
| "funcargvec_t const *" | rargs ) |
| ea | (::ea_t) address of the instruction |
| rargs | (const funcargvec_t *) vector of register arguments (including regs extracted from scattered arguments) |
| 1 | |
| 0 | not implemented |
| "int" ev_use_stkarg_type | ( | self, | |
| "ea_t" | ea, | ||
| "funcarg_t" | arg ) |
| ea | (::ea_t) address of the push instruction which pushes the function argument into the stack |
| arg | (const funcarg_t *) argument info |
| 1 | ok |
| <=0 | failed, the kernel will create a comment with the argument name or type for the instruction |
| "int" ev_validate_flirt_func | ( | self, | |
| "ea_t" | start_ea, | ||
| "char const *" | funcname ) |
This callback can be used by a plugin or proc module to intercept it and validate such a function.
| start_ea | (::ea_t) |
| funcname | (const char *) |
| -1 | do not create a function, |
| 0 | function is validated |
Reimplemented in processor_t.
| "int" ev_verify_noreturn | ( | self, | |
| "func_t *" | pfn ) |
| pfn | (func_t *) |
| 0 | ok. any other value: do not set 'noreturn' flag |
Reimplemented in processor_t.
| "int" ev_verify_sp | ( | self, | |
| "func_t *" | pfn ) |
Now the processor module can analyze the stack pointer for the whole function
| pfn | (func_t *) |
| 0 | ok |
| <0 | bad stack pointer |
Reimplemented in processor_t.
| "bool" hook | ( | self | ) |
| "bool" unhook | ( | self | ) |
|
static |
1.12.0