Module ida_auto

The autoanalyzer works when IDA is not busy processing the user keystrokes. It has several queues, each queue having its own priority. The analyzer stops when all queues are empty.

A queue contains addresses or address ranges. The addresses are kept sorted by their values. The analyzer will process all addresses from the first queue, then switch to the second queue and so on. There are no limitations on the size of the queues.

This file also contains functions that deal with the IDA status indicator and the autoanalysis indicator. You may use these functions to change the indicator value.

Global Variables

AU_CHLB

AU_CHLB = 90

AU_CODE

AU_CODE = 20

AU_FCHUNK

AU_FCHUNK = 38

AU_FINAL

AU_FINAL = 200

AU_LBF2

AU_LBF2 = 70

AU_LBF3

AU_LBF3 = 80

AU_LIBF

AU_LIBF = 60

AU_NONE

AU_NONE = 0

AU_PROC

AU_PROC = 30

AU_TAIL

AU_TAIL = 35

AU_TYPE

AU_TYPE = 50

AU_UNK

AU_UNK = 10

AU_USD2

AU_USD2 = 45

AU_USED

AU_USED = 40

AU_WEAK

AU_WEAK = 25

st_Ready

st_Ready = 0

st_Think

st_Think = 1

st_Waiting

st_Waiting = 2

st_Work

st_Work = 3

Functions

auto_apply_tail(tail_ea: ea_t, parent_ea: ea_t) ‑> void

auto_apply_tail(tail_ea, parent_ea) Plan to apply the tail_ea chunk to the parent

tail_ea: (C++: ea_t) linear address of start of tail
parent_ea: (C++: ea_t) linear address within parent. If BADADDR, automatically try to
                 find parent via xrefs.

auto_apply_type(caller: ea_t, callee: ea_t) ‑> void

auto_apply_type(caller, callee) Plan to apply the callee's type to the calling point.

caller: (C++: ea_t)
callee: (C++: ea_t)

auto_cancel(ea1: ea_t, ea2: ea_t) ‑> void

auto_cancel(ea1, ea2) Remove an address range (ea1..ea2) from queues AU_CODE, AU_PROC, AU_USED. To remove an address range from other queues use auto_unmark() function. 'ea1' may be higher than 'ea2', the kernel will swap them in this case. 'ea2' doesn't belong to the range.

ea1: (C++: ea_t)
ea2: (C++: ea_t)

auto_get(type: atype_t *, lowEA: ea_t, highEA: ea_t) ‑> ea_t

auto_get(type, lowEA, highEA) -> ea_t Retrieve an address from queues regarding their priority. Returns BADADDR if no addresses not lower than 'lowEA' and less than 'highEA' are found in the queues. Otherwise *type will have queue type.

type: (C++: atype_t *)
lowEA: (C++: ea_t)
highEA: (C++: ea_t)

auto_is_ok() ‑> bool

auto_is_ok() -> bool Are all queues empty? (i.e. has autoanalysis finished?).

auto_make_code(ea: ea_t) ‑> void

auto_make_code(ea) Plan to make code.

ea: (C++: ea_t)

auto_make_proc(ea: ea_t) ‑> void

auto_make_proc(ea) Plan to make code&function.

ea: (C++: ea_t)

auto_make_step(ea1: ea_t, ea2: ea_t) ‑> bool

auto_make_step(ea1, ea2) -> bool Analyze one address in the specified range and return true.

ea1: (C++: ea_t)
ea2: (C++: ea_t)
return: if processed anything. false means that there is nothing to process in
        the specified range.

auto_mark(ea: ea_t, type: atype_t) ‑> void

auto_mark(ea, type) Put single address into a queue. Queues keep addresses sorted.

ea: (C++: ea_t)
type: (C++: atype_t)

auto_mark_range(start: ea_t, end: ea_t, type: atype_t) ‑> void

auto_mark_range(start, end, type) Put range of addresses into a queue. 'start' may be higher than 'end', the kernel will swap them in this case. 'end' doesn't belong to the range.

start: (C++: ea_t)
end: (C++: ea_t)
type: (C++: atype_t)

auto_postpone_analysis(ea: ea_t) ‑> bool

auto_postpone_analysis(ea) -> bool Plan to reanalyze on the second pass The typical usage of this function in emu.cpp is: if ( !auto_postpone_analysis(ea) ) op_offset(ea, 0, ...); (we make an offset only on the second pass)

ea: (C++: ea_t)

auto_recreate_insn(ea: ea_t) ‑> int

auto_recreate_insn(ea) -> int Try to create instruction

ea: (C++: ea_t) linear address of callee
return: the length of the instruction or 0

auto_unmark(start: ea_t, end: ea_t, type: atype_t) ‑> void

auto_unmark(start, end, type) Remove range of addresses from a queue. 'start' may be higher than 'end', the kernel will swap them in this case. 'end' doesn't belong to the range.

start: (C++: ea_t)
end: (C++: ea_t)
type: (C++: atype_t)

auto_wait() ‑> bool

auto_wait() -> bool Process everything in the queues and return true.

return: false if the user clicked cancel. (the wait box must be displayed by
        the caller if desired)

auto_wait_range(ea1: ea_t, ea2: ea_t) ‑> ssize_t

auto_wait_range(ea1, ea2) -> ssize_t Process everything in the specified range and return true.

ea1: (C++: ea_t)
ea2: (C++: ea_t)
return: number of autoanalysis steps made. -1 if the user clicked cancel. (the
        wait box must be displayed by the caller if desired)

enable_auto(enable: bool) ‑> bool

enable_auto(enable) -> bool Temporarily enable/disable autoanalyzer. Not user-facing, but rather because IDA sometimes need to turn AA on/off regardless of inf.s_genflags:INFFL_AUTO

enable: (C++: bool)
return: old state

get_auto_display(auto_display: auto_display_t) ‑> bool

get_auto_display(auto_display) -> bool Get structure which holds the autoanalysis indicator contents.

auto_display: (C++: auto_display_t *)

get_auto_state() ‑> atype_t

get_auto_state() -> atype_t Get current state of autoanalyzer. If auto_state == AU_NONE, IDA is currently not running the analysis (it could be temporarily interrupted to perform the user's requests, for example).

is_auto_enabled() ‑> bool

is_auto_enabled() -> bool Get autoanalyzer state.

may_create_stkvars() ‑> bool

may_create_stkvars() -> bool Is it allowed to create stack variables automatically?. This function should be used by IDP modules before creating stack vars.

may_trace_sp() ‑> bool

may_trace_sp() -> bool Is it allowed to trace stack pointer automatically?. This function should be used by IDP modules before tracing sp.

peek_auto_queue(low_ea: ea_t, type: atype_t) ‑> ea_t

peek_auto_queue(low_ea, type) -> ea_t Peek into a queue 'type' for an address not lower than 'low_ea'. Do not remove address from the queue.

low_ea: (C++: ea_t)
type: (C++: atype_t)
return: the address or BADADDR

plan_and_wait(ea1: ea_t, ea2: ea_t, final_pass: bool = True) ‑> int

plan_and_wait(ea1, ea2, final_pass=True) -> int Analyze the specified range. Try to create instructions where possible. Make the final pass over the specified range if specified. This function doesn't return until the range is analyzed. retval 1: ok retval 0: Ctrl-Break was pressed

ea1: (C++: ea_t)
ea2: (C++: ea_t)
final_pass: (C++: bool)

plan_ea(ea: ea_t) ‑> void

plan_ea(ea) Plan to perform reanalysis.

ea: (C++: ea_t)

plan_range(sEA: ea_t, eEA: ea_t) ‑> void

plan_range(sEA, eEA) Plan to perform reanalysis.

sEA: (C++: ea_t)
eEA: (C++: ea_t)

reanalyze_callers(ea: ea_t, noret: bool) ‑> void

reanalyze_callers(ea, noret) Plan to reanalyze callers of the specified address. This function will add to AU_USED queue all instructions that call (not jump to) the specified address.

ea: (C++: ea_t) linear address of callee
noret: (C++: bool) !=0: the callee doesn't return, mark to undefine subsequent
             instructions in the caller. 0: do nothing.

revert_ida_decisions(ea1: ea_t, ea2: ea_t) ‑> void

revert_ida_decisions(ea1, ea2) Delete all analysis info that IDA generated for for the given range.

ea1: (C++: ea_t)
ea2: (C++: ea_t)

set_auto_state(new_state: atype_t) ‑> atype_t

set_auto_state(new_state) -> atype_t Set current state of autoanalyzer.

new_state: (C++: atype_t) new state of autoanalyzer
return: previous state

set_ida_state(st: idastate_t) ‑> idastate_t

set_ida_state(st) -> idastate_t Change IDA status indicator value

st: (C++: idastate_t) - new indicator status
return: old indicator status

show_addr(ea: ea_t) ‑> void

show_addr(ea) Show an address on the autoanalysis indicator. The address is displayed in the form " @:12345678".

ea: (C++: ea_t) - linear address to display

show_auto(*args) ‑> void

show_auto(ea, type=AU_NONE) Change autoanalysis indicator value.

ea: (C++: ea_t) linear address being analyzed
type: (C++: atype_t) autoanalysis type (see Autoanalysis queues)

Classes

auto_display_t()

: Proxy of C++ auto_display_t class.

__init__(self) -> auto_display_t

Instance variables

  • ea: ea_t ea


  • state: idastate_t state


  • type: atype_t type


Last updated