Module ida_idp
The interface consists of two structures:
definition of target assembler: ::ash
definition of current processor: ::ph
These structures contain information about target processor and assembler features.
It also defines two groups of kernel events:
processor_t::event_t processor related events
idb_event:event_code_t database related events
The processor related events are used to communicate with the processor module. The database related events are used to inform any interested parties, like plugins or processor modules, about the changes in the database.
Global Variables
AS2_BRACE
AS2_BYTE1CHAR
AS2_COLONSUF
AS2_IDEALDSCR
AS2_STRINV
AS2_TERSESTR
AS2_YWORD
AS2_ZWORD
ASB_BINF0
ASB_BINF1
ASB_BINF2
ASB_BINF3
ASB_BINF4
ASB_BINF5
ASD_DECF0
ASD_DECF1
ASD_DECF2
ASD_DECF3
ASH_HEXF0
ASH_HEXF1
ASH_HEXF2
ASH_HEXF3
ASH_HEXF4
ASH_HEXF5
ASO_OCTF0
ASO_OCTF1
ASO_OCTF2
ASO_OCTF3
ASO_OCTF4
ASO_OCTF5
ASO_OCTF6
ASO_OCTF7
AS_1TEXT
AS_2CHRE
AS_ALIGN2
AS_ASCIIC
AS_ASCIIZ
AS_BINFM
AS_COLON
AS_DECFM
AS_HEXFM
AS_LALIGN
AS_N2CHR
AS_NCHRE
AS_NCMAS
AS_NHIAS
AS_NOCODECLN
AS_NOSPACE
AS_NOXRF
AS_OCTFM
AS_OFFST
AS_ONEDUP
AS_RELSUP
AS_UDATA
AS_UNEQU
AS_XTRNTYPE
CF_CALL
CF_CHG1
CF_CHG2
CF_CHG3
CF_CHG4
CF_CHG5
CF_CHG6
CF_CHG7
CF_CHG8
CF_HLL
CF_JUMP
CF_SHFT
CF_STOP
CF_USE1
CF_USE2
CF_USE3
CF_USE4
CF_USE5
CF_USE6
CF_USE7
CF_USE8
CUSTOM_INSN_ITYPE
HKCB_GLOBAL
IDPOPT_BADKEY
IDPOPT_BADTYPE
IDPOPT_BADVALUE
IDPOPT_BIT
IDPOPT_BIT_BOOL
IDPOPT_BIT_UCHAR
IDPOPT_BIT_UINT
IDPOPT_BIT_USHORT
IDPOPT_CST
IDPOPT_CST_PARAMS
IDPOPT_FLT
IDPOPT_I64
IDPOPT_I64_RANGE
IDPOPT_I64_UNS
IDPOPT_JVL
IDPOPT_MBROFF
IDPOPT_NUM
IDPOPT_NUM_CHAR
IDPOPT_NUM_INT
IDPOPT_NUM_RANGE
IDPOPT_NUM_SHORT
IDPOPT_NUM_UNS
IDPOPT_OK
IDPOPT_PRI_DEFAULT
IDPOPT_PRI_HIGH
IDPOPT_STR
IDPOPT_STR_LONG
IDPOPT_STR_QSTRING
IDP_INTERFACE_VERSION
LTC_ADDED
LTC_ALIASED
LTC_COMPILER
LTC_DELETED
LTC_EDITED
LTC_NONE
LTC_TIL_COMPACTED
LTC_TIL_LOADED
LTC_TIL_UNLOADED
NO_ACCESS
OP_FP_BASED
OP_SP_ADD
OP_SP_BASED
OP_SP_SUB
PLFM_386
PLFM_6502
PLFM_65C816
PLFM_6800
PLFM_68K
PLFM_80196
PLFM_8051
PLFM_AD2106X
PLFM_AD218X
PLFM_ALPHA
PLFM_ARC
PLFM_ARM
PLFM_AVR
PLFM_C166
PLFM_C39
PLFM_CR16
PLFM_DALVIK
PLFM_DSP56K
PLFM_DSP96K
PLFM_EBC
PLFM_F2MC
PLFM_FR
PLFM_H8
PLFM_H8500
PLFM_HPPA
PLFM_I860
PLFM_I960
PLFM_IA64
PLFM_JAVA
PLFM_KR1878
PLFM_M16C
PLFM_M32R
PLFM_M740
PLFM_M7700
PLFM_M7900
PLFM_MC6812
PLFM_MC6816
PLFM_MIPS
PLFM_MN102L00
PLFM_MSP430
PLFM_NEC_78K0
PLFM_NEC_78K0S
PLFM_NEC_V850X
PLFM_NET
PLFM_OAKDSP
PLFM_PDP
PLFM_PIC
PLFM_PIC16
PLFM_PPC
PLFM_RISCV
PLFM_RL78
PLFM_RX
PLFM_S390
PLFM_SCR_ADPT
PLFM_SH
PLFM_SPARC
PLFM_SPC700
PLFM_SPU
PLFM_ST20
PLFM_ST7
PLFM_ST9
PLFM_TLCS900
PLFM_TMS
PLFM_TMS320C1X
PLFM_TMS320C28
PLFM_TMS320C3
PLFM_TMS320C54
PLFM_TMS320C55
PLFM_TMSC6
PLFM_TRICORE
PLFM_TRIMEDIA
PLFM_UNSP
PLFM_WASM
PLFM_XTENSA
PLFM_Z8
PLFM_Z80
PR2_CODE16_BIT
PR2_FORCE_16BIT
PR2_IDP_OPTS
PR2_MACRO
PR2_MAPPINGS
PR2_REL_BITS
PR2_USE_CALCREL
PRN_BIN
PRN_DEC
PRN_HEX
PRN_OCT
PR_ADJSEGS
PR_ALIGN
PR_ALIGN_INSN
PR_ASSEMBLE
PR_BINMEM
PR_CHK_XREF
PR_CNDINSNS
PR_DEFNUM
PR_DEFSEG32
PR_DEFSEG64
PR_DELAYED
PR_NOCHANGE
PR_NO_SEGMOVE
PR_OUTER
PR_PURGING
PR_RNAMESOK
PR_SCALE_STKVARS
PR_SEGS
PR_SEGTRANS
PR_SGROTHER
PR_STACK_UP
PR_TYPEINFO
PR_USE32
PR_USE64
PR_USE_ARG_TYPES
PR_USE_TBYTE
PR_WORD_INS
READ_ACCESS
REAL_ERROR_BADDATA
REAL_ERROR_FORMAT
REAL_ERROR_RANGE
REG_SPOIL
RW_ACCESS
SETPROC_IDB
SETPROC_LOADER
SETPROC_LOADER_NON_FATAL
SETPROC_USER
WRITE_ACCESS
adding_segm
allsegs_moved
auto_empty
auto_empty_finally
bookmark_changed
byte_patched
callee_addr_changed
changing_cmt
changing_op_ti
changing_op_type
changing_range_cmt
changing_segm_class
changing_segm_end
changing_segm_name
changing_segm_start
changing_ti
cik_filename
cik_path
cik_string
closebase
cmt_changed
compiler_changed
deleting_func
deleting_func_tail
deleting_segm
deleting_tryblks
destroyed_items
determined_main
dirtree_link
dirtree_mkdir
dirtree_move
dirtree_rank
dirtree_rmdir
dirtree_rminode
dirtree_segm_moved
extlang_changed
extra_cmt_changed
flow_chart_created
frame_created
frame_deleted
frame_expanded
frame_udm_changed
frame_udm_created
frame_udm_deleted
frame_udm_renamed
func_added
func_deleted
func_noret_changed
func_tail_appended
func_tail_deleted
func_updated
idasgn_loaded
item_color_changed
kernel_config_loaded
loader_finished
local_types_changed
lt_udm_changed
lt_udm_created
lt_udm_deleted
lt_udm_renamed
lt_udt_expanded
make_code
make_data
op_ti_changed
op_type_changed
range_cmt_changed
renamed
savebase
segm_added
segm_attrs_updated
segm_class_changed
segm_deleted
segm_end_changed
segm_moved
segm_name_changed
segm_start_changed
set_func_end
set_func_start
sgr_changed
sgr_deleted
stkpnts_changed
tail_owner_changed
thunk_func_created
ti_changed
tryblks_updated
updating_tryblks
upgraded
Functions
AssembleLine(ea: ea_t, cs: ea_t, ip: ea_t, use32: bool, nonnul_line: char const *) ‑> PyObject *
AssembleLine(ea, cs, ip, use32, nonnul_line) -> bytes Assemble an instruction to a string (display a warning if an error is found)
assemble(ea: ea_t, cs: ea_t, ip: ea_t, use32: bool, line: char const *) ‑> bool
assemble(ea, cs, ip, use32, line) -> bool Assemble an instruction into the database (display a warning if an error is found)
cfg_get_cc_header_path(compid: comp_t) ‑> char const *
cfg_get_cc_header_path(compid) -> char const *
cfg_get_cc_parm(compid: comp_t, name: char const *) ‑> char const *
cfg_get_cc_parm(compid, name) -> char const *
cfg_get_cc_predefined_macros(compid: comp_t) ‑> char const *
cfg_get_cc_predefined_macros(compid) -> char const *
delay_slot_insn(ea: ea_t *, bexec: bool *, fexec: bool *) ‑> bool
delay_slot_insn(ea, bexec, fexec) -> bool
gen_idb_event(*args) ‑> void
gen_idb_event(code) the kernel will use this function to generate idb_events
get_ash() ‑> asm_t *
get_ash() -> asm_t
get_config_value(key: char const *) ‑> jvalue_t *
get_config_value(key) -> bool
get_idb_notifier_addr(arg1: PyObject *) ‑> PyObject *
get_idb_notifier_addr(arg1) -> PyObject *
get_idb_notifier_ud_addr(hooks: IDB_Hooks) ‑> PyObject *
get_idb_notifier_ud_addr(hooks) -> PyObject *
get_idp_name() ‑> size_t
get_idp_name() -> str Get name of the current processor module. The name is derived from the file name. For example, for IBM PC the module is named "pc.w32" (windows version), then the module name is "PC" (uppercase). If no processor module is loaded, this function will return nullptr
get_idp_notifier_addr(arg1: PyObject *) ‑> PyObject *
get_idp_notifier_addr(arg1) -> PyObject *
get_idp_notifier_ud_addr(hooks: IDP_Hooks) ‑> PyObject *
get_idp_notifier_ud_addr(hooks) -> PyObject *
get_ph() ‑> processor_t *
get_ph() -> _processor_t
get_reg_info(regname: char const *, bitrange: bitrange_t) ‑> char const *
get_reg_info(regname, bitrange) -> char const *
get_reg_name(reg: int, width: size_t, reghi: int = -1) ‑> qstring *
get_reg_name(reg, width, reghi=-1) -> ssize_t Get text representation of a register. For most processors this function will just return processor_t::reg_names[reg]. If the processor module has implemented processor_t::get_reg_name, it will be used instead
has_cf_chg(feature: uint32, opnum: uint) ‑> bool
has_cf_chg(feature, opnum) -> bool Does an instruction with the specified feature modify the i-th operand?
has_cf_use(feature: uint32, opnum: uint) ‑> bool
has_cf_use(feature, opnum) -> bool Does an instruction with the specified feature use a value of the i-th operand?
has_insn_feature(icode: uint16, bit: uint32) ‑> bool
has_insn_feature(icode, bit) -> bool Does the specified instruction have the specified feature?
is_align_insn(ea: ea_t) ‑> int
is_align_insn(ea) -> int If the instruction at 'ea' looks like an alignment instruction, return its length in bytes. Otherwise return 0.
is_basic_block_end(insn: insn_t const &, call_insn_stops_block: bool) ‑> bool
is_basic_block_end(insn, call_insn_stops_block) -> bool Is the instruction the end of a basic block?
is_call_insn(insn: insn_t const &) ‑> bool
is_call_insn(insn) -> bool Is the instruction a "call"?
is_indirect_jump_insn(insn: insn_t const &) ‑> bool
is_indirect_jump_insn(insn) -> bool Is the instruction an indirect jump?
is_ret_insn(insn: insn_t const &, strict: bool = True) ‑> bool
is_ret_insn(insn, strict=True) -> bool Is the instruction a "return"?
parse_reg_name(ri: reg_info_t, regname: char const *) ‑> bool
parse_reg_name(ri, regname) -> bool Get register info by name.
ph_calcrel(ea: ea_t) ‑> bytevec_t *, size_t *
ph_calcrel(ea)
ph_find_op_value(insn: insn_t const &, op: int) ‑> uint64 *
ph_find_op_value(insn, op) -> ssize_t
ph_find_reg_value(insn: insn_t const &, reg: int) ‑> uint64 *
ph_find_reg_value(insn, reg) -> ssize_t
ph_get_cnbits() ‑> size_t
ph_get_cnbits() -> size_t Returns the 'ph.cnbits'
ph_get_dnbits() ‑> size_t
ph_get_dnbits() -> size_t Returns the 'ph.dnbits'
ph_get_flag() ‑> size_t
ph_get_flag() -> size_t Returns the 'ph.flag'
ph_get_icode_return() ‑> size_t
ph_get_icode_return() -> size_t Returns the 'ph.icode_return'
ph_get_id() ‑> size_t
ph_get_id() -> size_t Returns the 'ph.id' field
ph_get_instruc() ‑> PyObject *
ph_get_instruc() -> [(str, int), ...] Returns a list of tuples (instruction_name, instruction_feature) containing the instructions list as defined in he processor module
ph_get_instruc_end() ‑> size_t
ph_get_instruc_end() -> size_t Returns the 'ph.instruc_end'
ph_get_instruc_start() ‑> size_t
ph_get_instruc_start() -> size_t Returns the 'ph.instruc_start'
ph_get_operand_info(ea: ea_t, n: int) ‑> PyObject *
ph_get_operand_info(ea, n) -> (int, int, int, int, int) or None Returns the operand information given an ea and operand number.
ph_get_reg_accesses(accvec: reg_accesses_t, insn: insn_t const &, flags: int) ‑> ssize_t
ph_get_reg_accesses(accvec, insn, flags) -> ssize_t
ph_get_reg_code_sreg() ‑> size_t
ph_get_reg_code_sreg() -> size_t Returns the 'ph.reg_code_sreg'
ph_get_reg_data_sreg() ‑> size_t
ph_get_reg_data_sreg() -> size_t Returns the 'ph.reg_data_sreg'
ph_get_reg_first_sreg() ‑> size_t
ph_get_reg_first_sreg() -> size_t Returns the 'ph.reg_first_sreg'
ph_get_reg_last_sreg() ‑> size_t
ph_get_reg_last_sreg() -> size_t Returns the 'ph.reg_last_sreg'
ph_get_regnames() ‑> PyObject *
ph_get_regnames() -> [str, ...] Returns the list of register names as defined in the processor module
ph_get_segreg_size() ‑> size_t
ph_get_segreg_size() -> size_t Returns the 'ph.segreg_size'
ph_get_tbyte_size() ‑> size_t
ph_get_tbyte_size() -> size_t Returns the 'ph.tbyte_size' field as defined in he processor module
ph_get_version() ‑> size_t
ph_get_version() -> size_t Returns the 'ph.version'
process_config_directive(directive: char const *, priority: int = 2) ‑> void
process_config_directive(directive, priority=2)
register_cfgopts(opts: cfgopt_t const [], nopts: size_t, cb: config_changed_cb_t * = None, obj: void * = None) ‑> bool
register_cfgopts(opts, nopts, cb=None, obj=None) -> bool
set_processor_type(procname: char const *, level: setproc_level_t) ‑> bool
set_processor_type(procname, level) -> bool Set target processor type. Once a processor module is loaded, it cannot be replaced until we close the idb.
set_target_assembler(asmnum: int) ‑> bool
set_target_assembler(asmnum) -> bool Set target assembler.
sizeof_ldbl() ‑> size_t
sizeof_ldbl() -> size_t
str2reg(p: char const *) ‑> int
str2reg(p) -> int Get any reg number (-1 on error)
Classes
IDB_Hooks()
: Proxy of C++ IDB_Hooks class.
Descendants
Methods
adding_segm(self, s: segment_t *) ‑> void adding_segm(self, s) A segment is being created.
s: (segment_t *)
allsegs_moved(self, info: segm_move_infos_t *) ‑> void allsegs_moved(self, info) Program rebasing is complete. This event is generated after series of segm_moved events
info: (segm_move_infos_t *)
auto_empty(self) ‑> void auto_empty(self)
auto_empty_finally(self) ‑> void auto_empty_finally(self)
bookmark_changed(self, index: uint32, pos: lochist_entry_t const *, desc: char const *, operation: int) ‑> void bookmark_changed(self, index, pos, desc, operation) Boomarked position changed.
index: (uint32) pos: (::const lochist_entry_t *) desc: (::const char *) operation: (int) 0-added, 1-updated, 2-deleted if desc==nullptr, then the bookmark was deleted.
byte_patched(self, ea: ea_t, old_value: uint32) ‑> void byte_patched(self, ea, old_value) A byte has been patched.
ea: (::ea_t) old_value: (uint32)
callee_addr_changed(self, ea: ea_t, callee: ea_t) ‑> void callee_addr_changed(self, ea, callee) Callee address has been updated by the user.
ea: (::ea_t) callee: (::ea_t)
changing_cmt(self, ea: ea_t, repeatable_cmt: bool, newcmt: char const *) ‑> void changing_cmt(self, ea, repeatable_cmt, newcmt) An item comment is to be changed.
ea: (::ea_t) repeatable_cmt: (bool) newcmt: (const char *)
changing_op_ti(self, ea: ea_t, n: int, new_type: type_t const *, new_fnames: p_list const *) ‑> void changing_op_ti(self, ea, n, new_type, new_fnames) An operand typestring (c/c++ prototype) is to be changed.
ea: (::ea_t) n: (int) new_type: (const type_t *) new_fnames: (const p_list *)
changing_op_type(self, ea: ea_t, n: int, opinfo: opinfo_t) ‑> void changing_op_type(self, ea, n, opinfo) An operand type (offset, hex, etc...) is to be changed.
ea: (::ea_t) n: (int) eventually or'ed with OPND_OUTER or OPND_ALL opinfo: (const opinfo_t *) additional operand info
changing_range_cmt(self, kind: range_kind_t, a: range_t, cmt: char const *, repeatable: bool) ‑> void changing_range_cmt(self, kind, a, cmt, repeatable) Range comment is to be changed.
kind: (range_kind_t) a: (const range_t *) cmt: (const char *) repeatable: (bool)
changing_segm_class(self, s: segment_t *) ‑> void changing_segm_class(self, s) Segment class is being changed.
s: (segment_t *)
changing_segm_end(self, s: segment_t *, new_end: ea_t, segmod_flags: int) ‑> void changing_segm_end(self, s, new_end, segmod_flags) Segment end address is to be changed.
s: (segment_t *) new_end: (::ea_t) segmod_flags: (int)
changing_segm_name(self, s: segment_t *, oldname: char const *) ‑> void changing_segm_name(self, s, oldname) Segment name is being changed.
s: (segment_t *) oldname: (const char *)
changing_segm_start(self, s: segment_t *, new_start: ea_t, segmod_flags: int) ‑> void changing_segm_start(self, s, new_start, segmod_flags) Segment start address is to be changed.
s: (segment_t *) new_start: (::ea_t) segmod_flags: (int)
changing_ti(self, ea: ea_t, new_type: type_t const *, new_fnames: p_list const *) ‑> void changing_ti(self, ea, new_type, new_fnames) An item typestring (c/c++ prototype) is to be changed.
ea: (::ea_t) new_type: (const type_t *) new_fnames: (const p_list *)
closebase(self) ‑> void closebase(self) The database will be closed now.
cmt_changed(self, ea: ea_t, repeatable_cmt: bool) ‑> void cmt_changed(self, ea, repeatable_cmt) An item comment has been changed.
ea: (::ea_t) repeatable_cmt: (bool)
compiler_changed(self, adjust_inf_fields: bool) ‑> void compiler_changed(self, adjust_inf_fields) The kernel has changed the compiler information. ( idainfo::cc structure; get_abi_name)
adjust_inf_fields: (::bool) may change inf fields?
deleting_func(self, pfn: func_t *) ‑> void deleting_func(self, pfn) The kernel is about to delete a function.
pfn: (func_t *)
deleting_func_tail(self, pfn: func_t *, tail: range_t) ‑> void deleting_func_tail(self, pfn, tail) A function tail chunk is to be removed.
pfn: (func_t *) tail: (const range_t *)
deleting_segm(self, start_ea: ea_t) ‑> void deleting_segm(self, start_ea) A segment is to be deleted.
start_ea: (::ea_t)
deleting_tryblks(self, range: range_t) ‑> void deleting_tryblks(self, range) About to delete tryblk information in given range
range: (const range_t *)
destroyed_items(self, ea1: ea_t, ea2: ea_t, will_disable_range: bool) ‑> void destroyed_items(self, ea1, ea2, will_disable_range) Instructions/data have been destroyed in [ea1,ea2).
ea1: (::ea_t) ea2: (::ea_t) will_disable_range: (bool)
determined_main(self, main: ea_t) ‑> void determined_main(self, main) The main() function has been determined.
main: (::ea_t) address of the main() function
dirtree_link(self, dt: dirtree_t *, path: char const *, link: bool) ‑> void dirtree_link(self, dt, path, link)
dt: (dirtree_t *) path: (::const char *) link: (::bool)
dirtree_mkdir(self, dt: dirtree_t *, path: char const *) ‑> void dirtree_mkdir(self, dt, path)
dt: (dirtree_t *) path: (::const char *)
dirtree_move(self, dt: dirtree_t *, _from: char const *, to: char const *) ‑> void dirtree_move(self, dt, _from, to)
dt: (dirtree_t *) from: (::const char *) to: (::const char *)
dirtree_rank(self, dt: dirtree_t *, path: char const *, rank: size_t) ‑> void dirtree_rank(self, dt, path, rank)
dt: (dirtree_t *) path: (::const char *) rank: (::size_t)
dirtree_rmdir(self, dt: dirtree_t *, path: char const *) ‑> void dirtree_rmdir(self, dt, path)
dt: (dirtree_t *) path: (::const char *)
dirtree_rminode(self, dt: dirtree_t *, inode: inode_t) ‑> void dirtree_rminode(self, dt, inode)
dt: (dirtree_t *) inode: (inode_t)
dirtree_segm_moved(self, dt: dirtree_t *) ‑> void dirtree_segm_moved(self, dt)
dt: (dirtree_t *)
extlang_changed(self, kind: int, el: extlang_t *, idx: int) ‑> void extlang_changed(self, kind, el, idx) The list of extlangs or the default extlang was changed.
kind: (int) 0: extlang installed 1: extlang removed 2: default extlang changed el: (extlang_t *) pointer to the extlang affected idx: (int) extlang index
extra_cmt_changed(self, ea: ea_t, line_idx: int, cmt: char const *) ‑> void extra_cmt_changed(self, ea, line_idx, cmt) An extra comment has been changed.
ea: (::ea_t) line_idx: (int) cmt: (const char *)
flow_chart_created(self, fc: qflow_chart_t) ‑> void flow_chart_created(self, fc) Gui has retrieved a function flow chart. Plugins may modify the flow chart in this callback.
fc: (qflow_chart_t *)
frame_created(self, func_ea: ea_t) ‑> void frame_created(self, func_ea) A function frame has been created.
func_ea: (::ea_t) idb_event::frame_deleted
frame_deleted(self, pfn: func_t *) ‑> void frame_deleted(self, pfn) The kernel has deleted a function frame.
pfn: (func_t *) idb_event::frame_created
frame_expanded(self, func_ea: ea_t, udm_tid: tid_t, delta: adiff_t) ‑> void frame_expanded(self, func_ea, udm_tid, delta) A frame type has been expanded/shrank.
func_ea: (::ea_t) udm_tid: (tid_t) the gap was added/removed before this member delta: (::adiff_t) number of added/removed bytes
frame_udm_changed(self, func_ea: ea_t, udm_tid: tid_t, udmold: udm_t, udmnew: udm_t) ‑> void frame_udm_changed(self, func_ea, udm_tid, udmold, udmnew) Frame member has been changed.
func_ea: (::ea_t) udm_tid: (tid_t) udmold: (::const udm_t *) udmnew: (::const udm_t *)
frame_udm_created(self, func_ea: ea_t, udm: udm_t) ‑> void frame_udm_created(self, func_ea, udm) Frame member has been added.
func_ea: (::ea_t) udm: (::const udm_t *)
frame_udm_deleted(self, func_ea: ea_t, udm_tid: tid_t, udm: udm_t) ‑> void frame_udm_deleted(self, func_ea, udm_tid, udm) Frame member has been deleted.
func_ea: (::ea_t) udm_tid: (tid_t) udm: (::const udm_t *)
frame_udm_renamed(self, func_ea: ea_t, udm: udm_t, oldname: char const *) ‑> void frame_udm_renamed(self, func_ea, udm, oldname) Frame member has been renamed.
func_ea: (::ea_t) udm: (::const udm_t *) oldname: (::const char *)
func_added(self, pfn: func_t *) ‑> void func_added(self, pfn) The kernel has added a function.
pfn: (func_t *)
func_deleted(self, func_ea: ea_t) ‑> void func_deleted(self, func_ea) A function has been deleted.
func_ea: (::ea_t)
func_noret_changed(self, pfn: func_t *) ‑> void func_noret_changed(self, pfn) FUNC_NORET bit has been changed.
pfn: (func_t *)
func_tail_appended(self, pfn: func_t *, tail: func_t *) ‑> void func_tail_appended(self, pfn, tail) A function tail chunk has been appended.
pfn: (func_t *) tail: (func_t *)
func_tail_deleted(self, pfn: func_t *, tail_ea: ea_t) ‑> void func_tail_deleted(self, pfn, tail_ea) A function tail chunk has been removed.
pfn: (func_t *) tail_ea: (::ea_t)
func_updated(self, pfn: func_t *) ‑> void func_updated(self, pfn) The kernel has updated a function.
pfn: (func_t *)
hook(self) ‑> bool hook(self) -> bool
idasgn_loaded(self, short_sig_name: char const *) ‑> void idasgn_loaded(self, short_sig_name) FLIRT signature has been loaded for normal processing (not for recognition of startup sequences).
short_sig_name: (const char *)
item_color_changed(self, ea: ea_t, color: bgcolor_t) ‑> void item_color_changed(self, ea, color) An item color has been changed.
ea: (::ea_t) color: (bgcolor_t) if color==DEFCOLOR, the the color is deleted.
kernel_config_loaded(self, pass_number: int) ‑> void kernel_config_loaded(self, pass_number) This event is issued when ida.cfg is parsed.
pass_number: (int)
loader_finished(self, li: linput_t *, neflags: uint16, filetypename: char const *) ‑> void loader_finished(self, li, neflags, filetypename) External file loader finished its work. Use this event to augment the existing loader functionality.
li: (linput_t *) neflags: (uint16) Load file flags filetypename: (const char *)
local_types_changed(self, ltc: local_type_change_t, ordinal: uint32, name: char const *) ‑> void local_types_changed(self, ltc, ordinal, name) Local types have been changed
ltc: (::local_type_change_t) ordinal: (uint32) 0 means ordinal is unknown name: (const char *) nullptr means name is unknown
lt_udm_changed(self, udtname: char const *, udm_tid: tid_t, udmold: udm_t, udmnew: udm_t) ‑> void lt_udm_changed(self, udtname, udm_tid, udmold, udmnew) local type udt member has been changed
udtname: (::const char *) udm_tid: (tid_t) udmold: (::const udm_t *) udmnew: (::const udm_t *) note: udm_t::offset may not be calculated yet except of the fixed udt
lt_udm_created(self, udtname: char const *, udm: udm_t) ‑> void lt_udm_created(self, udtname, udm) local type udt member has been added
udtname: (::const char *) udm: (::const udm_t *) note: udm_t::offset may not be calculated yet except of the fixed udt
lt_udm_deleted(self, udtname: char const *, udm_tid: tid_t, udm: udm_t) ‑> void lt_udm_deleted(self, udtname, udm_tid, udm) local type udt member has been deleted
udtname: (::const char *) udm_tid: (tid_t) udm: (::const udm_t *)
lt_udm_renamed(self, udtname: char const *, udm: udm_t, oldname: char const *) ‑> void lt_udm_renamed(self, udtname, udm, oldname) local type udt member has been renamed
udtname: (::const char *) udm: (::const udm_t *) oldname: (::const char *)
lt_udt_expanded(self, udtname: char const *, udm_tid: tid_t, delta: adiff_t) ‑> void lt_udt_expanded(self, udtname, udm_tid, delta) A structure type has been expanded/shrank.
udtname: (::const char *) udm_tid: (tid_t) the gap was added/removed before this member delta: (::adiff_t) number of added/removed bytes
make_code(self, insn: insn_t const *) ‑> void make_code(self, insn) An instruction is being created.
insn: (const insn_t*)
make_data(self, ea: ea_t, flags: flags64_t, tid: tid_t, len: asize_t) ‑> void make_data(self, ea, flags, tid, len) A data item is being created.
ea: (::ea_t) flags: (flags64_t) tid: (tid_t) len: (::asize_t)
op_ti_changed(self, ea: ea_t, n: int, type: type_t const *, fnames: p_list const *) ‑> void op_ti_changed(self, ea, n, type, fnames) An operand typestring (c/c++ prototype) has been changed.
ea: (::ea_t) n: (int) type: (const type_t *) fnames: (const p_list *)
op_type_changed(self, ea: ea_t, n: int) ‑> void op_type_changed(self, ea, n) An operand type (offset, hex, etc...) has been set or deleted.
ea: (::ea_t) n: (int) eventually or'ed with OPND_OUTER or OPND_ALL
range_cmt_changed(self, kind: range_kind_t, a: range_t, cmt: char const *, repeatable: bool) ‑> void range_cmt_changed(self, kind, a, cmt, repeatable) Range comment has been changed.
kind: (range_kind_t) a: (const range_t *) cmt: (const char *) repeatable: (bool)
renamed(self, ea: ea_t, new_name: char const *, local_name: bool, old_name: char const *) ‑> void renamed(self, ea, new_name, local_name, old_name) The kernel has renamed a byte. See also the rename event
ea: (::ea_t) new_name: (const char *) can be nullptr local_name: (bool) old_name: (const char *) can be nullptr
savebase(self) ‑> void savebase(self) The database is being saved.
segm_added(self, s: segment_t *) ‑> void segm_added(self, s) A new segment has been created.
s: (segment_t *) See also adding_segm
segm_attrs_updated(self, s: segment_t *) ‑> void segm_attrs_updated(self, s) Segment attributes has been changed.
s: (segment_t *) This event is generated for secondary segment attributes (examples: color, permissions, etc)
segm_class_changed(self, s: segment_t *, sclass: char const *) ‑> void segm_class_changed(self, s, sclass) Segment class has been changed.
s: (segment_t *) sclass: (const char *)
segm_deleted(self, start_ea: ea_t, end_ea: ea_t, flags: int) ‑> void segm_deleted(self, start_ea, end_ea, flags) A segment has been deleted.
start_ea: (::ea_t) end_ea: (::ea_t) flags: (int)
segm_end_changed(self, s: segment_t *, oldend: ea_t) ‑> void segm_end_changed(self, s, oldend) Segment end address has been changed.
s: (segment_t *) oldend: (::ea_t)
segm_moved(self, _from: ea_t, to: ea_t, size: asize_t, changed_netmap: bool) ‑> void segm_moved(self, _from, to, size, changed_netmap) Segment has been moved.
from: (::ea_t) to: (::ea_t) size: (::asize_t) changed_netmap: (bool) See also idb_event::allsegs_moved
segm_name_changed(self, s: segment_t *, name: char const *) ‑> void segm_name_changed(self, s, name) Segment name has been changed.
s: (segment_t *) name: (const char *)
segm_start_changed(self, s: segment_t *, oldstart: ea_t) ‑> void segm_start_changed(self, s, oldstart) Segment start address has been changed.
s: (segment_t *) oldstart: (::ea_t)
set_func_end(self, pfn: func_t *, new_end: ea_t) ‑> void set_func_end(self, pfn, new_end) Function chunk end address will be changed.
pfn: (func_t *) new_end: (::ea_t)
set_func_start(self, pfn: func_t *, new_start: ea_t) ‑> void set_func_start(self, pfn, new_start) Function chunk start address will be changed.
pfn: (func_t *) new_start: (::ea_t)
sgr_changed(self, start_ea: ea_t, end_ea: ea_t, regnum: int, value: sel_t, old_value: sel_t, tag: uchar) ‑> void sgr_changed(self, start_ea, end_ea, regnum, value, old_value, tag) The kernel has changed a segment register value.
start_ea: (::ea_t) end_ea: (::ea_t) regnum: (int) value: (::sel_t) old_value: (::sel_t) tag: (uchar) Segment register range tags
sgr_deleted(self, start_ea: ea_t, end_ea: ea_t, regnum: int) ‑> void sgr_deleted(self, start_ea, end_ea, regnum) The kernel has deleted a segment register value.
start_ea: (::ea_t) end_ea: (::ea_t) regnum: (int)
stkpnts_changed(self, pfn: func_t *) ‑> void stkpnts_changed(self, pfn) Stack change points have been modified.
pfn: (func_t *)
tail_owner_changed(self, tail: func_t *, owner_func: ea_t, old_owner: ea_t) ‑> void tail_owner_changed(self, tail, owner_func, old_owner) A tail chunk owner has been changed.
tail: (func_t *) owner_func: (::ea_t) old_owner: (::ea_t)
thunk_func_created(self, pfn: func_t *) ‑> void thunk_func_created(self, pfn) A thunk bit has been set for a function.
pfn: (func_t *)
ti_changed(self, ea: ea_t, type: type_t const *, fnames: p_list const *) ‑> void ti_changed(self, ea, type, fnames) An item typestring (c/c++ prototype) has been changed.
ea: (::ea_t) type: (const type_t *) fnames: (const p_list *)
tryblks_updated(self, tbv: tryblks_t const *) ‑> void tryblks_updated(self, tbv) Updated tryblk information
tbv: (const ::tryblks_t *)
unhook(self) ‑> bool unhook(self) -> bool
updating_tryblks(self, tbv: tryblks_t const *) ‑> void updating_tryblks(self, tbv) About to update tryblk information
tbv: (const ::tryblks_t *)
upgraded(self, _from: int) ‑> void upgraded(self, _from) The database has been upgraded and the receiver can upgrade its info as well
from: (int) - old IDB version
IDP_Hooks()
: Proxy of C++ IDP_Hooks class.
Descendants
Methods
ev_add_cref(self, _from: ea_t, to: ea_t, type: cref_t) ‑> int ev_add_cref(self, _from, to, type) -> int A code reference is being created.
from: (::ea_t) to: (::ea_t) type: (cref_t) retval <0: cancel cref creation retval 0: not implemented or continue
ev_add_dref(self, _from: ea_t, to: ea_t, type: dref_t) ‑> int ev_add_dref(self, _from, to, type) -> int A data reference is being created.
from: (::ea_t) to: (::ea_t) type: (dref_t) retval <0: cancel dref creation retval 0: not implemented or continue
ev_adjust_argloc(self, argloc: argloc_t, optional_type: tinfo_t, size: int) ‑> int ev_adjust_argloc(self, argloc, optional_type, size) -> int Adjust argloc according to its type/size and platform endianess
argloc: (argloc_t *), inout type: (const tinfo_t *), may be nullptr nullptr means primitive type of given size size: (int) 'size' makes no sense if type != nullptr (type->get_size() should be used instead) retval 0: not implemented retval 1: ok retval -1: error
ev_adjust_libfunc_ea(self, sig: idasgn_t const *, libfun: libfunc_t const *, ea: ea_t *) ‑> int ev_adjust_libfunc_ea(self, sig, libfun, ea) -> int Called when a signature module has been matched against bytes in the database. This is used to compute the offset at which a particular module's libfunc should be applied.
sig: (const idasgn_t *) libfun: (const libfunc_t *) ea: (::ea_t *) note: 'ea' initially contains the ea_t of the start of the pattern match retval 1: the ea_t pointed to by the third argument was modified. retval <=0: not modified. use default algorithm.
ev_adjust_refinfo(self, ri: refinfo_t, ea: ea_t, n: int, fd: fixup_data_t const *) ‑> int ev_adjust_refinfo(self, ri, ea, n, fd) -> int Called from apply_fixup before converting operand to reference. Can be used for changing the reference info. (e.g. the PPC module adds REFINFO_NOBASE for some references)
ri: (refinfo_t *) ea: (::ea_t) instruction address n: (int) operand number fd: (const fixup_data_t *) retval <0: do not create an offset retval 0: not implemented or refinfo adjusted
ev_ana_insn(self, out: insn_t *) ‑> bool ev_ana_insn(self, out) -> bool Analyze one instruction and fill 'out' structure. This function shouldn't change the database, flags or anything else. All these actions should be performed only by emu_insn() function. insn_t::ea contains address of instruction to analyze.
out: (insn_t *) return: length of the instruction in bytes, 0 if instruction can't be decoded. retval 0: if instruction can't be decoded.
ev_analyze_prolog(self, ea: ea_t) ‑> int ev_analyze_prolog(self, ea) -> int Analyzes function prolog, epilog, and updates purge, and function attributes
ea: (::ea_t) start of function retval 1: ok retval 0: not implemented
ev_arch_changed(self) ‑> int ev_arch_changed(self) -> int The loader is done parsing arch-related information, which the processor module might want to use to finish its initialization. retval 1: if success retval 0: not implemented or failed
ev_arg_addrs_ready(self, caller: ea_t, n: int, tif: tinfo_t, addrs: ea_t *) ‑> int ev_arg_addrs_ready(self, caller, n, tif, addrs) -> int Argument address info is ready.
caller: (::ea_t) n: (int) number of formal arguments tif: (tinfo_t *) call prototype addrs: (::ea_t *) argument intilization addresses retval <0: do not save into idb; other values mean "ok to save"
ev_asm_installed(self, asmnum: int) ‑> int ev_asm_installed(self, asmnum) -> int After setting a new assembler
asmnum: (int) See also ev_newasm
ev_assemble(self, ea: ea_t, cs: ea_t, ip: ea_t, use32: bool, line: char const *) ‑> PyObject * ev_assemble(self, ea, cs, ip, use32, line) -> PyObject * Assemble an instruction. (display a warning if an error is found).
ea: (::ea_t) linear address of instruction cs: (::ea_t) cs of instruction ip: (::ea_t) ip of instruction use32: (bool) is 32bit segment? line: (const char *) line to assemble return: size of the instruction in bytes
ev_auto_queue_empty(self, type: atype_t) ‑> int ev_auto_queue_empty(self, type) -> int One analysis queue is empty.
type: (atype_t) retval void: see also idb_event::auto_empty_finally
ev_calc_arglocs(self, fti: func_type_data_t) ‑> int ev_calc_arglocs(self, fti) -> int Calculate function argument locations. This callback should fill retloc, all arglocs, and stkargs. This callback is never called for CM_CC_SPECIAL functions.
fti: (func_type_data_t *) points to the func type info retval 0: not implemented retval 1: ok retval -1: error
ev_calc_cdecl_purged_bytes(self, ea: ea_t) ‑> int ev_calc_cdecl_purged_bytes(self, ea) -> int Calculate number of purged bytes after call.
ea: (::ea_t) address of the call instruction return: number of purged bytes (usually add sp, N)
ev_calc_next_eas(self, res: eavec_t *, insn: insn_t const *, over: bool) ‑> int ev_calc_next_eas(self, res, insn, over) -> int Calculate list of addresses the instruction in 'insn' may pass control to. This callback is required for source level debugging.
res: (eavec_t ), out: array for the results. insn: (const insn_t) the instruction over: (bool) calculate for step over (ignore call targets) retval <0: incalculable (indirect jumps, for example) retval >=0: number of addresses of called functions in the array. They must be put at the beginning of the array (0 if over=true)
ev_calc_purged_bytes(self, p_purged_bytes: int *, fti: func_type_data_t) ‑> int ev_calc_purged_bytes(self, p_purged_bytes, fti) -> int Calculate number of purged bytes by the given function type.
p_purged_bytes: (int *) ptr to output fti: (const func_type_data_t *) func type details retval 1 retval 0: not implemented
ev_calc_retloc(self, retloc: argloc_t, rettype: tinfo_t, cc: cm_t) ‑> int ev_calc_retloc(self, retloc, rettype, cc) -> int Calculate return value location.
retloc: (argloc_t *) rettype: (const tinfo_t *) cc: (cm_t) retval 0: not implemented retval 1: ok, retval -1: error
ev_calc_spdelta(self, spdelta: sval_t *, insn: insn_t const *) ‑> int ev_calc_spdelta(self, spdelta, insn) -> int Calculate amount of change to sp for the given insn. This event is required to decompile code snippets.
spdelta: (sval_t *) insn: (const insn_t *) retval 1: ok retval 0: not implemented
ev_calc_step_over(self, target: ea_t *, ip: ea_t) ‑> int ev_calc_step_over(self, target, ip) -> int Calculate the address of the instruction which will be executed after "step over". The kernel will put a breakpoint there. If the step over is equal to step into or we cannot calculate the address, return BADADDR.
target: (::ea_t *) pointer to the answer ip: (::ea_t) instruction address retval 0: unimplemented retval 1: implemented
ev_calc_switch_cases(self, casevec: casevec_t *, targets: eavec_t *, insn_ea: ea_t, si: switch_info_t) ‑> int ev_calc_switch_cases(self, casevec, targets, insn_ea, si) -> int Calculate case values and targets for a custom jump table.
casevec: (::casevec_t *) vector of case values (may be nullptr) targets: (eavec_t *) corresponding target addresses (my be nullptr) insn_ea: (::ea_t) address of the 'indirect jump' instruction si: (switch_info_t *) switch information retval 1: ok retval <=0: failed
ev_calc_varglocs(self, ftd: func_type_data_t, aux_regs: regobjs_t, aux_stkargs: relobj_t, nfixed: int) ‑> int ev_calc_varglocs(self, ftd, aux_regs, aux_stkargs, nfixed) -> int Calculate locations of the arguments that correspond to '...'.
ftd: (func_type_data_t *), inout: info about all arguments (including varargs) aux_regs: (regobjs_t *) buffer for hidden register arguments, may be nullptr aux_stkargs: (relobj_t *) buffer for hidden stack arguments, may be nullptr nfixed: (int) number of fixed arguments retval 0: not implemented retval 1: ok retval -1: error On some platforms variadic calls require passing additional information: for example, number of floating variadic arguments must be passed in rax on gcc-x64. The locations and values that constitute this additional information are returned in the buffers pointed by aux_regs and aux_stkargs
ev_calcrel(self) ‑> int ev_calcrel(self) -> int Reserved.
ev_can_have_type(self, op: op_t const *) ‑> int ev_can_have_type(self, op) -> int Can the operand have a type as offset, segment, decimal, etc? (for example, a register AX can't have a type, meaning that the user can't change its representation. see bytes.hpp for information about types and flags)
op: (const op_t *) retval 0: unknown retval <0: no retval 1: yes
ev_clean_tbit(self, ea: ea_t, getreg: processor_t::regval_getter_t *, regvalues: regval_t) ‑> int ev_clean_tbit(self, ea, getreg, regvalues) -> int Clear the TF bit after an insn like pushf stored it in memory.
ea: (::ea_t) instruction address getreg: (::processor_t::regval_getter_t *) function to get register values regvalues: (const regval_t *) register values array retval 1: ok retval 0: failed
ev_cmp_operands(self, op1: op_t const *, op2: op_t const *) ‑> int ev_cmp_operands(self, op1, op2) -> int Compare instruction operands
op1: (const op_t*) op2: (const op_t*) retval 1: equal retval -1: not equal retval 0: not implemented
ev_coagulate(self, start_ea: ea_t) ‑> int ev_coagulate(self, start_ea) -> int Try to define some unexplored bytes. This notification will be called if the kernel tried all possibilities and could not find anything more useful than to convert to array of bytes. The module can help the kernel and convert the bytes into something more useful.
start_ea: (::ea_t) return: number of converted bytes
ev_coagulate_dref(self, _from: ea_t, to: ea_t, may_define: bool, code_ea: ea_t *) ‑> int ev_coagulate_dref(self, _from, to, may_define, code_ea) -> int Data reference is being analyzed. plugin may correct 'code_ea' (e.g. for thumb mode refs, we clear the last bit)
from: (::ea_t) to: (::ea_t) may_define: (bool) code_ea: (::ea_t *) retval <0: failed dref analysis, >0 done dref analysis retval 0: not implemented or continue
ev_create_flat_group(self, image_base: ea_t, bitness: int, dataseg_sel: sel_t) ‑> int ev_create_flat_group(self, image_base, bitness, dataseg_sel) -> int Create special segment representing the flat group.
image_base: (::ea_t) bitness: (int) dataseg_sel: (::sel_t) return value is ignored
ev_create_func_frame(self, pfn: func_t *) ‑> int ev_create_func_frame(self, pfn) -> int Create a function frame for a newly created function Set up frame size, its attributes etc
pfn: (func_t *) retval 1: ok retval 0: not implemented
ev_create_merge_handlers(self, md: merge_data_t *) ‑> int ev_create_merge_handlers(self, md) -> int Create merge handlers, if needed
md: (merge_data_t *) This event is generated immediately after opening idbs. return: must be 0
ev_create_switch_xrefs(self, jumpea: ea_t, si: switch_info_t) ‑> int ev_create_switch_xrefs(self, jumpea, si) -> int Create xrefs for a custom jump table.
jumpea: (::ea_t) address of the jump insn si: (const switch_info_t *) switch information return: must return 1 Must be implemented if module uses custom jump tables, SWI_CUSTOM
ev_creating_segm(self, seg: segment_t *) ‑> int ev_creating_segm(self, seg) -> int A new segment is about to be created.
seg: (segment_t *) retval 1: ok retval <0: segment should not be created
ev_cvt64_hashval(self, node: nodeidx_t, tag: uchar, name: char const *, data: uchar const *) ‑> int ev_cvt64_hashval(self, node, tag, name, data) -> int perform 32-64 conversion for a hash value
node: (::nodeidx_t) tag: (uchar) name: (const ::char *) data: (const uchar *) return: 0 nothing was done 1 converted successfully -1 error (and message in errbuf)
ev_cvt64_supval(self, node: nodeidx_t, tag: uchar, idx: nodeidx_t, data: uchar const *) ‑> int ev_cvt64_supval(self, node, tag, idx, data) -> int perform 32-64 conversion for a netnode array element
node: (::nodeidx_t) tag: (uchar) idx: (::nodeidx_t) data: (const uchar *) return: 0 nothing was done 1 converted successfully -1 error (and message in errbuf)
ev_decorate_name(self, name: char const *, mangle: bool, cc: int, optional_type: tinfo_t) ‑> PyObject * ev_decorate_name(self, name, mangle, cc, optional_type) -> PyObject * Decorate/undecorate a C symbol name.
name: (const char *) name of symbol mangle: (bool) true-mangle, false-unmangle cc: (cm_t) calling convention optional_type: tinfo_t const * retval 1: if success retval 0: not implemented or failed
ev_del_cref(self, _from: ea_t, to: ea_t, expand: bool) ‑> int ev_del_cref(self, _from, to, expand) -> int A code reference is being deleted.
from: (::ea_t) to: (::ea_t) expand: (bool) retval <0: cancel cref deletion retval 0: not implemented or continue
ev_del_dref(self, _from: ea_t, to: ea_t) ‑> int ev_del_dref(self, _from, to) -> int A data reference is being deleted.
from: (::ea_t) to: (::ea_t) retval <0: cancel dref deletion retval 0: not implemented or continue
ev_delay_slot_insn(self, ea: ea_t, bexec: bool, fexec: bool) ‑> PyObject * ev_delay_slot_insn(self, ea, bexec, fexec) -> PyObject * Get delay slot instruction
ea: (::ea_t *) in: instruction address in question, out: (if the answer is positive) if the delay slot contains valid insn: the address of the delay slot insn else: BADADDR (invalid insn, e.g. a branch) bexec: (bool *) execute slot if jumping, initially set to 'true' fexec: (bool *) execute slot if not jumping, initally set to 'true' retval 1: positive answer retval <=0: ordinary insn note: Input EA may point to the instruction with a delay slot or to the delay slot instruction itself.
ev_demangle_name(self, name: char const *, disable_mask: uint32, demreq: int) ‑> PyObject * ev_demangle_name(self, name, disable_mask, demreq) -> PyObject * Demangle a C++ (or another language) name into a user-readable string. This event is called by demangle_name()
name: (const char *) mangled name disable_mask: (uint32) flags to inhibit parts of output or compiler info/other (see MNG_) demreq: (demreq_type_t) operation to perform retval 1: if success retval 0: not implemented note: if you call demangle_name() from the handler, protect against recursion!
ev_emu_insn(self, insn: insn_t const *) ‑> bool ev_emu_insn(self, insn) -> bool Emulate instruction, create cross-references, plan to analyze subsequent instructions, modify flags etc. Upon entrance to this function, all information about the instruction is in 'insn' structure.
insn: (const insn_t *) retval 1: ok retval -1: the kernel will delete the instruction
ev_endbinary(self, ok: bool) ‑> int ev_endbinary(self, ok) -> int IDA has loaded a binary file.
ok: (bool) file loaded successfully?
ev_ending_undo(self, action_name: char const *, is_undo: bool) ‑> int ev_ending_undo(self, action_name, is_undo) -> int Ended undoing/redoing an action
action_name: (const char *) action that we finished undoing/redoing. is not nullptr. is_undo: (bool) true if performing undo, false if performing redo
ev_equal_reglocs(self, a1: argloc_t, a2: argloc_t) ‑> int ev_equal_reglocs(self, a1, a2) -> int Are 2 register arglocs the same?. We need this callback for the pc module.
a1: (argloc_t *) a2: (argloc_t *) retval 1: yes retval -1: no retval 0: not implemented
ev_extract_address(self, out_ea: ea_t *, screen_ea: ea_t, string: char const *, position: size_t) ‑> int ev_extract_address(self, out_ea, screen_ea, string, position) -> int Extract address from a string.
out_ea: (ea_t *), out screen_ea: (ea_t) string: (const char *) position: (size_t) retval 1: ok retval 0: kernel should use the standard algorithm retval -1: error
ev_find_op_value(self, pinsn: insn_t const *, opn: int) ‑> PyObject * ev_find_op_value(self, pinsn, opn) -> PyObject * Find operand value via a register tracker. The returned value in 'out' is valid before executing the instruction.
pinsn: (const insn_t *) instruction opn: (int) operand index retval 1: if implemented, and value was found retval 0: not implemented, -1 decoding failed, or no value found
ev_find_reg_value(self, pinsn: insn_t const *, reg: int) ‑> PyObject * ev_find_reg_value(self, pinsn, reg) -> PyObject * Find register value via a register tracker. The returned value in 'out' is valid before executing the instruction.
pinsn: (const insn_t *) instruction reg: (int) register index retval 1: if implemented, and value was found retval 0: not implemented, -1 decoding failed, or no value found
ev_func_bounds(self, possible_return_code: int *, pfn: func_t *, max_func_end_ea: ea_t) ‑> int ev_func_bounds(self, possible_return_code, pfn, max_func_end_ea) -> int find_func_bounds() finished its work. The module may fine tune the function bounds
possible_return_code: (int *), in/out pfn: (func_t *) max_func_end_ea: (::ea_t) (from the kernel's point of view) retval void
ev_gen_asm_or_lst(self, starting: bool, fp: FILE *, is_asm: bool, flags: int, outline: html_line_cb_t **) ‑> int ev_gen_asm_or_lst(self, starting, fp, is_asm, flags, outline) -> int
starting: (bool) beginning listing generation fp: (FILE *) output file is_asm: (bool) true:assembler, false:listing flags: (int) flags passed to gen_file() outline: (html_line_cb_t **) ptr to ptr to outline callback. if this callback is defined for this code, it will be used by the kernel to output the generated lines retval void
ev_gen_map_file(self, nlines: int *, fp: FILE *) ‑> int ev_gen_map_file(self, nlines, fp) -> int Generate map file. If not implemented the kernel itself will create the map file.
nlines: (int *) number of lines in map file (-1 means write error) fp: (FILE *) output file retval 0: not implemented retval 1: ok retval -1: write error
ev_gen_regvar_def(self, outctx: outctx_t *, v: regvar_t *) ‑> int ev_gen_regvar_def(self, outctx, v) -> int Generate register variable definition line.
outctx: (outctx_t *) v: (regvar_t *) retval >0: ok, generated the definition text retval 0: not implemented
ev_gen_src_file_lnnum(self, outctx: outctx_t *, file: char const *, lnnum: size_t) ‑> int ev_gen_src_file_lnnum(self, outctx, file, lnnum) -> int
outctx: (outctx_t *) output context file: (const char *) source file (may be nullptr) lnnum: (size_t) line number retval 1: directive has been generated retval 0: not implemented
ev_gen_stkvar_def2(self, outctx: outctx_t *, stkvar: udm_t, v: sval_t, tid: tid_t) ‑> int ev_gen_stkvar_def2(self, outctx, stkvar, v, tid) -> int Generate stack variable definition line Default line is varname = type ptr value, where 'type' is one of byte,word,dword,qword,tbyte
outctx: (outctx_t *) stkvar: (const udm_t *) v: (sval_t) tid: (tid_t) stkvar TID retval 1: ok retval 0: not implemented
ev_get_abi_info(self, abi_names: qstrvec_t *, abi_opts: qstrvec_t *, comp: comp_t) ‑> int ev_get_abi_info(self, abi_names, abi_opts, comp) -> int Get all possible ABI names and optional extensions for given compiler abiname/option is a string entirely consisting of letters, digits and underscore
abi_names: (qstrvec_t *) - all possible ABis each in form abiname- opt1-opt2-... abi_opts: (qstrvec_t *) - array of all possible options in form "opt:description" or opt:hint-line#description comp: (comp_t) - compiler ID retval 0: not implemented retval 1: ok
ev_get_autocmt(self, insn: insn_t const *) ‑> PyObject * ev_get_autocmt(self, insn) -> PyObject *
insn: (const insn_t*) the instruction retval 1: new comment has been generated retval 0: callback has not been handled. the buffer must not be changed in this case
ev_get_bg_color(self, color: bgcolor_t *, ea: ea_t) ‑> int ev_get_bg_color(self, color, ea) -> int Get item background color. Plugins can hook this callback to color disassembly lines dynamically
color: (bgcolor_t *), out ea: (::ea_t) retval 0: not implemented retval 1: color set
ev_get_cc_regs(self, regs: callregs_t, cc: cm_t) ‑> int ev_get_cc_regs(self, regs, cc) -> int Get register allocation convention for given calling convention
regs: (callregs_t *), out cc: (cm_t) retval 1 retval 0: not implemented
ev_get_code16_mode(self, ea: ea_t) ‑> int ev_get_code16_mode(self, ea) -> int Get ISA 16-bit mode
ea: (ea_t) address to get the ISA mode retval 1: 16-bit mode retval 0: not implemented or 32-bit mode
ev_get_dbr_opnum(self, opnum: int *, insn: insn_t const *) ‑> int ev_get_dbr_opnum(self, opnum, insn) -> int Get the number of the operand to be displayed in the debugger reference view (text mode).
opnum: (int ) operand number (out, -1 means no such operand) insn: (const insn_t) the instruction retval 0: unimplemented retval 1: implemented
ev_get_default_enum_size(self) ‑> int ev_get_default_enum_size(self) -> int Get default enum size. Not generated anymore. inf_get_cc_size_e() is used instead
ev_get_frame_retsize(self, frsize: int *, pfn: func_t const *) ‑> int ev_get_frame_retsize(self, frsize, pfn) -> int Get size of function return address in bytes If this event is not implemented, the kernel will assume
8 bytes for 64-bit function
4 bytes for 32-bit function
2 bytes otherwise
frsize: (int *) frame size (out) pfn: (const func_t *), can't be nullptr retval 1: ok retval 0: not implemented
ev_get_macro_insn_head(self, head: ea_t *, ip: ea_t) ‑> int ev_get_macro_insn_head(self, head, ip) -> int Calculate the start of a macro instruction. This notification is called if IP points to the middle of an instruction
head: (::ea_t *), out: answer, BADADDR means normal instruction ip: (::ea_t) instruction address retval 0: unimplemented retval 1: implemented
ev_get_operand_string(self, insn: insn_t const *, opnum: int) ‑> PyObject * ev_get_operand_string(self, insn, opnum) -> PyObject * Request text string for operand (cli, java, ...).
insn: (const insn_t*) the instruction opnum: (int) operand number, -1 means any string operand retval 0: no string (or empty string) retval >0: original string length without terminating zero
ev_get_procmod(self) ‑> int ev_get_procmod(self) -> int Get pointer to the processor module object. All processor modules must implement this. The pointer is returned as size_t.
ev_get_reg_accesses(self, accvec: reg_accesses_t, insn: insn_t const *, flags: int) ‑> int ev_get_reg_accesses(self, accvec, insn, flags) -> int Get info about the registers that are used/changed by an instruction.
accvec: (reg_accesses_t*) out: info about accessed registers insn: (const insn_t *) instruction in question flags: (int) reserved, must be 0 retval -1: if accvec is nullptr retval 1: found the requested access (and filled accvec) retval 0: not implemented
ev_get_reg_info(self, main_regname: char const **, bitrange: bitrange_t, regname: char const *) ‑> int ev_get_reg_info(self, main_regname, bitrange, regname) -> int Get register information by its name. example: "ah" returns:
main_regname="eax"
bitrange_t = { offset==8, nbits==8 }
This callback may be unimplemented if the register names are all present in processor_t::reg_names and they all have the same size
main_regname: (const char **), out bitrange: (bitrange_t *), out: position and size of the value within 'main_regname' (empty bitrange == whole register) regname: (const char *) retval 1: ok retval -1: failed (not found) retval 0: unimplemented
ev_get_reg_name(self, reg: int, width: size_t, reghi: int) ‑> PyObject * ev_get_reg_name(self, reg, width, reghi) -> PyObject * Generate text representation of a register. Most processor modules do not need to implement this callback. It is useful only if processor_t::reg_names[reg] does not provide the correct register name.
reg: (int) internal register number as defined in the processor module width: (size_t) register width in bytes reghi: (int) if not -1 then this function will return the register pair retval -1: if error retval strlen(buf): if success
ev_get_simd_types(self, out: simd_info_vec_t *, simd_attrs: simd_info_t, argloc: argloc_t, create_tifs: bool) ‑> int ev_get_simd_types(self, out, simd_attrs, argloc, create_tifs) -> int Get SIMD-related types according to given attributes ant/or argument location
out: (::simd_info_vec_t *) simd_attrs: (const simd_info_t *), may be nullptr argloc: (const argloc_t *), may be nullptr create_tifs: (bool) return valid tinfo_t objects, create if neccessary retval number: of found types retval -1: error If name==nullptr, initialize all SIMD types
ev_get_stkarg_area_info(self, out: stkarg_area_info_t, cc: cm_t) ‑> int ev_get_stkarg_area_info(self, out, cc) -> int Get some metrics of the stack argument area.
out: (stkarg_area_info_t *) ptr to stkarg_area_info_t cc: (cm_t) calling convention retval 1: if success retval 0: not implemented
ev_get_stkvar_scale_factor(self) ‑> int ev_get_stkvar_scale_factor(self) -> int Should stack variable references be multiplied by a coefficient before being used in the stack frame?. Currently used by TMS320C55 because the references into the stack should be multiplied by 2
return: scaling factor retval 0: not implemented note: PR_SCALE_STKVARS should be set to use this callback
ev_getreg(self, regval: uval_t *, regnum: int) ‑> int ev_getreg(self, regval, regnum) -> int IBM PC only internal request, should never be used for other purpose Get register value by internal index
regval: (uval_t *), out regnum: (int) retval 1: ok retval 0: not implemented retval -1: failed (undefined value or bad regnum)
ev_init(self, idp_modname: char const *) ‑> int ev_init(self, idp_modname) -> int The IDP module is just loaded.
idp_modname: (const char *) processor module name retval <0: on failure
ev_insn_reads_tbit(self, insn: insn_t const *, getreg: processor_t::regval_getter_t *, regvalues: regval_t) ‑> int ev_insn_reads_tbit(self, insn, getreg, regvalues) -> int Check if insn will read the TF bit.
insn: (const insn_t*) the instruction getreg: (::processor_t::regval_getter_t *) function to get register values regvalues: (const regval_t *) register values array retval 2: yes, will generate 'step' exception retval 1: yes, will store the TF bit in memory retval 0: no
ev_is_align_insn(self, ea: ea_t) ‑> int ev_is_align_insn(self, ea) -> int Is the instruction created only for alignment purposes?. Do not directly call this function, use is_align_insn()
ea: (ea_t) - instruction address retval number: of bytes in the instruction
ev_is_alloca_probe(self, ea: ea_t) ‑> int ev_is_alloca_probe(self, ea) -> int Does the function at 'ea' behave as __alloca_probe?
ea: (::ea_t) retval 1: yes retval 0: no
ev_is_basic_block_end(self, insn: insn_t const *, call_insn_stops_block: bool) ‑> int ev_is_basic_block_end(self, insn, call_insn_stops_block) -> int Is the current instruction end of a basic block?. This function should be defined for processors with delayed jump slots.
insn: (const insn_t*) the instruction call_insn_stops_block: (bool) retval 0: unknown retval <0: no retval 1: yes
ev_is_call_insn(self, insn: insn_t const *) ‑> int ev_is_call_insn(self, insn) -> int Is the instruction a "call"?
insn: (const insn_t *) instruction retval 0: unknown retval <0: no retval 1: yes
ev_is_cond_insn(self, insn: insn_t const *) ‑> int ev_is_cond_insn(self, insn) -> int Is conditional instruction?
insn: (const insn_t *) instruction address retval 1: yes retval -1: no retval 0: not implemented or not instruction
ev_is_control_flow_guard(self, p_reg: int *, insn: insn_t const *) ‑> int ev_is_control_flow_guard(self, p_reg, insn) -> int Detect if an instruction is a "thunk call" to a flow guard function (equivalent to call reg/return/nop)
p_reg: (int *) indirect register number, may be -1 insn: (const insn_t *) call/jump instruction retval -1: no thunk detected retval 1: indirect call retval 2: security check routine call (NOP) retval 3: return thunk retval 0: not implemented
ev_is_far_jump(self, icode: int) ‑> int ev_is_far_jump(self, icode) -> int is indirect far jump or call instruction? meaningful only if the processor has 'near' and 'far' reference types
icode: (int) retval 0: not implemented retval 1: yes retval -1: no
ev_is_indirect_jump(self, insn: insn_t const *) ‑> int ev_is_indirect_jump(self, insn) -> int Determine if instruction is an indirect jump. If CF_JUMP bit cannot describe all jump types jumps, please define this callback.
insn: (const insn_t*) the instruction retval 0: use CF_JUMP retval 1: no retval 2: yes
ev_is_insn_table_jump(self) ‑> int ev_is_insn_table_jump(self) -> int Reserved.
ev_is_jump_func(self, pfn: func_t *, jump_target: ea_t *, func_pointer: ea_t *) ‑> int ev_is_jump_func(self, pfn, jump_target, func_pointer) -> int Is the function a trivial "jump" function?.
pfn: (func_t *) jump_target: (::ea_t *) func_pointer: (::ea_t *) retval <0: no retval 0: don't know retval 1: yes, see 'jump_target' and 'func_pointer'
ev_is_ret_insn(self, insn: insn_t const *, strict: bool) ‑> int ev_is_ret_insn(self, insn, strict) -> int Is the instruction a "return"?
insn: (const insn_t *) instruction strict: (bool) 1: report only ret instructions 0: include instructions like "leave" which begins the function epilog retval 0: unknown retval <0: no retval 1: yes
ev_is_sane_insn(self, insn: insn_t const *, no_crefs: int) ‑> int ev_is_sane_insn(self, insn, no_crefs) -> int Is the instruction sane for the current file type?.
insn: (const insn_t*) the instruction no_crefs: (int) 1: the instruction has no code refs to it. ida just tries to convert unexplored bytes to an instruction (but there is no other reason to convert them into an instruction) 0: the instruction is created because of some coderef, user request or another weighty reason. retval >=0: ok retval <0: no, the instruction isn't likely to appear in the program
ev_is_sp_based(self, mode: int *, insn: insn_t const *, op: op_t const *) ‑> int ev_is_sp_based(self, mode, insn, op) -> int Check whether the operand is relative to stack pointer or frame pointer This event is used to determine how to output a stack variable If not implemented, then all operands are sp based by default. Implement this event only if some stack references use frame pointer instead of stack pointer.
mode: (int *) out, combination of SP/FP operand flags insn: (const insn_t *) op: (const op_t *) retval 0: not implemented retval 1: ok
ev_is_switch(self, si: switch_info_t, insn: insn_t const *) ‑> int ev_is_switch(self, si, insn) -> int Find 'switch' idiom or override processor module's decision. It will be called for instructions marked with CF_JUMP.
si: (switch_info_t *), out insn: (const insn_t *) instruction possibly belonging to a switch retval 1: switch is found, 'si' is filled. IDA will create the switch using the filled 'si' retval -1: no switch found. This value forbids switch creation by the processor module retval 0: not implemented
ev_last_cb_before_loader(self) ‑> int ev_last_cb_before_loader(self) -> int
ev_loader(self) ‑> int ev_loader(self) -> int This code and higher ones are reserved for the loaders. The arguments and the return values are defined by the loaders
ev_lower_func_type(self, argnums: intvec_t *, fti: func_type_data_t) ‑> int ev_lower_func_type(self, argnums, fti) -> int Get function arguments which should be converted to pointers when lowering function prototype. The processor module can also modify 'fti' in order to make non-standard conversion of some arguments.
argnums: (intvec_t *), out - numbers of arguments to be converted to pointers in acsending order fti: (func_type_data_t *), inout func type details retval 0: not implemented retval 1: argnums was filled retval 2: argnums was filled and made substantial changes to fti argnums[0] can contain a special negative value indicating that the return value should be passed as a hidden 'retstr' argument: -1 this argument is passed as the first one and the function returns a pointer to the argument, -2 this argument is passed as the last one and the function returns a pointer to the argument, -3 this argument is passed as the first one and the function returns 'void'.
ev_max_ptr_size(self) ‑> int ev_max_ptr_size(self) -> int Get maximal size of a pointer in bytes.
return: max possible size of a pointer
ev_may_be_func(self, insn: insn_t const *, state: int) ‑> int ev_may_be_func(self, insn, state) -> int Can a function start here?
insn: (const insn_t*) the instruction state: (int) autoanalysis phase 0: creating functions 1: creating chunks return: probability 1..100 note: Actually IDA uses 3 intervals of a probability: 0..50 not a function, 51..99 a function (IDA needs another proof), 100 a function (no other proofs needed)
ev_may_show_sreg(self, current_ea: ea_t) ‑> int ev_may_show_sreg(self, current_ea) -> int The kernel wants to display the segment registers in the messages window.
current_ea: (::ea_t) retval <0: if the kernel should not show the segment registers. (assuming that the module has done it) retval 0: not implemented
ev_moving_segm(self, seg: segment_t *, to: ea_t, flags: int) ‑> int ev_moving_segm(self, seg, to, flags) -> int May the kernel move the segment?
seg: (segment_t *) segment to move to: (::ea_t) new segment start address flags: (int) combination of Move segment flags retval 0: yes retval <0: the kernel should stop
ev_newasm(self, asmnum: int) ‑> int ev_newasm(self, asmnum) -> int Before setting a new assembler.
asmnum: (int) See also ev_asm_installed
ev_newbinary(self, filename: char *, fileoff: qoff64_t, basepara: ea_t, binoff: ea_t, nbytes: uint64) ‑> int ev_newbinary(self, filename, fileoff, basepara, binoff, nbytes) -> int IDA is about to load a binary file.
filename: (char *) binary file name fileoff: (qoff64_t) offset in the file basepara: (::ea_t) base loading paragraph binoff: (::ea_t) loader offset nbytes: (::uint64) number of bytes to load
ev_newfile(self, fname: char *) ‑> int ev_newfile(self, fname) -> int A new file has been loaded.
fname: (char *) input file name
ev_newprc(self, pnum: int, keep_cfg: bool) ‑> int ev_newprc(self, pnum, keep_cfg) -> int Before changing processor type.
pnum: (int) processor number in the array of processor names keep_cfg: (bool) true: do not modify kernel configuration retval 1: ok retval <0: prohibit
ev_next_exec_insn(self, target: ea_t *, ea: ea_t, tid: int, getreg: processor_t::regval_getter_t *, regvalues: regval_t) ‑> int ev_next_exec_insn(self, target, ea, tid, getreg, regvalues) -> int Get next address to be executed This function must return the next address to be executed. If the instruction following the current one is executed, then it must return BADADDR Usually the instructions to consider are: jumps, branches, calls, returns. This function is essential if the 'single step' is not supported in hardware.
target: (::ea_t *), out: pointer to the answer ea: (::ea_t) instruction address tid: (int) current therad id getreg: (::processor_t::regval_getter_t *) function to get register values regvalues: (const regval_t *) register values array retval 0: unimplemented retval 1: implemented
ev_obsolete3(self) ‑> int ev_obsolete3(self) -> int ev_gen_stkvar_def is obsolete, check ev_gen_stkvar_def2 below
ev_oldfile(self, fname: char *) ‑> int ev_oldfile(self, fname) -> int An old file has been loaded.
fname: (char *) input file name
ev_out_assumes(self, outctx: outctx_t *) ‑> int ev_out_assumes(self, outctx) -> int Function to produce assume directives when segment register value changes.
outctx: (outctx_t *) retval 1: ok retval 0: not implemented
ev_out_data(self, outctx: outctx_t *, analyze_only: bool) ‑> int ev_out_data(self, outctx, analyze_only) -> int Generate text representation of data items This function may change the database and create cross-references if analyze_only is set
outctx: (outctx_t *) analyze_only: (bool) retval 1: ok retval 0: not implemented
ev_out_footer(self, outctx: outctx_t *) ‑> int ev_out_footer(self, outctx) -> int Function to produce end of disassembled text
outctx: (outctx_t *) retval void
ev_out_header(self, outctx: outctx_t *) ‑> int ev_out_header(self, outctx) -> int Function to produce start of disassembled text
outctx: (outctx_t *) retval void
ev_out_insn(self, outctx: outctx_t *) ‑> bool ev_out_insn(self, outctx) -> bool Generate text representation of an instruction in 'ctx.insn' outctx_t provides functions to output the generated text. This function shouldn't change the database, flags or anything else. All these actions should be performed only by emu_insn() function.
outctx: (outctx_t *) retval void
ev_out_label(self, outctx: outctx_t *, colored_name: char const *) ‑> int ev_out_label(self, outctx, colored_name) -> int The kernel is going to generate an instruction label line or a function header.
outctx: (outctx_t *) colored_name: (const char *) retval <0: if the kernel should not generate the label retval 0: not implemented or continue
ev_out_mnem(self, outctx: outctx_t *) ‑> int ev_out_mnem(self, outctx) -> int Generate instruction mnemonics. This callback should append the colored mnemonics to ctx.outbuf Optional notification, if absent, out_mnem will be called.
outctx: (outctx_t *) retval 1: if appended the mnemonics retval 0: not implemented
ev_out_operand(self, outctx: outctx_t *, op: op_t const *) ‑> bool ev_out_operand(self, outctx, op) -> bool Generate text representation of an instruction operand outctx_t provides functions to output the generated text. All these actions should be performed only by emu_insn() function.
outctx: (outctx_t *) op: (const op_t *) retval 1: ok retval -1: operand is hidden
ev_out_segend(self, outctx: outctx_t *, seg: segment_t *) ‑> int ev_out_segend(self, outctx, seg) -> int Function to produce end of segment
outctx: (outctx_t *) seg: (segment_t *) retval 1: ok retval 0: not implemented
ev_out_segstart(self, outctx: outctx_t *, seg: segment_t *) ‑> int ev_out_segstart(self, outctx, seg) -> int Function to produce start of segment
outctx: (outctx_t *) seg: (segment_t *) retval 1: ok retval 0: not implemented
ev_out_special_item(self, outctx: outctx_t *, segtype: uchar) ‑> int ev_out_special_item(self, outctx, segtype) -> int Generate text representation of an item in a special segment i.e. absolute symbols, externs, communal definitions etc
outctx: (outctx_t *) segtype: (uchar) retval 1: ok retval 0: not implemented retval -1: overflow
ev_privrange_changed(self, old_privrange: range_t, delta: adiff_t) ‑> int ev_privrange_changed(self, old_privrange, delta) -> int Privrange interval has been moved to a new location. Most common actions to be done by module in this case: fix indices of netnodes used by module
old_privrange: (const range_t *) - old privrange interval delta: (::adiff_t) return: 0 Ok -1 error (and message in errbuf)
ev_realcvt(self, m: void *, e: fpvalue_t *, swt: uint16) ‑> int ev_realcvt(self, m, e, swt) -> int Floating point -> IEEE conversion
m: (void *) ptr to processor-specific floating point value e: (fpvalue_t *) IDA representation of a floating point value swt: (uint16) operation (see realcvt() in ieee.h) retval 0: not implemented retval unknown
ev_rename(self, ea: ea_t, new_name: char const *) ‑> int ev_rename(self, ea, new_name) -> int The kernel is going to rename a byte.
ea: (::ea_t) new_name: (const char *) retval <0: if the kernel should not rename it. retval 2: to inhibit the notification. I.e., the kernel should not rename, but 'set_name()' should return 'true'. also see renamed the return value is ignored when kernel is going to delete name
ev_replaying_undo(self, action_name: char const *, vec: undo_records_t const *, is_undo: bool) ‑> int ev_replaying_undo(self, action_name, vec, is_undo) -> int Replaying an undo/redo buffer
action_name: (const char *) action that we perform undo/redo for. may be nullptr for intermediary buffers. vec: (const undo_records_t *) is_undo: (bool) true if performing undo, false if performing redo This event may be generated multiple times per undo/redo
ev_set_code16_mode(self, ea: ea_t, code16: bool) ‑> int ev_set_code16_mode(self, ea, code16) -> int Some processors have ISA 16-bit mode e.g. ARM Thumb mode, PPC VLE, MIPS16 Set ISA 16-bit mode
ea: (ea_t) address to set new ISA mode code16: (bool) true for 16-bit mode, false for 32-bit mode
ev_set_idp_options(self, keyword: char const *, value_type: int, value: void const *, idb_loaded: bool) ‑> int ev_set_idp_options(self, keyword, value_type, value, idb_loaded) -> int Set IDP-specific configuration option Also see set_options_t in config.hpp
keyword: (const char *) value_type: (int) value: (const void *) idb_loaded: (bool) true if the ev_oldfile/ev_newfile events have been generated retval 1: ok retval 0: not implemented retval -1: error (and message in errbuf)
ev_set_proc_options(self, options: char const *, confidence: int) ‑> int ev_set_proc_options(self, options, confidence) -> int Called if the user specified an option string in the command line: -p:. Can be used for setting a processor subtype. Also called if option string is passed to set_processor_type() and IDC's SetProcessorType().
options: (const char *) confidence: (int) 0: loader's suggestion 1: user's decision retval <0: if bad option string
ev_setup_til(self) ‑> int ev_setup_til(self) -> int Setup default type libraries. (called after loading a new file into the database). The processor module may load tils, setup memory model and perform other actions required to set up the type system. This is an optional callback. retval void
ev_str2reg(self, regname: char const *) ‑> int ev_str2reg(self, regname) -> int Convert a register name to a register number. The register number is the register index in the processor_t::reg_names array Most processor modules do not need to implement this callback It is useful only if processor_t::reg_names[reg] does not provide the correct register names
regname: (const char *) retval register: number + 1 retval 0: not implemented or could not be decoded
ev_term(self) ‑> int ev_term(self) -> int The IDP module is being unloaded.
ev_treat_hindering_item(self, hindering_item_ea: ea_t, new_item_flags: flags64_t, new_item_ea: ea_t, new_item_length: asize_t) ‑> int ev_treat_hindering_item(self, hindering_item_ea, new_item_flags, new_item_ea, new_item_length) -> int An item hinders creation of another item.
hindering_item_ea: (::ea_t) new_item_flags: (flags64_t) (0 for code) new_item_ea: (::ea_t) new_item_length: (::asize_t) retval 0: no reaction retval !=0: the kernel may delete the hindering item
ev_undefine(self, ea: ea_t) ‑> int ev_undefine(self, ea) -> int An item in the database (insn or data) is being deleted.
ea: (ea_t) retval 1: do not delete srranges at the item end retval 0: srranges can be deleted
ev_update_call_stack(self, stack: call_stack_t, tid: int, getreg: processor_t::regval_getter_t *, regvalues: regval_t) ‑> int ev_update_call_stack(self, stack, tid, getreg, regvalues) -> int Calculate the call stack trace for the given thread. This callback is invoked when the process is suspended and should fill the 'trace' object with the information about the current call stack. Note that this callback is NOT invoked if the current debugger backend implements stack tracing via debugger_t::event_t::ev_update_call_stack. The debugger-specific algorithm takes priority. Implementing this callback in the processor module is useful when multiple debugging platforms follow similar patterns, and thus the same processor-specific algorithm can be used for different platforms.
stack: (call_stack_t *) result tid: (int) thread id getreg: (::processor_t::regval_getter_t *) function to get register values regvalues: (const regval_t *) register values array retval 1: ok retval -1: failed retval 0: unimplemented
ev_use_arg_types(self, ea: ea_t, fti: func_type_data_t, rargs: funcargvec_t *) ‑> int ev_use_arg_types(self, ea, fti, rargs) -> int Use information about callee arguments.
ea: (::ea_t) address of the call instruction fti: (func_type_data_t *) info about function type rargs: (funcargvec_t *) array of register arguments retval 1: (and removes handled arguments from fti and rargs) retval 0: not implemented
ev_use_regarg_type(self, ea: ea_t, rargs: funcargvec_t const *) ‑> PyObject * ev_use_regarg_type(self, ea, rargs) -> PyObject * Use information about register argument.
ea: (::ea_t) address of the instruction rargs: (const funcargvec_t *) vector of register arguments (including regs extracted from scattered arguments) retval 1 retval 0: not implemented
ev_use_stkarg_type(self, ea: ea_t, arg: funcarg_t) ‑> int ev_use_stkarg_type(self, ea, arg) -> int Use information about a stack argument.
ea: (::ea_t) address of the push instruction which pushes the function argument into the stack arg: (const funcarg_t *) argument info retval 1: ok retval <=0: failed, the kernel will create a comment with the argument name or type for the instruction
ev_validate_flirt_func(self, start_ea: ea_t, funcname: char const *) ‑> int ev_validate_flirt_func(self, start_ea, funcname) -> int Flirt has recognized a library function. This callback can be used by a plugin or proc module to intercept it and validate such a function.
start_ea: (::ea_t) funcname: (const char *) retval -1: do not create a function, retval 0: function is validated
ev_verify_noreturn(self, pfn: func_t *) ‑> int ev_verify_noreturn(self, pfn) -> int The kernel wants to set 'noreturn' flags for a function.
pfn: (func_t *) retval 0: ok. any other value: do not set 'noreturn' flag
ev_verify_sp(self, pfn: func_t *) ‑> int ev_verify_sp(self, pfn) -> int All function instructions have been analyzed. Now the processor module can analyze the stack pointer for the whole function
pfn: (func_t *) retval 0: ok retval <0: bad stack pointer
hook(self) ‑> bool hook(self) -> bool
unhook(self) ‑> bool unhook(self) -> bool
asm_t()
: Proxy of C++ asm_t class.
Instance variables
a_align: char const *
a_align
a_ascii: char const *
a_ascii
a_band: char const *
a_band
a_bnot: char const *
a_bnot
a_bor: char const *
a_bor
a_bss: char const *
a_bss
a_byte: char const *
a_byte
a_comdef: char const *
a_comdef
a_curip: char const *
a_curip
a_double: char const *
a_double
a_dups: char const *
a_dups
a_dword: char const *
a_dword
a_equ: char const *
a_equ
a_extrn: char const *
a_extrn
a_float: char const *
a_float
a_include_fmt: char const *
a_include_fmt
a_mod: char const *
a_mod
a_oword: char const *
a_oword
a_packreal: char const *
a_packreal
a_public: char const *
a_public
a_qword: char const *
a_qword
a_rva: char const *
a_rva
a_seg: char const *
a_seg
a_shl: char const *
a_shl
a_shr: char const *
a_shr
a_sizeof_fmt: char const *
a_sizeof_fmt
a_tbyte: char const *
a_tbyte
a_vstruc_fmt: char const *
a_vstruc_fmt
a_weak: char const *
a_weak
a_word: char const *
a_word
a_xor: char const *
a_xor
a_yword: char const *
a_yword
a_zword: char const *
a_zword
accsep: char
accsep
ascsep: char
ascsep
cmnt: char const *
cmnt
cmnt2: char const *
cmnt2
end: char const *
end
esccodes: char const *
esccodes
flag: uint32
flag
flag2: uint32
flag2
header: char const *const *
header
help: help_t
help
high16: char const *
high16
high8: char const *
high8
lbrace: char
lbrace
low16: char const *
low16
low8: char const *
low8
name: char const *
name
origin: char const *
origin
rbrace: char
rbrace
uflag: uint16
uflag
num_range_t(_min: int64, _max: int64)
: Proxy of C++ cfgopt_t::num_range_t class.
Instance variables
maxval: int64
maxval
minval: int64
minval
params_t(_p1: int64, _p2: int64)
: Proxy of C++ cfgopt_t::params_t class.
Instance variables
p1: int64
p1
p2: int64
p2
processor_t()
: Proxy of C++ IDP_Hooks class.
Ancestors (in MRO)
Methods
auto_empty(self, *args)
auto_empty_finally(self, *args)
closebase(self, *args)
compiler_changed(self, *args)
deleting_func(self, pfn)
determined_main(self, *args)
func_added(self, pfn)
get_auxpref(self, insn) This function returns insn.auxpref value
get_idpdesc(self) This function must be present and should return the list of short processor names similar to the one in ph.psnames. This method can be overridden to return to the kernel a different IDP description.
idasgn_loaded(self, *args)
kernel_config_loaded(self, *args)
make_code(self, *args)
make_data(self, *args)
renamed(self, *args)
savebase(self, *args)
segm_moved(self, from_ea, to_ea, size, changed_netmap)
set_func_end(self, *args)
set_func_start(self, *args)
sgr_changed(self, *args)
reg_access_t()
: Proxy of C++ reg_access_t class.
Instance variables
access_type: access_type_t
access_type
opnum: uchar
opnum
range: bitrange_t
range
regnum: int
regnum
Methods
have_common_bits(self, r: reg_access_t) ‑> bool have_common_bits(self, r) -> bool
r: reg_access_t const &
reg_access_vec_t(*args)
: Proxy of C++ qvector< reg_access_t > class.
Descendants
Methods
add_unique(self, x: reg_access_t) ‑> bool add_unique(self, x) -> bool
x: reg_access_t const &
at(self, _idx: size_t) ‑> reg_access_t const & at(self, _idx) -> reg_access_t
_idx: size_t
back(self)
begin(self, *args) ‑> qvector< reg_access_t >::const_iterator begin(self) -> reg_access_t
capacity(self) ‑> size_t capacity(self) -> size_t
clear(self) ‑> void clear(self)
empty(self) ‑> bool empty(self) -> bool
end(self, *args) ‑> qvector< reg_access_t >::const_iterator end(self) -> reg_access_t
erase(self, *args) ‑> qvector< reg_access_t >::iterator erase(self, it) -> reg_access_t
it: qvector< reg_access_t >::iterator
erase(self, first, last) -> reg_access_t
first: qvector< reg_access_t >::iterator last: qvector< reg_access_t >::iterator
extract(self) ‑> reg_access_t * extract(self) -> reg_access_t
find(self, *args) ‑> qvector< reg_access_t >::const_iterator find(self, x) -> reg_access_t
x: reg_access_t const &
front(self)
grow(self, *args) ‑> void grow(self, x=reg_access_t())
x: reg_access_t const &
has(self, x: reg_access_t) ‑> bool has(self, x) -> bool
x: reg_access_t const &
inject(self, s: reg_access_t, len: size_t) ‑> void inject(self, s, len)
s: reg_access_t * len: size_t
insert(self, it: reg_access_t, x: reg_access_t) ‑> qvector< reg_access_t >::iterator insert(self, it, x) -> reg_access_t
it: qvector< reg_access_t >::iterator x: reg_access_t const &
pop_back(self) ‑> void pop_back(self)
push_back(self, *args) ‑> reg_access_t & push_back(self, x)
x: reg_access_t const &
push_back(self) -> reg_access_t
qclear(self) ‑> void qclear(self)
reserve(self, cnt: size_t) ‑> void reserve(self, cnt)
cnt: size_t
resize(self, *args) ‑> void resize(self, _newsize, x)
_newsize: size_t x: reg_access_t const &
resize(self, _newsize)
_newsize: size_t
size(self) ‑> size_t size(self) -> size_t
swap(self, r: reg_access_vec_t) ‑> void swap(self, r)
r: qvector< reg_access_t > &
truncate(self) ‑> void truncate(self)
reg_accesses_t()
: Proxy of C++ reg_accesses_t class.
Ancestors (in MRO)
reg_info_t()
: Proxy of C++ reg_info_t class.
Instance variables
reg: int
reg
size: int
size
Methods
compare(self, r: reg_info_t) ‑> int compare(self, r) -> int
r: reg_info_t const &
Last updated