Module idautils

Functions

Assemble(ea, line)

Assembles one or more lines (does not display an message dialogs) If line is a list then this function will attempt to assemble all the lines This function will turn on batch mode temporarily so that no messages are displayed on the screen

ea:       start address
return: (False, "Error message") or (True, asm_buf) or (True, [asm_buf1, asm_buf2, asm_buf3])

Chunks(start)

Get a list of function chunks See also ida_funcs.func_tail_iterator_t

start: address of the function

return: list of function chunks (tuples of the form (start_ea, end_ea))
        belonging to the function

CodeRefsFrom(ea, flow)

Get a list of code references from 'ea'

ea:   Target address
flow: Follow normal code flow or not

@type flow: Boolean (0/1, False/True)

return: list of references (may be empty list)

Example::

   for ref in CodeRefsFrom(get_screen_ea(), 1):
       print(ref)

CodeRefsTo(ea, flow)

Get a list of code references to 'ea'

ea:   Target address
flow: Follow normal code flow or not

@type flow: Boolean (0/1, False/True)

return: list of references (may be empty list)

Example::

   for ref in CodeRefsTo(get_screen_ea(), 1):
       print(ref)

DataRefsFrom(ea)

Get a list of data references from 'ea'

ea:   Target address

return: list of references (may be empty list)

Example::

   for ref in DataRefsFrom(get_screen_ea()):
       print(ref)

DataRefsTo(ea)

Get a list of data references to 'ea'

ea:   Target address

return: list of references (may be empty list)

Example::

   for ref in DataRefsTo(get_screen_ea()):
       print(ref)

DecodeInstruction(ea)

Decodes an instruction and returns an insn_t like class

ea: address to decode
return: None or a new insn_t instance

DecodePrecedingInstruction(ea)

Decode preceding instruction in the execution flow.

ea: address to decode
return: (None or the decode instruction, farref)
        farref will contain 'true' if followed an xref, false otherwise

DecodePreviousInstruction(ea)

Decodes the previous instruction and returns an insn_t like class

ea: address to decode
return: None or a new insn_t instance

Entries()

Returns a list of entry points (exports)

return: List of tuples (index, ordinal, ea, name)

FuncItems(start)

Get a list of function items (instruction or data items inside function boundaries) See also ida_funcs.func_item_iterator_t

start: address of the function

return: ea of each item in the function

Functions(start=None, end=None)

Get a list of functions

start: start address (default: inf.min_ea)
end:   end address (default: inf.max_ea)

return: list of function entrypoints between start and end

note: The last function that starts before 'end' is included even

if it extends beyond 'end'. Any function that has its chunks scattered in multiple segments will be reported multiple times, once in each segment as they are listed.

GetDataList(ea, count, itemsize=1)

Get data list - INTERNAL USE ONLY

GetIdbDir()

Get IDB directory

This function returns directory path of the current IDB database

GetInstructionList()

Returns the instruction list of the current processor module

GetRegisterList()

Returns the register list

Heads(start=None, end=None)

Get a list of heads (instructions or data items)

start: start address (default: inf.min_ea)
end:   end address (default: inf.max_ea)

return: list of heads between start and end

MapDataList(ea, length, func, wordsize=1)

Map through a list of data words in the database

ea:       start address
length:   number of words to map
func:     mapping function
wordsize: size of words to map [default: 1 byte]

return: None

Modules()

Returns a list of module objects with name,size,base and the rebase_to attributes

Names()

Returns a list of names

return: List of tuples (ea, name)

ProcessUiActions(actions, flags=0)

actions: A string containing a list of actions separated by semicolon, a list or a tuple flags: flags to be passed to process_ui_action() return: Boolean. Returns False if the action list was empty or execute_ui_requests() failed.

PutDataList(ea, datalist, itemsize=1)

Put data list - INTERNAL USE ONLY

Segments()

Get list of segments (sections) in the binary image

return: List of segment start addresses.

StructMembers(sid)

Get a list of structure members information (or stack vars if given a frame).

sid: ID of the structure.

return: List of tuples (offset_in_bytes, name, size_in_bytes)

note: If 'sid' does not refer to a valid structure,
      an exception will be raised.
note: This will not return 'holes' in structures/stack frames;
      it only returns defined structure members.

Structs()

Get a list of structures

return: List of tuples (ordinal, sid, name)

Threads()

Returns all thread IDs for the current debugee

XrefTypeName(typecode)

Convert cross-reference type codes to readable names

typecode: cross-reference type code

XrefsFrom(ea, flags=0)

Return all references from address 'ea'

ea: Reference address
flags: one of ida_xref.XREF_ALL (default), ida_xref.XREF_FAR, ida_xref.XREF_DATA

Example:: for xref in XrefsFrom(here(), 0): print(xref.type, XrefTypeName(xref.type), 'from', hex(xref.frm), 'to', hex(xref.to))

XrefsTo(ea, flags=0)

Return all references to address 'ea'

ea: Reference address
flags: one of ida_xref.XREF_ALL (default), ida_xref.XREF_FAR, ida_xref.XREF_DATA

Example:: for xref in XrefsTo(here(), 0): print(xref.type, XrefTypeName(xref.type), 'from', hex(xref.frm), 'to', hex(xref.to))

Classes

Strings(default_setup=False)

: Allows iterating over the string list. The set of strings will not be modified, unless asked explicitly at setup()-time. This string list also is used by the "String window" so it may be changed when this window is updated.

Example:
    s = Strings()

    for i in s:
        print("%x: len=%d type=%d -> '%s'" % (i.ea, i.length, i.strtype, str(i)))

Initializes the Strings enumeration helper class

 default_setup: Set to True to use default setup (C strings, min len 5, ...)

Class variables

  • StringItem Class representing each string item.

Methods

  • clear_cache(self) Clears the string list cache

  • refresh(self) Refreshes the string list

  • setup(self, strtypes=[0], minlen=5, only_7bit=True, ignore_instructions=False, display_only_existing_strings=False)

peutils_t()

: PE utility class. Retrieves PE information from the database.

Constants from pe.h

Class variables

  • PE_ALT_DBG_FPOS

  • PE_ALT_IMAGEBASE

  • PE_ALT_NEFLAGS

  • PE_ALT_PEHDR_OFF

  • PE_ALT_PSXDLL

  • PE_ALT_TDS_LOADED

  • PE_NODE

Instance variables

  • header_offset

  • imagebase

Methods

  • header(self)

PreviousModule ida_xrefNextModule idc

Last updated