mirror of
https://github.com/cemu-project/idapython.git
synced 2024-11-24 18:16:55 +01:00
6166 lines
167 KiB
Python
6166 lines
167 KiB
Python
#!/usr/bin/env python
|
|
#------------------------------------------------------------
|
|
# IDAPython - Python plugin for Interactive Disassembler Pro
|
|
#
|
|
# Original IDC.IDC:
|
|
# Copyright (c) 1990-2007 Ilfak Guilfanov
|
|
#
|
|
# Python conversion:
|
|
# Copyright (c) 2004-2007 Gergely Erdelyi <dyce@d-dome.net>
|
|
#
|
|
# All rights reserved.
|
|
#
|
|
# For detailed copyright information see the file COPYING in
|
|
# the root of the distribution archive.
|
|
#------------------------------------------------------------
|
|
# idc.py - IDC compatibility module
|
|
#------------------------------------------------------------
|
|
"""
|
|
IDC compatibility module
|
|
|
|
This file contains IDA built-in function declarations and internal bit
|
|
definitions. Each byte of the program has 32-bit flags (low 8 bits keep
|
|
the byte value). These 32 bits are used in GetFlags/SetFlags functions.
|
|
You may freely examine these bits using GetFlags() but the use of the
|
|
SetFlags() function is strongly discouraged.
|
|
|
|
This file is subject to change without any notice.
|
|
Future versions of IDA may use other definitions.
|
|
"""
|
|
try:
|
|
import idaapi
|
|
except:
|
|
print "Could not import idaapi. Running in 'pydoc mode'."
|
|
|
|
import os, struct, re
|
|
|
|
class DeprecatedIDCError(Exception):
|
|
"""
|
|
Exception for deprecated function calls
|
|
"""
|
|
def __init__(self, val):
|
|
self.var = val
|
|
|
|
def __str__(self):
|
|
return self.val
|
|
|
|
|
|
def _IDC_GetAttr(object, map, attroffs):
|
|
"""
|
|
Internal function to generically get object attributes
|
|
Do not use unless you know what you are doing
|
|
"""
|
|
if attroffs in map and hasattr(object, map[attroffs]):
|
|
return getattr(object, map[attroffs])
|
|
else:
|
|
str = "attribute with offset %d not found, check the offset and report the problem" % attroffs
|
|
raise KeyError, str
|
|
|
|
|
|
def _IDC_SetAttr(object, map, attroffs, value):
|
|
"""
|
|
Internal function to generically set object attributes
|
|
Do not use unless you know what you are doing
|
|
"""
|
|
if attroffs in map and hasattr(object, map[attroffs]):
|
|
return setattr(object, map[attroffs], value)
|
|
else:
|
|
str = "attribute with offset %d not found, check the offset and report the problem" % attroffs
|
|
raise KeyError, str
|
|
|
|
|
|
BADADDR = idaapi.BADADDR # Not allowed address value
|
|
BADSEL = idaapi.BADSEL # Not allowed selector value/number
|
|
MAXADDR = idaapi.MAXADDR
|
|
|
|
#
|
|
# Flag bit definitions (for GetFlags())
|
|
#
|
|
MS_VAL = idaapi.MS_VAL # Mask for byte value
|
|
FF_IVL = idaapi.FF_IVL # Byte has value ?
|
|
|
|
# Do flags contain byte value? (i.e. has the byte a value?)
|
|
# if not, the byte is uninitialized.
|
|
|
|
def hasValue(F): return ((F & FF_IVL) != 0) # any defined value?
|
|
|
|
# Get byte value from flags
|
|
# Get value of byte provided that the byte is initialized.
|
|
# This macro works ok only for 8-bit byte machines.
|
|
|
|
def byteValue(F): return (F & MS_VAL) # quick replacement for Byte()
|
|
|
|
# Is the byte initialized?
|
|
|
|
def isLoaded(ea): hasValue(GetFlags(ea)) # any defined value?
|
|
|
|
MS_CLS = idaapi.MS_CLS # Mask for typing
|
|
FF_CODE = idaapi.FF_CODE # Code ?
|
|
FF_DATA = idaapi.FF_DATA # Data ?
|
|
FF_TAIL = idaapi.FF_TAIL # Tail ?
|
|
FF_UNK = idaapi.FF_UNK # Unknown ?
|
|
|
|
def isCode(F): return ((F & MS_CLS) == FF_CODE) # is code byte?
|
|
def isData(F): return ((F & MS_CLS) == FF_DATA) # is data byte?
|
|
def isTail(F): return ((F & MS_CLS) == FF_TAIL) # is tail byte?
|
|
def isUnknown(F): return ((F & MS_CLS) == FF_UNK) # is unexplored byte?
|
|
def isHead(F): return ((F & FF_DATA) != 0) # is start of code/data?
|
|
|
|
#
|
|
# Common bits
|
|
#
|
|
MS_COMM = idaapi.MS_COMM # Mask of common bits
|
|
FF_COMM = idaapi.FF_COMM # Has comment?
|
|
FF_REF = idaapi.FF_REF # has references?
|
|
FF_LINE = idaapi.FF_LINE # Has next or prev cmt lines ?
|
|
FF_NAME = idaapi.FF_NAME # Has user-defined name ?
|
|
FF_LABL = idaapi.FF_LABL # Has dummy name?
|
|
FF_FLOW = idaapi.FF_FLOW # Exec flow from prev instruction?
|
|
FF_VAR = idaapi.FF_VAR # Is byte variable ?
|
|
FF_ANYNAME = FF_LABL | FF_NAME
|
|
|
|
def isFlow(F): return ((F & FF_FLOW) != 0)
|
|
def isVar(F): return ((F & FF_VAR ) != 0)
|
|
def isExtra(F): return ((F & FF_LINE) != 0)
|
|
def isRef(F): return ((F & FF_REF) != 0)
|
|
def hasName(F): return ((F & FF_NAME) != 0)
|
|
def hasUserName(F): return ((F & FF_ANYNAME) == FF_NAME)
|
|
|
|
MS_0TYPE = idaapi.MS_0TYPE # Mask for 1st arg typing
|
|
FF_0VOID = idaapi.FF_0VOID # Void (unknown)?
|
|
FF_0NUMH = idaapi.FF_0NUMH # Hexadecimal number?
|
|
FF_0NUMD = idaapi.FF_0NUMD # Decimal number?
|
|
FF_0CHAR = idaapi.FF_0CHAR # Char ('x')?
|
|
FF_0SEG = idaapi.FF_0SEG # Segment?
|
|
FF_0OFF = idaapi.FF_0OFF # Offset?
|
|
FF_0NUMB = idaapi.FF_0NUMB # Binary number?
|
|
FF_0NUMO = idaapi.FF_0NUMO # Octal number?
|
|
FF_0ENUM = idaapi.FF_0ENUM # Enumeration?
|
|
FF_0FOP = idaapi.FF_0FOP # Forced operand?
|
|
FF_0STRO = idaapi.FF_0STRO # Struct offset?
|
|
FF_0STK = idaapi.FF_0STK # Stack variable?
|
|
|
|
MS_1TYPE = idaapi.MS_1TYPE # Mask for 2nd arg typing
|
|
FF_1VOID = idaapi.FF_1VOID # Void (unknown)?
|
|
FF_1NUMH = idaapi.FF_1NUMH # Hexadecimal number?
|
|
FF_1NUMD = idaapi.FF_1NUMD # Decimal number?
|
|
FF_1CHAR = idaapi.FF_1CHAR # Char ('x')?
|
|
FF_1SEG = idaapi.FF_1SEG # Segment?
|
|
FF_1OFF = idaapi.FF_1OFF # Offset?
|
|
FF_1NUMB = idaapi.FF_1NUMB # Binary number?
|
|
FF_1NUMO = idaapi.FF_1NUMO # Octal number?
|
|
FF_1ENUM = idaapi.FF_1ENUM # Enumeration?
|
|
FF_1FOP = idaapi.FF_1FOP # Forced operand?
|
|
FF_1STRO = idaapi.FF_1STRO # Struct offset?
|
|
FF_1STK = idaapi.FF_1STK # Stack variable?
|
|
|
|
# The following macros answer questions like
|
|
# 'is the 1st (or 2nd) operand of instruction or data of the given type'?
|
|
# Please note that data items use only the 1st operand type (is...0)
|
|
|
|
def isDefArg0(F): return ((F & MS_0TYPE) != FF_0VOID)
|
|
def isDefArg1(F): return ((F & MS_1TYPE) != FF_1VOID)
|
|
def isDec0(F): return ((F & MS_0TYPE) == FF_0NUMD)
|
|
def isDec1(F): return ((F & MS_1TYPE) == FF_1NUMD)
|
|
def isHex0(F): return ((F & MS_0TYPE) == FF_0NUMH)
|
|
def isHex1(F): return ((F & MS_1TYPE) == FF_1NUMH)
|
|
def isOct0(F): return ((F & MS_0TYPE) == FF_0NUMO)
|
|
def isOct1(F): return ((F & MS_1TYPE) == FF_1NUMO)
|
|
def isBin0(F): return ((F & MS_0TYPE) == FF_0NUMB)
|
|
def isBin1(F): return ((F & MS_1TYPE) == FF_1NUMB)
|
|
def isOff0(F): return ((F & MS_0TYPE) == FF_0OFF)
|
|
def isOff1(F): return ((F & MS_1TYPE) == FF_1OFF)
|
|
def isChar0(F): return ((F & MS_0TYPE) == FF_0CHAR)
|
|
def isChar1(F): return ((F & MS_1TYPE) == FF_1CHAR)
|
|
def isSeg0(F): return ((F & MS_0TYPE) == FF_0SEG)
|
|
def isSeg1(F): return ((F & MS_1TYPE) == FF_1SEG)
|
|
def isEnum0(F): return ((F & MS_0TYPE) == FF_0ENUM)
|
|
def isEnum1(F): return ((F & MS_1TYPE) == FF_1ENUM)
|
|
def isFop0(F): return ((F & MS_0TYPE) == FF_0FOP)
|
|
def isFop1(F): return ((F & MS_1TYPE) == FF_1FOP)
|
|
def isStroff0(F): return ((F & MS_0TYPE) == FF_0STRO)
|
|
def isStroff1(F): return ((F & MS_1TYPE) == FF_1STRO)
|
|
def isStkvar0(F): return ((F & MS_0TYPE) == FF_0STK)
|
|
def isStkvar1(F): return ((F & MS_1TYPE) == FF_1STK)
|
|
|
|
#
|
|
# Bits for DATA bytes
|
|
#
|
|
DT_TYPE = idaapi.DT_TYPE # Mask for DATA typing
|
|
|
|
FF_BYTE = idaapi.FF_BYTE # byte
|
|
FF_WORD = idaapi.FF_WORD # word
|
|
FF_DWRD = idaapi.FF_DWRD # dword
|
|
FF_QWRD = idaapi.FF_QWRD # qword
|
|
FF_TBYT = idaapi.FF_TBYT # tbyte
|
|
FF_ASCI = idaapi.FF_ASCI # ASCII ?
|
|
FF_STRU = idaapi.FF_STRU # Struct ?
|
|
FF_OWRD = idaapi.FF_OWRD # octaword (16 bytes)
|
|
FF_FLOAT = idaapi.FF_FLOAT # float
|
|
FF_DOUBLE = idaapi.FF_DOUBLE # double
|
|
FF_PACKREAL = idaapi.FF_PACKREAL # packed decimal real
|
|
FF_ALIGN = idaapi.FF_ALIGN # alignment directive
|
|
|
|
#
|
|
# Bits for CODE bytes
|
|
#
|
|
MS_CODE = idaapi.MS_CODE
|
|
FF_FUNC = idaapi.FF_FUNC # function start?
|
|
FF_IMMD = idaapi.FF_IMMD # Has Immediate value ?
|
|
FF_JUMP = idaapi.FF_JUMP # Has jump table
|
|
|
|
#
|
|
# Loader flags
|
|
#
|
|
NEF_SEGS = idaapi.NEF_SEGS # Create segments
|
|
NEF_RSCS = idaapi.NEF_RSCS # Load resources
|
|
NEF_NAME = idaapi.NEF_NAME # Rename entries
|
|
NEF_MAN = idaapi.NEF_MAN # Manual load
|
|
NEF_FILL = idaapi.NEF_FILL # Fill segment gaps
|
|
NEF_IMPS = idaapi.NEF_IMPS # Create imports section
|
|
NEF_TIGHT = idaapi.NEF_TIGHT # Don't align segments (OMF)
|
|
NEF_FIRST = idaapi.NEF_FIRST # This is the first file loaded
|
|
NEF_CODE = idaapi.NEF_CODE # for load_binary_file:
|
|
NEF_RELOAD = idaapi.NEF_RELOAD # reload the file at the same place:
|
|
NEF_FLAT = idaapi.NEF_FLAT # Autocreate FLAT group (PE)
|
|
|
|
# List of built-in functions
|
|
# --------------------------
|
|
#
|
|
# The following conventions are used in this list:
|
|
# 'ea' is a linear address
|
|
# 'success' is 0 if a function failed, 1 otherwise
|
|
# 'void' means that function returns no meaningful value (always 0)
|
|
#
|
|
# All function parameter conversions are made automatically.
|
|
#
|
|
# ----------------------------------------------------------------------------
|
|
# M I S C E L L A N E O U S
|
|
# ----------------------------------------------------------------------------
|
|
def MK_FP(seg, off):
|
|
"""
|
|
Return value of expression: ((seg<<4) + off)
|
|
"""
|
|
return (seg << 4) + off
|
|
|
|
def form(format, *args):
|
|
raise DeprecatedIDCError, "form() is deprecated. Use python string operations instead."
|
|
|
|
def substr(str,x1,x2):
|
|
raise DeprecatedIDCError, "substr() is deprecated. Use python string operations instead."
|
|
|
|
def strstr(str, substr):
|
|
raise DeprecatedIDCError, "strstr() is deprecated. Use python string operations instead."
|
|
|
|
def strlen(str):
|
|
raise DeprecatedIDCError, "strlen() is deprecated. Use python string operations instead."
|
|
|
|
def xtol(str):
|
|
raise DeprecatedIDCError, "xtol() is deprecated. Use python long() instead."
|
|
|
|
|
|
def atoa(ea):
|
|
"""
|
|
Convert address value to a string
|
|
Return address in the form 'seg000:1234'
|
|
(the same as in line prefixes)
|
|
|
|
@param ea: address to format
|
|
"""
|
|
segname = SegName(ea)
|
|
|
|
if segname == "":
|
|
segname = "0"
|
|
|
|
return "%s:%X" % (segname, ea)
|
|
|
|
|
|
def ltoa(n, radix):
|
|
raise DeprecatedIDCError, "ltoa() is deprecated. Use python string operations instead."
|
|
|
|
def atol(str):
|
|
raise DeprecatedIDCError, "atol() is deprecated. Use python long() instead."
|
|
|
|
|
|
def rotate_left(value, count, nbits, offset):
|
|
"""
|
|
Rotate a value to the left (or right)
|
|
|
|
@param x: value to rotate
|
|
@param count: number of times to rotate. negative counter means
|
|
rotate to the right
|
|
@param nbits: number of bits to rotate
|
|
@param offset: offset of the first bit to rotate
|
|
|
|
@return: the value with the specified field rotated
|
|
all other bits are not modified
|
|
|
|
FIXME: unimplemented
|
|
"""
|
|
raise NotImplementedError
|
|
|
|
|
|
def AddHotkey(hotkey, idcfunc):
|
|
"""
|
|
Add hotkey for IDC function
|
|
|
|
@param hotkey: hotkey name ('a', "Alt-A", etc)
|
|
@param idcfunc: IDC function name
|
|
|
|
@note: GUI version doesn't support hotkeys
|
|
|
|
@return: None
|
|
"""
|
|
return idaapi.add_idc_hotkey(hotkey, idcfunc)
|
|
|
|
|
|
# AddHotkey return codes
|
|
IDCHK_OK = 0 # ok
|
|
IDCHK_ARG = -1 # bad argument(s)
|
|
IDCHK_KEY = -2 # bad hotkey name
|
|
IDCHK_MAX = -3 # too many IDC hotkeys
|
|
|
|
|
|
def DelHotkey(hotkey):
|
|
"""
|
|
Delete IDC function hotkey
|
|
|
|
@param hotkey: hotkey code to delete
|
|
"""
|
|
return idaapi.del_idc_hotkey(hotkey)
|
|
|
|
|
|
def Jump(ea):
|
|
"""
|
|
Move cursor to the specifed linear address
|
|
|
|
@param ea: linear address
|
|
"""
|
|
return idaapi.jumpto(ea)
|
|
|
|
|
|
def Wait():
|
|
"""
|
|
Process all entries in the autoanalysis queue
|
|
Wait for the end of autoanalysis
|
|
|
|
@note: This function will suspend execution of the calling script
|
|
till the autoanalysis queue is empty.
|
|
"""
|
|
return idaapi.autoWait()
|
|
|
|
|
|
def Compile(filename):
|
|
"""
|
|
Compile an IDC file.
|
|
|
|
The file being compiled should not contain functions that are
|
|
currently executing - otherwise the behaviour of the replaced
|
|
functions is undefined.
|
|
|
|
@param filename: name of file to compile
|
|
|
|
@return: 0 - ok, otherwise it returns an error message
|
|
"""
|
|
res = idaapi.Compile(filename)
|
|
|
|
if res:
|
|
return res
|
|
else:
|
|
return 0
|
|
|
|
|
|
def Exit(code):
|
|
"""
|
|
Stop execution of IDC program, close the database and exit to OS
|
|
|
|
@param code: code to exit with.
|
|
|
|
@return: -
|
|
"""
|
|
idaapi.qexit(code)
|
|
|
|
|
|
def Exec(command):
|
|
"""
|
|
Execute an OS command.
|
|
|
|
@param command: command line to execute
|
|
|
|
@return: error code from OS
|
|
|
|
@note:
|
|
IDA will wait for the started program to finish.
|
|
In order to start the command in parallel, use OS methods.
|
|
For example, you may start another program in parallel using
|
|
"start" command.
|
|
"""
|
|
return os.system(command)
|
|
|
|
|
|
def RunPlugin(name, arg):
|
|
"""
|
|
Load and run a plugin
|
|
|
|
@param name: The plugin name is a short plugin name without an extension
|
|
@param arg: integer argument
|
|
|
|
@return: 0 if could not load the plugin, 1 if ok
|
|
"""
|
|
return idaapi.load_and_run_plugin(name, arg)
|
|
|
|
|
|
def ApplySig(name):
|
|
"""
|
|
Load (plan to apply) a FLIRT signature file
|
|
|
|
@param name: signature name without path and extension
|
|
|
|
@return: 0 if could not load the signature file, !=0 otherwise
|
|
"""
|
|
return idaapi.plan_to_apply_idasgn(name)
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# C H A N G E P R O G R A M R E P R E S E N T A T I O N
|
|
#----------------------------------------------------------------------------
|
|
|
|
|
|
def DeleteAll():
|
|
"""
|
|
Delete all segments, instructions, comments, i.e. everything
|
|
except values of bytes.
|
|
"""
|
|
ea = idaapi.cvar.inf.minEA
|
|
|
|
# Brute-force nuke all info from all the heads
|
|
while ea != BADADDR and ea <= idaapi.cvar.inf.maxEA:
|
|
idaapi.del_local_name(ea)
|
|
idaapi.del_global_name(ea)
|
|
func = idaapi.get_func(ea)
|
|
if func:
|
|
idaapi.del_func_cmt(func, False)
|
|
idaapi.del_func_cmt(func, True)
|
|
idaapi.del_func(ea)
|
|
idaapi.del_hidden_area(ea)
|
|
seg = idaapi.getseg(ea)
|
|
if seg:
|
|
idaapi.del_segment_cmt(seg, False)
|
|
idaapi.del_segment_cmt(seg, True)
|
|
idaapi.del_segm(ea, idaapi.SEGDEL_KEEP | idaapi.SEGDEL_SILENT)
|
|
|
|
ea = idaapi.next_head(ea, idaapi.cvar.inf.maxEA)
|
|
|
|
|
|
def MakeCode(ea):
|
|
"""
|
|
Create an instruction at the specified address
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 0 - can not create an instruction (no such opcode, the instruction
|
|
would overlap with existing items, etc) otherwise returns length of the
|
|
instruction in bytes
|
|
"""
|
|
return idaapi.ua_code(ea)
|
|
|
|
|
|
def AnalyzeArea(sEA, eEA):
|
|
"""
|
|
Perform full analysis of the area
|
|
|
|
@param sEA: starting linear address
|
|
@param eEA: ending linear address (excluded)
|
|
|
|
@return: 1-ok, 0-Ctrl-Break was pressed.
|
|
"""
|
|
return idaapi.analyze_area(sEA, eEA)
|
|
|
|
|
|
def MakeNameEx(ea, name, flags):
|
|
"""
|
|
Rename an address
|
|
|
|
@param ea: linear address
|
|
@param name: new name of address. If name == "", then delete old name
|
|
@param flags: combination of SN_... constants
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.set_name(ea, name, flags)
|
|
|
|
SN_CHECK = idaapi.SN_CHECK # Fail if the name contains invalid
|
|
# characters
|
|
# If this bit is clear, all invalid chars
|
|
# (those !is_ident_char()) will be replaced
|
|
# by SubstChar (usually '_')
|
|
# List of valid characters is defined in
|
|
# ida.cfg
|
|
SN_NOCHECK = idaapi.SN_NOCHECK # Replace invalid chars with SubstChar
|
|
SN_PUBLIC = idaapi.SN_PUBLIC # if set, make name public
|
|
SN_NON_PUBLIC = idaapi.SN_NON_PUBLIC # if set, make name non-public
|
|
SN_WEAK = idaapi.SN_WEAK # if set, make name weak
|
|
SN_NON_WEAK = idaapi.SN_NON_WEAK # if set, make name non-weak
|
|
SN_AUTO = idaapi.SN_AUTO # if set, make name autogenerated
|
|
SN_NON_AUTO = idaapi.SN_NON_AUTO # if set, make name non-autogenerated
|
|
SN_NOLIST = idaapi.SN_NOLIST # if set, exclude name from the list
|
|
# if not set, then include the name into
|
|
# the list (however, if other bits are set,
|
|
# the name might be immediately excluded
|
|
# from the list)
|
|
SN_NOWARN = idaapi.SN_NOWARN # don't display a warning if failed
|
|
SN_LOCAL = idaapi.SN_LOCAL # create local name. a function should exist.
|
|
# local names can't be public or weak.
|
|
# also they are not included into the list
|
|
# of names they can't have dummy prefixes
|
|
|
|
def MakeComm(ea, comment):
|
|
"""
|
|
Set an indented regular comment of an item
|
|
|
|
@param ea: linear address
|
|
@param comment: comment string
|
|
|
|
@return: None
|
|
"""
|
|
return idaapi.set_cmt(ea, comment, 0)
|
|
|
|
|
|
def MakeRptCmt(ea, comment):
|
|
"""
|
|
Set an indented repeatable comment of an item
|
|
|
|
@param ea: linear address
|
|
@param comment: comment string
|
|
|
|
@return: None
|
|
"""
|
|
return idaapi.set_cmt(ea, comment, 1)
|
|
|
|
|
|
def MakeArray(ea, nitems):
|
|
"""
|
|
Create an array.
|
|
|
|
@param ea: linear address
|
|
@param nitems: size of array in items
|
|
|
|
@note: This function will create an array of the items with the same type as
|
|
the type of the item at 'ea'. If the byte at 'ea' is undefined, then
|
|
this function will create an array of bytes.
|
|
"""
|
|
flags = idaapi.getFlags(ea)
|
|
|
|
if idaapi.isUnknown(flags):
|
|
flags = idaapi.FF_BYTE
|
|
|
|
if idaapi.isStruct(flags):
|
|
ti = idaapi.typeinfo_t()
|
|
assert idaapi.get_typeinfo(ea, 0, flags, ti), "get_typeinfo() failed"
|
|
itemsize = idaapi.get_data_elsize(ea, flags, ti)
|
|
tid = ti.tid
|
|
else:
|
|
itemsize = idaapi.get_item_size(ea)
|
|
tid = BADADDR
|
|
|
|
return idaapi.do_data_ex(ea, flags, itemsize*nitems, tid)
|
|
|
|
|
|
def MakeStr(ea, endea):
|
|
"""
|
|
Create a string.
|
|
|
|
This function creates a string (the string type is determined by the
|
|
value of GetLongPrm(INF_STRTYPE))
|
|
|
|
@param ea: linear address
|
|
@param endea: ending address of the string (excluded)
|
|
if endea == BADADDR, then length of string will be calculated
|
|
by the kernel
|
|
|
|
@return: 1-ok, 0-failure
|
|
|
|
@note: The type of an existing string is returned by GetStringType()
|
|
"""
|
|
return idaapi.make_ascii_string(ea, endea - ea, GetLongPrm(INF_STRTYPE))
|
|
|
|
|
|
def MakeByte(ea):
|
|
"""
|
|
Convert the current item to a byte
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doByte(ea, 1)
|
|
|
|
|
|
def MakeWord(ea):
|
|
"""
|
|
Convert the current item to a word (2 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doWord(ea, 2)
|
|
|
|
|
|
def MakeDword(ea):
|
|
"""
|
|
Convert the current item to a double word (4 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doDwrd(ea, 4)
|
|
|
|
|
|
def MakeQword(ea):
|
|
"""
|
|
Convert the current item to a quadro word (8 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doQwrd(ea, 8)
|
|
|
|
|
|
def MakeOword(ea):
|
|
"""
|
|
Convert the current item to a octa word (16 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doOwrd(ea, 16)
|
|
|
|
|
|
def MakeFloat(ea):
|
|
"""
|
|
Convert the current item to a floating point (4 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doFloat(ea, 4)
|
|
|
|
|
|
def MakeDouble(ea):
|
|
"""
|
|
Convert the current item to a double floating point (8 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doDouble(ea, 8)
|
|
|
|
|
|
def MakePackReal(ea):
|
|
"""
|
|
Convert the current item to a packed real (10 or 12 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doPackReal(ea, idaapi.cvar.ph.tbyte_size)
|
|
|
|
|
|
def MakeTbyte(ea):
|
|
"""
|
|
Convert the current item to a tbyte (10 or 12 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doTbyt(ea, idaapi.cvar.ph.tbyte_size)
|
|
|
|
|
|
def MakeStructEx(ea, size, strname):
|
|
"""
|
|
Convert the current item to a structure instance
|
|
|
|
@param ea: linear address
|
|
@param size: structure size in bytes. -1 means that the size
|
|
will be calculated automatically
|
|
@param strname: name of a structure type
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
strid = idaapi.get_struc_id(strname)
|
|
|
|
# FIXME: This should be changed to BADNODE
|
|
if strid == 0xFFFFFFFF:
|
|
return False
|
|
|
|
if size == -1:
|
|
size = idaapi.get_struc_size(strid)
|
|
|
|
return idaapi.doStruct(ea, size, strid)
|
|
|
|
|
|
def MakeAlign(ea, count, align):
|
|
"""
|
|
Convert the current item to an alignment directive
|
|
|
|
@param ea: linear address
|
|
@param count: number of bytes to convert
|
|
@param align: 0 or 1..32
|
|
if it is 0, the correct alignment will be calculated
|
|
by the kernel
|
|
|
|
@return: 1-ok, 0-failure
|
|
"""
|
|
return idaapi.doAlign(ea, count, align)
|
|
|
|
|
|
def MakeLocal(start, end, location, name):
|
|
"""
|
|
Create a local variable
|
|
|
|
@param start: start of address range for the local variable
|
|
@param end: end of address range for the local variable
|
|
@param location: the variable location in the "[bp+xx]" form where xx is
|
|
a number. The location can also be specified as a
|
|
register name.
|
|
@param name: name of the local variable
|
|
|
|
@return: 1-ok, 0-failure
|
|
|
|
@note: For the stack variables the end address is ignored.
|
|
If there is no function at 'start' then this function.
|
|
will fail.
|
|
"""
|
|
func = idaapi.get_func(start)
|
|
|
|
if not func:
|
|
return 0
|
|
|
|
# Find out if location is in the [bp+xx] form
|
|
r = re.compile("\[([a-z]+)([-+][0-9a-fx]+)", re.IGNORECASE)
|
|
m = r.match(location)
|
|
|
|
if m:
|
|
# Location in the form of [bp+xx]
|
|
register = idaapi.str2reg(m.group(1))
|
|
offset = int(m.group(2), 0)
|
|
frame = idaapi.get_frame(func)
|
|
|
|
print register, frame
|
|
|
|
if register == -1 or not frame:
|
|
return 0
|
|
|
|
offset += func.frsize
|
|
|
|
member = idaapi.get_member(frame, offset)
|
|
|
|
if member:
|
|
# Member already exists, rename it
|
|
if idaapi.set_member_name(frame, offset, name):
|
|
return 1
|
|
else:
|
|
return 0
|
|
else:
|
|
# No member at the offset, create a new one
|
|
if idaapi.add_struc_member(frame,
|
|
name,
|
|
offset,
|
|
idaapi.byteflag(),
|
|
None, 1) == 0:
|
|
return 1
|
|
else:
|
|
return 0
|
|
else:
|
|
# Location as simple register name
|
|
return idaapi.add_regvar(func, start, end, location, name, None)
|
|
|
|
|
|
def MakeUnkn(ea, flags):
|
|
"""
|
|
Convert the current item to an explored item
|
|
|
|
@param ea: linear address
|
|
@param flags: combination of DOUNK_* constants
|
|
|
|
@return: None
|
|
"""
|
|
return idaapi.do_unknown(ea, flags)
|
|
|
|
|
|
def MakeUnknown(ea, size, flags):
|
|
"""
|
|
Convert the current item to an explored item
|
|
|
|
@param ea: linear address
|
|
@param size: size of the range to undefine (for MakeUnknown)
|
|
@param flags: combination of DOUNK_* constants
|
|
|
|
@return: None
|
|
"""
|
|
return idaapi.do_unknown_range(ea, size, flags)
|
|
|
|
|
|
DOUNK_SIMPLE = idaapi.DOUNK_SIMPLE # simply undefine the specified item
|
|
DOUNK_EXPAND = idaapi.DOUNK_EXPAND # propogate undefined items, for example
|
|
# if removing an instruction removes all
|
|
# references to the next instruction, then
|
|
# plan to convert to unexplored the next
|
|
# instruction too.
|
|
DOUNK_DELNAMES = idaapi.DOUNK_DELNAMES # delete any names at the specified address(es)
|
|
|
|
|
|
def OpBinary(ea, n):
|
|
"""
|
|
Convert an operand of the item (instruction or data) to a binary number
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
|
|
@return: 1-ok, 0-failure
|
|
|
|
@note: the data items use only the type of the first operand
|
|
"""
|
|
return idaapi.op_bin(ea, n)
|
|
|
|
|
|
def OpOctal(ea, n):
|
|
"""
|
|
Convert an operand of the item (instruction or data) to an octal number
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
return idaapi.op_oct(ea, n)
|
|
|
|
|
|
def OpDecimal(ea, n):
|
|
"""
|
|
Convert an operand of the item (instruction or data) to a decimal number
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
return idaapi.op_dec(ea, n)
|
|
|
|
|
|
def OpHex(ea, n):
|
|
"""
|
|
Convert an operand of the item (instruction or data) to a hexadecimal number
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
return idaapi.op_hex(ea, n)
|
|
|
|
|
|
def OpChr(ea, n):
|
|
"""
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
return idaapi.op_chr(ea, n)
|
|
|
|
|
|
def OpOff(ea, n, base):
|
|
"""
|
|
Convert operand to an offset
|
|
(for the explanations of 'ea' and 'n' please see OpBinary())
|
|
|
|
Example:
|
|
========
|
|
|
|
seg000:2000 dw 1234h
|
|
|
|
and there is a segment at paragraph 0x1000 and there is a data item
|
|
within the segment at 0x1234:
|
|
|
|
seg000:1234 MyString db 'Hello, world!',0
|
|
|
|
Then you need to specify a linear address of the segment base to
|
|
create a proper offset:
|
|
|
|
OpOffset(["seg000",0x2000],0,0x10000);
|
|
|
|
and you will have:
|
|
|
|
seg000:2000 dw offset MyString
|
|
|
|
Motorola 680x0 processor have a concept of "outer offsets".
|
|
If you want to create an outer offset, you need to combine number
|
|
of the operand with the following bit:
|
|
|
|
Please note that the outer offsets are meaningful only for
|
|
Motorola 680x0.
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
@param base: base of the offset as a linear address
|
|
If base == BADADDR then the current operand becomes non-offset
|
|
"""
|
|
return idaapi.set_offset(ea, n, base)
|
|
|
|
|
|
OPND_OUTER = idaapi.OPND_OUTER # outer offset base
|
|
|
|
|
|
def OpOffEx(ea, n, reftype, target, base, tdelta):
|
|
"""
|
|
Convert operand to a complex offset expression
|
|
This is a more powerful version of OpOff() function.
|
|
It allows to explicitly specify the reference type (off8,off16, etc)
|
|
and the expression target with a possible target delta.
|
|
The complex expressions are represented by IDA in the following form:
|
|
|
|
target + tdelta - base
|
|
|
|
If the target is not present, then it will be calculated using
|
|
|
|
target = operand_value - tdelta + base
|
|
|
|
The target must be present for LOW.. and HIGH.. reference types
|
|
|
|
@param ea: linear address of the instruction/data
|
|
@param n: number of operand to convert (the same as in OpOff)
|
|
@param reftype: one of REF_... constants
|
|
@param target: an explicitly specified expression target. if you don't
|
|
want to specify it, use -1. Please note that LOW... and
|
|
HIGH... reference type requre the target.
|
|
@param base: the offset base (a linear address)
|
|
@param tdelta: a displacement from the target which will be displayed
|
|
in the expression.
|
|
|
|
@return: success (boolean)
|
|
"""
|
|
return idaapi.op_offset(ea, n, reftype, target, base, tdelta)
|
|
|
|
|
|
REF_OFF8 = idaapi.REF_OFF8 # 8bit full offset
|
|
REF_OFF16 = idaapi.REF_OFF16 # 16bit full offset
|
|
REF_OFF32 = idaapi.REF_OFF32 # 32bit full offset
|
|
REF_LOW8 = idaapi.REF_LOW8 # low 8bits of 16bit offset
|
|
REF_LOW16 = idaapi.REF_LOW16 # low 16bits of 32bit offset
|
|
REF_HIGH8 = idaapi.REF_HIGH8 # high 8bits of 16bit offset
|
|
REF_HIGH16 = idaapi.REF_HIGH16 # high 16bits of 32bit offset
|
|
REF_VHIGH = idaapi.REF_VHIGH # high ph.high_fixup_bits of 32bit offset (processor dependent)
|
|
REF_VLOW = idaapi.REF_VLOW # low (32-ph.high_fixup_bits) of 32bit offset (processor dependent)
|
|
REF_OFF64 = idaapi.REF_OFF64 # 64bit full offset
|
|
REFINFO_RVA = 0x10 # based reference (rva)
|
|
REFINFO_PASTEND = 0x20 # reference past an item it may point to an nonexistitng
|
|
# do not destroy alignment dirs
|
|
REFINFO_NOBASE = 0x80 # offset base is a number
|
|
# that base have be any value
|
|
# nb: base xrefs are created only if base
|
|
# points to the middle of a segment
|
|
|
|
|
|
def OpSeg(ea, n):
|
|
"""
|
|
Convert operand to a segment expression
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
return idaapi.op_seg(ea, n)
|
|
|
|
|
|
def OpNumber(ea, n):
|
|
"""
|
|
Convert operand to a number (with default number base, radix)
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
return idaapi.op_num(ea, n)
|
|
|
|
|
|
def OpAlt(ea, n, str):
|
|
"""
|
|
Specify operand represenation manually.
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
@param str: a string represenation of the operand
|
|
|
|
@note: IDA will not check the specified operand, it will simply display
|
|
it instead of the orginal representation of the operand.
|
|
"""
|
|
return idaapi.set_forced_operand(ea, n, str)
|
|
|
|
|
|
def OpSign(ea, n):
|
|
"""
|
|
Change sign of the operand
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
return idaapi.toggle_signness(ea, n)
|
|
|
|
|
|
def OpNot(ea, n):
|
|
"""
|
|
Toggle the bitwise not operator for the operand
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
idaapi.toggle_bnot(ea, n)
|
|
return True
|
|
|
|
|
|
def OpEnumEx(ea, n, enumid, serial):
|
|
"""
|
|
Convert operand to a symbolic constant
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
@param enumid: id of enumeration type
|
|
@param serial: serial number of the constant in the enumeration
|
|
The serial numbers are used if there are more than
|
|
one symbolic constant with the same value in the
|
|
enumeration. In this case the first defined constant
|
|
get the serial number 0, then second 1, etc.
|
|
There could be 256 symbolic constants with the same
|
|
value in the enumeration.
|
|
"""
|
|
return idaapi.op_enum(ea, n, enumid, serial)
|
|
|
|
|
|
def OpStroffEx(ea, n, strid, delta):
|
|
"""
|
|
Convert operand to an offset in a structure
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
@param strid: id of a structure type
|
|
@param delta: struct offset delta. usually 0. denotes the difference
|
|
between the structure base and the pointer into the structure.
|
|
|
|
"""
|
|
path = idaapi.tidArray(1)
|
|
path[0] = strid
|
|
return idaapi.op_stroff(ea, n, path.cast(), 1, delta)
|
|
|
|
|
|
def OpStkvar(ea, n):
|
|
"""
|
|
Convert operand to a stack variable
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
"""
|
|
return idaapi.op_stkvar(ea, n)
|
|
|
|
|
|
def OpHigh(ea, n, target):
|
|
"""
|
|
Convert operand to a high offset
|
|
High offset is the upper 16bits of an offset.
|
|
This type is used by TMS320C6 processors (and probably by other
|
|
RISC processors too)
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand
|
|
- 0 - the first operand
|
|
- 1 - the second, third and all other operands
|
|
- -1 - all operands
|
|
@param target: the full value (all 32bits) of the offset
|
|
"""
|
|
return idaapi.op_offset(ea, n, idaapi.REF_HIGH16, target)
|
|
|
|
|
|
def MakeVar(ea):
|
|
"""
|
|
Mark the location as "variable"
|
|
|
|
@param ea: address to mark
|
|
|
|
@return: None
|
|
|
|
@note: All that IDA does is to mark the location as "variable".
|
|
Nothing else, no additional analysis is performed.
|
|
This function may disappear in the future.
|
|
"""
|
|
idaapi.doVar(ea, 1)
|
|
|
|
|
|
def ExtLinA(ea, n, line):
|
|
"""
|
|
Specify an additional line to display before the generated ones.
|
|
|
|
@param ea: linear address
|
|
@param n: number of anterior additioal line (0..MAX_ITEM_LINES)
|
|
@param line: the line to display
|
|
|
|
@return: None
|
|
|
|
@note: IDA displays additional lines from number 0 up to the first unexisting
|
|
additional line. So, if you specify additional line #150 and there is no
|
|
additional line #149, your line will not be displayed. MAX_ITEM_LINES is
|
|
defined in IDA.CFG
|
|
"""
|
|
idaapi.ExtraUpdate(ea, line, idaapi.E_PREV + n)
|
|
|
|
|
|
def ExtLinB(ea, n, line):
|
|
"""
|
|
Specify an additional line to display after the generated ones.
|
|
|
|
@param ea: linear address
|
|
@param n: number of posterior additioal line (0..MAX_ITEM_LINES)
|
|
@param line: the line to display
|
|
|
|
@return: None
|
|
|
|
@note: IDA displays additional lines from number 0 up to the first
|
|
unexisting additional line. So, if you specify additional line #150
|
|
and there is no additional line #149, your line will not be displayed.
|
|
MAX_ITEM_LINES is defined in IDA.CFG
|
|
"""
|
|
idaapi.ExtraUpdate(ea, line, idaapi.E_NEXT + n)
|
|
|
|
|
|
def DelExtLnA(ea, n):
|
|
"""
|
|
Delete an additional anterior line
|
|
|
|
@param ea: linear address
|
|
@param n: number of anterior additioal line (0..500)
|
|
|
|
@return: None
|
|
"""
|
|
idaapi.ExtraDel(ea, idaapi.E_PREV + n)
|
|
|
|
|
|
def DelExtLnB(ea, n):
|
|
"""
|
|
Delete an additional posterior line
|
|
|
|
@param ea: linear address
|
|
@param n: number of posterior additioal line (0..500)
|
|
|
|
@return: None
|
|
"""
|
|
idaapi.ExtraDel(ea, idaapi.E_NEXT + n)
|
|
|
|
|
|
def SetManualInsn(ea, insn):
|
|
"""
|
|
Specify instruction represenation manually.
|
|
|
|
@param ea: linear address
|
|
@param insn: a string represenation of the operand
|
|
|
|
@note: IDA will not check the specified instruction, it will simply
|
|
display it instead of the orginal representation.
|
|
"""
|
|
return idaapi.set_manual_insn(ea, insn)
|
|
|
|
|
|
def GetManualInsn(ea):
|
|
"""
|
|
Get manual representation of instruction
|
|
|
|
@param ea: linear address
|
|
|
|
@note: This function returns value set by SetManualInsn earlier.
|
|
"""
|
|
return idaapi.get_manual_insn(ea)
|
|
|
|
|
|
def PatchByte(ea, value):
|
|
"""
|
|
Change value of a program byte
|
|
|
|
@param ea: linear address
|
|
@param value: new value of the byte
|
|
|
|
@return: None
|
|
"""
|
|
return idaapi.patch_byte(ea, value)
|
|
|
|
|
|
def PatchWord(ea, value):
|
|
"""
|
|
Change value of a program word (2 bytes)
|
|
|
|
@param ea: linear address
|
|
@param value: new value of the word
|
|
"""
|
|
return idaapi.patch_word(ea, value)
|
|
|
|
|
|
def PatchDword(ea, value):
|
|
"""
|
|
Change value of a double word
|
|
|
|
@param ea: linear address
|
|
@param value: new value of the double word
|
|
"""
|
|
return idaapi.patch_long(ea, value)
|
|
|
|
|
|
def SetFlags(ea, flags):
|
|
"""
|
|
Set new value of flags
|
|
This function should not used be used directly if possible.
|
|
It changes properties of a program byte and if misused, may lead to
|
|
very-very strange results.
|
|
|
|
@param ea: adress
|
|
@param flags: new flags value
|
|
"""
|
|
return idaapi.setFlags(ea, flags)
|
|
|
|
_REGMAP = {
|
|
'es' : idaapi.R_es,
|
|
'cs' : idaapi.R_cs,
|
|
'ss' : idaapi.R_ss,
|
|
'ds' : idaapi.R_ds,
|
|
'fs' : idaapi.R_fs,
|
|
'gs' : idaapi.R_gs
|
|
}
|
|
|
|
def SetReg(ea, reg, value):
|
|
"""
|
|
Set value of a segment register.
|
|
|
|
@param ea: linear address
|
|
@param reg: name of a register, like "cs", "ds", "es", etc.
|
|
@param value: new value of the segment register.
|
|
|
|
@note: IDA keeps tracks of all the points where segment register change their
|
|
values. This function allows you to specify the correct value of a segment
|
|
register if IDA is not able to find the corrent value.
|
|
|
|
"""
|
|
if _REGMAP.has_key(reg):
|
|
return idaapi.splitSRarea1(ea, _REGMAP[reg], value, 2)
|
|
else:
|
|
return False
|
|
|
|
|
|
def AutoMark2(start, end, queuetype):
|
|
"""
|
|
Plan to perform an action in the future.
|
|
This function will put your request to a special autoanalysis queue.
|
|
Later IDA will retrieve the request from the queue and process
|
|
it. There are several autoanalysis queue types. IDA will process all
|
|
queries from the first queue and then switch to the second queue, etc.
|
|
"""
|
|
return idaapi.auto_mark_range(start, end, queuetype)
|
|
|
|
|
|
def AutoUnmark(start, end, queuetype):
|
|
"""
|
|
Remove range of addresses from a queue.
|
|
"""
|
|
return autoUnmark(start, end, queuetype)
|
|
|
|
|
|
def AutoMark(ea,qtype):
|
|
"""
|
|
Plan to analyze an address
|
|
"""
|
|
return AutoMark2(ea,ea+1,qtype)
|
|
|
|
AU_UNK = idaapi.AU_UNK # make unknown
|
|
AU_CODE = idaapi.AU_CODE # convert to instruction
|
|
AU_PROC = idaapi.AU_PROC # make function
|
|
AU_USED = idaapi.AU_USED # reanalyze
|
|
AU_LIBF = idaapi.AU_LIBF # apply a flirt signature (the current signature!)
|
|
AU_FINAL = idaapi.AU_FINAL # coagulate unexplored items
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# P R O D U C E O U T P U T F I L E S
|
|
#----------------------------------------------------------------------------
|
|
|
|
def GenerateFile(type, path, ea1, ea2, flags):
|
|
"""
|
|
Generate an output file
|
|
|
|
@param type: type of output file. One of OFILE_... symbols. See below.
|
|
@param path: the output file path (will be overwritten!)
|
|
@param ea1: start address. For some file types this argument is ignored
|
|
@param ea2: end address. For some file types this argument is ignored
|
|
@param flags: bit combination of GENFLG_...
|
|
|
|
@returns: number of the generated lines.
|
|
-1 if an error occured
|
|
OFILE_EXE: 0-can't generate exe file, 1-ok
|
|
"""
|
|
f = idaapi.fopenWT(path)
|
|
|
|
if f:
|
|
retval = idaapi.gen_file(type, f, ea1, ea2, flags)
|
|
idaapi.eclose(f)
|
|
return retval
|
|
else:
|
|
return -1
|
|
|
|
|
|
# output file types:
|
|
OFILE_MAP = idaapi.OFILE_MAP
|
|
OFILE_EXE = idaapi.OFILE_EXE
|
|
OFILE_IDC = idaapi.OFILE_IDC
|
|
OFILE_LST = idaapi.OFILE_LST
|
|
OFILE_ASM = idaapi.OFILE_ASM
|
|
OFILE_DIF = idaapi.OFILE_DIF
|
|
|
|
# output control flags:
|
|
GENFLG_MAPSEG = idaapi.GENFLG_MAPSEG # map: generate map of segments
|
|
GENFLG_MAPNAME = idaapi.GENFLG_MAPNAME # map: include dummy names
|
|
GENFLG_MAPDMNG = idaapi.GENFLG_MAPDMNG # map: demangle names
|
|
GENFLG_MAPLOC = idaapi.GENFLG_MAPLOC # map: include local names
|
|
GENFLG_IDCTYPE = idaapi.GENFLG_IDCTYPE # idc: gen only information about types
|
|
GENFLG_ASMTYPE = idaapi.GENFLG_ASMTYPE # asm&lst: gen information about types too
|
|
GENFLG_GENHTML = idaapi.GENFLG_GENHTML # asm&lst: generate html (gui version only)
|
|
GENFLG_ASMINC = idaapi.GENFLG_ASMINC # asm&lst: gen information only about types
|
|
|
|
#----------------------------------------------------------------------------
|
|
# C O M M O N I N F O R M A T I O N
|
|
#----------------------------------------------------------------------------
|
|
def GetIdaDirectory ():
|
|
"""
|
|
Get IDA directory
|
|
|
|
This function returns the directory where IDA.EXE resides
|
|
"""
|
|
return idaapi.idadir()
|
|
|
|
|
|
def GetInputFile():
|
|
"""
|
|
Get input file name
|
|
|
|
This function returns name of the file being disassembled
|
|
"""
|
|
return idaapi.get_root_filename()
|
|
|
|
|
|
def GetInputFilePath():
|
|
"""
|
|
Get input file path
|
|
|
|
This function returns the full path of the file being disassembled
|
|
"""
|
|
return idaapi.get_input_file_path()
|
|
|
|
|
|
def GetIdbPath():
|
|
"""
|
|
Get IDB full path
|
|
|
|
This function returns full path of the current IDB database
|
|
"""
|
|
return idaapi.cvar.database_idb
|
|
|
|
|
|
def GetFlags(ea):
|
|
"""
|
|
Get internal flags
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 32-bit value of internal flags. See start of IDC.IDC file
|
|
for explanations.
|
|
"""
|
|
return idaapi.getFlags(ea)
|
|
|
|
|
|
def Byte(ea):
|
|
"""
|
|
Get value of program byte
|
|
|
|
@param ea: linear address
|
|
|
|
@return: value of byte. If byte has no value then returns 0xFF
|
|
If the current byte size is different from 8 bits, then the returned value
|
|
might have more 1's.
|
|
To check if a byte has a value, use functions hasValue(GetFlags(ea))
|
|
"""
|
|
return idaapi.get_byte(ea)
|
|
|
|
|
|
def GetOriginalByte(ea):
|
|
"""
|
|
Get original value of program byte
|
|
|
|
@param ea: linear address
|
|
|
|
@return: the original value of byte before any patch applied to it
|
|
"""
|
|
return idaapi.get_original_byte(ea)
|
|
|
|
|
|
def Word(ea):
|
|
"""
|
|
Get value of program word (2 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: the value of the word. If word has no value then returns 0xFFFF
|
|
If the current byte size is different from 8 bits, then the returned value
|
|
might have more 1's.
|
|
"""
|
|
return idaapi.get_word(ea)
|
|
|
|
|
|
def Dword(ea):
|
|
"""
|
|
Get value of program double word (4 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: the value of the double word. If double word has no value
|
|
then returns 0xFFFFFFFF.
|
|
"""
|
|
return idaapi.get_long(ea)
|
|
|
|
|
|
def GetFloat(ea):
|
|
"""
|
|
Get value of a floating point number (4 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: float
|
|
"""
|
|
str = chr(idaapi.get_byte(ea)) + \
|
|
chr(idaapi.get_byte(ea+1)) + \
|
|
chr(idaapi.get_byte(ea+2)) + \
|
|
chr(idaapi.get_byte(ea+3))
|
|
|
|
return struct.unpack("f", str)[0]
|
|
|
|
|
|
def GetDouble(ea):
|
|
"""
|
|
Get value of a floating point number (8 bytes)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: double
|
|
"""
|
|
str = chr(idaapi.get_byte(ea)) + \
|
|
chr(idaapi.get_byte(ea+1)) + \
|
|
chr(idaapi.get_byte(ea+2)) + \
|
|
chr(idaapi.get_byte(ea+3)) + \
|
|
chr(idaapi.get_byte(ea+4)) + \
|
|
chr(idaapi.get_byte(ea+5)) + \
|
|
chr(idaapi.get_byte(ea+6)) + \
|
|
chr(idaapi.get_byte(ea+7))
|
|
|
|
return struct.unpack("d", str)[0]
|
|
|
|
|
|
def LocByName(name):
|
|
"""
|
|
Get linear address of a name
|
|
|
|
@param name: name of program byte
|
|
|
|
@return: address of the name
|
|
badaddr - no such name
|
|
"""
|
|
return idaapi.get_name_ea(BADADDR, name)
|
|
|
|
|
|
def LocByNameEx(fromaddr, name):
|
|
"""
|
|
Get linear address of a name
|
|
|
|
@param fromaddr: the referring address. Allows to retrieve local label
|
|
addresses in functions. If a local name is not found,
|
|
then address of a global name is returned.
|
|
|
|
@param name: name of program byte
|
|
|
|
@return: address of the name (BADADDR - no such name)
|
|
"""
|
|
return idaapi.get_name_ea(fromaddr, name)
|
|
|
|
|
|
def SegByBase(base):
|
|
"""
|
|
Get segment by segment base
|
|
|
|
@param base: segment base paragraph or selector
|
|
|
|
@return: linear address of the start of the segment or BADADDR
|
|
if no such segment
|
|
"""
|
|
sel = idaapi.find_selector(base)
|
|
seg = idaapi.get_segm_by_sel(sel)
|
|
|
|
if seg:
|
|
return seg.startEA
|
|
else:
|
|
return BADADDR
|
|
|
|
|
|
def ScreenEA():
|
|
"""
|
|
Get linear address of cursor
|
|
"""
|
|
return idaapi.get_screen_ea()
|
|
|
|
|
|
def GetCurrentLine():
|
|
"""
|
|
Get the disassembly line at the cursor
|
|
|
|
@return: string
|
|
"""
|
|
return idaapi.tag_remove(idaapi.get_curline())
|
|
|
|
|
|
def SelStart():
|
|
"""
|
|
Get start address of the selected area
|
|
returns BADADDR - the user has not selected an area
|
|
"""
|
|
selection, startaddr, endaddr = idaapi.read_selection()
|
|
|
|
if selection == 1:
|
|
return startaddr
|
|
else:
|
|
return BADADDR
|
|
|
|
|
|
def SelEnd():
|
|
"""
|
|
Get end address of the selected area
|
|
|
|
@return: BADADDR - the user has not selected an area
|
|
"""
|
|
selection, startaddr, endaddr = idaapi.read_selection()
|
|
|
|
if selection == 1:
|
|
return endaddr
|
|
else:
|
|
return BADADDR
|
|
|
|
|
|
def GetReg(ea, reg):
|
|
"""
|
|
Get value of segment register at the specified address
|
|
|
|
@param ea: linear address
|
|
@param reg: name of segment register
|
|
|
|
@return: the value of the segment register or 0xFFFF on error
|
|
|
|
@note: The segment registers in 32bit program usually contain selectors,
|
|
so to get paragraph pointed by the segment register you need to
|
|
call AskSelector() function.
|
|
"""
|
|
if _REGMAP.has_key(reg):
|
|
return idaapi.getSR(ea, _REGMAP[reg]) & 0xFFFF
|
|
else:
|
|
return False
|
|
|
|
|
|
def NextAddr(ea):
|
|
"""
|
|
Get next address in the program
|
|
|
|
@param ea: linear address
|
|
|
|
@return: BADADDR - the specified address in the last used address
|
|
"""
|
|
return idaapi.nextaddr(ea)
|
|
|
|
|
|
def PrevAddr(ea):
|
|
"""
|
|
Get previous address in the program
|
|
|
|
@param ea: linear address
|
|
|
|
@return: BADADDR - the specified address in the first address
|
|
"""
|
|
return idaapi.prevaddr(ea)
|
|
|
|
|
|
def NextHead(ea, maxea):
|
|
"""
|
|
Get next defined item (instruction or data) in the program
|
|
|
|
@param ea: linear address to start search from
|
|
@param maxea: the search will stop at the address
|
|
maxea is not included in the search range
|
|
|
|
@return: BADADDR - no (more) defined items
|
|
"""
|
|
return idaapi.next_head(ea, maxea)
|
|
|
|
|
|
def PrevHead(ea, minea):
|
|
"""
|
|
Get previous defined item (instruction or data) in the program
|
|
|
|
@param ea: linear address to start search from
|
|
@param minea: the search will stop at the address
|
|
minea is included in the search range
|
|
|
|
@return: BADADDR - no (more) defined items
|
|
"""
|
|
return idaapi.prev_head(ea, minea)
|
|
|
|
|
|
def NextNotTail(ea):
|
|
"""
|
|
Get next not-tail address in the program
|
|
This function searches for the next displayable address in the program.
|
|
The tail bytes of instructions and data are not displayable.
|
|
|
|
@param ea: linear address
|
|
|
|
@return: BADADDR - no (more) not-tail addresses
|
|
"""
|
|
return idaapi.next_not_tail(ea)
|
|
|
|
|
|
def PrevNotTail(ea):
|
|
"""
|
|
Get previous not-tail address in the program
|
|
This function searches for the previous displayable address in the program.
|
|
The tail bytes of instructions and data are not displayable.
|
|
|
|
@param ea: linear address
|
|
|
|
@return: BADADDR - no (more) not-tail addresses
|
|
"""
|
|
return idaapi.prev_not_tail(ea)
|
|
|
|
|
|
def ItemEnd(ea):
|
|
"""
|
|
Get address of the end of the item (instruction or data)
|
|
|
|
@param ea: linear address
|
|
|
|
@return: address past end of the item at 'ea'
|
|
"""
|
|
return idaapi.get_item_end(ea)
|
|
|
|
|
|
def ItemSize(ea):
|
|
"""
|
|
Get size of instruction or data item in bytes
|
|
|
|
@param ea: linear address
|
|
|
|
@return: 1..n
|
|
"""
|
|
return idaapi.get_item_end(ea) - ea
|
|
|
|
|
|
def NameEx(fromaddr, ea):
|
|
"""
|
|
Get visible name of program byte
|
|
|
|
This function returns name of byte as it is displayed on the screen.
|
|
If a name contains illegal characters, IDA replaces them by the
|
|
substitution character during displaying. See IDA.CFG for the
|
|
definition of the substitution character.
|
|
|
|
@param fromaddr: the referring address. May be BADADDR.
|
|
Allows to retrieve local label addresses in functions.
|
|
If a local name is not found, then a global name is
|
|
returned.
|
|
@param ea: linear address
|
|
|
|
@return: "" - byte has no name
|
|
"""
|
|
name = idaapi.get_name(fromaddr, ea)
|
|
|
|
if not name:
|
|
return ""
|
|
else:
|
|
return name
|
|
|
|
|
|
def GetTrueNameEx(fromaddr, ea):
|
|
"""
|
|
Get true name of program byte
|
|
|
|
This function returns name of byte as is without any replacements.
|
|
|
|
@param fromaddr: the referring address. May be BADADDR.
|
|
Allows to retrieve local label addresses in functions.
|
|
If a local name is not found, then a global name is returned.
|
|
@param ea: linear address
|
|
|
|
@return: "" - byte has no name
|
|
"""
|
|
name = idaapi.get_true_name(fromaddr, ea)
|
|
|
|
if not name:
|
|
return ""
|
|
else:
|
|
return name
|
|
|
|
|
|
def Demangle(name, disable_mask):
|
|
"""
|
|
Demangle a name
|
|
|
|
@param name: name to demangle
|
|
@param disable_mask: a mask that tells how to demangle the name
|
|
it is a good idea to get this mask using
|
|
GetLongPrm(INF_SHORT_DN) or GetLongPrm(INF_LONG_DN)
|
|
|
|
@return: a demangled name
|
|
If the input name cannot be demangled, returns None
|
|
"""
|
|
return idaapi.demangle_name(name, disable_mask)
|
|
|
|
|
|
def GetDisasm(ea):
|
|
"""
|
|
Get disassembly line
|
|
|
|
@param ea: linear address of instruction
|
|
|
|
@return: "" - no instruction at the specified location
|
|
|
|
@note: this function may not return exactly the same mnemonics
|
|
as you see on the screen.
|
|
"""
|
|
text = idaapi.generate_disasm_line(ea)
|
|
if text:
|
|
return idaapi.tag_remove(text)
|
|
else:
|
|
return ""
|
|
|
|
|
|
def GetMnem(ea):
|
|
"""
|
|
Get instruction mnemonics
|
|
|
|
@param ea: linear address of instruction
|
|
|
|
@return: "" - no instruction at the specified location
|
|
|
|
@note: this function may not return exactly the same mnemonics
|
|
as you see on the screen.
|
|
"""
|
|
res = idaapi.ua_mnem(ea)
|
|
|
|
if not res:
|
|
return ""
|
|
else:
|
|
return res
|
|
|
|
|
|
def GetOpnd(ea, n):
|
|
"""
|
|
Get operand of an instruction
|
|
|
|
@param ea: linear address of instruction
|
|
@param n: number of operand:
|
|
0 - the first operand
|
|
1 - the second operand
|
|
|
|
@return: the current text representation of operand
|
|
"""
|
|
res = idaapi.ua_outop(ea, n)
|
|
|
|
if not res:
|
|
return ""
|
|
else:
|
|
return idaapi.tag_remove(res)
|
|
|
|
|
|
def GetOpType(ea, n):
|
|
"""
|
|
Get type of instruction operand
|
|
|
|
@param ea: linear address of instruction
|
|
@param n: number of operand:
|
|
0 - the first operand
|
|
1 - the second operand
|
|
|
|
@return:
|
|
- -1 bad operand number passed
|
|
- 0 None
|
|
- 1 General Register
|
|
- 2 Memory Reference
|
|
- 3 Base + Index
|
|
- 4 Base + Index + Displacement
|
|
- 5 Immediate
|
|
- 6 Immediate Far Address (with a Segment Selector)
|
|
- 7 Immediate Near Address
|
|
|
|
B{PC:}
|
|
|
|
- 8 386 Trace register
|
|
- 9 386 Debug register
|
|
- 10 386 Control register
|
|
- 11 FPP register
|
|
- 12 MMX register
|
|
|
|
B{8051:}
|
|
|
|
- 8 bit
|
|
- 9 /bit
|
|
- 10 bit
|
|
|
|
B{80196:}
|
|
|
|
- 8 [intmem]
|
|
- 9 [intmem]+
|
|
- 10 offset[intmem]
|
|
- 11 bit
|
|
|
|
B{ARM:}
|
|
|
|
- 8 shifted register
|
|
- 9 MLA operands
|
|
- 10 register list (for LDM/STM)
|
|
- 11 coprocessor register list (for CDP)
|
|
- 12 coprocessor register (for LDC/STC)
|
|
|
|
B{PPC:}
|
|
|
|
- 8 SPR
|
|
- 9 2 FPRs
|
|
- 10 SH & MB & ME
|
|
- 11 CR field
|
|
- 12 CR bit
|
|
|
|
B{TMS320C5:}
|
|
|
|
- 8 bit
|
|
- 9 bit not
|
|
- 10 condition
|
|
|
|
B{TMS320C6:}
|
|
|
|
- 8 register pair (A1:A0..B15:B14)
|
|
|
|
B{Z8:}
|
|
|
|
- 8 @intmem
|
|
- 9 @Rx
|
|
|
|
B{Z80:}
|
|
|
|
- 8 condition
|
|
"""
|
|
inslen = idaapi.ua_code(ea)
|
|
|
|
if inslen == 0:
|
|
return -1
|
|
|
|
insn = idaapi.get_current_instruction()
|
|
|
|
if not insn:
|
|
return -1
|
|
|
|
op = idaapi.get_instruction_operand(insn, n)
|
|
|
|
if not op:
|
|
return -1
|
|
|
|
return op.type
|
|
|
|
|
|
def GetOperandValue(ea, n):
|
|
"""
|
|
Get number used in the operand
|
|
|
|
This function returns an immediate number used in the operand
|
|
|
|
@param ea: linear address of instruction
|
|
@param n: the operand number
|
|
|
|
@return: value
|
|
operand is an immediate value => immediate value
|
|
operand has a displacement => displacement
|
|
operand is a direct memory ref => memory address
|
|
operand is a register => register number
|
|
operand is a register phrase => phrase number
|
|
otherwise => -1
|
|
"""
|
|
inslen = idaapi.ua_code(ea)
|
|
|
|
if inslen == 0:
|
|
return -1
|
|
|
|
insn = idaapi.get_current_instruction()
|
|
|
|
if not insn:
|
|
return -1
|
|
|
|
op = idaapi.get_instruction_operand(insn, n)
|
|
|
|
if not op:
|
|
return -1
|
|
|
|
return op.value
|
|
|
|
|
|
def LineA(ea, num):
|
|
"""
|
|
Get anterior line
|
|
|
|
@param ea: linear address
|
|
@param num: number of anterior line (0..MAX_ITEM_LINES)
|
|
MAX_ITEM_LINES is defined in IDA.CFG
|
|
|
|
@return: anterior line string
|
|
"""
|
|
return idaapi.ExtraGet(ea, E_PREV + num)
|
|
|
|
|
|
def LineB(ea, num):
|
|
"""
|
|
Get posterior line
|
|
|
|
@param ea: linear address
|
|
@param num: number of posterior line (0..MAX_ITEM_LINES)
|
|
|
|
@return: posterior line string
|
|
"""
|
|
return idaapi.ExtraGet(ea, E_NEXT + num)
|
|
|
|
|
|
def GetCommentEx(ea, repeatable):
|
|
"""
|
|
Get regular indented comment
|
|
|
|
@param ea: linear address
|
|
|
|
@return: string or None if it fails
|
|
"""
|
|
return idaapi.get_cmt(ea, repeatable)
|
|
|
|
|
|
def AltOp(ea, n):
|
|
"""
|
|
Get manually entered operand string
|
|
|
|
@param ea: linear address
|
|
@param n: number of operand:
|
|
0 - the first operand
|
|
1 - the second operand
|
|
|
|
@return: string or None if it fails
|
|
"""
|
|
return idaapi.get_forced_operand(ea, n)
|
|
|
|
|
|
def GetStringType(ea):
|
|
"""
|
|
Get string type
|
|
|
|
@param ea: linear address
|
|
|
|
Returns one of ASCSTR_... constants
|
|
"""
|
|
ti = idaapi.typeinfo_t()
|
|
|
|
if idaapi.get_typeinfo(ea, 0, GetFlags(ea), ti):
|
|
return ti.strtype
|
|
else:
|
|
return None
|
|
|
|
ASCSTR_C = idaapi.ASCSTR_TERMCHR # C-style ASCII string
|
|
ASCSTR_PASCAL = idaapi.ASCSTR_PASCAL # Pascal-style ASCII string (length byte)
|
|
ASCSTR_LEN2 = idaapi.ASCSTR_LEN2 # Pascal-style, length is 2 bytes
|
|
ASCSTR_UNICODE = idaapi.ASCSTR_UNICODE # Unicode string
|
|
ASCSTR_LEN4 = idaapi.ASCSTR_LEN4 # Pascal-style, length is 4 bytes
|
|
ASCSTR_ULEN2 = idaapi.ASCSTR_ULEN2 # Pascal-style Unicode, length is 2 bytes
|
|
ASCSTR_ULEN4 = idaapi.ASCSTR_ULEN4 # Pascal-style Unicode, length is 4 bytes
|
|
ASCSTR_LAST = idaapi.ASCSTR_LAST # Last string type
|
|
|
|
|
|
# The following functions search for the specified byte
|
|
# ea - address to start from
|
|
# flag is combination of the following bits
|
|
|
|
# returns BADADDR - not found
|
|
def FindVoid (ea, flag): return idaapi.find_void(ea, flag)
|
|
def FindCode (ea, flag): return idaapi.find_code(ea, flag)
|
|
def FindData (ea, flag): return idaapi.find_data(ea, flag)
|
|
def FindUnexplored (ea, flag): return idaapi.find_unknown(ea, flag)
|
|
def FindExplored (ea, flag): return idaapi.find_defined(ea, flag)
|
|
def FindImmediate (ea, flag, value): return idaapi.find_imm(ea, flag, value)
|
|
|
|
SEARCH_UP = idaapi.SEARCH_UP # search backward
|
|
SEARCH_DOWN = idaapi.SEARCH_DOWN # search forward
|
|
SEARCH_NEXT = idaapi.SEARCH_NEXT # search next occurence
|
|
SEARCH_CASE = idaapi.SEARCH_CASE # search case-sensitive
|
|
# (only for bin&txt search)
|
|
SEARCH_REGEX = idaapi.SEARCH_REGEX # enable regular expressions (only for text)
|
|
SEARCH_NOBRK = idaapi.SEARCH_NOBRK # don't test ctrl-break
|
|
SEARCH_NOSHOW = idaapi.SEARCH_NOSHOW # don't display the search progress
|
|
|
|
def FindText(ea, flag, y, x, str):
|
|
"""
|
|
@param ea: start address
|
|
@param flag: combination of SEARCH_* flags
|
|
@param y: number of text line at ea to start from (0..MAX_ITEM_LINES)
|
|
@param x: coordinate in this line
|
|
@param str: search string
|
|
|
|
@return: ea of result or BADADDR if not found
|
|
"""
|
|
return idaapi.find_text(ea, y, x, str, flag)
|
|
|
|
|
|
def FindBinary(ea, flag, str, radix=16):
|
|
"""
|
|
@param ea: start address
|
|
@param flag: combination of SEARCH_* flags
|
|
@param str: a string as a user enters it for Search Text in Core
|
|
@param radix: radix of the numbers (default=16)
|
|
|
|
@return: ea of result or BADADDR if not found
|
|
|
|
@note: Example: "41 42" - find 2 bytes 41h,42h (radix is 16)
|
|
"""
|
|
return idaapi.find_binary(ea, BADADDR, str, radix, flag)
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# G L O B A L S E T T I N G S M A N I P U L A T I O N
|
|
#----------------------------------------------------------------------------
|
|
|
|
# The following functions allow you to set/get common parameters.
|
|
# Please note that not all parameters can be set directly.
|
|
|
|
def GetLongPrm (offset):
|
|
"""
|
|
"""
|
|
return _IDC_GetAttr(idaapi.cvar.inf, _INFMAP, offset)
|
|
|
|
|
|
def GetShortPrm(offset):
|
|
return GetLongPrm(offset)
|
|
|
|
|
|
def GetCharPrm (offset):
|
|
return GetLongPrm(offset)
|
|
|
|
|
|
def SetLongPrm (offset, value):
|
|
"""
|
|
"""
|
|
return _IDC_SetAttr(idaapi.cvar.inf, _INFMAP, offset, value)
|
|
|
|
|
|
def SetShortPrm(offset, value):
|
|
SetLongPrm(offset, value)
|
|
|
|
|
|
def SetCharPrm (offset, value):
|
|
SetLongPrm(offset, value)
|
|
|
|
|
|
INF_VERSION = 3 # short; Version of database
|
|
INF_PROCNAME = 5 # char[8]; Name of current processor
|
|
INF_LFLAGS = 13 # char; IDP-dependent flags
|
|
LFLG_PC_FPP = 0x01 # decode floating point processor
|
|
# instructions?
|
|
LFLG_PC_FLAT = 0x02 # Flat model?
|
|
LFLG_64BIT = 0x04 # 64-bit program?
|
|
LFLG_DBG_NOPATH = 0x08 # do not store input full path
|
|
LFLG_SNAPSHOT = 0x10 # is memory snapshot?
|
|
# in debugger process options
|
|
INF_DEMNAMES = 14 # char; display demangled names as:
|
|
DEMNAM_CMNT = 0 # comments
|
|
DEMNAM_NAME = 1 # regular names
|
|
DEMNAM_NONE = 2 # don't display
|
|
INF_FILETYPE = 15 # short; type of input file (see ida.hpp)
|
|
FT_EXE_OLD = 0 # MS DOS EXE File (obsolete)
|
|
FT_COM_OLD = 1 # MS DOS COM File (obsolete)
|
|
FT_BIN = 2 # Binary File
|
|
FT_DRV = 3 # MS DOS Driver
|
|
FT_WIN = 4 # New Executable (NE)
|
|
FT_HEX = 5 # Intel Hex Object File
|
|
FT_MEX = 6 # MOS Technology Hex Object File
|
|
FT_LX = 7 # Linear Executable (LX)
|
|
FT_LE = 8 # Linear Executable (LE)
|
|
FT_NLM = 9 # Netware Loadable Module (NLM)
|
|
FT_COFF = 10 # Common Object File Format (COFF)
|
|
FT_PE = 11 # Portable Executable (PE)
|
|
FT_OMF = 12 # Object Module Format
|
|
FT_SREC = 13 # R-records
|
|
FT_ZIP = 14 # ZIP file (this file is never loaded to IDA database)
|
|
FT_OMFLIB = 15 # Library of OMF Modules
|
|
FT_AR = 16 # ar library
|
|
FT_LOADER = 17 # file is loaded using LOADER DLL
|
|
FT_ELF = 18 # Executable and Linkable Format (ELF)
|
|
FT_W32RUN = 19 # Watcom DOS32 Extender (W32RUN)
|
|
FT_AOUT = 20 # Linux a.out (AOUT)
|
|
FT_PRC = 21 # PalmPilot program file
|
|
FT_EXE = 22 # MS DOS EXE File
|
|
FT_COM = 23 # MS DOS COM File
|
|
FT_AIXAR = 24 # AIX ar library
|
|
INF_FCORESIZ = 17
|
|
INF_CORESTART = 21
|
|
INF_OSTYPE = 25 # short; FLIRT: OS type the program is for
|
|
OSTYPE_MSDOS = 0x0001
|
|
OSTYPE_WIN = 0x0002
|
|
OSTYPE_OS2 = 0x0004
|
|
OSTYPE_NETW = 0x0008
|
|
INF_APPTYPE = 27 # short; FLIRT: Application type
|
|
APPT_CONSOLE = 0x0001 # console
|
|
APPT_GRAPHIC = 0x0002 # graphics
|
|
APPT_PROGRAM = 0x0004 # EXE
|
|
APPT_LIBRARY = 0x0008 # DLL
|
|
APPT_DRIVER = 0x0010 # DRIVER
|
|
APPT_1THREAD = 0x0020 # Singlethread
|
|
APPT_MTHREAD = 0x0040 # Multithread
|
|
APPT_16BIT = 0x0080 # 16 bit application
|
|
APPT_32BIT = 0x0100 # 32 bit application
|
|
INF_START_SP = 29 # long; SP register value at the start of
|
|
# program execution
|
|
INF_START_AF = 33 # short; Analysis flags:
|
|
AF_FIXUP = 0x0001 # Create offsets and segments using fixup info
|
|
AF_MARKCODE = 0x0002 # Mark typical code sequences as code
|
|
AF_UNK = 0x0004 # Delete instructions with no xrefs
|
|
AF_CODE = 0x0008 # Trace execution flow
|
|
AF_PROC = 0x0010 # Create functions if call is present
|
|
AF_USED = 0x0020 # Analyze and create all xrefs
|
|
AF_FLIRT = 0x0040 # Use flirt signatures
|
|
AF_PROCPTR = 0x0080 # Create function if data xref data->code32 exists
|
|
AF_JFUNC = 0x0100 # Rename jump functions as j_...
|
|
AF_NULLSUB = 0x0200 # Rename empty functions as nullsub_...
|
|
AF_LVAR = 0x0400 # Create stack variables
|
|
AF_TRACE = 0x0800 # Trace stack pointer
|
|
AF_ASCII = 0x1000 # Create ascii string if data xref exists
|
|
AF_IMMOFF = 0x2000 # Convert 32bit instruction operand to offset
|
|
AF_DREFOFF = 0x4000 # Create offset if data xref to seg32 exists
|
|
AF_FINAL = 0x8000 # Final pass of analysis
|
|
INF_START_IP = 35 # long; IP register value at the start of
|
|
# program execution
|
|
INF_BEGIN_EA = 39 # long; Linear address of program entry point
|
|
INF_MIN_EA = 43 # long; The lowest address used
|
|
# in the program
|
|
INF_MAX_EA = 47 # long; The highest address used
|
|
# in the program - = 1
|
|
INF_OMIN_EA = 51
|
|
INF_OMAX_EA = 55
|
|
INF_LOW_OFF = 59 # long; low limit of voids
|
|
INF_HIGH_OFF = 63 # long; high limit of voids
|
|
INF_MAXREF = 67 # long; max xref depth
|
|
INF_ASCII_BREAK = 71 # char; ASCII line break symbol
|
|
INF_WIDE_HIGH_BYTE_FIRST = 72
|
|
INF_INDENT = 73 # char; Indention for instructions
|
|
INF_COMMENT = 74 # char; Indention for comments
|
|
INF_XREFNUM = 75 # char; Number of references to generate
|
|
# = 0 - xrefs wont be generated at all
|
|
INF_ENTAB = 76 # char; Use '\t' chars in the output file?
|
|
INF_SPECSEGS = 77
|
|
INF_VOIDS = 78 # char; Display void marks?
|
|
INF_SHOWAUTO = 80 # char; Display autoanalysis indicator?
|
|
INF_AUTO = 81 # char; Autoanalysis is enabled?
|
|
INF_BORDER = 82 # char; Generate borders?
|
|
INF_NULL = 83 # char; Generate empty lines?
|
|
INF_GENFLAGS = 84 # char; General flags:
|
|
INFFL_LZERO = 0x01 # generate leading zeroes in numbers
|
|
INF_SHOWPREF = 85 # char; Show line prefixes?
|
|
INF_PREFSEG = 86 # char; line prefixes with segment name?
|
|
INF_ASMTYPE = 87 # char; target assembler number (0..n)
|
|
INF_BASEADDR = 88 # long; base paragraph of the program
|
|
INF_XREFS = 92 # char; xrefs representation:
|
|
SW_SEGXRF = 0x01 # show segments in xrefs?
|
|
SW_XRFMRK = 0x02 # show xref type marks?
|
|
SW_XRFFNC = 0x04 # show function offsets?
|
|
SW_XRFVAL = 0x08 # show xref values? (otherwise-"...")
|
|
INF_BINPREF = 93 # short; # of instruction bytes to show
|
|
# in line prefix
|
|
INF_CMTFLAG = 95 # char; comments:
|
|
SW_RPTCMT = 0x01 # show repeatable comments?
|
|
SW_ALLCMT = 0x02 # comment all lines?
|
|
SW_NOCMT = 0x04 # no comments at all
|
|
SW_LINNUM = 0x08 # show source line numbers
|
|
SW_MICRO = 0x10 # show microcode (if implemented)
|
|
INF_NAMETYPE = 96 # char; dummy names represenation type
|
|
NM_REL_OFF = 0
|
|
NM_PTR_OFF = 1
|
|
NM_NAM_OFF = 2
|
|
NM_REL_EA = 3
|
|
NM_PTR_EA = 4
|
|
NM_NAM_EA = 5
|
|
NM_EA = 6
|
|
NM_EA4 = 7
|
|
NM_EA8 = 8
|
|
NM_SHORT = 9
|
|
NM_SERIAL = 10
|
|
INF_SHOWBADS = 97 # char; show bad instructions?
|
|
# an instruction is bad if it appears
|
|
# in the ash.badworks array
|
|
|
|
INF_PREFFLAG = 98 # char; line prefix type:
|
|
PREF_SEGADR = 0x01 # show segment addresses?
|
|
PREF_FNCOFF = 0x02 # show function offsets?
|
|
PREF_STACK = 0x04 # show stack pointer?
|
|
|
|
INF_PACKBASE = 99 # char; pack database?
|
|
|
|
INF_ASCIIFLAGS = 100 # uchar; ascii flags
|
|
ASCF_GEN = 0x01 # generate ASCII names?
|
|
ASCF_AUTO = 0x02 # ASCII names have 'autogenerated' bit?
|
|
ASCF_SERIAL = 0x04 # generate serial names?
|
|
ASCF_COMMENT = 0x10 # generate auto comment for ascii references?
|
|
ASCF_SAVECASE = 0x20 # preserve case of ascii strings for identifiers
|
|
|
|
INF_LISTNAMES = 101 # uchar; What names should be included in the list?
|
|
LN_NORMAL = 0x01 # normal names
|
|
LN_PUBLIC = 0x02 # public names
|
|
LN_AUTO = 0x04 # autogenerated names
|
|
LN_WEAK = 0x08 # weak names
|
|
|
|
INF_ASCIIPREF = 102 # char[16];ASCII names prefix
|
|
INF_ASCIISERNUM = 118 # ulong; serial number
|
|
INF_ASCIIZEROES = 122 # char; leading zeroes
|
|
INF_MF = 126 # uchar; Byte order: 1==MSB first
|
|
INF_ORG = 127 # char; Generate 'org' directives?
|
|
INF_ASSUME = 128 # char; Generate 'assume' directives?
|
|
INF_CHECKARG = 129 # char; Check manual operands?
|
|
INF_START_SS = 130 # long; value of SS at the start
|
|
INF_START_CS = 134 # long; value of CS at the start
|
|
INF_MAIN = 138 # long; address of main()
|
|
INF_SHORT_DN = 142 # long; short form of demangled names
|
|
INF_LONG_DN = 146 # long; long form of demangled names
|
|
# see demangle.h for definitions
|
|
INF_DATATYPES = 150 # long; data types allowed in data carousel
|
|
INF_STRTYPE = 154 # long; current ascii string type
|
|
# is considered as several bytes:
|
|
# low byte:
|
|
ASCSTR_TERMCHR = 0 # Character-terminated ASCII string
|
|
ASCSTR_C = 0 # C-string, zero terminated
|
|
ASCSTR_PASCAL = 1 # Pascal-style ASCII string (length byte)
|
|
ASCSTR_LEN2 = 2 # Pascal-style, length is 2 bytes
|
|
ASCSTR_UNICODE = 3 # Unicode string
|
|
ASCSTR_LEN4 = 4 # Delphi string, length is 4 bytes
|
|
ASCSTR_ULEN2 = 5 # Pascal-style Unicode, length is 2 bytes
|
|
ASCSTR_ULEN4 = 6 # Pascal-style Unicode, length is 4 bytes
|
|
|
|
# = 2nd byte - termination chracters for ASCSTR_TERMCHR:
|
|
#STRTERM1(strtype) ((strtype>>8)&0xFF)
|
|
# = 3d byte:
|
|
#STRTERM2(strtype) ((strtype>>16)&0xFF)
|
|
# The termination characters are kept in
|
|
# the = 2nd and 3d bytes of string type
|
|
# if the second termination character is
|
|
# '\0', then it is ignored.
|
|
INF_AF2 = 158 # ushort; Analysis flags 2
|
|
AF2_JUMPTBL = 0x0001 # Locate and create jump tables
|
|
AF2_DODATA = 0x0002 # Coagulate data segs in final pass
|
|
AF2_HFLIRT = 0x0004 # Automatically hide library functions
|
|
AF2_STKARG = 0x0008 # Propagate stack argument information
|
|
AF2_REGARG = 0x0010 # Propagate register argument information
|
|
AF2_CHKUNI = 0x0020 # Check for unicode strings
|
|
AF2_SIGCMT = 0x0040 # Append a signature name comment for recognized anonymous library functions
|
|
AF2_SIGMLT = 0x0080 # Allow recognition of several copies of the same function
|
|
AF2_FTAIL = 0x0100 # Create function tails
|
|
AF2_DATOFF = 0x0200 # Automatically convert data to offsets
|
|
AF2_ANORET = 0x0400 # Perform 'no-return' analysis
|
|
AF2_VERSP = 0x0800 # Perform full stack pointer analysis
|
|
AF2_DOCODE = 0x1000 # Coagulate code segs at the final pass
|
|
|
|
INF_NAMELEN = 160 # ushort; max name length (without zero byte)
|
|
INF_MARGIN = 162 # ushort; max length of data lines
|
|
INF_LENXREF = 164 # ushort; max length of line with xrefs
|
|
INF_LPREFIX = 166 # char[16];prefix of local names
|
|
# if a new name has this prefix,
|
|
# it will be automatically converted to a local name
|
|
INF_LPREFIXLEN = 182 # uchar; length of the lprefix
|
|
INF_COMPILER = 183 # uchar; compiler
|
|
COMP_MASK = 0x0F
|
|
COMP_UNK = 0x00 # Unknown
|
|
COMP_MS = 0x01 # Visual C++
|
|
COMP_BC = 0x02 # Borland C++
|
|
COMP_WATCOM = 0x03 # Watcom C++
|
|
COMP_GNU = 0x06 # GNU C++
|
|
COMP_VISAGE = 0x07 # Visual Age C++
|
|
COMP_BP = 0x08 # Delphi
|
|
|
|
INF_MODEL = 184 # uchar; memory model & calling convention
|
|
INF_SIZEOF_INT = 185 # uchar; sizeof(int)
|
|
INF_SIZEOF_BOOL = 186 # uchar; sizeof(bool)
|
|
INF_SIZEOF_ENUM = 187 # uchar; sizeof(enum)
|
|
INF_SIZEOF_ALGN = 188 # uchar; default alignment
|
|
INF_SIZEOF_SHORT = 189
|
|
INF_SIZEOF_LONG = 190
|
|
INF_SIZEOF_LLONG = 191
|
|
|
|
_INFMAP = {
|
|
INF_VERSION : 'version', # short; Version of database
|
|
INF_PROCNAME : 'procname', # char[8]; Name of current processor
|
|
INF_LFLAGS : 'lflags', # char; IDP-dependent flags
|
|
INF_DEMNAMES : 'demnames', # char; display demangled names as:
|
|
INF_FILETYPE : 'filetype', # short; type of input file (see ida.hpp)
|
|
INF_FCORESIZ : 'fcoresize',
|
|
INF_CORESTART : 'corestart',
|
|
INF_OSTYPE : 'ostype', # short; FLIRT: OS type the program is for
|
|
INF_APPTYPE : 'apptype', # short; FLIRT: Application type
|
|
INF_START_SP : 'startSP', # long; SP register value at the start of
|
|
INF_START_AF : 'af', # short; Analysis flags:
|
|
INF_START_IP : 'startIP', # long; IP register value at the start of
|
|
INF_BEGIN_EA : 'beginEA', # long; Linear address of program entry point
|
|
INF_MIN_EA : 'minEA', # long; The lowest address used
|
|
INF_MAX_EA : 'maxEA', # long; The highest address used
|
|
INF_OMIN_EA : 'ominEA',
|
|
INF_OMAX_EA : 'omaxEA',
|
|
INF_LOW_OFF : 'lowoff', # long; low limit of voids
|
|
INF_HIGH_OFF : 'highoff', # long; high limit of voids
|
|
INF_MAXREF : 'maxref', # long; max xref depth
|
|
INF_ASCII_BREAK : 'ASCIIbreak', # char; ASCII line break symbol
|
|
INF_WIDE_HIGH_BYTE_FIRST : 'wide_high_byte_first',
|
|
INF_INDENT : 'indent', # char; Indention for instructions
|
|
INF_COMMENT : 'comment', # char; Indention for comments
|
|
INF_XREFNUM : 'xrefnum', # char; Number of references to generate
|
|
INF_ENTAB : 's_entab', # char; Use '\t' chars in the output file?
|
|
INF_SPECSEGS : 'specsegs',
|
|
INF_VOIDS : 's_void', # char; Display void marks?
|
|
INF_SHOWAUTO : 's_showauto', # char; Display autoanalysis indicator?
|
|
INF_AUTO : 's_auto', # char; Autoanalysis is enabled?
|
|
# FIXME: This might be incorrect
|
|
INF_BORDER : 's_limiter', # char; Generate borders?
|
|
INF_NULL : 's_null', # char; Generate empty lines?
|
|
INF_GENFLAGS : 's_genflags', # char; General flags:
|
|
INF_SHOWPREF : 's_showpref', # char; Show line prefixes?
|
|
INF_PREFSEG : 's_prefseg', # char; line prefixes with segment name?
|
|
INF_ASMTYPE : 'asmtype', # char; target assembler number (0..n)
|
|
INF_BASEADDR : 'baseaddr', # long; base paragraph of the program
|
|
INF_XREFS : 's_xrefflag', # char; xrefs representation:
|
|
INF_BINPREF : 'binSize', # short; # of instruction bytes to show
|
|
INF_CMTFLAG : 's_cmtflg', # char; comments:
|
|
INF_NAMETYPE : 'nametype', # char; dummy names represenation type
|
|
INF_SHOWBADS : 's_showbads', # char; show bad instructions?
|
|
INF_PREFFLAG : 's_prefflag', # char; line prefix type:
|
|
INF_PACKBASE : 's_packbase', # char; pack database?
|
|
INF_ASCIIFLAGS : 'asciiflags', # uchar; ascii flags
|
|
INF_LISTNAMES : 'listnames', # uchar; What names should be included in the list?
|
|
INF_ASCIIPREF : 'ASCIIpref', # char[16];ASCII names prefix
|
|
INF_ASCIISERNUM : 'ASCIIsernum', # ulong; serial number
|
|
INF_ASCIIZEROES : 'ASCIIzeroes', # char; leading zeroes
|
|
INF_MF : 'mf', # uchar; Byte order: 1==MSB first
|
|
INF_ORG : 's_org', # char; Generate 'org' directives?
|
|
INF_ASSUME : 's_assume', # char; Generate 'assume' directives?
|
|
INF_CHECKARG : 's_checkarg', # char; Check manual operands?
|
|
INF_START_SS : 'start_ss', # long; value of SS at the start
|
|
INF_START_CS : 'start_cs', # long; value of CS at the start
|
|
INF_MAIN : 'main', # long; address of main()
|
|
INF_SHORT_DN : 'short_demnames', # long; short form of demangled names
|
|
INF_LONG_DN : 'long_demnames', # long; long form of demangled names
|
|
INF_DATATYPES : 'datatypes', # long; data types allowed in data carousel
|
|
INF_STRTYPE : 'strtype', # long; current ascii string type
|
|
INF_AF2 : 'af2', # ushort; Analysis flags 2
|
|
INF_NAMELEN : 'namelen', # ushort; max name length (without zero byte)
|
|
INF_MARGIN : 'margin', # ushort; max length of data lines
|
|
INF_LENXREF : 'lenxref', # ushort; max length of line with xrefs
|
|
INF_LPREFIX : 'lprefix', # char[16];prefix of local names
|
|
INF_LPREFIXLEN : 'lprefixlen', # uchar; length of the lprefix
|
|
INF_COMPILER : 'cc' # uchar; compiler
|
|
|
|
#INF_MODEL = 184 # uchar; memory model & calling convention
|
|
#INF_SIZEOF_INT = 185 # uchar; sizeof(int)
|
|
#INF_SIZEOF_BOOL = 186 # uchar; sizeof(bool)
|
|
#INF_SIZEOF_ENUM = 187 # uchar; sizeof(enum)
|
|
#INF_SIZEOF_ALGN = 188 # uchar; default alignment
|
|
#INF_SIZEOF_SHORT = 189
|
|
#INF_SIZEOF_LONG = 190
|
|
#INF_SIZEOF_LLONG = 191
|
|
}
|
|
|
|
|
|
def SetProcessorType (processor, level):
|
|
"""
|
|
Change current processor
|
|
|
|
@param processor: name of processor in short form.
|
|
run 'ida ?' to get list of allowed processor types
|
|
@param level: the power of request:
|
|
SETPROC_COMPAT - search for the processor type in the current module
|
|
SETPROC_ALL - search for the processor type in all modules
|
|
only if there were not calls with SETPROC_USER
|
|
SETPROC_USER - search for the processor type in all modules
|
|
and prohibit level SETPROC_USER
|
|
SETPROC_FATAL - can be combined with previous bits.
|
|
means that if the processor type can't be
|
|
set, IDA should display an error message and exit.
|
|
"""
|
|
return idaapi.set_processor_type(processor, level)
|
|
|
|
SETPROC_COMPAT = idaapi.SETPROC_COMPAT
|
|
SETPROC_ALL = idaapi.SETPROC_ALL
|
|
SETPROC_USER = idaapi.SETPROC_USER
|
|
SETPROC_FATAL = idaapi.SETPROC_FATAL
|
|
|
|
def SetPrcsr(processor): return SetProcessorType(processor, SETPROC_COMPAT)
|
|
|
|
|
|
def Batch(batch):
|
|
"""
|
|
Enable/disable batch mode of operation
|
|
|
|
@param batch: Batch mode
|
|
0 - ida will display dialog boxes and wait for the user input
|
|
1 - ida will not display dialog boxes, warnings, etc.
|
|
|
|
@return: old balue of batch flag
|
|
"""
|
|
batch_prev = idaapi.cvar.batch
|
|
idaapi.cvar.batch = batch
|
|
return batch_prev
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# I N T E R A C T I O N W I T H T H E U S E R
|
|
#----------------------------------------------------------------------------
|
|
def AskStr(defval, prompt):
|
|
"""
|
|
Ask the user to enter a string
|
|
|
|
@param defval: the default string value. This value will appear
|
|
in the dialog box.
|
|
@param prompt: the prompt to display in the dialog box
|
|
|
|
@return: the entered string or 0.
|
|
"""
|
|
return idaapi.askstr(idaapi.HIST_IDENT, defval, prompt)
|
|
|
|
|
|
def AskFile(forsave, mask, prompt):
|
|
"""
|
|
Ask the user to choose a file
|
|
|
|
@param forsave: 0: "Open" dialog box, 1: "Save" dialog box
|
|
@param mask: the input file mask as "*.*" or the default file name.
|
|
@param prompt: the prompt to display in the dialog box
|
|
|
|
@return: the selected file or 0.
|
|
"""
|
|
return idaapi.askfile_c(forsave, mask, prompt)
|
|
|
|
|
|
def AskAddr(defval, prompt):
|
|
"""
|
|
Ask the user to enter an address
|
|
|
|
@param defval: the default address value. This value
|
|
will appear in the dialog box.
|
|
@param prompt: the prompt to display in the dialog box
|
|
|
|
@return: the entered address or BADADDR.
|
|
"""
|
|
return idaapi.askaddr(defval, prompt)
|
|
|
|
|
|
def AskLong(defval, prompt):
|
|
"""
|
|
Ask the user to enter a number
|
|
|
|
@param defval: the default value. This value
|
|
will appear in the dialog box.
|
|
@param prompt: the prompt to display in the dialog box
|
|
|
|
@return: the entered number or -1.
|
|
"""
|
|
return idaapi.asklong(defval, prompt)
|
|
|
|
|
|
def AskSeg(defval, prompt):
|
|
"""
|
|
Ask the user to enter a segment value
|
|
|
|
@param defval: the default value. This value
|
|
will appear in the dialog box.
|
|
@param prompt: the prompt to display in the dialog box
|
|
|
|
@return: the entered segment selector or BADSEL.
|
|
"""
|
|
return idaapi.askseg(defval, prompt)
|
|
|
|
|
|
def AskIdent(defval, prompt):
|
|
"""
|
|
Ask the user to enter an identifier
|
|
|
|
@param defval: the default identifier. This value will appear in
|
|
the dialog box.
|
|
@param prompt: the prompt to display in the dialog box
|
|
|
|
@return: the entered identifier or 0.
|
|
"""
|
|
return idaapi.askident(defval, prompt)
|
|
|
|
|
|
def AskYN(defval, prompt):
|
|
"""
|
|
Ask the user a question and let him answer Yes/No/Cancel
|
|
|
|
@param defval: the default answer. This answer will be selected if the user
|
|
presses Enter. -1:cancel,0-no,1-ok
|
|
@param prompt: the prompt to display in the dialog box
|
|
|
|
@return: -1:cancel,0-no,1-ok
|
|
"""
|
|
return idaapi.askyn_c(defval, prompt)
|
|
|
|
|
|
def Message(msg):
|
|
"""
|
|
Display a message in the message window
|
|
|
|
@param msg: message to print (formatting is done in Python)
|
|
|
|
This function can be used to debug IDC scripts
|
|
"""
|
|
idaapi.msg(msg)
|
|
|
|
|
|
def Warning(msg):
|
|
"""
|
|
Display a message in a message box
|
|
|
|
@param msg: message to print (formatting is done in Python)
|
|
|
|
This function can be used to debug IDC scripts
|
|
The user will be able to hide messages if they appear twice in a row on
|
|
the screen
|
|
"""
|
|
idaapi.warning(msg)
|
|
|
|
|
|
def Fatal(format):
|
|
"""
|
|
Display a fatal message in a message box and quit IDA
|
|
|
|
@param format: message to print
|
|
"""
|
|
idaapi.error(format)
|
|
|
|
|
|
def SetStatus(status):
|
|
"""
|
|
Change IDA indicator.
|
|
|
|
@param status: new status
|
|
|
|
@return: the previous status.
|
|
"""
|
|
return idaapi.setStat(status)
|
|
|
|
|
|
IDA_STATUS_READY = 0 # READY IDA is idle
|
|
IDA_STATUS_THINKING = 1 # THINKING Analyzing but the user may press keys
|
|
IDA_STATUS_WAITING = 2 # WAITING Waiting for the user input
|
|
IDA_STATUS_WORK = 3 # BUSY IDA is busy
|
|
|
|
def Refresh():
|
|
"""
|
|
Refresh all disassembly views
|
|
"""
|
|
idaapi.refresh_idaview_anyway()
|
|
|
|
|
|
def RefreshLists():
|
|
"""
|
|
Refresh all list views (names, functions, etc)
|
|
"""
|
|
idaapi.refresh_lists()
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# S E G M E N T A T I O N
|
|
#----------------------------------------------------------------------------
|
|
def AskSelector(sel):
|
|
"""
|
|
Get a selector value
|
|
|
|
@param sel: the selector number
|
|
|
|
@return: selector value if found
|
|
otherwise the input value (sel)
|
|
|
|
@note: selector values are always in paragraphs
|
|
"""
|
|
sel = idaapi.getn_selector(sel)
|
|
|
|
if not sel:
|
|
return sel
|
|
else:
|
|
return sel.base
|
|
|
|
|
|
def FindSelector(val):
|
|
"""
|
|
Find a selector which has the specifed value
|
|
|
|
@param val: value to search for
|
|
|
|
@return: the selector number if found,
|
|
otherwise the input value (val & 0xFFFF)
|
|
|
|
@note: selector values are always in paragraphs
|
|
"""
|
|
sel = idaapi.find_selector(val)
|
|
|
|
if not sel:
|
|
return val & 0xffff
|
|
else:
|
|
return sel.n
|
|
|
|
|
|
def SetSelector(sel, value):
|
|
"""
|
|
Set a selector value
|
|
|
|
@param sel: the selector number
|
|
@param value: value of selector
|
|
|
|
@return: None
|
|
|
|
@note: ida supports up to 4096 selectors.
|
|
if 'sel' == 'val' then the selector is destroyed because
|
|
it has no significance
|
|
"""
|
|
return idaapi.set_selector(sel, value)
|
|
|
|
|
|
def DelSelector(sel):
|
|
"""
|
|
Delete a selector
|
|
|
|
@param sel: the selector number to delete
|
|
|
|
@return: None
|
|
|
|
@note: if the selector is found, it will be deleted
|
|
"""
|
|
return idaapi.del_selector(sel)
|
|
|
|
|
|
def FirstSeg():
|
|
"""
|
|
Get first segment
|
|
|
|
@return: address of the start of the first segment
|
|
BADADDR - no segments are defined
|
|
"""
|
|
segn = idaapi.get_segm_qty()
|
|
|
|
if segn == 0:
|
|
return BADADDR
|
|
else:
|
|
seg = idaapi.getnseg(0)
|
|
|
|
if not seg:
|
|
return BADADDR
|
|
else:
|
|
return seg.startEA
|
|
|
|
|
|
def NextSeg(ea):
|
|
"""
|
|
Get next segment
|
|
|
|
@param ea: linear address
|
|
|
|
@return: start of the next segment
|
|
BADADDR - no next segment
|
|
|
|
TODO: Any better way of doing this?
|
|
"""
|
|
|
|
for n in range(idaapi.get_segm_qty()):
|
|
currseg = idaapi.getnseg(n)
|
|
|
|
if ea >= currseg.startEA and ea < currseg.endEA:
|
|
nextseg = idaapi.getnseg(n+1)
|
|
|
|
if not nextseg:
|
|
return BADADDR
|
|
else:
|
|
return nextseg.startEA
|
|
|
|
return BADADDR
|
|
|
|
|
|
def SegStart(ea):
|
|
"""
|
|
Get start address of a segment
|
|
|
|
@param ea: any address in the segment
|
|
|
|
@return: start of segment
|
|
BADADDR - the specified address doesn't belong to any segment
|
|
"""
|
|
seg = idaapi.getseg(ea)
|
|
|
|
if not seg:
|
|
return BADADDR
|
|
else:
|
|
return seg.startEA
|
|
|
|
|
|
def SegEnd(ea):
|
|
"""
|
|
Get end address of a segment
|
|
|
|
@param ea: any address in the segment
|
|
|
|
@return: end of segment (an address past end of the segment)
|
|
BADADDR - the specified address doesn't belong to any segment
|
|
"""
|
|
seg = idaapi.getseg(ea)
|
|
|
|
if not seg:
|
|
return BADADDR
|
|
else:
|
|
return seg.endEA
|
|
|
|
|
|
def SegName(ea):
|
|
"""
|
|
Get name of a segment
|
|
|
|
@param ea: any address in the segment
|
|
|
|
@return: "" - no segment at the specified address
|
|
"""
|
|
seg = idaapi.getseg(ea)
|
|
|
|
if not seg:
|
|
return ""
|
|
else:
|
|
name = idaapi.get_true_segm_name(seg)
|
|
|
|
if not name:
|
|
return ""
|
|
else:
|
|
return name
|
|
|
|
|
|
def SegCreate(startea, endea, base, use32, align, comb):
|
|
"""
|
|
Create a new segment
|
|
|
|
@param startea: linear address of the start of the segment
|
|
@param endea: linear address of the end of the segment
|
|
this address will not belong to the segment
|
|
'endea' should be higher than 'startea'
|
|
@param base: base paragraph or selector of the segment.
|
|
a paragraph is 16byte memory chunk.
|
|
If a selector value is specified, the selector should be
|
|
already defined.
|
|
@param use32: 0: 16bit segment, 1: 32bit segment, 2: 64bit segment
|
|
@param align: segment alignment. see below for alignment values
|
|
@param comb: segment combination. see below for combination values.
|
|
|
|
@return: 0-failed, 1-ok
|
|
"""
|
|
success = idaapi.add_segm(base, startea, endea, "Segment", "CODE")
|
|
|
|
if success != 1:
|
|
return 0
|
|
|
|
seg = idaapi.getseg(startea)
|
|
|
|
if not seg:
|
|
return 0
|
|
|
|
seg.bitness = use32
|
|
seg.align = align
|
|
seg.comb = comb
|
|
|
|
return 1
|
|
|
|
|
|
def SegDelete(ea, flags):
|
|
"""
|
|
Delete a segment
|
|
|
|
@param ea: any address in the segment
|
|
@param flags: combination of SEGDEL_* flags
|
|
|
|
@return: boolean success
|
|
"""
|
|
return idaapi.del_segm(ea, disable)
|
|
|
|
SEGDEL_PERM = idaapi.SEGDEL_PERM # permanently, i.e. disable addresses
|
|
SEGDEL_KEEP = idaapi.SEGDEL_KEEP # keep information (code & data, etc)
|
|
SEGDEL_SILENT = idaapi.SEGDEL_SILENT # be silent
|
|
|
|
def SegBounds(ea, startea, endea, disable):
|
|
"""
|
|
Change segment boundaries
|
|
|
|
@param ea: any address in the segment
|
|
@param startea: new start address of the segment
|
|
@param endea: new end address of the segment
|
|
@param disable: discard bytes that go out of the segment
|
|
|
|
@return: boolean success
|
|
"""
|
|
return idaapi.set_segm_start(ea, startea, disable) & \
|
|
idaapi.set_segm_end(ea, endea, disable)
|
|
|
|
|
|
def SegRename(ea, name):
|
|
"""
|
|
Change name of the segment
|
|
|
|
@param ea: any address in the segment
|
|
@param name: new name of the segment
|
|
|
|
@return: success (boolean)
|
|
"""
|
|
seg = idaapi.getseg(ea)
|
|
|
|
if not seg:
|
|
return False
|
|
|
|
return idaapi.set_segm_name(seg, name)
|
|
|
|
|
|
def SegClass(ea, segclass):
|
|
"""
|
|
Change class of the segment
|
|
|
|
@param ea: any address in the segment
|
|
@param segclass: new class of the segment
|
|
|
|
@return: success (boolean)
|
|
"""
|
|
seg = idaapi.getseg(ea)
|
|
|
|
if not seg:
|
|
return False
|
|
|
|
return idaapi.set_segm_class(seg, segclass)
|
|
|
|
|
|
def SegAlign(ea, alignment):
|
|
"""
|
|
Change alignment of the segment
|
|
|
|
@param ea: any address in the segment
|
|
@param alignment: new alignment of the segment (one of the sa... constants)
|
|
|
|
@return: success (boolean)
|
|
"""
|
|
return SetSegmentAttr(ea, SEGATTR_ALIGN, alignment)
|
|
|
|
|
|
saAbs = idaapi.saAbs # Absolute segment.
|
|
saRelByte = idaapi.saRelByte # Relocatable, byte aligned.
|
|
saRelWord = idaapi.saRelWord # Relocatable, word (2-byte, 16-bit) aligned.
|
|
saRelPara = idaapi.saRelPara # Relocatable, paragraph (16-byte) aligned.
|
|
saRelPage = idaapi.saRelPage # Relocatable, aligned on 256-byte boundary
|
|
# (a "page" in the original Intel specification).
|
|
saRelDble = idaapi.saRelDble # Relocatable, aligned on a double word
|
|
# (4-byte) boundary. This value is used by
|
|
# the PharLap OMF for the same alignment.
|
|
saRel4K = idaapi.saRel4K # This value is used by the PharLap OMF for
|
|
# page (4K) alignment. It is not supported
|
|
# by LINK.
|
|
saGroup = idaapi.saGroup # Segment group
|
|
saRel32Bytes = idaapi.saRel32Bytes # 32 bytes
|
|
saRel64Bytes = idaapi.saRel64Bytes # 64 bytes
|
|
saRelQword = idaapi.saRelQword # 8 bytes
|
|
|
|
|
|
def SegComb(segea, comb):
|
|
"""
|
|
Change combination of the segment
|
|
|
|
@param segea: any address in the segment
|
|
@param comb: new combination of the segment (one of the sc... constants)
|
|
|
|
@return: success (boolean)
|
|
"""
|
|
return SetSegmentAttr(ea, SEGATTR_COMB, comb)
|
|
|
|
|
|
scPriv = idaapi.scPriv # Private. Do not combine with any other program
|
|
# segment.
|
|
scPub = idaapi.scPub # Public. Combine by appending at an offset that
|
|
# meets the alignment requirement.
|
|
scPub2 = idaapi.scPub2 # As defined by Microsoft, same as C=2 (public).
|
|
scStack = idaapi.scStack # Stack. Combine as for C=2. This combine type
|
|
# forces byte alignment.
|
|
scCommon = idaapi.scCommon # Common. Combine by overlay using maximum size.
|
|
scPub3 = idaapi.scPub3 # As defined by Microsoft, same as C=2 (public).
|
|
|
|
|
|
def SegAddrng(ea, bitness):
|
|
"""
|
|
Change segment addressing
|
|
|
|
@param ea: any address in the segment
|
|
@param bitness: 0: 16bit, 1: 32bit, 2: 64bit
|
|
|
|
@return: success (boolean)
|
|
"""
|
|
seg = idaapi.getseg(segea)
|
|
|
|
if not seg:
|
|
return False
|
|
|
|
seg.bitness = use32
|
|
|
|
return True
|
|
|
|
|
|
def SegByName(segname):
|
|
"""
|
|
Get segment by name
|
|
|
|
@param segname: name of segment
|
|
|
|
@return: segment selector or BADADDR
|
|
"""
|
|
seg = idaapi.get_segm_by_name(segname)
|
|
|
|
if not seg:
|
|
return BADADDR
|
|
|
|
return seg.startEA
|
|
|
|
|
|
def SegDefReg(ea, reg, value):
|
|
"""
|
|
Set default segment register value for a segment
|
|
|
|
@param ea: any address in the segment
|
|
if no segment is present at the specified address
|
|
then all segments will be affected
|
|
@param reg: name of segment register
|
|
@param value: default value of the segment register. -1-undefined.
|
|
"""
|
|
seg = idaapi.getseg(ea)
|
|
|
|
if seg and _REGMAP.has_key(reg):
|
|
return idaapi.SetDefaultRegisterValue(seg, _REGMAP[reg], value)
|
|
else:
|
|
return False
|
|
|
|
|
|
def SetSegmentType(segea, type):
|
|
"""
|
|
Set segment type
|
|
|
|
@param segea: any address within segment
|
|
@param type: new segment type:
|
|
|
|
@return: !=0 - ok
|
|
"""
|
|
seg = idaapi.getseg(segea)
|
|
|
|
if not seg:
|
|
return False
|
|
|
|
seg.type = type
|
|
return seg.update()
|
|
|
|
|
|
SEG_NORM = idaapi.SEG_NORM
|
|
SEG_XTRN = idaapi.SEG_XTRN # * segment with 'extern' definitions
|
|
# no instructions are allowed
|
|
SEG_CODE = idaapi.SEG_CODE # pure code segment
|
|
SEG_DATA = idaapi.SEG_DATA # pure data segment
|
|
SEG_IMP = idaapi.SEG_IMP # implementation segment
|
|
SEG_GRP = idaapi.SEG_GRP # * group of segments
|
|
# no instructions are allowed
|
|
SEG_NULL = idaapi.SEG_NULL # zero-length segment
|
|
SEG_UNDF = idaapi.SEG_UNDF # undefined segment type
|
|
SEG_BSS = idaapi.SEG_BSS # uninitialized segment
|
|
SEG_ABSSYM = idaapi.SEG_ABSSYM # * segment with definitions of absolute symbols
|
|
# no instructions are allowed
|
|
SEG_COMM = idaapi.SEG_COMM # * segment with communal definitions
|
|
# no instructions are allowed
|
|
SEG_IMEM = idaapi.SEG_IMEM # internal processor memory & sfr (8051)
|
|
|
|
|
|
def GetSegmentAttr(segea, attr):
|
|
"""
|
|
Get segment attribute
|
|
|
|
@param segea: any address within segment
|
|
@param attr: one of SEGATTR_... constants
|
|
|
|
FIXME: add support for segment registers
|
|
"""
|
|
seg = idaapi.getseg(segea)
|
|
|
|
if seg:
|
|
return _IDC_GetAttr(seg, _SEGATTRMAP, attr)
|
|
|
|
|
|
def SetSegmentAttr(segea, attr, value):
|
|
"""
|
|
Set segment attribute
|
|
|
|
@param segea: any address within segment
|
|
@param attr: one of SEGATTR_... constants
|
|
|
|
@note: Please note that not all segment attributes are modifiable.
|
|
Also some of them should be modified using special functions
|
|
like SegAddrng, etc.
|
|
|
|
FIXME: add support for segment registers
|
|
"""
|
|
seg = idaapi.getseg(segea)
|
|
|
|
if seg:
|
|
_IDC_SetAttr(seg, _SEGATTRMAP, attr, value)
|
|
return seg.update()
|
|
|
|
|
|
SEGATTR_START = 0 # starting address
|
|
SEGATTR_END = 4 # ending address
|
|
SEGATTR_ORGBASE = 16
|
|
SEGATTR_ALIGN = 20 # alignment
|
|
SEGATTR_COMB = 21 # combination
|
|
SEGATTR_PERM = 22 # permissions
|
|
SEGATTR_BITNESS = 23 # bitness (0: 16, 1: 32, 2: 64 bit segment)
|
|
# Note: modifying the attribute directly does
|
|
# not lead to the reanalysis of the segment.
|
|
# Using SegAddrng() is more correct.
|
|
SEGATTR_FLAGS = 24 # segment flags
|
|
SEGATTR_SEL = 26 # segment selector
|
|
SEGATTR_ES = 30 # default ES value
|
|
SEGATTR_CS = 34 # default CS value
|
|
SEGATTR_SS = 38 # default SS value
|
|
SEGATTR_DS = 42 # default DS value
|
|
SEGATTR_FS = 46 # default FS value
|
|
SEGATTR_GS = 50 # default GS value
|
|
SEGATTR_TYPE = 94 # segment type
|
|
SEGATTR_COLOR = 95 # segment color
|
|
|
|
_SEGATTRMAP = {
|
|
SEGATTR_START : 'startEA',
|
|
SEGATTR_END : 'endEA',
|
|
SEGATTR_ORGBASE : 'orgbase',
|
|
SEGATTR_ALIGN : 'align',
|
|
SEGATTR_COMB : 'comb',
|
|
SEGATTR_PERM : 'perm',
|
|
SEGATTR_BITNESS : 'bitness',
|
|
SEGATTR_FLAGS : 'flags',
|
|
SEGATTR_SEL : 'sel',
|
|
SEGATTR_ES : '',
|
|
SEGATTR_CS : '',
|
|
SEGATTR_SS : '',
|
|
SEGATTR_DS : '',
|
|
SEGATTR_FS : '',
|
|
SEGATTR_GS : '',
|
|
SEGATTR_TYPE : 'type',
|
|
SEGATTR_COLOR : 'color',
|
|
}
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# C R O S S R E F E R E N C E S
|
|
#----------------------------------------------------------------------------
|
|
# Flow types (combine with XREF_USER!):
|
|
fl_CF = 16 # Call Far
|
|
fl_CN = 17 # Call Near
|
|
fl_JF = 18 # Jump Far
|
|
fl_JN = 19 # Jump Near
|
|
fl_F = 21 # Ordinary flow
|
|
|
|
XREF_USER = 32 # All user-specified xref types
|
|
# must be combined with this bit
|
|
|
|
|
|
# Mark exec flow 'from' 'to'
|
|
def AddCodeXref(From, To, flowtype):
|
|
"""
|
|
"""
|
|
return idaapi.add_cref(From, To, flowtype)
|
|
|
|
|
|
def DelCodeXref(From, To, undef):
|
|
"""
|
|
Unmark exec flow 'from' 'to'
|
|
|
|
@param undef: make 'To' undefined if no more references to it
|
|
|
|
@returns: 1 - planned to be made undefined
|
|
"""
|
|
return idaapi.del_cref(From, To, undef)
|
|
|
|
|
|
# The following functions include the ordinary flows:
|
|
# (the ordinary flow references are returned first)
|
|
def Rfirst(From):
|
|
"""
|
|
Get first code xref from 'From'
|
|
"""
|
|
return idaapi.get_first_cref_from(From)
|
|
|
|
|
|
def Rnext(From, current):
|
|
"""
|
|
Get next code xref from
|
|
"""
|
|
return idaapi.get_next_cref_from(From, current)
|
|
|
|
|
|
def RfirstB(To):
|
|
"""
|
|
Get first code xref to 'To'
|
|
"""
|
|
return idaapi.get_first_cref_to(To)
|
|
|
|
|
|
def RnextB(To, current):
|
|
"""
|
|
Get next code xref to 'To'
|
|
"""
|
|
return idaapi.get_next_cref_to(To, current)
|
|
|
|
|
|
# The following functions don't take into account the ordinary flows:
|
|
def Rfirst0(From):
|
|
"""
|
|
Get first xref from 'From'
|
|
"""
|
|
return idaapi.get_first_fcref_from(From)
|
|
|
|
|
|
def Rnext0(From, current):
|
|
"""
|
|
Get next xref from
|
|
"""
|
|
return idaapi.get_next_fcref_from(From, current)
|
|
|
|
|
|
def RfirstB0(To):
|
|
"""
|
|
Get first xref to 'To'
|
|
"""
|
|
return idaapi.get_first_fcref_to(To)
|
|
|
|
|
|
def RnextB0(To, current):
|
|
"""
|
|
Get next xref to 'To'
|
|
"""
|
|
return idaapi.get_next_fcref_to(To, current)
|
|
|
|
|
|
# Data reference types (combine with XREF_USER!):
|
|
dr_O = idaapi.dr_O # Offset
|
|
dr_W = idaapi.dr_W # Write
|
|
dr_R = idaapi.dr_R # Read
|
|
dr_T = idaapi.dr_T # Text (names in manual operands)
|
|
dr_I = idaapi.dr_I # Informational
|
|
|
|
|
|
def add_dref(From, To, drefType):
|
|
"""
|
|
Create Data Ref
|
|
"""
|
|
return idaapi.add_dref(From, To, drefType)
|
|
|
|
|
|
def del_dref(From, To):
|
|
"""
|
|
Unmark Data Ref
|
|
"""
|
|
return idaapi.del_dref(From, To)
|
|
|
|
|
|
def Dfirst(From):
|
|
"""
|
|
Get first data xref from 'From'
|
|
"""
|
|
return idaapi.get_first_dref_from(From)
|
|
|
|
|
|
def Dnext(From, current):
|
|
"""
|
|
Get next data xref from 'From'
|
|
"""
|
|
return idaapi.get_next_dref_from(From, current)
|
|
|
|
|
|
def DfirstB(To):
|
|
"""
|
|
Get first data xref to 'To'
|
|
"""
|
|
return idaapi.get_first_dref_to(To)
|
|
|
|
|
|
def DnextB(To, current):
|
|
"""
|
|
Get next data xref to 'To'
|
|
"""
|
|
return idaapi.get_next_dref_to(To, current)
|
|
|
|
|
|
def XrefType():
|
|
"""
|
|
Return type of the last xref obtained by
|
|
[RD]first/next[B0] functions.
|
|
|
|
@return: constants fl_* or dr_*
|
|
|
|
FIXME: unimplemented
|
|
"""
|
|
raise NotImplementedError
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# F I L E I / O
|
|
#----------------------------------------------------------------------------
|
|
def fopen(file, mode):
|
|
raise DeprecatedIDCError, "fopen() deprecated. Use Python file objects instead."
|
|
|
|
def fclose(handle):
|
|
raise DeprecatedIDCError, "fclose() deprecated. Use Python file objects instead."
|
|
|
|
def filelength(handle):
|
|
raise DeprecatedIDCError, "filelength() deprecated. Use Python file objects instead."
|
|
|
|
def fseek(handle, offset, origin):
|
|
raise DeprecatedIDCError, "fseek() deprecated. Use Python file objects instead."
|
|
|
|
def ftell(handle):
|
|
raise DeprecatedIDCError, "ftell() deprecated. Use Python file objects instead."
|
|
|
|
|
|
def LoadFile(filepath, pos, ea, size):
|
|
"""
|
|
Load file into IDA database
|
|
|
|
@param filepath: path to input file
|
|
@param pos: position in the file
|
|
@param ea: linear address to load
|
|
@param size: number of bytes to load
|
|
|
|
@return: 0 - error, 1 - ok
|
|
"""
|
|
li = idaapi.open_linput(filepath, False)
|
|
|
|
if li:
|
|
retval = idaapi.file2base(li, pos, ea, ea+size, False)
|
|
idaapi.close_linput(li)
|
|
return retval
|
|
else:
|
|
return 0
|
|
|
|
|
|
def SaveFile(filepath, pos, ea, size):
|
|
"""
|
|
Save from IDA database to file
|
|
|
|
@param filepath: path to output file
|
|
@param pos: position in the file
|
|
@param ea: linear address to save from
|
|
@param size: number of bytes to save
|
|
|
|
@return: 0 - error, 1 - ok
|
|
"""
|
|
of = idaapi.fopenWB(filepath)
|
|
|
|
if of:
|
|
retval = idaapi.base2file(of, pos, ea, ea+size)
|
|
idaapi.eclose(of)
|
|
return retval
|
|
else:
|
|
return 0
|
|
|
|
|
|
def fgetc(handle):
|
|
raise DeprecatedIDCError, "fgetc() deprecated. Use Python file objects instead."
|
|
|
|
def fputc(byte, handle):
|
|
raise DeprecatedIDCError, "fputc() deprecated. Use Python file objects instead."
|
|
|
|
def fprintf(handle, format, *args):
|
|
raise DeprecatedIDCError, "fprintf() deprecated. Use Python file objects instead."
|
|
|
|
def readshort(handle, mostfirst):
|
|
raise DeprecatedIDCError, "readshort() deprecated. Use Python file objects instead."
|
|
|
|
def readlong(handle, mostfirst):
|
|
raise DeprecatedIDCError, "readlong() deprecated. Use Python file objects instead."
|
|
|
|
def writeshort(handle, word, mostfirst):
|
|
raise DeprecatedIDCError, "writeshort() deprecated. Use Python file objects instead."
|
|
|
|
def writelong(handle, dword, mostfirst):
|
|
raise DeprecatedIDCError, "writelong() deprecated. Use Python file objects instead."
|
|
|
|
def readstr(handle):
|
|
raise DeprecatedIDCError, "readstr() deprecated. Use Python file objects instead."
|
|
|
|
def writestr(handle, str):
|
|
raise DeprecatedIDCError, "writestr() deprecated. Use Python file objects instead."
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# F U N C T I O N S
|
|
# ----------------------------------------------------------------------------
|
|
|
|
def MakeFunction(start, end):
|
|
"""
|
|
Create a function
|
|
|
|
@param start: function bounds
|
|
@param end: function bounds
|
|
|
|
If the function end address is BADADDR, then
|
|
IDA will try to determine the function bounds
|
|
automatically. IDA will define all necessary
|
|
instructions to determine the function bounds.
|
|
|
|
@return: !=0 - ok
|
|
|
|
@note: an instruction should be present at the start address
|
|
"""
|
|
return idaapi.add_func(start, end)
|
|
|
|
|
|
def DelFunction(ea):
|
|
"""
|
|
Delete a function
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: !=0 - ok
|
|
"""
|
|
return idaapi.del_func(ea)
|
|
|
|
|
|
def SetFunctionEnd(ea, end):
|
|
"""
|
|
Change function end address
|
|
|
|
@param ea: any address belonging to the function
|
|
@param end: new function end address
|
|
|
|
@return: !=0 - ok
|
|
"""
|
|
return idaapi.func_setend(ea, end)
|
|
|
|
|
|
def NextFunction(ea):
|
|
"""
|
|
Find next function
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: -1 - no more functions
|
|
otherwise returns the next function start address
|
|
"""
|
|
func = idaapi.get_next_func(ea)
|
|
|
|
if not func:
|
|
return BADADDR
|
|
else:
|
|
return func.startEA
|
|
|
|
|
|
def PrevFunction(ea):
|
|
"""
|
|
Find previous function
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: -1 - no more functions
|
|
otherwise returns the previous function start address
|
|
"""
|
|
func = idaapi.get_prev_func(ea)
|
|
|
|
if not func:
|
|
return BADADDR
|
|
else:
|
|
return func.startEA
|
|
|
|
|
|
def GetFunctionAttr(ea, attr):
|
|
"""
|
|
Get a function attribute
|
|
|
|
@param ea: any address belonging to the function
|
|
@param attr: one of FUNCATTR_... constants
|
|
|
|
@return: -1 - error otherwise returns the attribute value
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if func:
|
|
return _IDC_GetAttr(func, _FUNCATTRMAP, attr)
|
|
|
|
|
|
def SetFunctionAttr(ea, attr, value):
|
|
"""
|
|
Set a function attribute
|
|
|
|
@param ea: any address belonging to the function
|
|
@param attr: one of FUNCATTR_... constants
|
|
@param value: new value of the attribute
|
|
|
|
@return: 1-ok, 0-failed
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if func:
|
|
_IDC_SetAttr(func, _FUNCATTRMAP, attr, value)
|
|
return idaapi.update_func(func)
|
|
|
|
|
|
FUNCATTR_START = 0 # function start address
|
|
FUNCATTR_END = 4 # function end address
|
|
FUNCATTR_FLAGS = 8 # function flags
|
|
FUNCATTR_FRAME = 10 # function frame id
|
|
FUNCATTR_FRSIZE = 14 # size of local variables
|
|
FUNCATTR_FRREGS = 18 # size of saved registers area
|
|
FUNCATTR_ARGSIZE = 20 # number of bytes purged from the stack
|
|
FUNCATTR_FPD = 24 # frame pointer delta
|
|
FUNCATTR_COLOR = 28 # function color code
|
|
|
|
_FUNCATTRMAP = {
|
|
FUNCATTR_START : 'startEA',
|
|
FUNCATTR_END : 'endEA',
|
|
FUNCATTR_FLAGS : 'flags',
|
|
FUNCATTR_FRAME : 'frame',
|
|
FUNCATTR_FRSIZE : 'frsize',
|
|
FUNCATTR_FRREGS : 'frregs',
|
|
FUNCATTR_ARGSIZE : 'argsize',
|
|
FUNCATTR_FPD : 'fpd',
|
|
FUNCATTR_COLOR : 'color'
|
|
}
|
|
|
|
|
|
def GetFunctionFlags(ea):
|
|
"""
|
|
Retrieve function flags
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: -1 - function doesn't exist otherwise returns the flags
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if not func:
|
|
return -1
|
|
else:
|
|
return func.flags
|
|
|
|
|
|
FUNC_NORET = idaapi.FUNC_NORET # function doesn't return
|
|
FUNC_FAR = idaapi.FUNC_FAR # far function
|
|
FUNC_LIB = idaapi.FUNC_LIB # library function
|
|
FUNC_STATIC = idaapi.FUNC_STATIC # static function
|
|
FUNC_FRAME = idaapi.FUNC_FRAME # function uses frame pointer (BP)
|
|
FUNC_USERFAR = idaapi.FUNC_USERFAR # user has specified far-ness
|
|
# of the function
|
|
FUNC_HIDDEN = idaapi.FUNC_HIDDEN # a hidden function
|
|
FUNC_THUNK = idaapi.FUNC_THUNK # thunk (jump) function
|
|
FUNC_BOTTOMBP = idaapi.FUNC_BOTTOMBP # BP points to the bottom of the stack frame
|
|
|
|
|
|
def SetFunctionFlags(ea, flags):
|
|
"""
|
|
Change function flags
|
|
|
|
@param ea: any address belonging to the function
|
|
@param flags: see GetFunctionFlags() for explanations
|
|
|
|
@return: !=0 - ok
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if not func:
|
|
return 0
|
|
else:
|
|
func.flags = flags
|
|
idaapi.update_func(func)
|
|
return 1
|
|
|
|
|
|
def GetFunctionName(ea):
|
|
"""
|
|
Retrieve function name
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: null string - function doesn't exist
|
|
otherwise returns function name
|
|
"""
|
|
name = idaapi.get_func_name(ea)
|
|
|
|
if not name:
|
|
return ""
|
|
else:
|
|
return name
|
|
|
|
|
|
def GetFunctionCmt(ea, repeatable):
|
|
"""
|
|
Retrieve function comment
|
|
|
|
@param ea: any address belonging to the function
|
|
@param repeatable: 1: get repeatable comment
|
|
0: get regular comment
|
|
|
|
@return: function comment string
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if not func:
|
|
return ""
|
|
else:
|
|
comment = idaapi.get_func_cmt(func, repeatable)
|
|
|
|
if not comment:
|
|
return ""
|
|
else:
|
|
return comment
|
|
|
|
|
|
def SetFunctionCmt(ea, cmt, repeatable):
|
|
"""
|
|
Set function comment
|
|
|
|
@param ea: any address belonging to the function
|
|
@param cmt: a function comment line
|
|
@param repeatable: 1: get repeatable comment
|
|
0: get regular comment
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if not func:
|
|
return None
|
|
else:
|
|
return idaapi.set_func_cmt(func, cmt, repeatable)
|
|
|
|
|
|
def ChooseFunction(title):
|
|
"""
|
|
Ask the user to select a function
|
|
|
|
Arguments:
|
|
|
|
@param title: title of the dialog box
|
|
|
|
@return: -1 - user refused to select a function
|
|
otherwise returns the selected function start address
|
|
"""
|
|
return idaapi.choose_func(title)
|
|
|
|
|
|
def GetFuncOffset(ea):
|
|
"""
|
|
Convert address to 'funcname+offset' string
|
|
|
|
@param ea - address to convert
|
|
|
|
@return: if the address belongs to a function then return a string
|
|
formed as 'name+offset' where 'name' is a function name
|
|
'offset' is offset within the function else return null string
|
|
"""
|
|
return idaapi.a2funcoff(ea)
|
|
|
|
|
|
def FindFuncEnd(ea):
|
|
"""
|
|
Determine a new function boundaries
|
|
|
|
@param ea: starting address of a new function
|
|
|
|
@return: if a function already exists, then return its end address.
|
|
If a function end cannot be determined, the return BADADDR
|
|
otherwise return the end address of the new function
|
|
"""
|
|
func = idaapi.func_t()
|
|
|
|
res = idaapi.find_func_bounds(ea, func, idaapi.FIND_FUNC_DEFINE)
|
|
|
|
if res == idaapi.FIND_FUNC_UNDEF:
|
|
return BADADDR
|
|
else:
|
|
return func.endEA
|
|
|
|
|
|
def GetFrame(ea):
|
|
"""
|
|
Get ID of function frame structure
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: ID of function frame or None In order to access stack variables
|
|
you need to use structure member manipulaion functions with the
|
|
obtained ID.
|
|
"""
|
|
frame = idaapi.get_frame(ea)
|
|
|
|
if frame:
|
|
return frame.id
|
|
else:
|
|
return None
|
|
|
|
|
|
def GetFrameLvarSize(ea):
|
|
"""
|
|
Get size of local variables in function frame
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: Size of local variables in bytes.
|
|
If the function doesn't have a frame, return 0
|
|
If the function does't exist, return None
|
|
"""
|
|
return GetFunctionAttr(ea, FUNCATTR_FRSIZE)
|
|
|
|
|
|
def GetFrameRegsSize(ea):
|
|
"""
|
|
Get size of saved registers in function frame
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: Size of saved registers in bytes.
|
|
If the function doesn't have a frame, return 0
|
|
This value is used as offset for BP (if FUNC_FRAME is set)
|
|
If the function does't exist, return None
|
|
"""
|
|
return GetFunctionAttr(ea, FUNCATTR_FRREGS)
|
|
|
|
|
|
def GetFrameArgsSize(ea):
|
|
"""
|
|
Get size of arguments in function frame which are purged upon return
|
|
|
|
@param ea: any address belonging to the function
|
|
|
|
@return: Size of function arguments in bytes.
|
|
If the function doesn't have a frame, return 0
|
|
If the function does't exist, return -1
|
|
"""
|
|
return GetFunctionAttr(ea, FUNCATTR_ARGSIZE)
|
|
|
|
|
|
def GetFrameSize(ea):
|
|
"""
|
|
Get full size of function frame
|
|
|
|
@param ea: any address belonging to the function
|
|
@returns: Size of function frame in bytes.
|
|
This function takes into account size of local
|
|
variables + size of saved registers + size of
|
|
return address + size of function arguments
|
|
If the function doesn't have a frame, return size of
|
|
function return address in the stack.
|
|
If the function does't exist, return 0
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if not func:
|
|
return 0
|
|
else:
|
|
return idaapi.get_frame_size(func)
|
|
|
|
|
|
def MakeFrame(ea, lvsize, frregs, argsize):
|
|
"""
|
|
Make function frame
|
|
|
|
@param ea: any address belonging to the function
|
|
@param lvsize: size of function local variables
|
|
@param frregs: size of saved registers
|
|
@param argsize: size of function arguments
|
|
|
|
@return: ID of function frame or -1
|
|
If the function did not have a frame, the frame
|
|
will be created. Otherwise the frame will be modified
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if not func:
|
|
return -1
|
|
|
|
id = idaapi.add_frame(func, lvsize, frregs, argsize)
|
|
|
|
if not id:
|
|
if not idaapi.set_frame_size(func, lvsize, frregs, argsize):
|
|
return -1
|
|
|
|
return func.frame
|
|
|
|
|
|
def GetSpd(ea):
|
|
"""
|
|
Get current delta for the stack pointer
|
|
|
|
@param ea: end address of the instruction
|
|
i.e.the last address of the instruction+1
|
|
|
|
@return: The difference between the original SP upon
|
|
entering the function and SP for the specified address
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if not func:
|
|
return None
|
|
|
|
return idaapi.get_spd(func, ea)
|
|
|
|
|
|
def GetSpDiff(ea):
|
|
"""
|
|
Get modification of SP made by the instruction
|
|
|
|
@param ea: end address of the instruction
|
|
i.e.the last address of the instruction+1
|
|
|
|
@return: Get modification of SP made at the specified location
|
|
If the specified location doesn't contain a SP change point, return 0
|
|
Otherwise return delta of SP modification
|
|
"""
|
|
func = idaapi.get_func(ea)
|
|
|
|
if not func:
|
|
return None
|
|
|
|
return idaapi.get_sp_delta(func, ea)
|
|
|
|
|
|
def SetSpDiff(ea, delta):
|
|
"""
|
|
Setup modification of SP made by the instruction
|
|
|
|
@param ea: end address of the instruction
|
|
i.e.the last address of the instruction+1
|
|
@param delta: the difference made by the current instruction.
|
|
|
|
@return: 1-ok, 0-failed
|
|
"""
|
|
return idaapi.add_user_stkpnt(ea, delta)
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# E N T R Y P O I N T S
|
|
# ----------------------------------------------------------------------------
|
|
|
|
def GetEntryPointQty():
|
|
"""
|
|
Retrieve number of entry points
|
|
|
|
@returns: number of entry points
|
|
"""
|
|
return idaapi.get_entry_qty()
|
|
|
|
|
|
def AddEntryPoint(ordinal, ea, name, makecode):
|
|
"""
|
|
Add entry point
|
|
|
|
@param ordinal: entry point number
|
|
if entry point doesn't have an ordinal
|
|
number, 'ordinal' should be equal to 'ea'
|
|
@param ea: address of the entry point
|
|
@param name: name of the entry point. If null string,
|
|
the entry point won't be renamed.
|
|
@param makecode: if 1 then this entry point is a start
|
|
of a function. Otherwise it denotes data bytes.
|
|
|
|
@return: 0 - entry point with the specifed ordinal already exists
|
|
1 - ok
|
|
"""
|
|
return idaapi.add_entry(ordinal, ea, name, makecode)
|
|
|
|
|
|
def GetEntryOrdinal(index):
|
|
"""
|
|
Retrieve entry point ordinal number
|
|
|
|
@param index: 0..GetEntryPointQty()-1
|
|
|
|
@return: 0 if entry point doesn't exist
|
|
otherwise entry point ordinal
|
|
"""
|
|
return idaapi.get_entry_ordinal(index)
|
|
|
|
|
|
def GetEntryPoint(ordinal):
|
|
"""
|
|
Retrieve entry point address
|
|
|
|
@param ordinal: entry point number
|
|
it is returned by GetEntryPointOrdinal()
|
|
|
|
@return: -1 if entry point doesn't exist
|
|
otherwise entry point address.
|
|
If entry point address is equal to its ordinal
|
|
number, then the entry point has no ordinal.
|
|
"""
|
|
return idaapi.get_entry(ordinal)
|
|
|
|
|
|
def RenameEntryPoint(ordinal, name):
|
|
"""
|
|
Rename entry point
|
|
|
|
@param ordinal: entry point number
|
|
@param name: new name
|
|
|
|
@return: !=0 - ok
|
|
"""
|
|
return idaapi.rename_entry(ordinal, name)
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# F I X U P S
|
|
# ----------------------------------------------------------------------------
|
|
def GetNextFixupEA(ea):
|
|
"""
|
|
Find next address with fixup information
|
|
|
|
@param ea: current address
|
|
|
|
@return: -1 - no more fixups otherwise returns the next
|
|
address with fixup information
|
|
"""
|
|
return idaapi.get_next_fixup_ea(ea)
|
|
|
|
|
|
def GetPrevFixupEA(ea):
|
|
"""
|
|
Find previous address with fixup information
|
|
|
|
@param ea: current address
|
|
|
|
@return: -1 - no more fixups otherwise returns the
|
|
previous address with fixup information
|
|
"""
|
|
return idaapi.get_prev_fixup_ea(ea)
|
|
|
|
|
|
def GetFixupTgtType(ea):
|
|
"""
|
|
Get fixup target type
|
|
|
|
@param ea: address to get information about
|
|
|
|
@return: -1 - no fixup at the specified address
|
|
otherwise returns fixup target type:
|
|
"""
|
|
fd = idaapi.get_fixup(ea)
|
|
|
|
if not fd:
|
|
return -1
|
|
|
|
return fd.type
|
|
|
|
|
|
FIXUP_MASK = 0xF
|
|
FIXUP_OFF8 = 0 # 8-bit offset.
|
|
FIXUP_BYTE = FIXUP_OFF8 # 8-bit offset.
|
|
FIXUP_OFF16 = 1 # 16-bit offset.
|
|
FIXUP_SEG16 = 2 # 16-bit base--logical segment base (selector).
|
|
FIXUP_PTR32 = 3 # 32-bit long pointer (16-bit base:16-bit
|
|
# offset).
|
|
FIXUP_OFF32 = 4 # 32-bit offset.
|
|
FIXUP_PTR48 = 5 # 48-bit pointer (16-bit base:32-bit offset).
|
|
FIXUP_HI8 = 6 # high 8 bits of 16bit offset
|
|
FIXUP_HI16 = 7 # high 16 bits of 32bit offset
|
|
FIXUP_LOW8 = 8 # low 8 bits of 16bit offset
|
|
FIXUP_LOW16 = 9 # low 16 bits of 32bit offset
|
|
FIXUP_REL = 0x10 # fixup is relative to the linear address
|
|
# specified in the 3d parameter to set_fixup()
|
|
FIXUP_SELFREL = 0x0 # self-relative?
|
|
# - disallows the kernel to convert operands
|
|
# in the first pass
|
|
# - this fixup is used during output
|
|
# This type of fixups is not used anymore.
|
|
# Anyway you can use it for commenting purposes
|
|
# in the loader modules
|
|
FIXUP_EXTDEF = 0x20 # target is a location (otherwise - segment)
|
|
FIXUP_UNUSED = 0x40 # fixup is ignored by IDA
|
|
# - disallows the kernel to convert operands
|
|
# - this fixup is not used during output
|
|
FIXUP_CREATED = 0x80 # fixup was not present in the input file
|
|
|
|
|
|
def GetFixupTgtSel(ea):
|
|
"""
|
|
Get fixup target selector
|
|
|
|
@param ea: address to get information about
|
|
|
|
@return: -1 - no fixup at the specified address
|
|
otherwise returns fixup target selector
|
|
"""
|
|
fd = idaapi.get_fixup(ea)
|
|
|
|
if not fd:
|
|
return -1
|
|
|
|
return fd.sel
|
|
|
|
|
|
def GetFixupTgtOff(ea):
|
|
"""
|
|
Get fixup target offset
|
|
|
|
@param ea: address to get information about
|
|
|
|
@return: -1 - no fixup at the specified address
|
|
otherwise returns fixup target offset
|
|
"""
|
|
fd = idaapi.get_fixup(ea)
|
|
|
|
if not fd:
|
|
return -1
|
|
|
|
return fd.off
|
|
|
|
|
|
def GetFixupTgtDispl(ea):
|
|
"""
|
|
Get fixup target displacement
|
|
|
|
@param ea: address to get information about
|
|
|
|
@return: -1 - no fixup at the specified address
|
|
otherwise returns fixup target displacement
|
|
"""
|
|
fd = idaapi.get_fixup(ea)
|
|
|
|
if not fd:
|
|
return -1
|
|
|
|
return fd.displacement
|
|
|
|
|
|
def SetFixup(ea, type, targetsel, targetoff, displ):
|
|
"""
|
|
Set fixup information
|
|
|
|
@param ea: address to set fixup information about
|
|
@param type: fixup type. see GetFixupTgtType()
|
|
for possible fixup types.
|
|
@param targetsel: target selector
|
|
@param targetoff: target offset
|
|
@param displ: displacement
|
|
|
|
@return: none
|
|
"""
|
|
fd = idaapi.fixup_data_t()
|
|
fd.type = type
|
|
fd.sel = targetsel
|
|
fd.off = targetoff
|
|
fd.displacement = displ
|
|
|
|
idaapi.set_fixup(ea, fd)
|
|
|
|
|
|
def DelFixup(ea):
|
|
"""
|
|
Delete fixup information
|
|
|
|
@param ea: address to delete fixup information about
|
|
|
|
@return: None
|
|
"""
|
|
idaapi.del_fixup(ea)
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# M A R K E D P O S I T I O N S
|
|
#----------------------------------------------------------------------------
|
|
|
|
def MarkPosition(ea, lnnum, x, y, slot, comment):
|
|
"""
|
|
Mark position
|
|
|
|
@param ea: address to mark
|
|
@param lnnum: number of generated line for the 'ea'
|
|
@param x: x coordinate of cursor
|
|
@param y: y coordinate of cursor
|
|
@param slot: slot number: 1..1024
|
|
if the specifed value is not within the
|
|
range, IDA will ask the user to select slot.
|
|
@param comment: description of the mark. Should be not empty.
|
|
|
|
@return: None
|
|
"""
|
|
curloc = idaapi.curloc()
|
|
curloc.ea = ea
|
|
curloc.lnnum = lnnum
|
|
curloc.x = x
|
|
curloc.y = y
|
|
curloc.mark(slot, comment, comment)
|
|
|
|
|
|
def GetMarkedPos(slot):
|
|
"""
|
|
Get marked position
|
|
|
|
@param slot: slot number: 1..1024 if the specifed value is <= 0
|
|
range, IDA will ask the user to select slot.
|
|
|
|
@return: BADADDR - the slot doesn't contain a marked address
|
|
otherwise returns the marked address
|
|
"""
|
|
curloc = idaapi.curloc()
|
|
intp = idaapi.int_pointer()
|
|
intp.assign(slot)
|
|
return curloc.markedpos(intp)
|
|
|
|
|
|
def GetMarkComment(slot):
|
|
"""
|
|
Get marked position comment
|
|
|
|
@param slot: slot number: 1..1024
|
|
|
|
@return: None if the slot doesn't contain a marked address
|
|
otherwise returns the marked address comment
|
|
"""
|
|
curloc = idaapi.curloc()
|
|
return curloc.markdesc(slot)
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# S T R U C T U R E S
|
|
# ----------------------------------------------------------------------------
|
|
|
|
def GetStrucQty():
|
|
"""
|
|
Get number of defined structure types
|
|
|
|
@return: number of structure types
|
|
"""
|
|
return idaapi.get_struc_qty()
|
|
|
|
|
|
def GetFirstStrucIdx():
|
|
"""
|
|
Get index of first structure type
|
|
|
|
@return: -1 if no structure type is defined
|
|
index of first structure type.
|
|
Each structure type has an index and ID.
|
|
INDEX determines position of structure definition
|
|
in the list of structure definitions. Index 1
|
|
is listed first, after index 2 and so on.
|
|
The index of a structure type can be changed any
|
|
time, leading to movement of the structure definition
|
|
in the list of structure definitions.
|
|
ID uniquely denotes a structure type. A structure
|
|
gets a unique ID at the creation time and this ID
|
|
can't be changed. Even when the structure type gets
|
|
deleted, its ID won't be resued in the future.
|
|
"""
|
|
return idaapi.get_first_struc_idx()
|
|
|
|
|
|
def GetLastStrucIdx():
|
|
"""
|
|
Get index of last structure type
|
|
|
|
@return: -1 if no structure type is defined
|
|
index of last structure type.
|
|
See GetFirstStrucIdx() for the explanation of
|
|
structure indices and IDs.
|
|
"""
|
|
return idaapi.get_last_struc_idx()
|
|
|
|
|
|
def GetNextStrucIdx(index):
|
|
"""
|
|
Get index of next structure type
|
|
|
|
@param index: current structure index
|
|
|
|
@return: -1 if no (more) structure type is defined
|
|
index of the next structure type.
|
|
See GetFirstStrucIdx() for the explanation of
|
|
structure indices and IDs.
|
|
"""
|
|
return idaapi.get_next_struc_idx(index)
|
|
|
|
|
|
def GetPrevStrucIdx(index):
|
|
"""
|
|
Get index of previous structure type
|
|
|
|
@param index: current structure index
|
|
|
|
@return: -1 if no (more) structure type is defined
|
|
index of the presiouvs structure type.
|
|
See GetFirstStrucIdx() for the explanation of
|
|
structure indices and IDs.
|
|
"""
|
|
return idaapi.get_prev_struc_idx(index)
|
|
|
|
|
|
def GetStrucIdx(id):
|
|
"""
|
|
Get structure index by structure ID
|
|
|
|
@param id: structure ID
|
|
|
|
@return: -1 if bad structure ID is passed
|
|
otherwise returns structure index.
|
|
See GetFirstStrucIdx() for the explanation of
|
|
structure indices and IDs.
|
|
"""
|
|
return idaapi.get_struc_idx(id)
|
|
|
|
|
|
def GetStrucId(index):
|
|
"""
|
|
Get structure ID by structure index
|
|
|
|
@param index: structure index
|
|
|
|
@return: -1 if bad structure index is passed otherwise returns structure ID.
|
|
|
|
@note: See GetFirstStrucIdx() for the explanation of structure indices and IDs.
|
|
"""
|
|
return idaapi.get_struc_by_idx(index)
|
|
|
|
|
|
def GetStrucIdByName(name):
|
|
"""
|
|
Get structure ID by structure name
|
|
|
|
@param name: structure type name
|
|
|
|
@return: -1 if bad structure type name is passed
|
|
otherwise returns structure ID.
|
|
"""
|
|
return idaapi.get_struc_id(name)
|
|
|
|
|
|
def GetStrucName(id):
|
|
"""
|
|
Get structure type name
|
|
|
|
@param id: structure type ID
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
otherwise returns structure type name.
|
|
"""
|
|
return idaapi.get_struc_name(id)
|
|
|
|
|
|
def GetStrucComment(id, repeatable):
|
|
"""
|
|
Get structure type comment
|
|
|
|
@param id: structure type ID
|
|
@param repeatable: 1: get repeatable comment
|
|
0: get regular comment
|
|
|
|
@return: None if bad structure type ID is passed
|
|
otherwise returns comment.
|
|
"""
|
|
return idaapi.get_struc_cmt(id, repeatable)
|
|
|
|
|
|
def GetStrucSize(id):
|
|
"""
|
|
Get size of a structure
|
|
|
|
@param id: structure type ID
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
otherwise returns size of structure in bytes.
|
|
"""
|
|
return idaapi.get_struc_size(id)
|
|
|
|
|
|
def GetMemberQty(id):
|
|
"""
|
|
Get number of members of a structure
|
|
|
|
@param id: structure type ID
|
|
|
|
@return: -1 if bad structure type ID is passed otherwise
|
|
returns number of members.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return -1
|
|
|
|
return s.memqty
|
|
|
|
|
|
def GetStrucPrevOff(id, offset):
|
|
"""
|
|
Get previous offset in a structure
|
|
|
|
@param id: structure type ID
|
|
@param offset: current offset
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
or no (more) offsets in the structure
|
|
otherwise returns previous offset in a structure.
|
|
|
|
@note: IDA allows 'holes' between members of a
|
|
structure. It treats these 'holes'
|
|
as unnamed arrays of bytes.
|
|
This function returns a member offset or a hole offset.
|
|
It will return size of the structure if input
|
|
'offset' is bigger than the structure size.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return -1
|
|
|
|
return idaapi.get_struc_prev_offset(s, offset)
|
|
|
|
|
|
def GetStrucNextOff(id, offset):
|
|
"""
|
|
Get next offset in a structure
|
|
|
|
@param id: structure type ID
|
|
@param offset: current offset
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
or no (more) offsets in the structure
|
|
otherwise returns next offset in a structure.
|
|
|
|
@note: IDA allows 'holes' between members of a
|
|
structure. It treats these 'holes'
|
|
as unnamed arrays of bytes.
|
|
This function returns a member offset or a hole offset.
|
|
It will return size of the structure if input
|
|
'offset' belongs to the last member of the structure.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return -1
|
|
|
|
return idaapi.get_struc_next_offset(s, offset)
|
|
|
|
|
|
def GetFirstMember(id):
|
|
"""
|
|
Get offset of the first member of a structure
|
|
|
|
@param id: structure type ID
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
or structure has no members
|
|
otherwise returns offset of the first member.
|
|
|
|
@note: IDA allows 'holes' between members of a
|
|
structure. It treats these 'holes'
|
|
as unnamed arrays of bytes.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return -1
|
|
|
|
return idaapi.get_struc_first_offset(s)
|
|
|
|
|
|
def GetLastMember(id):
|
|
"""
|
|
Get offset of the last member of a structure
|
|
|
|
@param id: structure type ID
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
or structure has no members
|
|
otherwise returns offset of the last member.
|
|
|
|
@note: IDA allows 'holes' between members of a
|
|
structure. It treats these 'holes'
|
|
as unnamed arrays of bytes.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return -1
|
|
|
|
return idaapi.get_struc_last_offset(s)
|
|
|
|
|
|
def GetMemberOffset(id, member_name):
|
|
"""
|
|
Get offset of a member of a structure by the member name
|
|
|
|
@param id: structure type ID
|
|
@param member_name: name of structure member
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
or no such member in the structure
|
|
otherwise returns offset of the specified member.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return -1
|
|
|
|
m = idaapi.get_member_by_name(s, member_name)
|
|
if not m:
|
|
return -1
|
|
|
|
return m.get_soff()
|
|
|
|
|
|
def GetMemberName(id, member_offset):
|
|
"""
|
|
Get name of a member of a structure
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: member offset. The offset can be
|
|
any offset in the member. For example,
|
|
is a member is 4 bytes long and starts
|
|
at offset 2, then 2,3,4,5 denote
|
|
the same structure member.
|
|
|
|
@return: None if bad structure type ID is passed
|
|
or no such member in the structure
|
|
otherwise returns name of the specified member.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return None
|
|
|
|
m = idaapi.get_member(s, member_offset)
|
|
if not m:
|
|
return None
|
|
|
|
return idaapi.get_member_name(m.id)
|
|
|
|
|
|
def GetMemberComment(id, member_offset, repeatable):
|
|
"""
|
|
Get comment of a member
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: member offset. The offset can be
|
|
any offset in the member. For example,
|
|
is a member is 4 bytes long and starts
|
|
at offset 2, then 2,3,4,5 denote
|
|
the same structure member.
|
|
@param repeatable: 1: get repeatable comment
|
|
0: get regular comment
|
|
|
|
@return: None if bad structure type ID is passed
|
|
or no such member in the structure
|
|
otherwise returns comment of the specified member.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return None
|
|
|
|
m = idaapi.get_member(s, member_offset)
|
|
if not m:
|
|
return None
|
|
|
|
return idaapi.get_member_cmt(m.id, repeatable)
|
|
|
|
|
|
def GetMemberSize(id, member_offset):
|
|
"""
|
|
Get size of a member
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: member offset. The offset can be
|
|
any offset in the member. For example,
|
|
is a member is 4 bytes long and starts
|
|
at offset 2, then 2,3,4,5 denote
|
|
the same structure member.
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
or no such member in the structure
|
|
otherwise returns size of the specified
|
|
member in bytes.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return None
|
|
|
|
m = idaapi.get_member(s, member_offset)
|
|
if not m:
|
|
return None
|
|
|
|
return idaapi.get_member_size(m)
|
|
|
|
|
|
def GetMemberFlag(id, member_offset):
|
|
"""
|
|
Get type of a member
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: member offset. The offset can be
|
|
any offset in the member. For example,
|
|
is a member is 4 bytes long and starts
|
|
at offset 2, then 2,3,4,5 denote
|
|
the same structure member.
|
|
|
|
@return: -1 if bad structure type ID is passed
|
|
or no such member in the structure
|
|
otherwise returns type of the member, see bit
|
|
definitions above. If the member type is a structure
|
|
then function GetMemberStrid() should be used to
|
|
get the structure type id.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return -1
|
|
|
|
m = idaapi.get_member(s, member_offset)
|
|
if not m:
|
|
return -1
|
|
|
|
return m.flag
|
|
|
|
|
|
def GetMemberStrId(id, member_offset):
|
|
"""
|
|
Get structure id of a member
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: member offset. The offset can be
|
|
any offset in the member. For example,
|
|
is a member is 4 bytes long and starts
|
|
at offset 2, then 2,3,4,5 denote
|
|
the same structure member.
|
|
@return: -1 if bad structure type ID is passed
|
|
or no such member in the structure
|
|
otherwise returns structure id of the member.
|
|
If the current member is not a structure, returns -1.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return -1
|
|
|
|
m = idaapi.get_member(s, member_offset)
|
|
if not m:
|
|
return -1
|
|
|
|
cs = get_member_struc(m)
|
|
if cs:
|
|
return cs.id
|
|
else:
|
|
return -1
|
|
|
|
|
|
def IsUnion(id):
|
|
"""
|
|
Is a structure a union?
|
|
|
|
@param id: structure type ID
|
|
|
|
@return: 1: yes, this is a union id
|
|
0: no
|
|
|
|
@note: Unions are a special kind of structures
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return 0
|
|
|
|
return s.is_union()
|
|
|
|
|
|
def AddStrucEx(index, name, is_union):
|
|
"""
|
|
Define a new structure type
|
|
|
|
@param index: index of new structure type
|
|
If another structure has the specified index,
|
|
then index of that structure and all other
|
|
structures will be incremented, freeing the specifed
|
|
index. If index is == -1, then the biggest index
|
|
number will be used.
|
|
See GetFirstStrucIdx() for the explanation of
|
|
structure indices and IDs.
|
|
@param name: name of the new structure type.
|
|
@param is_union: 0: structure
|
|
1: union
|
|
|
|
@return: -1 if can't define structure type because of
|
|
bad structure name: the name is ill-formed or is
|
|
already used in the program.
|
|
otherwise returns ID of the new structure type
|
|
"""
|
|
if index == -1:
|
|
index = BADADDR
|
|
|
|
return idaapi.add_struc(index, name, is_union)
|
|
|
|
|
|
def DelStruc(id):
|
|
"""
|
|
Delete a structure type
|
|
|
|
@param id: structure type ID
|
|
|
|
@return: 0 if bad structure type ID is passed
|
|
1 otherwise the structure type is deleted. All data
|
|
and other structure types referencing to the
|
|
deleted structure type will be displayed as array
|
|
of bytes.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return 0
|
|
|
|
return idaapi.del_struc(s)
|
|
|
|
|
|
def SetStrucIdx(id, index):
|
|
"""
|
|
Change structure index
|
|
|
|
@param id: structure type ID
|
|
@param index: new index of the structure
|
|
|
|
@return: != 0 - ok
|
|
|
|
@note: See GetFirstStrucIdx() for the explanation of
|
|
structure indices and IDs.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return 0
|
|
|
|
return idaapi.set_struc_idx(s, index)
|
|
|
|
|
|
def SetStrucName(id, name):
|
|
"""
|
|
Change structure name
|
|
|
|
@param id: structure type ID
|
|
@param name: new name of the structure
|
|
|
|
@return: != 0 - ok
|
|
"""
|
|
return idaapi.set_struc_name(id, name)
|
|
|
|
|
|
def SetStrucComment(id, comment, repeatable):
|
|
"""
|
|
Change structure comment
|
|
|
|
@param id: structure type ID
|
|
@param comment: new comment of the structure
|
|
@param repeatable: 1: change repeatable comment
|
|
0: change regular comment
|
|
@return: != 0 - ok
|
|
"""
|
|
return idaapi.set_struc_cmt(id, comment, repeatable)
|
|
|
|
|
|
def _IDC_PrepareStrucMemberTypeinfo(flag, typeid):
|
|
""" Internal function to prepare typeinfo_t for adding/setting structure members """
|
|
|
|
simple_types = [ FF_BYTE, FF_WORD, FF_DWRD, FF_QWRD, FF_OWRD, FF_TBYT, FF_FLOAT, FF_DOUBLE, FF_PACKREAL ]
|
|
|
|
if idaapi.isASCII(flag):
|
|
ti = idaapi.typeinfo_t()
|
|
ti.strtype = typeid
|
|
elif idaapi.isStruct(flag):
|
|
ti = idaapi.typeinfo_t()
|
|
ti.tid = typeid
|
|
elif idaapi.isOff0(flag):
|
|
ti = idaapi.typeinfo_t()
|
|
ri = idaapi.refinfo_t()
|
|
ri.target = BADADDR
|
|
ri.base = typeid
|
|
ri.tdelta = 0
|
|
if (flag & FF_WORD):
|
|
ri.flags = REF_OFF16
|
|
else:
|
|
ri.flags = REF_OFF32
|
|
ti.ri = ri
|
|
elif idaapi.isEnum0(flag):
|
|
ti = idaapi.typeinfo_t()
|
|
ec = idaapi.enum_const_t()
|
|
ec.tid = typeid
|
|
ti.ec = ec
|
|
elif idaapi.isStroff0(flag):
|
|
ti = idaapi.typeinfo_t()
|
|
ti.path.len = 2
|
|
target_struct = idaapi.get_struc(typeid)
|
|
assert target_struct, "Target structure is invalid"
|
|
target_member = idaapi.get_member(target_struct, 0)
|
|
assert target_member, "Target member is not found"
|
|
ti.path.ids = [ typeid, target_member.id ]
|
|
elif ((flag & 0xFFFFFF) & idaapi.DT_TYPE) in simple_types:
|
|
ti = None
|
|
else:
|
|
assert False, "Unknown type flag 0x%08x" % flag
|
|
return ti
|
|
|
|
|
|
def AddStrucMember(id, name, offset, flag, typeid, nbytes):
|
|
"""
|
|
Add structure member
|
|
|
|
@param id: structure type ID
|
|
@param name: name of the new member
|
|
@param offset: offset of the new member
|
|
-1 means to add at the end of the structure
|
|
@param flag: type of the new member. Should be one of
|
|
FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA
|
|
@param typeid: structure id if 'flag' == FF_STRU
|
|
Denotes type of the member if the member itself is a structure.
|
|
if isOff0(flag) then typeid specifies the offset base.
|
|
if isASCII(flag) then typeid specifies the string type (ASCSTR_...).
|
|
if isStroff(flag) then typeid specifies the structure id
|
|
Otherwise should be -1.
|
|
@param nbytes: number of bytes in the new member
|
|
|
|
@return: 0 - ok, otherwise error code (one of STRUC_ERROR_*)
|
|
"""
|
|
struc = idaapi.get_struc(id)
|
|
assert struct, "get_struc() failed"
|
|
ti = _IDC_PrepareStrucMemberTypeinfo(flag, typeid)
|
|
return idaapi.add_struc_member(struc, name, offset, flag, ti, nbytes)
|
|
|
|
|
|
STRUC_ERROR_MEMBER_NAME = -1 # already has member with this name (bad name)
|
|
STRUC_ERROR_MEMBER_OFFSET = -2 # already has member at this offset
|
|
STRUC_ERROR_MEMBER_SIZE = -3 # bad number of bytes or bad sizeof(type)
|
|
STRUC_ERROR_MEMBER_TINFO = -4 # bad typeid parameter
|
|
STRUC_ERROR_MEMBER_STRUCT = -5 # bad struct id (the 1st argument)
|
|
STRUC_ERROR_MEMBER_UNIVAR = -6 # unions can't have variable sized members
|
|
STRUC_ERROR_MEMBER_VARLAST = -7 # variable sized member should be the last member in the structure
|
|
|
|
|
|
def DelStrucMember(id, member_offset):
|
|
"""
|
|
Delete structure member
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: offset of the member
|
|
|
|
@return: != 0 - ok.
|
|
|
|
@note: IDA allows 'holes' between members of a
|
|
structure. It treats these 'holes'
|
|
as unnamed arrays of bytes.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return 0
|
|
|
|
return idaapi.del_struc_member(s, member_offset)
|
|
|
|
|
|
def SetMemberName(id, member_offset, name):
|
|
"""
|
|
Change structure member name
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: offset of the member
|
|
@param name: new name of the member
|
|
|
|
@return: != 0 - ok.
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return 0
|
|
|
|
return idaapi.set_member_name(s, member_offset, name)
|
|
|
|
|
|
def SetMemberType(id, member_offset, flag, typeid, nitems):
|
|
"""
|
|
Change structure member type
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: offset of the member
|
|
@param flag: new type of the member. Should be one of
|
|
FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA
|
|
@param typeid: structure id if 'flag' == FF_STRU
|
|
Denotes type of the member is the member
|
|
itself is a structure. Otherwise should be -1.
|
|
if isOff0(flag) then typeid specifies the offset base.
|
|
if isASCII(flag) then typeid specifies the string type
|
|
(ASCSTR_...).
|
|
@param nitems: number of items in the member
|
|
|
|
@return: !=0 - ok.
|
|
"""
|
|
struc = idaapi.get_struc(id)
|
|
assert struct, "get_struc() failed"
|
|
ti = _IDC_PrepareStrucMemberTypeinfo(flag, typeid)
|
|
return idaapi.set_member_type(struc, member_offset, flag, ti, nitems)
|
|
|
|
|
|
def SetMemberComment(id, member_offset, comment, repeatable):
|
|
"""
|
|
Change structure member comment
|
|
|
|
@param id: structure type ID
|
|
@param member_offset: offset of the member
|
|
@param comment: new comment of the structure member
|
|
@param repeatable: 1: change repeatable comment
|
|
0: change regular comment
|
|
|
|
@return: != 0 - ok
|
|
"""
|
|
s = idaapi.get_struc(id)
|
|
if not s:
|
|
return 0
|
|
|
|
m = idaapi.get_member(s, member_offset)
|
|
if not m:
|
|
return 0
|
|
|
|
return idaapi.set_member_cmt(m, comment, repeatable)
|
|
|
|
|
|
def GetFchunkAttr(ea, attr):
|
|
"""
|
|
Get a function chunk attribute
|
|
|
|
@param ea: any address in the chunk
|
|
@param attr: one of: FUNCATTR_START, FUNCATTR_END, FUNCATTR_COLOR
|
|
|
|
@return: desired attribute or -1
|
|
"""
|
|
if attr in [ FUNCATTR_START, FUNCATTR_END, FUNCATTR_COLOR ]:
|
|
return GetFunctionAttr(ea, attr)
|
|
else:
|
|
return -1
|
|
|
|
|
|
def SetFchunkAttr(ea, attr, value):
|
|
"""
|
|
Set a function chunk attribute
|
|
|
|
@param ea: any address in the chunk
|
|
@param attr: only FUNCATTR_COLOR
|
|
@param value: desired bg color (RGB)
|
|
|
|
@return: 0 if failed, 1 if success
|
|
"""
|
|
if attr in [ FUNCATTR_COLOR ]:
|
|
return SetFunctionAttr(ea, attr, value)
|
|
else:
|
|
return 0
|
|
|
|
|
|
def NextFchunk(ea):
|
|
"""
|
|
Get next function chunk
|
|
|
|
@param ea: any address
|
|
|
|
@return: the starting address of the next function chunk or BADADDR
|
|
|
|
@note: This function enumerates all chunks of all functions in the database
|
|
"""
|
|
func = idaapi.get_next_fchunk(ea)
|
|
|
|
if func:
|
|
return func.startEA
|
|
else:
|
|
return BADADDR
|
|
|
|
|
|
def PrevFchunk(ea):
|
|
"""
|
|
Get previous function chunk
|
|
|
|
@param ea: any address
|
|
|
|
@return: the starting address of the function chunk or BADADDR
|
|
|
|
@note: This function enumerates all chunks of all functions in the database
|
|
"""
|
|
func = idaapi.get_prev_fchunk(ea)
|
|
|
|
if func:
|
|
return func.startEA
|
|
else:
|
|
return BADADDR
|
|
|
|
|
|
def AppendFchunk(funcea, ea1, ea2):
|
|
"""
|
|
Append a function chunk to the function
|
|
|
|
@param funcea: any address in the function
|
|
@param ea1: start of function tail
|
|
@param ea2: end of function tail
|
|
@return: 0 if failed, 1 if success
|
|
|
|
@note: If a chunk exists at the specified addresses, it must have exactly
|
|
the specified boundaries
|
|
"""
|
|
func = idaapi.get_func(funcea)
|
|
|
|
if not func:
|
|
return 0
|
|
else:
|
|
return idaapi.append_func_tail(func, ea1, ea2)
|
|
|
|
|
|
def RemoveFchunk(funcea, tailea):
|
|
"""
|
|
Remove a function chunk from the function
|
|
|
|
@param funcea: any address in the function
|
|
@param ea1: any address in the function chunk to remove
|
|
|
|
@return: 0 if failed, 1 if success
|
|
"""
|
|
func = idaapi.get_func(funcea)
|
|
|
|
if not func:
|
|
return 0
|
|
else:
|
|
return idaapi.remove_func_tail(func, tailea)
|
|
|
|
|
|
def SetFchunkOwner(tailea, funcea):
|
|
"""
|
|
Change the function chunk owner
|
|
|
|
@param tailea: any address in the function chunk
|
|
@param funcea: the starting address of the new owner
|
|
|
|
@return: 0 if failed, 1 if success
|
|
|
|
@note: The new owner must already have the chunk appended before the call
|
|
"""
|
|
tail = idaapi.get_func(tailea)
|
|
|
|
if not tail:
|
|
return 0
|
|
else:
|
|
return idaapi.set_tail_owner(tail, funcea)
|
|
|
|
|
|
def FirstFuncFchunk(funcea):
|
|
"""
|
|
Get the first function chunk of the specified function
|
|
|
|
@param funcea: any address in the function
|
|
|
|
@return: the function entry point or BADADDR
|
|
|
|
@note: This function returns the first (main) chunk of the specified function
|
|
"""
|
|
func = idaapi.get_func(funcea)
|
|
fci = idaapi.func_tail_iterator_t(func, funcea)
|
|
if fci.main():
|
|
return fci.chunk().startEA
|
|
else:
|
|
return BADADDR
|
|
|
|
|
|
def NextFuncFchunk(funcea, tailea):
|
|
"""
|
|
Get the next function chunk of the specified function
|
|
|
|
@param funcea: any address in the function
|
|
@param tailea: any address in the current chunk
|
|
|
|
@return: the starting address of the next function chunk or BADADDR
|
|
|
|
@note: This function returns the next chunk of the specified function
|
|
"""
|
|
func = idaapi.get_func(funcea)
|
|
fci = idaapi.func_tail_iterator_t(func, funcea)
|
|
if not fci.main():
|
|
return BADADDR
|
|
|
|
# Iterate and try to find the current chunk
|
|
found = False
|
|
while True:
|
|
if fci.chunk().startEA <= tailea and \
|
|
fci.chunk().endEA > tailea:
|
|
found = True
|
|
break
|
|
if not fci.next():
|
|
break
|
|
|
|
# Return the next chunk, if there is one
|
|
if found and fci.next():
|
|
return fci.chunk().startEA
|
|
else:
|
|
return BADADDR
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# E N U M S
|
|
# ----------------------------------------------------------------------------
|
|
def GetEnumQty():
|
|
"""
|
|
Get number of enum types
|
|
|
|
@return: number of enumerations
|
|
"""
|
|
return idaapi.get_enum_qty()
|
|
|
|
|
|
def GetnEnum(idx):
|
|
"""
|
|
Get ID of the specified enum by its serial number
|
|
|
|
@param idx: number of enum (0..GetEnumQty()-1)
|
|
|
|
@return: ID of enum or -1 if error
|
|
"""
|
|
return idaapi.getn_enum(idx)
|
|
|
|
|
|
def GetEnumIdx(enum_id):
|
|
"""
|
|
Get serial number of enum by its ID
|
|
|
|
@param enum_id: ID of enum
|
|
|
|
@return: (0..GetEnumQty()-1) or -1 if error
|
|
"""
|
|
return idaapi.get_enum_idx(enum_id)
|
|
|
|
|
|
def GetEnum(name):
|
|
"""
|
|
Get enum ID by the name of enum
|
|
|
|
Arguments:
|
|
name - name of enum
|
|
|
|
returns: ID of enum or -1 if no such enum exists
|
|
"""
|
|
return idaapi.get_enum(name)
|
|
|
|
|
|
def GetEnumName(enum_id):
|
|
"""
|
|
Get name of enum
|
|
|
|
@param enum_id: ID of enum
|
|
|
|
@return: name of enum or empty string
|
|
"""
|
|
return idaapi.get_enum_name(enum_id)
|
|
|
|
|
|
def GetEnumCmt(enum_id, repeatable):
|
|
"""
|
|
Get comment of enum
|
|
|
|
@param enum_id: ID of enum
|
|
@param repeatable: 0:get regular comment
|
|
1:get repeatable comment
|
|
|
|
@return: comment of enum
|
|
"""
|
|
return idaapi.get_enum_cmt(enum_id, repeatable)
|
|
|
|
|
|
def GetEnumSize(enum_id):
|
|
"""
|
|
Get size of enum
|
|
|
|
@param enum_id: ID of enum
|
|
|
|
@return: number of constants in the enum
|
|
Returns 0 if enum_id is bad.
|
|
"""
|
|
return idaapi.get_enum_size(enum_id)
|
|
|
|
|
|
def GetEnumFlag(enum_id):
|
|
"""
|
|
Get flag of enum
|
|
|
|
@param enum_id: ID of enum
|
|
|
|
@return: flags of enum. These flags determine representation
|
|
of numeric constants (binary,octal,decimal,hex)
|
|
in the enum definition. See start of this file for
|
|
more information about flags.
|
|
Returns 0 if enum_id is bad.
|
|
"""
|
|
return idaapi.get_enum_flag(enum_id)
|
|
|
|
|
|
def GetConstByName(name):
|
|
"""
|
|
Get member of enum - a symbolic constant ID
|
|
|
|
@param name: name of symbolic constant
|
|
|
|
@return: ID of constant or -1
|
|
"""
|
|
return idaapi.get_const_by_name(name)
|
|
|
|
|
|
def GetConstValue(const_id):
|
|
"""
|
|
Get value of symbolic constant
|
|
|
|
@param const_id: id of symbolic constant
|
|
|
|
@return: value of constant or 0
|
|
"""
|
|
return idaapi.get_const_value(const_id)
|
|
|
|
|
|
def GetConstBmask(const_id):
|
|
"""
|
|
Get bit mask of symbolic constant
|
|
|
|
@param const_id: id of symbolic constant
|
|
|
|
@return: bitmask of constant or 0
|
|
ordinary enums have bitmask = -1
|
|
"""
|
|
return idaapi.get_const_bitmask(const_id)
|
|
|
|
|
|
def GetConstEnum(const_id):
|
|
"""
|
|
Get id of enum by id of constant
|
|
|
|
@param const_id: id of symbolic constant
|
|
|
|
@return: id of enum the constant belongs to.
|
|
-1 if const_id is bad.
|
|
"""
|
|
return idaapi.get_const_enum(const_id)
|
|
|
|
|
|
def GetConstEx(enum_id, value, serial, bmask):
|
|
"""
|
|
Get id of constant
|
|
|
|
@param enum_id: id of enum
|
|
@param value: value of constant
|
|
@param serial: serial number of the constant in the
|
|
enumeration. See OpEnumEx() for details.
|
|
@param bmask: bitmask of the constant
|
|
ordinary enums accept only -1 as a bitmask
|
|
|
|
@return: id of constant or -1 if error
|
|
"""
|
|
return idaapi.get_const(enum_id, value, serial, bmask)
|
|
|
|
|
|
def GetFirstBmask(enum_id):
|
|
"""
|
|
Get first bitmask in the enum (bitfield)
|
|
|
|
@param enum_id: id of enum (bitfield)
|
|
|
|
@return: the smallest bitmask of constant or -1
|
|
no bitmasks are defined yet
|
|
All bitmasks are sorted by their values
|
|
as unsigned longs.
|
|
"""
|
|
return idaapi.get_first_bmask(enum_id)
|
|
|
|
|
|
def GetLastBmask(enum_id):
|
|
"""
|
|
Get last bitmask in the enum (bitfield)
|
|
|
|
@param enum_id: id of enum
|
|
|
|
@return: the biggest bitmask or -1 no bitmasks are defined yet
|
|
All bitmasks are sorted by their values as unsigned longs.
|
|
"""
|
|
return idaapi.get_last_bmask(enum_id)
|
|
|
|
|
|
def GetNextBmask(enum_id, value):
|
|
"""
|
|
Get next bitmask in the enum (bitfield)
|
|
|
|
@param enum_id: id of enum
|
|
@param value: value of the current bitmask
|
|
|
|
@return: value of a bitmask with value higher than the specified
|
|
value. -1 if no such bitmasks exist.
|
|
All bitmasks are sorted by their values
|
|
as unsigned longs.
|
|
"""
|
|
return idaapi.get_next_bmask(enum_id, value)
|
|
|
|
|
|
def GetPrevBmask(enum_id, value):
|
|
"""
|
|
Get prev bitmask in the enum (bitfield)
|
|
|
|
@param enum_id: id of enum
|
|
@param value: value of the current bitmask
|
|
|
|
@return: value of a bitmask with value lower than the specified
|
|
value. -1 no such bitmasks exist.
|
|
All bitmasks are sorted by their values as unsigned longs.
|
|
"""
|
|
return idaapi.get_prev_bmask(enum_id, value)
|
|
|
|
|
|
def GetBmaskName(enum_id, bmask):
|
|
"""
|
|
Get bitmask name (only for bitfields)
|
|
|
|
@param enum_id: id of enum
|
|
@param bmask: bitmask of the constant
|
|
|
|
@return: name of bitmask or None
|
|
"""
|
|
return idaapi.get_bmask_name(enum_id, bmask)
|
|
|
|
|
|
def GetBmaskCmt(enum_id, bmask, repeatable):
|
|
"""
|
|
Get bitmask comment (only for bitfields)
|
|
|
|
@param enum_id: id of enum
|
|
@param bmask: bitmask of the constant
|
|
@param repeatable: type of comment, 0-regular, 1-repeatable
|
|
|
|
@return: comment attached to bitmask or None
|
|
"""
|
|
return idaapi.get_bmask_cmt(enum_id, bmask, repeatable)
|
|
|
|
|
|
def SetBmaskName(enum_id, bmask, name):
|
|
"""
|
|
Set bitmask name (only for bitfields)
|
|
|
|
@param enum_id: id of enum
|
|
@param bmask: bitmask of the constant
|
|
@param name: name of bitmask
|
|
|
|
@return: 1-ok, 0-failed
|
|
"""
|
|
return idaapi.set_bmask_name(enum_id, bmask, name)
|
|
|
|
|
|
def SetBmaskCmt(enum_id, bmask, cmt, repeatable):
|
|
"""
|
|
Set bitmask comment (only for bitfields)
|
|
|
|
@param enum_id: id of enum
|
|
@param bmask: bitmask of the constant
|
|
@param cmt: comment
|
|
repeatable - type of comment, 0-regular, 1-repeatable
|
|
|
|
@return: 1-ok, 0-failed
|
|
"""
|
|
return idaapi.set_bmask_cmt(enum_id, bmask, cmt, repeatable)
|
|
|
|
|
|
def GetFirstConst(enum_id, bmask):
|
|
"""
|
|
Get first constant in the enum
|
|
|
|
@param enum_id: id of enum
|
|
@param bmask: bitmask of the constant (ordinary enums accept only -1 as a bitmask)
|
|
|
|
@return: value of constant or -1 no constants are defined
|
|
All constants are sorted by their values as unsigned longs.
|
|
"""
|
|
return idaapi.get_first_const(enum_id, bmask)
|
|
|
|
|
|
def GetLastConst(enum_id, bmask):
|
|
"""
|
|
Get last constant in the enum
|
|
|
|
@param enum_id: id of enum
|
|
@param bmask: bitmask of the constant (ordinary enums accept only -1 as a bitmask)
|
|
|
|
@return: value of constant or -1 no constants are defined
|
|
All constants are sorted by their values
|
|
as unsigned longs.
|
|
"""
|
|
return idaapi.get_last_const(enum_id, bmask)
|
|
|
|
|
|
def GetNextConst(enum_id, value, bmask):
|
|
"""
|
|
Get next constant in the enum
|
|
|
|
@param enum_id: id of enum
|
|
@param bmask: bitmask of the constant ordinary enums accept only -1 as a bitmask
|
|
@param value: value of the current constant
|
|
|
|
@return: value of a constant with value higher than the specified
|
|
value. -1 no such constants exist.
|
|
All constants are sorted by their values as unsigned longs.
|
|
"""
|
|
return idaapi.get_next_const(enum_id, value, bmask)
|
|
|
|
|
|
def GetPrevConst(enum_id, value, bmask):
|
|
"""
|
|
Get prev constant in the enum
|
|
|
|
@param enum_id: id of enum
|
|
@param bmask : bitmask of the constant
|
|
ordinary enums accept only -1 as a bitmask
|
|
@param value: value of the current constant
|
|
|
|
@return: value of a constant with value lower than the specified
|
|
value. -1 no such constants exist.
|
|
All constants are sorted by their values as unsigned longs.
|
|
"""
|
|
return idaapi.get_prev_const(enum_id, value, bmask)
|
|
|
|
|
|
def GetConstName(const_id):
|
|
"""
|
|
Get name of a constant
|
|
|
|
@param const_id: id of const
|
|
|
|
Returns: name of constant
|
|
"""
|
|
name = idaapi.get_const_name(const_id)
|
|
|
|
if not name:
|
|
return ""
|
|
else:
|
|
return name
|
|
|
|
|
|
def GetConstCmt(const_id, repeatable):
|
|
"""
|
|
Get comment of a constant
|
|
|
|
@param const_id: id of const
|
|
@param repeatable: 0:get regular comment, 1:get repeatable comment
|
|
|
|
@return: comment string
|
|
"""
|
|
cmt = idaapi.get_const_cmt(const_id, repeatable)
|
|
|
|
if not cmt:
|
|
return ""
|
|
else:
|
|
return cmt
|
|
|
|
|
|
def AddEnum(idx, name, flag):
|
|
"""
|
|
Add a new enum type
|
|
|
|
@param idx: serial number of the new enum.
|
|
If another enum with the same serial number
|
|
exists, then all enums with serial
|
|
numbers >= the specified idx get their
|
|
serial numbers incremented (in other words,
|
|
the new enum is put in the middle of the list of enums).
|
|
|
|
If idx >= GetEnumQty() or idx == -1
|
|
then the new enum is created at the end of
|
|
the list of enums.
|
|
@param name: name of the enum.
|
|
@param flag: flags for representation of numeric constants
|
|
in the definition of enum.
|
|
|
|
@return: id of new enum or -1.
|
|
"""
|
|
return idaapi.add_enum(idx, name, flag)
|
|
|
|
|
|
def DelEnum(enum_id):
|
|
"""
|
|
Delete enum type
|
|
|
|
@param enum_id: id of enum
|
|
|
|
@return: None
|
|
"""
|
|
idaapi.del_enum(enum_id)
|
|
|
|
|
|
def SetEnumIdx(enum_id, idx):
|
|
"""
|
|
Give another serial number to a enum
|
|
|
|
@param enum_id: id of enum
|
|
@param idx: new serial number.
|
|
If another enum with the same serial number
|
|
exists, then all enums with serial
|
|
numbers >= the specified idx get their
|
|
serial numbers incremented (in other words,
|
|
the new enum is put in the middle of the list of enums).
|
|
|
|
If idx >= GetEnumQty() then the enum is
|
|
moved to the end of the list of enums.
|
|
|
|
@return: comment string
|
|
"""
|
|
return idaapi.set_enum_idx(enum_id, idx)
|
|
|
|
|
|
def SetEnumName(enum_id, name):
|
|
"""
|
|
Rename enum
|
|
|
|
@param enum_id: id of enum
|
|
@param name: new name of enum
|
|
|
|
@return: 1-ok,0-failed
|
|
"""
|
|
return idaapi.set_enum_name(enum_id, name)
|
|
|
|
|
|
def SetEnumCmt(enum_id, cmt, repeatable):
|
|
"""
|
|
Set comment of enum
|
|
|
|
@param enum_id: id of enum
|
|
@param cmt: new comment for the enum
|
|
@param repeatable: is the comment repeatable?
|
|
- 0:set regular comment
|
|
- 1:set repeatable comment
|
|
|
|
@return: 1-ok,0-failed
|
|
"""
|
|
return idaapi.set_enum_cmt(enum_id, cmt, repeatable)
|
|
|
|
|
|
def SetEnumFlag(enum_id, flag):
|
|
"""
|
|
Set flag of enum
|
|
|
|
@param enum_id: id of enum
|
|
@param flag: flags for representation of numeric constants
|
|
in the definition of enum.
|
|
|
|
@return: 1-ok,0-failed
|
|
"""
|
|
return idaapi.set_enum_flag(enum_id, flag)
|
|
|
|
|
|
def SetEnumBf(enum_id, flag):
|
|
"""
|
|
Set bitfield property of enum
|
|
|
|
@param enum_id: id of enum
|
|
@param flag: flags
|
|
- 1: convert to bitfield
|
|
- 0: convert to ordinary enum
|
|
|
|
@return: 1-ok,0-failed
|
|
"""
|
|
return idaapi.set_enum_bf(enum_id, flag)
|
|
|
|
|
|
def IsBitfield(enum_id):
|
|
"""
|
|
Is enum a bitfield?
|
|
|
|
@param enum_id: id of enum
|
|
|
|
@return: 1-yes, 0-no, ordinary enum
|
|
"""
|
|
return idaapi.is_bf(enum_id)
|
|
|
|
|
|
def AddConstEx(enum_id, name, value, bmask):
|
|
"""
|
|
Add a member of enum - a symbolic constant
|
|
|
|
@param enum_id: id of enum
|
|
@param name: name of symbolic constant. Must be unique in the program.
|
|
@param value: value of symbolic constant.
|
|
@param bmask: bitmask of the constant
|
|
ordinary enums accept only -1 as a bitmask
|
|
all bits set in value should be set in bmask too
|
|
|
|
@return: 0-ok, otherwise error code (one of CONST_ERROR_*)
|
|
"""
|
|
return idaapi.add_const(enum_id, name, value, bmask)
|
|
|
|
|
|
CONST_ERROR_NAME = idaapi.CONST_ERROR_NAME # already have member with this name (bad name)
|
|
CONST_ERROR_VALUE = idaapi.CONST_ERROR_VALUE # already have member with this value
|
|
CONST_ERROR_ENUM = idaapi.CONST_ERROR_ENUM # bad enum id
|
|
CONST_ERROR_MASK = idaapi.CONST_ERROR_MASK # bad bmask
|
|
CONST_ERROR_ILLV = idaapi.CONST_ERROR_ILLV # bad bmask and value combination (~bmask & value != 0)
|
|
|
|
|
|
def DelConstEx(enum_id, value, serial, bmask):
|
|
"""
|
|
Delete a member of enum - a symbolic constant
|
|
|
|
@param enum_id: id of enum
|
|
@param value: value of symbolic constant.
|
|
@param serial: serial number of the constant in the
|
|
enumeration. See OpEnumEx() for for details.
|
|
@param bmask: bitmask of the constant ordinary enums accept
|
|
only -1 as a bitmask
|
|
|
|
@return: 1-ok, 0-failed
|
|
"""
|
|
return idaapi.del_const(enum_id, value, serial, bmask)
|
|
|
|
|
|
def SetConstName(const_id, name):
|
|
"""
|
|
Rename a member of enum - a symbolic constant
|
|
|
|
@param const_id: id of const
|
|
@param name: new name of constant
|
|
|
|
@return: 1-ok, 0-failed
|
|
"""
|
|
return idaapi.set_const_name(const_id, name)
|
|
|
|
|
|
def SetConstCmt(const_id, cmt, repeatable):
|
|
"""
|
|
Set a comment of a symbolic constant
|
|
|
|
@param const_id: id of const
|
|
@param cmt: new comment for the constant
|
|
@param repeatable: is the comment repeatable?
|
|
0: set regular comment
|
|
1: set repeatable comment
|
|
|
|
@return: 1-ok, 0-failed
|
|
"""
|
|
return idaapi.set_const_cmt(const_id, cmt, repeatable)
|
|
|
|
#----------------------------------------------------------------------------
|
|
# A R R A Y S I N I D C
|
|
#----------------------------------------------------------------------------
|
|
|
|
def CreateArray(name):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetArrayId(name):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def RenameArray(id, newname):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def DeleteArray(id):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def SetArrayLong(id, idx, value):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def SetArrayString(id, idx, str):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetArrayElement(tag, id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def DelArrayElement(tag, id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetFirstIndex(tag, id):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetLastIndex(tag, id):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetNextIndex(tag, id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetPrevIndex(tag, id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def SetHashLong(id, idx, value):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def SetHashString(id, idx, value):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetHashLong(id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetHashString(id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def DelHashElement(id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetFirstHashKey(id):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetNextHashKey(id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetLastHashKey(id):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
def GetPrevHashKey(id, idx):
|
|
raise DeprecatedIDCError, "Use python pickles instead."
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# S O U R C E F I L E / L I N E N U M B E R S
|
|
#----------------------------------------------------------------------------
|
|
def AddSourceFile(ea1, ea2, filename):
|
|
"""
|
|
Mark a range of address as belonging to a source file
|
|
An address range may belong only to one source file.
|
|
A source file may be represented by several address ranges.
|
|
|
|
@param ea1: linear address of start of the address range
|
|
@param ea2: linear address of end of the address range
|
|
@param filename: name of source file.
|
|
|
|
@return: 1-ok, 0-failed.
|
|
|
|
@note: IDA can keep information about source files used to create the program.
|
|
Each source file is represented by a range of addresses.
|
|
A source file may contains several address ranges.
|
|
"""
|
|
return idaapi.add_sourcefile(ea1, ea2, filename)
|
|
|
|
|
|
def GetSourceFile(ea):
|
|
"""
|
|
Get name of source file occupying the given address
|
|
|
|
@param ea: linear address
|
|
|
|
@return: NULL - source file information is not found
|
|
otherwise returns pointer to file name
|
|
"""
|
|
return idaapi.get_sourcefile(ea)
|
|
|
|
|
|
def DelSourceFile(ea):
|
|
"""
|
|
Delete information about the source file
|
|
|
|
@param ea: linear address belonging to the source file
|
|
|
|
@return: NULL - source file information is not found
|
|
otherwise returns pointer to file name
|
|
"""
|
|
return idaapi.del_sourcefile(ea)
|
|
|
|
|
|
def SetLineNumber(ea, lnnum):
|
|
"""
|
|
Set source line number
|
|
|
|
@param ea: linear address
|
|
@param lnnum: number of line in the source file
|
|
|
|
@return: None
|
|
"""
|
|
idaapi.set_source_linnum(ea, lnnum)
|
|
|
|
|
|
def GetLineNumber(ea):
|
|
"""
|
|
Get source line number
|
|
|
|
@param ea: linear address
|
|
|
|
@return: number of line in the source file or -1
|
|
"""
|
|
return idaapi.get_source_linnum(ea)
|
|
|
|
|
|
def DelLineNumber(ea):
|
|
"""
|
|
Delete information about source line number
|
|
|
|
@param ea: linear address
|
|
|
|
@return: None
|
|
"""
|
|
idaapi.del_source_linnum(ea)
|
|
|
|
|
|
#----------------------------------------------------------------------------
|
|
# T Y P E L I B R A R I E S
|
|
#----------------------------------------------------------------------------
|
|
|
|
def LoadTil(name, tildir=None):
|
|
"""
|
|
Load a type library
|
|
|
|
@param name: name of type library.
|
|
@param tildir: drectory to load the TIL from (defaults to "til/pc")
|
|
|
|
@return: 1-ok, 0-failed.
|
|
"""
|
|
if not tildir:
|
|
tildir = "til" + os.sep + "pc"
|
|
|
|
til = idaapi.load_til(tildir, name)
|
|
|
|
if til:
|
|
return 1
|
|
else:
|
|
return 0
|
|
|
|
|
|
def Til2Idb(idx, type_name):
|
|
"""
|
|
Copy information from type library to database
|
|
Copy structure, union, or enum definition from the type library
|
|
to the IDA database.
|
|
|
|
@param idx: the position of the new type in the list of
|
|
types (structures or enums) -1 means at the end of the list
|
|
@param type_name: name of type to copy
|
|
|
|
@return: BADNODE-failed, otherwise the type id (structure id or enum id)
|
|
"""
|
|
return idaapi.til2idb(idx, type_name)
|
|
|
|
|
|
def GetType(ea):
|
|
"""
|
|
Get type of function/variable
|
|
|
|
@param ea: the address of the object
|
|
|
|
@return: type string or None if failed
|
|
"""
|
|
return idaapi.idc_get_type(ea)
|
|
|
|
|
|
def GuessType(ea):
|
|
"""
|
|
Guess type of function/variable
|
|
|
|
@param ea: the address of the object, can be the structure member id too
|
|
|
|
@return: type string or None if failed
|
|
"""
|
|
return idaapi.idc_guess_type(ea)
|
|
|
|
|
|
def SetType(ea, type):
|
|
"""
|
|
Set type of function/variable
|
|
|
|
@param ea: the address of the object
|
|
@param type: the type string in C declaration form.
|
|
Must contain the closing ';'
|
|
if specified as an empty string, then the
|
|
assciated with 'ea' will be deleted
|
|
|
|
@return: 1-ok, 0-failed.
|
|
"""
|
|
return idaapi.apply_cdecl(ea, type)
|
|
|
|
|
|
def ParseTypes(input, flags):
|
|
"""
|
|
Parse type declarations
|
|
|
|
@param input: file name or C declarations (depending on the flags)
|
|
@param flags: combination of PT_... constants or 0
|
|
|
|
@return: number of errors
|
|
"""
|
|
return idaapi.idc_parse_types(input, flags)
|
|
|
|
|
|
PT_FILE = 0x0001 # input if a file name (otherwise contains type declarations)
|
|
PT_SILENT = 0x0002 # silent mode
|
|
PT_PAKDEF = 0x0000 # default pack value
|
|
PT_PAK1 = 0x0010 # #pragma pack(1)
|
|
PT_PAK2 = 0x0020 # #pragma pack(2)
|
|
PT_PAK4 = 0x0030 # #pragma pack(4)
|
|
PT_PAK8 = 0x0040 # #pragma pack(8)
|
|
PT_PAK16 = 0x0050 # #pragma pack(16)
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# H I D D E N A R E A S
|
|
# ----------------------------------------------------------------------------
|
|
def HideArea(start, end, description, header, footer, color):
|
|
"""
|
|
Hide an area
|
|
|
|
Hidden areas - address ranges which can be replaced by their descriptions
|
|
|
|
@param start: area start
|
|
@param end: area end
|
|
@param description: description to display if the area is collapsed
|
|
@param header: header lines to display if the area is expanded
|
|
@param footer: footer lines to display if the area is expanded
|
|
@param color: RGB color code (-1 means default color)
|
|
|
|
@returns: !=0 - ok
|
|
"""
|
|
return idaapi.add_hidden_area(start, end, description, header, footer, color)
|
|
|
|
|
|
def SetHiddenArea(ea, visible):
|
|
"""
|
|
Set hidden area state
|
|
|
|
@param ea: any address belonging to the hidden area
|
|
@param visible: new state of the area
|
|
|
|
@return: != 0 - ok
|
|
"""
|
|
ha = idaapi.get_hidden_area(ea)
|
|
|
|
if not ha:
|
|
return 0
|
|
else:
|
|
ha.visible = visible
|
|
return idaapi.update_hidden_area(ha)
|
|
|
|
|
|
def DelHiddenArea(ea):
|
|
"""
|
|
Delete a hidden area
|
|
|
|
@param ea: any address belonging to the hidden area
|
|
@returns: != 0 - ok
|
|
"""
|
|
return idaapi.del_hidden_area(ea)
|
|
|
|
|
|
#--------------------------------------------------------------------------
|
|
# D E B U G G E R I N T E R F A C E
|
|
#--------------------------------------------------------------------------
|
|
|
|
def GetRegValue(name):
|
|
"""
|
|
Get register value
|
|
|
|
@param name: the register name
|
|
|
|
@note: The debugger should be running. otherwise the function fails
|
|
the register name should be valid.
|
|
It is not necessary to use this function to get register values
|
|
because a register name in the script will do too.
|
|
|
|
@return: register value (integer or floating point)
|
|
"""
|
|
rv = idaapi.regval_t()
|
|
res = idaapi.get_reg_val(name, rv)
|
|
assert res, "get_reg_val() failed, bogus name perhaps?"
|
|
return rv.ival
|
|
|
|
|
|
def SetRegValue(value, name):
|
|
"""
|
|
Set register value
|
|
|
|
@param name: the register name
|
|
@param value: new register value
|
|
|
|
@note: The debugger should be running
|
|
It is not necessary to use this function to set register values.
|
|
A register name in the left side of an assignment will do too.
|
|
"""
|
|
rv = idaapi.regval_t()
|
|
rv.ival = value
|
|
return idaapi.set_reg_val(name, value)
|
|
|
|
|
|
def GetBptQty():
|
|
"""
|
|
Get number of breakpoints.
|
|
|
|
@return: number of breakpoints
|
|
"""
|
|
return idaapi.get_bpt_qty()
|
|
|
|
|
|
def GetBptEA(n):
|
|
"""
|
|
Get breakpoint address
|
|
|
|
@param n: number of breakpoint, is in range 0..GetBptQty()-1
|
|
|
|
@return: addresss of the breakpoint or BADADDR
|
|
"""
|
|
bpt = idaapi.bpt_t()
|
|
|
|
if idaapi.getn_bpt(n, bpt):
|
|
return bpt.ea
|
|
else:
|
|
return BADADDR
|
|
|
|
|
|
def GetBptAttr(ea, bptattr):
|
|
"""
|
|
Get the characteristics of a breakpoint
|
|
|
|
@param address: any address in the breakpoint range
|
|
@param bptattr: the desired attribute code, one of BPTATTR_... constants
|
|
|
|
@return: the desired attribute value or -1
|
|
"""
|
|
bpt = idaapi.bpt_t()
|
|
|
|
if not idaapi.get_bpt(ea, bpt):
|
|
return -1
|
|
else:
|
|
if bptattr == BPTATTR_EA:
|
|
return bpt.ea
|
|
if bptattr == BPTATTR_SIZE:
|
|
return bpt.size
|
|
if bptattr == BPTATTR_TYPE:
|
|
return bpt.type
|
|
if bptattr == BPTATTR_COUNT:
|
|
return bpt.pass_count
|
|
if bptattr == BPTATTR_FLAGS:
|
|
return bpt.flags
|
|
if bptattr == BPTATTR_COND:
|
|
return bpt.condition
|
|
return -1
|
|
|
|
|
|
BPTATTR_EA = 0 # starting address of the breakpoint
|
|
BPTATTR_SIZE = 4 # size of the breakpoint (undefined if software breakpoint)
|
|
BPTATTR_TYPE = 8 # type of the breakpoint
|
|
BPTATTR_COUNT = 12 # how many times does the execution reach this breakpoint ?
|
|
BPTATTR_FLAGS = 16 # Breakpoint attributes:
|
|
BPTATTR_COND = 20 # Breakpoint condition NOTE: the return value is a string in this case
|
|
|
|
# Breakpoint types:
|
|
BPT_EXEC = 0 # Hardware: Execute instruction
|
|
BPT_WRITE = 1 # Hardware: Write access
|
|
BPT_RDWR = 3 # Hardware: Read/write access
|
|
BPT_SOFT = 4 # Software breakpoint
|
|
|
|
BPT_BRK = 0x01 # does the debugger stop on this breakpoint?
|
|
BPT_TRACE = 0x02 # does the debugger add trace information when this breakpoint is reached?
|
|
|
|
|
|
def SetBptAttr(address, bptattr, value):
|
|
"""
|
|
modifiable characteristics of a breakpoint
|
|
|
|
@param address: any address in the breakpoint range
|
|
@param bptattr: the attribute code, one of BPTATTR_* constants
|
|
BPTATTR_CND is not allowed, see SetBptCnd()
|
|
@param value: the attibute value
|
|
|
|
@return: success
|
|
"""
|
|
bpt = idaapi.bpt_t()
|
|
|
|
if not idaapi.get_bpt(address, bpt):
|
|
return False
|
|
else:
|
|
if bptattr not in [ BPTATTR_SIZE, BPTATTR_TYPE, BPTATTR_FLAGS, BPTATTR_COUNT ]:
|
|
return False
|
|
if bptattr == BPTATTR_SIZE:
|
|
bpt.size = value
|
|
if bptattr == BPTATTR_TYPE:
|
|
bpt.type = value
|
|
if bptattr == BPTATTR_COUNT:
|
|
bpt.pass_count = value
|
|
if bptattr == BPTATTR_FLAGS:
|
|
bpt.flags = value
|
|
|
|
idaapi.update_bpt(bpt)
|
|
return True
|
|
|
|
|
|
def SetBptCnd(ea, cnd):
|
|
"""
|
|
Set breakpoint condition
|
|
|
|
@param address: any address in the breakpoint range
|
|
@param cnd: breakpoint condition
|
|
|
|
@return: success
|
|
"""
|
|
bpt = idaapi.bpt_t()
|
|
|
|
if not idaapi.get_bpt(ea, bpt):
|
|
return False
|
|
|
|
bpt.condition = cnd
|
|
|
|
return idaapi.update_bpt(bpt)
|
|
|
|
|
|
def AddBptEx(ea, size, bpttype):
|
|
"""
|
|
Add a new breakpoint
|
|
|
|
@param ea: any address in the process memory space:
|
|
@param size: size of the breakpoint (irrelevant for software breakpoints):
|
|
@param type: type of the breakpoint (one of BPT_... constants)
|
|
|
|
@return: success
|
|
|
|
@note: Only one breakpoint can exist at a given address.
|
|
"""
|
|
return idaapi.add_bpt(ea, size, bpttype)
|
|
|
|
|
|
def AddBpt(ea): return AddBptEx(ea, 0, BPT_SOFT)
|
|
|
|
|
|
def DelBpt(ea):
|
|
"""
|
|
Delete breakpoint
|
|
|
|
@param ea: any address in the process memory space:
|
|
|
|
@return: success
|
|
"""
|
|
return idaapi.del_bpt(ea)
|
|
|
|
|
|
def EnableBpt(ea, enable):
|
|
"""
|
|
Enable/disable breakpoint
|
|
|
|
@param ea: any address in the process memory space:
|
|
|
|
@return: success
|
|
|
|
@note: Disabled breakpoints are not written to the process memory
|
|
"""
|
|
return idaapi.enable_bpt(ea, enable)
|
|
|
|
|
|
#--------------------------------------------------------------------------
|
|
# C O L O R S
|
|
#--------------------------------------------------------------------------
|
|
|
|
def GetColor(ea, what):
|
|
"""
|
|
Get item color
|
|
|
|
@param ea: address of the item
|
|
@param what: type of the item (one of CIC_* constants)
|
|
|
|
@return: color code in RGB (hex 0xBBGGRR)
|
|
"""
|
|
if what not in [ CIC_ITEM, CIC_FUNC, CIC_SEGM ]:
|
|
raise ValueError, "'what' must be one of CIC_ITEM, CIC_FUNC and CIC_SEGM"
|
|
|
|
if what == CIC_ITEM:
|
|
return idaapi.get_item_color(ea)
|
|
|
|
if what == CIC_FUNC:
|
|
func = idaapi.get_func(ea)
|
|
if func:
|
|
return func.color
|
|
else:
|
|
return DEFCOLOR
|
|
|
|
if what == CIC_SEGM:
|
|
seg = idaapi.getseg(ea)
|
|
if seg:
|
|
return seg.color
|
|
else:
|
|
return DEFCOLOR
|
|
|
|
# color item codes:
|
|
CIC_ITEM = 1 # one instruction or data
|
|
CIC_FUNC = 2 # function
|
|
CIC_SEGM = 3 # segment
|
|
|
|
DEFCOLOR = 0xFFFFFFFF # Default color
|
|
|
|
|
|
def SetColor(ea, what, color):
|
|
"""
|
|
Set item color
|
|
|
|
@param ea: address of the item
|
|
@param what: type of the item (one of CIC_* constants)
|
|
@param color: new color code in RGB (hex 0xBBGGRR)
|
|
|
|
@return: success (True or False)
|
|
"""
|
|
if what not in [ CIC_ITEM, CIC_FUNC, CIC_SEGM ]:
|
|
raise ValueError, "'what' must be one of CIC_ITEM, CIC_FUNC and CIC_SEGM"
|
|
|
|
if what == CIC_ITEM:
|
|
return idaapi.set_item_color(ea, color)
|
|
|
|
if what == CIC_FUNC:
|
|
func = idaapi.get_func(ea)
|
|
if func:
|
|
func.color = color
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
if what == CIC_SEGM:
|
|
seg = idaapi.getseg(ea)
|
|
if seg:
|
|
seg.color = color
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
|
|
|
|
#--------------------------------------------------------------------------
|
|
# X M L
|
|
#--------------------------------------------------------------------------
|
|
|
|
def SetXML(path, name, value):
|
|
"""
|
|
Set or update one or more XML values.
|
|
|
|
@param path: XPath expression of elements where to create value(s)
|
|
@param name: name of the element/attribute
|
|
(use @XXX for an attribute) to create.
|
|
If 'name' is empty, the elements or
|
|
attributes returned by XPath are directly
|
|
updated to contain the new 'value'.
|
|
@param value: value of the element/attribute
|
|
|
|
@return: success (True or False)
|
|
"""
|
|
return idaapi.set_xml(path, name, value)
|
|
|
|
|
|
def GetXML(path):
|
|
"""
|
|
Get one XML value.
|
|
|
|
@param path: XPath expression to an element
|
|
or attribute whose value is requested
|
|
|
|
@return: the value, None if failed
|
|
"""
|
|
v = idaapi.value_t()
|
|
if idaapi.get_xml(path):
|
|
return v.str
|
|
else:
|
|
return None
|
|
|
|
|
|
#--------------------------------------------------------------------------
|
|
# Compatibility macros:
|
|
def OpOffset(ea,base): return OpOff(ea,-1,base)
|
|
def OpNum(ea): return OpNumber(ea,-1)
|
|
def OpChar(ea): return OpChr(ea,-1)
|
|
def OpSegment(ea): return OpSeg(ea,-1)
|
|
def OpDec(ea): return OpDecimal(ea,-1)
|
|
def OpAlt1(ea,str): return OpAlt(ea,0,str)
|
|
def OpAlt2(ea,str): return OpAlt(ea,1,str)
|
|
def StringStp(x): return SetCharPrm(INF_ASCII_BREAK,x)
|
|
def LowVoids(x): return SetLongPrm(INF_LOW_OFF,x)
|
|
def HighVoids(x): return SetLongPrm(INF_HIGH_OFF,x)
|
|
def TailDepth(x): return SetLongPrm(INF_MAXREF,x)
|
|
def Analysis(x): return SetCharPrm(INF_AUTO,x)
|
|
def Tabs(x): return SetCharPrm(INF_ENTAB,x)
|
|
#def Comments(x): SetCharPrm(INF_CMTFLAG,((x) ? (SW_ALLCMT|GetCharPrm(INF_CMTFLAG)) : (~SW_ALLCMT&GetCharPrm(INF_CMTFLAG))))
|
|
def Voids(x): return SetCharPrm(INF_VOIDS,x)
|
|
def XrefShow(x): return SetCharPrm(INF_XREFNUM,x)
|
|
def Indent(x): return SetCharPrm(INF_INDENT,x)
|
|
def CmtIndent(x): return SetCharPrm(INF_COMMENT,x)
|
|
def AutoShow(x): return SetCharPrm(INF_SHOWAUTO,x)
|
|
def MinEA(): return GetLongPrm(INF_MIN_EA)
|
|
def MaxEA(): return GetLongPrm(INF_MAX_EA)
|
|
def BeginEA(): return GetLongPrm(INF_BEGIN_EA)
|
|
def set_start_cs(x): return SetLongPrm(INF_START_CS,x)
|
|
def set_start_ip(x): return SetLongPrm(INF_START_IP,x)
|
|
|
|
def WriteMap(filepath):
|
|
return GenerateFile(OFILE_MAP, filepath, 0, BADADDR, GENFLG_MAPSEGS|GENFLG_MAPNAME)
|
|
|
|
def WriteTxt(filepath, ea1, ea2):
|
|
return GenerateFile(OFILE_ASM, filepath, ea1, ea2, 0)
|
|
|
|
def WriteExe(filepath):
|
|
return GenerateFile(OFILE_EXE, filepath, 0, BADADDR, 0)
|
|
|
|
def AddConst(enum_id,name,value): return AddConstEx(enum_id,name,value,-1)
|
|
def AddStruc(index,name): return AddStrucEx(index,name,0)
|
|
def AddUnion(index,name): return AddStrucEx(index,name,1)
|
|
#def OpStroff(ea,n,strid): OpStroffEx(ea,n,strid,0)
|
|
def OpEnum(ea,n,enumid): return OpEnumEx(ea,n,enumid,0)
|
|
def DelConst(id,v,mask): return DelConstEx(id,v,0,mask)
|
|
def GetConst(id,v,mask): return GetConstEx(id,v,0,mask)
|
|
def AnalyseArea(sEA, eEA): AnalyzeArea(sEA,eEA)
|
|
|
|
def MakeStruct(ea,name): return MakeStructEx(ea, -1, name)
|
|
def Name(ea): return NameEx(BADADDR, ea)
|
|
def GetTrueName(ea): return GetTrueNameEx(BADADDR, ea)
|
|
def MakeName(ea, name): MakeNameEx(ea,name,SN_CHECK)
|
|
|
|
def GetFrame(ea): return GetFunctionAttr(ea, FUNCATTR_FRAME)
|
|
def GetFrameLvarSize(ea): return GetFunctionAttr(ea, FUNCATTR_FRSIZE)
|
|
def GetFrameRegsSize(ea): return GetFunctionAttr(ea, FUNCATTR_FRREGS)
|
|
def GetFrameArgsSize(ea): return GetFunctionAttr(ea, FUNCATTR_ARGSIZE)
|
|
def GetFunctionFlags(ea): return GetFunctionAttr(ea, FUNCATTR_FLAGS)
|
|
def SetFunctionFlags(ea, flags): return SetFunctionAttr(ea, FUNCATTR_FLAGS, flags)
|
|
|
|
def SegStart(ea): return GetSegmentAttr(ea, SEGATTR_START)
|
|
def SegEnd(ea): return GetSegmentAttr(ea, SEGATTR_END)
|
|
def SetSegmentType(ea, type): return SetSegmentAttr(ea, SEGATTR_TYPE, type)
|
|
|
|
def Comment(ea): return GetCommentEx(ea, 0)
|
|
def RptCmt(ea): return GetCommentEx(ea, 1)
|
|
|
|
def loadfile(filepath, pos, ea, size): return LoadFile(filepath, pos, ea, size)
|
|
def savefile(filepath, pos, ea, size): return SaveFile(filepath, pos, ea, size)
|
|
|
|
# A convenice macro:
|
|
def here(): return ScreenEA()
|
|
|
|
# END OF IDC COMPATIBILY CODE
|