Module idc

IDC compatibility module

This file contains IDA built-in function declarations and internal bit definitions. Each byte of the program has 32-bit flags (low 8 bits keep the byte value). These 32 bits are used in GetFlags/SetFlags functions. You may freely examine these bits using GetFlags() but the use of the SetFlags() function is strongly discouraged.

This file is subject to change without any notice. Future versions of IDA may use other definitions.

Classes
	DeprecatedIDCError Exception for deprecated function calls

Functions

hasValue(F)

byteValue(F)

isLoaded(ea)

isCode(F)

isData(F)

isTail(F)

isUnknown(F)

isHead(F)

isFlow(F)

isVar(F)

isExtra(F)

isRef(F)

hasName(F)

hasUserName(F)

isDefArg0(F)

isDefArg1(F)

isDec0(F)

isDec1(F)

isHex0(F)

isHex1(F)

isOct0(F)

isOct1(F)

isBin0(F)

isBin1(F)

isOff0(F)

isOff1(F)

isChar0(F)

isChar1(F)

isSeg0(F)

isSeg1(F)

isEnum0(F)

isEnum1(F)

isFop0(F)

isFop1(F)

isStroff0(F)

isStroff1(F)

isStkvar0(F)

isStkvar1(F)

isByte(F)

isWord(F)

isDwrd(F)

isQwrd(F)

isOwrd(F)

isTbyt(F)

isFloat(F)

isDouble(F)

isPackReal(F)

isASCII(F)

isStruct(F)

isAlign(F)

MK_FP(seg, off)
Return value of expression: ((seg<<4) + off)

form(format, *args)

substr(s, x1, x2)

strstr(s1, s2)

strlen(s)

xtol(s)

atoa(ea)
Convert address value to a string Return address in the form 'seg000:1234' (the same as in line prefixes)

ltoa(n, radix)

atol(s)

rotate_left(value, count, nbits, offset)
Rotate a value to the left (or right)

rotate_dword(x, count)

rotate_word(x, count)

rotate_byte(x, count)

AddHotkey(hotkey, idcfunc)
Add hotkey for IDC function

DelHotkey(hotkey)
Delete IDC function hotkey

Jump(ea)
Move cursor to the specifed linear address

Wait()
Process all entries in the autoanalysis queue Wait for the end of autoanalysis

Compile(filename)
Compile an IDC file.

Exit(code)
Stop execution of IDC program, close the database and exit to OS

Exec(command)
Execute an OS command.

RunPlugin(name, arg)
Load and run a plugin

ApplySig(name)
Load (plan to apply) a FLIRT signature file

DeleteAll()
Delete all segments, instructions, comments, i.e.

MakeCode(ea)
Create an instruction at the specified address

AnalyzeArea(sEA, eEA)
Perform full analysis of the area

MakeNameEx(ea, name, flags)
Rename an address

MakeComm(ea, comment)
Set an indented regular comment of an item

MakeRptCmt(ea, comment)
Set an indented repeatable comment of an item

MakeArray(ea, nitems)
Create an array.

MakeStr(ea, endea)
Create a string.

MakeData(ea, flags, size, tid)
Create a data item at the specified address

MakeByte(ea)
Convert the current item to a byte

MakeWord(ea)
Convert the current item to a word (2 bytes)

MakeDword(ea)
Convert the current item to a double word (4 bytes)

MakeQword(ea)
Convert the current item to a quadro word (8 bytes)

MakeOword(ea)
Convert the current item to a octa word (16 bytes)

MakeFloat(ea)
Convert the current item to a floating point (4 bytes)

MakeDouble(ea)
Convert the current item to a double floating point (8 bytes)

MakePackReal(ea)
Convert the current item to a packed real (10 or 12 bytes)

MakeTbyte(ea)
Convert the current item to a tbyte (10 or 12 bytes)

MakeStructEx(ea, size, strname)
Convert the current item to a structure instance

MakeAlign(ea, count, align)
Convert the current item to an alignment directive

MakeLocal(start, end, location, name)
Create a local variable

MakeUnkn(ea, flags)
Convert the current item to an explored item

MakeUnknown(ea, size, flags)
Convert the current item to an explored item

OpBinary(ea, n)
Convert an operand of the item (instruction or data) to a binary number

OpOctal(ea, n)
Convert an operand of the item (instruction or data) to an octal number

OpDecimal(ea, n)
Convert an operand of the item (instruction or data) to a decimal number

OpHex(ea, n)
Convert an operand of the item (instruction or data) to a hexadecimal number

OpChr(ea, n)

OpOff(ea, n, base)
Convert operand to an offset (for the explanations of 'ea' and 'n' please see OpBinary())

OpOffEx(ea, n, reftype, target, base, tdelta)
Convert operand to a complex offset expression This is a more powerful version of OpOff() function.

OpSeg(ea, n)
Convert operand to a segment expression

OpNumber(ea, n)
Convert operand to a number (with default number base, radix)

OpAlt(ea, n, opstr)
Specify operand represenation manually.

OpSign(ea, n)
Change sign of the operand

OpNot(ea, n)
Toggle the bitwise not operator for the operand

OpEnumEx(ea, n, enumid, serial)
Convert operand to a symbolic constant

OpStroffEx(ea, n, strid, delta)
Convert operand to an offset in a structure

OpStkvar(ea, n)
Convert operand to a stack variable

OpHigh(ea, n, target)
Convert operand to a high offset High offset is the upper 16bits of an offset.

MakeVar(ea)
Mark the location as "variable"

ExtLinA(ea, n, line)
Specify an additional line to display before the generated ones.

ExtLinB(ea, n, line)
Specify an additional line to display after the generated ones.

DelExtLnA(ea, n)
Delete an additional anterior line

DelExtLnB(ea, n)
Delete an additional posterior line

SetManualInsn(ea, insn)
Specify instruction represenation manually.

GetManualInsn(ea)
Get manual representation of instruction

PatchByte(ea, value)
Change value of a program byte

PatchWord(ea, value)
Change value of a program word (2 bytes)

PatchDword(ea, value)
Change value of a double word

SetFlags(ea, flags)
Set new value of flags This function should not used be used directly if possible.

SetReg(ea, reg, value)
Set value of a segment register.

AutoMark2(start, end, queuetype)
Plan to perform an action in the future.

AutoUnmark(start, end, queuetype)
Remove range of addresses from a queue.

AutoMark(ea, qtype)
Plan to analyze an address

GenerateFile(filetype, path, ea1, ea2, flags)
Generate an output file

GetIdaDirectory()
Get IDA directory

GetInputFile()
Get input file name

GetInputFilePath()
Get input file path

GetIdbPath()
Get IDB full path

GetFlags(ea)
Get internal flags

Byte(ea)
Get value of program byte

GetOriginalByte(ea)
Get original value of program byte

Word(ea)
Get value of program word (2 bytes)

Dword(ea)
Get value of program double word (4 bytes)

GetFloat(ea)
Get value of a floating point number (4 bytes)

GetDouble(ea)
Get value of a floating point number (8 bytes)

LocByName(name)
Get linear address of a name

LocByNameEx(fromaddr, name)
Get linear address of a name

SegByBase(base)
Get segment by segment base

ScreenEA()
Get linear address of cursor

GetCurrentLine()
Get the disassembly line at the cursor

SelStart()
Get start address of the selected area returns BADADDR - the user has not selected an area

SelEnd()
Get end address of the selected area

GetReg(ea, reg)
Get value of segment register at the specified address

NextAddr(ea)
Get next address in the program

PrevAddr(ea)
Get previous address in the program

NextHead(ea, maxea)
Get next defined item (instruction or data) in the program

PrevHead(ea, minea)
Get previous defined item (instruction or data) in the program

NextNotTail(ea)
Get next not-tail address in the program This function searches for the next displayable address in the program.

PrevNotTail(ea)
Get previous not-tail address in the program This function searches for the previous displayable address in the program.

ItemEnd(ea)
Get address of the end of the item (instruction or data)

ItemSize(ea)
Get size of instruction or data item in bytes

NameEx(fromaddr, ea)
Get visible name of program byte

GetTrueNameEx(fromaddr, ea)
Get true name of program byte

Demangle(name, disable_mask)
Demangle a name

GetDisasm(ea)
Get disassembly line

GetMnem(ea)
Get instruction mnemonics

GetOpnd(ea, n)
Get operand of an instruction

GetOpType(ea, n)
Get type of instruction operand

GetOperandValue(ea, n)
Get number used in the operand

LineA(ea, num)
Get anterior line

LineB(ea, num)
Get posterior line

GetCommentEx(ea, repeatable)
Get regular indented comment

CommentEx(ea, repeatable)

AltOp(ea, n)
Get manually entered operand string

GetString(ea, length, strtype)
Get string contents

GetStringType(ea)
Get string type

FindVoid(ea, flag)

FindCode(ea, flag)

FindData(ea, flag)

FindUnexplored(ea, flag)

FindExplored(ea, flag)

FindImmediate(ea, flag, value)

FindText(ea, flag, y, x, searchstr)
Returns: ea of result or BADADDR if not found

FindBinary(ea, flag, searchstr, radix=16)
Returns: ea of result or BADADDR if not found

GetLongPrm(offset)

GetShortPrm(offset)

GetCharPrm(offset)

SetLongPrm(offset, value)

SetShortPrm(offset, value)

SetCharPrm(offset, value)

SetProcessorType(processor, level)
Change current processor

SetPrcsr(processor)

Batch(batch)
Enable/disable batch mode of operation

AskStr(defval, prompt)
Ask the user to enter a string

AskFile(forsave, mask, prompt)
Ask the user to choose a file

AskAddr(defval, prompt)
Ask the user to enter an address

AskLong(defval, prompt)
Ask the user to enter a number

AskSeg(defval, prompt)
Ask the user to enter a segment value

AskIdent(defval, prompt)
Ask the user to enter an identifier

AskYN(defval, prompt)
Ask the user a question and let him answer Yes/No/Cancel

Message(msg)
Display a message in the message window

Warning(msg)
Display a message in a message box

Fatal(format)
Display a fatal message in a message box and quit IDA

SetStatus(status)
Change IDA indicator.

Refresh()
Refresh all disassembly views

RefreshLists()
Refresh all list views (names, functions, etc)

AskSelector(sel)
Get a selector value

FindSelector(val)
Find a selector which has the specifed value

SetSelector(sel, value)
Set a selector value

DelSelector(sel)
Delete a selector

FirstSeg()
Get first segment

NextSeg(ea)
Get next segment

SegStart(ea)
Get start address of a segment

SegEnd(ea)
Get end address of a segment

SegName(ea)
Get name of a segment

SegCreate(startea, endea, base, use32, align, comb)
Create a new segment

SegDelete(ea, flags)
Delete a segment

SegBounds(ea, startea, endea, disable)
Change segment boundaries

SegRename(ea, name)
Change name of the segment

SegClass(ea, segclass)
Change class of the segment

SegAlign(ea, alignment)
Change alignment of the segment

SegComb(segea, comb)
Change combination of the segment

SegAddrng(ea, bitness)
Change segment addressing

SegByName(segname)
Get segment by name

SegDefReg(ea, reg, value)
Set default segment register value for a segment

SetSegmentType(segea, segtype)
Set segment type

GetSegmentAttr(segea, attr)
Get segment attribute

SetSegmentAttr(segea, attr, value)
Set segment attribute

AddCodeXref(From, To, flowtype)

DelCodeXref(From, To, undef)
Unmark exec flow 'from' 'to'

Rfirst(From)
Get first code xref from 'From'

Rnext(From, current)
Get next code xref from

RfirstB(To)
Get first code xref to 'To'

RnextB(To, current)
Get next code xref to 'To'

Rfirst0(From)
Get first xref from 'From'

Rnext0(From, current)
Get next xref from

RfirstB0(To)
Get first xref to 'To'

RnextB0(To, current)
Get next xref to 'To'

add_dref(From, To, drefType)
Create Data Ref

del_dref(From, To)
Unmark Data Ref

Dfirst(From)
Get first data xref from 'From'

Dnext(From, current)
Get next data xref from 'From'

DfirstB(To)
Get first data xref to 'To'

DnextB(To, current)
Get next data xref to 'To'

XrefType()
Return type of the last xref obtained by [RD]first/next[B0] functions.

fopen(f, mode)

fclose(handle)

filelength(handle)

fseek(handle, offset, origin)

ftell(handle)

LoadFile(filepath, pos, ea, size)
Load file into IDA database

loadfile(filepath, pos, ea, size)

SaveFile(filepath, pos, ea, size)
Save from IDA database to file

savefile(filepath, pos, ea, size)

fgetc(handle)

fputc(byte, handle)

fprintf(handle, format, *args)

readshort(handle, mostfirst)

readlong(handle, mostfirst)

writeshort(handle, word, mostfirst)

writelong(handle, dword, mostfirst)

readstr(handle)

writestr(handle, s)

MakeFunction(start, end)
Create a function

DelFunction(ea)
Delete a function

SetFunctionEnd(ea, end)
Change function end address

NextFunction(ea)
Find next function

PrevFunction(ea)
Find previous function

GetFunctionAttr(ea, attr)
Get a function attribute

SetFunctionAttr(ea, attr, value)
Set a function attribute

GetFunctionFlags(ea)
Retrieve function flags

SetFunctionFlags(ea, flags)
Change function flags

GetFunctionName(ea)
Retrieve function name

GetFunctionCmt(ea, repeatable)
Retrieve function comment

SetFunctionCmt(ea, cmt, repeatable)
Set function comment

ChooseFunction(title)
Ask the user to select a function

GetFuncOffset(ea)
Convert address to 'funcname+offset' string

FindFuncEnd(ea)
Determine a new function boundaries

GetFrame(ea)
Get ID of function frame structure

GetFrameLvarSize(ea)
Get size of local variables in function frame

GetFrameRegsSize(ea)
Get size of saved registers in function frame

GetFrameArgsSize(ea)
Get size of arguments in function frame which are purged upon return

GetFrameSize(ea)
Get full size of function frame

MakeFrame(ea, lvsize, frregs, argsize)
Make function frame

GetSpd(ea)
Get current delta for the stack pointer

GetSpDiff(ea)
Get modification of SP made by the instruction

SetSpDiff(ea, delta)
Setup modification of SP made by the instruction

GetEntryPointQty()
Retrieve number of entry points

AddEntryPoint(ordinal, ea, name, makecode)
Add entry point

GetEntryOrdinal(index)
Retrieve entry point ordinal number

GetEntryPoint(ordinal)
Retrieve entry point address

RenameEntryPoint(ordinal, name)
Rename entry point

GetNextFixupEA(ea)
Find next address with fixup information

GetPrevFixupEA(ea)
Find previous address with fixup information

GetFixupTgtType(ea)
Get fixup target type

GetFixupTgtSel(ea)
Get fixup target selector

GetFixupTgtOff(ea)
Get fixup target offset

GetFixupTgtDispl(ea)
Get fixup target displacement

SetFixup(ea, fixuptype, targetsel, targetoff, displ)
Set fixup information

DelFixup(ea)
Delete fixup information

MarkPosition(ea, lnnum, x, y, slot, comment)
Mark position

GetMarkedPos(slot)
Get marked position

GetMarkComment(slot)
Get marked position comment

GetStrucQty()
Get number of defined structure types

GetFirstStrucIdx()
Get index of first structure type

GetLastStrucIdx()
Get index of last structure type

GetNextStrucIdx(index)
Get index of next structure type

GetPrevStrucIdx(index)
Get index of previous structure type

GetStrucIdx(sid)
Get structure index by structure ID

GetStrucId(index)
Get structure ID by structure index

GetStrucIdByName(name)
Get structure ID by structure name

GetStrucName(sid)
Get structure type name

GetStrucComment(sid, repeatable)
Get structure type comment

GetStrucSize(sid)
Get size of a structure

GetMemberQty(sid)
Get number of members of a structure

GetStrucPrevOff(sid, offset)
Get previous offset in a structure

GetStrucNextOff(sid, offset)
Get next offset in a structure

GetFirstMember(sid)
Get offset of the first member of a structure

GetLastMember(sid)
Get offset of the last member of a structure

GetMemberOffset(sid, member_name)
Get offset of a member of a structure by the member name

GetMemberNames(sid, member_offset)
Get name of a member of a structure

GetMemberComment(sid, member_offset, repeatable)
Get comment of a member

GetMemberSize(sid, member_offset)
Get size of a member

GetMemberFlag(sid, member_offset)
Get type of a member

GetMemberStrId(sid, member_offset)
Get structure id of a member

IsUnion(sid)
Is a structure a union?

AddStrucEx(index, name, is_union)
Define a new structure type

DelStruc(sid)
Delete a structure type

SetStrucIdx(sid, index)
Change structure index

SetStrucName(sid, name)
Change structure name

SetStrucComment(sid, comment, repeatable)
Change structure comment

AddStrucMember(sid, name, offset, flag, typeid, nbytes)
Add structure member

DelStrucMember(sid, member_offset)
Delete structure member

SetMemberName(sid, member_offset, name)
Change structure member name

SetMemberType(sid, member_offset, flag, typeid, nitems)
Change structure member type

SetMemberComment(sid, member_offset, comment, repeatable)
Change structure member comment

GetFchunkAttr(ea, attr)
Get a function chunk attribute

SetFchunkAttr(ea, attr, value)
Set a function chunk attribute

NextFchunk(ea)
Get next function chunk

PrevFchunk(ea)
Get previous function chunk

AppendFchunk(funcea, ea1, ea2)
Append a function chunk to the function

RemoveFchunk(funcea, tailea)
Remove a function chunk from the function

SetFchunkOwner(tailea, funcea)
Change the function chunk owner

FirstFuncFchunk(funcea)
Get the first function chunk of the specified function

NextFuncFchunk(funcea, tailea)
Get the next function chunk of the specified function

GetEnumQty()
Get number of enum types

GetnEnum(idx)
Get ID of the specified enum by its serial number

GetEnumIdx(enum_id)
Get serial number of enum by its ID

GetEnum(name)
Get enum ID by the name of enum

GetEnumName(enum_id)
Get name of enum

GetEnumCmt(enum_id, repeatable)
Get comment of enum

GetEnumSize(enum_id)
Get size of enum

GetEnumFlag(enum_id)
Get flag of enum

GetConstByName(name)
Get member of enum - a symbolic constant ID

GetConstValue(const_id)
Get value of symbolic constant

GetConstBmask(const_id)
Get bit mask of symbolic constant

GetConstEnum(const_id)
Get id of enum by id of constant

GetConstEx(enum_id, value, serial, bmask)
Get id of constant

GetFirstBmask(enum_id)
Get first bitmask in the enum (bitfield)

GetLastBmask(enum_id)
Get last bitmask in the enum (bitfield)

GetNextBmask(enum_id, value)
Get next bitmask in the enum (bitfield)

GetPrevBmask(enum_id, value)
Get prev bitmask in the enum (bitfield)

GetBmaskName(enum_id, bmask)
Get bitmask name (only for bitfields)

GetBmaskCmt(enum_id, bmask, repeatable)
Get bitmask comment (only for bitfields)

SetBmaskName(enum_id, bmask, name)
Set bitmask name (only for bitfields)

SetBmaskCmt(enum_id, bmask, cmt, repeatable)
Set bitmask comment (only for bitfields)

GetFirstConst(enum_id, bmask)
Get first constant in the enum

GetLastConst(enum_id, bmask)
Get last constant in the enum

GetNextConst(enum_id, value, bmask)
Get next constant in the enum

GetPrevConst(enum_id, value, bmask)
Get prev constant in the enum

GetConstName(const_id)
Get name of a constant

GetConstCmt(const_id, repeatable)
Get comment of a constant

AddEnum(idx, name, flag)
Add a new enum type

DelEnum(enum_id)
Delete enum type

SetEnumIdx(enum_id, idx)
Give another serial number to a enum

SetEnumName(enum_id, name)
Rename enum

SetEnumCmt(enum_id, cmt, repeatable)
Set comment of enum

SetEnumFlag(enum_id, flag)
Set flag of enum

SetEnumBf(enum_id, flag)
Set bitfield property of enum

IsBitfield(enum_id)
Is enum a bitfield?

AddConstEx(enum_id, name, value, bmask)
Add a member of enum - a symbolic constant

DelConstEx(enum_id, value, serial, bmask)
Delete a member of enum - a symbolic constant

SetConstName(const_id, name)
Rename a member of enum - a symbolic constant

SetConstCmt(const_id, cmt, repeatable)
Set a comment of a symbolic constant

CreateArray(name)

GetArrayId(name)

RenameArray(hashid, newname)

DeleteArray(hashid)

SetArrayLong(hashid, idx, value)

SetArrayString(hashid, idx, s)

GetArrayElement(tag, hashid, idx)

DelArrayElement(tag, hashid, idx)

GetFirstIndex(tag, hashid)

GetLastIndex(tag, hashid)

GetNextIndex(tag, hashid, idx)

GetPrevIndex(tag, hashid, idx)

SetHashLong(hashid, idx, value)

SetHashString(hashid, idx, value)

GetHashLong(hashid, idx)

GetHashString(hashid, idx)

DelHashElement(hashid, idx)

GetFirstHashKey(hashid)

GetNextHashKey(hashid, idx)

GetLastHashKey(hashid)

GetPrevHashKey(hashid, idx)

AddSourceFile(ea1, ea2, filename)
Mark a range of address as belonging to a source file An address range may belong only to one source file.

GetSourceFile(ea)
Get name of source file occupying the given address

DelSourceFile(ea)
Delete information about the source file

SetLineNumber(ea, lnnum)
Set source line number

GetLineNumber(ea)
Get source line number

DelLineNumber(ea)
Delete information about source line number

LoadTil(name, tildir=None)
Load a type library

Til2Idb(idx, type_name)
Copy information from type library to database Copy structure, union, or enum definition from the type library to the IDA database.

GetType(ea)
Get type of function/variable

GuessType(ea)
Guess type of function/variable

SetType(ea, newtype)
Set type of function/variable

ParseTypes(inputtype, flags)
Parse type declarations

HideArea(start, end, description, header, footer, color)
Hide an area

SetHiddenArea(ea, visible)
Set hidden area state

DelHiddenArea(ea)
Delete a hidden area

GetRegValue(name)
Get register value

SetRegValue(value, name)
Set register value

GetBptQty()
Get number of breakpoints.

GetBptEA(n)
Get breakpoint address

GetBptAttr(ea, bptattr)
Get the characteristics of a breakpoint

SetBptAttr(address, bptattr, value)
modifiable characteristics of a breakpoint

SetBptCnd(ea, cnd)
Set breakpoint condition

AddBptEx(ea, size, bpttype)
Add a new breakpoint

AddBpt(ea)

DelBpt(ea)
Delete breakpoint

EnableBpt(ea, enable)
Enable/disable breakpoint

GetColor(ea, what)
Get item color

SetColor(ea, what, color)
Set item color

SetXML(path, name, value)
Set or update one or more XML values.

GetXML(path)
Get one XML value.

OpOffset(ea, base)

OpNum(ea)

OpChar(ea)

OpSegment(ea)

OpDec(ea)

OpAlt1(ea, opstr)

OpAlt2(ea, opstr)

StringStp(x)

LowVoids(x)

HighVoids(x)

TailDepth(x)

Analysis(x)

Tabs(x)

Voids(x)

XrefShow(x)

Indent(x)

CmtIndent(x)

AutoShow(x)

MinEA()

MaxEA()

BeginEA()

set_start_cs(x)

set_start_ip(x)

WriteMap(filepath)

WriteTxt(filepath, ea1, ea2)

WriteExe(filepath)

AddConst(enum_id, name, value)

AddStruc(index, name)

AddUnion(index, name)

OpStroff(ea, n, strid)

OpEnum(ea, n, enumid)

DelConst(constid, v, mask)

GetConst(constid, v, mask)

AnalyseArea(sEA, eEA)

MakeStruct(ea, name)

Name(ea)

GetTrueName(ea)

MakeName(ea, name)

Comment(ea)

RptCmt(ea)

here()

Variables
	BADADDR = `4294967295`
	BADSEL = `4294967295`
	MAXADDR = `-16777216`
	MS_VAL = `255`
	FF_IVL = `256`
	MS_CLS = `1536`
	FF_CODE = `1536`
	FF_DATA = `1024`
	FF_TAIL = `512`
	FF_UNK = `0`
	MS_COMM = `1046528`
	FF_COMM = `2048`
	FF_REF = `4096`
	FF_LINE = `8192`
	FF_NAME = `16384`
	FF_LABL = `32768`
	FF_FLOW = `65536`
	FF_VAR = `524288`
	FF_ANYNAME = `49152`
	MS_0TYPE = `15728640`
	FF_0VOID = `0`
	FF_0NUMH = `1048576`
	FF_0NUMD = `2097152`
	FF_0CHAR = `3145728`
	FF_0SEG = `4194304`
	FF_0OFF = `5242880`
	FF_0NUMB = `6291456`
	FF_0NUMO = `7340032`
	FF_0ENUM = `8388608`
	FF_0FOP = `9437184`
	FF_0STRO = `10485760`
	FF_0STK = `11534336`
	MS_1TYPE = `251658240`
	FF_1VOID = `0`
	FF_1NUMH = `16777216`
	FF_1NUMD = `33554432`
	FF_1CHAR = `50331648`
	FF_1SEG = `67108864`
	FF_1OFF = `83886080`
	FF_1NUMB = `100663296`
	FF_1NUMO = `117440512`
	FF_1ENUM = `134217728`
	FF_1FOP = `150994944`
	FF_1STRO = `167772160`
	FF_1STK = `184549376`
	DT_TYPE = `-268435456`
	FF_BYTE = `0`
	FF_WORD = `268435456`
	FF_DWRD = `536870912`
	FF_QWRD = `805306368`
	FF_TBYT = `1073741824`
	FF_ASCI = `1342177280`
	FF_STRU = `1610612736`
	FF_OWRD = `1879048192`
	FF_FLOAT = `-2147483648`
	FF_DOUBLE = `-1879048192`
	FF_PACKREAL = `-1610612736`
	FF_ALIGN = `-1342177280`
	MS_CODE = `-268435456`
	FF_FUNC = `268435456`
	FF_IMMD = `1073741824`
	FF_JUMP = `-2147483648`
	NEF_SEGS = `1`
	NEF_RSCS = `2`
	NEF_NAME = `4`
	NEF_MAN = `8`
	NEF_FILL = `16`
	NEF_IMPS = `32`
	NEF_TIGHT = `64`
	NEF_FIRST = `128`
	NEF_CODE = `256`
	NEF_RELOAD = `512`
	NEF_FLAT = `1024`
	IDCHK_OK = `0`
	IDCHK_ARG = `-1`
	IDCHK_KEY = `-2`
	IDCHK_MAX = `-3`
	SN_CHECK = `1`
	SN_NOCHECK = `0`
	SN_PUBLIC = `2`
	SN_NON_PUBLIC = `4`
	SN_WEAK = `8`
	SN_NON_WEAK = `16`
	SN_AUTO = `32`
	SN_NON_AUTO = `64`
	SN_NOLIST = `128`
	SN_NOWARN = `256`
	SN_LOCAL = `512`
	DOUNK_SIMPLE = `0`
	DOUNK_EXPAND = `1`
	DOUNK_DELNAMES = `2`
	OPND_OUTER = `128`
	REF_OFF8 = `0`
	REF_OFF16 = `1`
	REF_OFF32 = `2`
	REF_LOW8 = `3`
	REF_LOW16 = `4`
	REF_HIGH8 = `5`
	REF_HIGH16 = `6`
	REF_VHIGH = `7`
	REF_VLOW = `8`
	REF_OFF64 = `9`
	REFINFO_RVA = `16`
	REFINFO_PASTEND = `32`
	REFINFO_NOBASE = `128`
	AU_UNK = `10`
	AU_CODE = `20`
	AU_PROC = `30`
	AU_USED = `40`
	AU_LIBF = `60`
	AU_FINAL = `200`
	OFILE_MAP = `0`
	OFILE_EXE = `1`
	OFILE_IDC = `2`
	OFILE_LST = `3`
	OFILE_ASM = `4`
	OFILE_DIF = `5`
	GENFLG_MAPSEG = `1`
	GENFLG_MAPNAME = `2`
	GENFLG_MAPDMNG = `4`
	GENFLG_MAPLOC = `8`
	GENFLG_IDCTYPE = `8`
	GENFLG_ASMTYPE = `16`
	GENFLG_GENHTML = `32`
	GENFLG_ASMINC = `64`
	ASCSTR_LAST = `6`
	SEARCH_UP = `0`
	SEARCH_DOWN = `1`
	SEARCH_NEXT = `2`
	SEARCH_CASE = `4`
	SEARCH_REGEX = `8`
	SEARCH_NOBRK = `16`
	SEARCH_NOSHOW = `32`
	INF_VERSION = `3`
	INF_PROCNAME = `5`
	INF_LFLAGS = `13`
	LFLG_PC_FPP = `1`
	LFLG_PC_FLAT = `2`
	LFLG_64BIT = `4`
	LFLG_DBG_NOPATH = `8`
	LFLG_SNAPSHOT = `16`
	INF_DEMNAMES = `14`
	DEMNAM_CMNT = `0`
	DEMNAM_NAME = `1`
	DEMNAM_NONE = `2`
	INF_FILETYPE = `15`
	FT_EXE_OLD = `0`
	FT_COM_OLD = `1`
	FT_BIN = `2`
	FT_DRV = `3`
	FT_WIN = `4`
	FT_HEX = `5`
	FT_MEX = `6`
	FT_LX = `7`
	FT_LE = `8`
	FT_NLM = `9`
	FT_COFF = `10`
	FT_PE = `11`
	FT_OMF = `12`
	FT_SREC = `13`
	FT_ZIP = `14`
	FT_OMFLIB = `15`
	FT_AR = `16`
	FT_LOADER = `17`
	FT_ELF = `18`
	FT_W32RUN = `19`
	FT_AOUT = `20`
	FT_PRC = `21`
	FT_EXE = `22`
	FT_COM = `23`
	FT_AIXAR = `24`
	INF_FCORESIZ = `17`
	INF_CORESTART = `21`
	INF_OSTYPE = `25`
	OSTYPE_MSDOS = `1`
	OSTYPE_WIN = `2`
	OSTYPE_OS2 = `4`
	OSTYPE_NETW = `8`
	INF_APPTYPE = `27`
	APPT_CONSOLE = `1`
	APPT_GRAPHIC = `2`
	APPT_PROGRAM = `4`
	APPT_LIBRARY = `8`
	APPT_DRIVER = `16`
	APPT_1THREAD = `32`
	APPT_MTHREAD = `64`
	APPT_16BIT = `128`
	APPT_32BIT = `256`
	INF_START_SP = `29`
	INF_START_AF = `33`
	AF_FIXUP = `1`
	AF_MARKCODE = `2`
	AF_UNK = `4`
	AF_CODE = `8`
	AF_PROC = `16`
	AF_USED = `32`
	AF_FLIRT = `64`
	AF_PROCPTR = `128`
	AF_JFUNC = `256`
	AF_NULLSUB = `512`
	AF_LVAR = `1024`
	AF_TRACE = `2048`
	AF_ASCII = `4096`
	AF_IMMOFF = `8192`
	AF_DREFOFF = `16384`
	AF_FINAL = `32768`
	INF_START_IP = `35`
	INF_BEGIN_EA = `39`
	INF_MIN_EA = `43`
	INF_MAX_EA = `47`
	INF_OMIN_EA = `51`
	INF_OMAX_EA = `55`
	INF_LOW_OFF = `59`
	INF_HIGH_OFF = `63`
	INF_MAXREF = `67`
	INF_ASCII_BREAK = `71`
	INF_WIDE_HIGH_BYTE_FIRST = `72`
	INF_INDENT = `73`
	INF_COMMENT = `74`
	INF_XREFNUM = `75`
	INF_ENTAB = `76`
	INF_SPECSEGS = `77`
	INF_VOIDS = `78`
	INF_SHOWAUTO = `80`
	INF_AUTO = `81`
	INF_BORDER = `82`
	INF_NULL = `83`
	INF_GENFLAGS = `84`
	INFFL_LZERO = `1`
	INF_SHOWPREF = `85`
	INF_PREFSEG = `86`
	INF_ASMTYPE = `87`
	INF_BASEADDR = `88`
	INF_XREFS = `92`
	SW_SEGXRF = `1`
	SW_XRFMRK = `2`
	SW_XRFFNC = `4`
	SW_XRFVAL = `8`
	INF_BINPREF = `93`
	INF_CMTFLAG = `95`
	SW_RPTCMT = `1`
	SW_ALLCMT = `2`
	SW_NOCMT = `4`
	SW_LINNUM = `8`
	SW_MICRO = `16`
	INF_NAMETYPE = `96`
	NM_REL_OFF = `0`
	NM_PTR_OFF = `1`
	NM_NAM_OFF = `2`
	NM_REL_EA = `3`
	NM_PTR_EA = `4`
	NM_NAM_EA = `5`
	NM_EA = `6`
	NM_EA4 = `7`
	NM_EA8 = `8`
	NM_SHORT = `9`
	NM_SERIAL = `10`
	INF_SHOWBADS = `97`
	INF_PREFFLAG = `98`
	PREF_SEGADR = `1`
	PREF_FNCOFF = `2`
	PREF_STACK = `4`
	INF_PACKBASE = `99`
	INF_ASCIIFLAGS = `100`
	ASCF_GEN = `1`
	ASCF_AUTO = `2`
	ASCF_SERIAL = `4`
	ASCF_COMMENT = `16`
	ASCF_SAVECASE = `32`
	INF_LISTNAMES = `101`
	LN_NORMAL = `1`
	LN_PUBLIC = `2`
	LN_AUTO = `4`
	LN_WEAK = `8`
	INF_ASCIIPREF = `102`
	INF_ASCIISERNUM = `118`
	INF_ASCIIZEROES = `122`
	INF_MF = `126`
	INF_ORG = `127`
	INF_ASSUME = `128`
	INF_CHECKARG = `129`
	INF_START_SS = `130`
	INF_START_CS = `134`
	INF_MAIN = `138`
	INF_SHORT_DN = `142`
	INF_LONG_DN = `146`
	INF_DATATYPES = `150`
	INF_STRTYPE = `154`
	ASCSTR_TERMCHR = `0`
	ASCSTR_C = `0`
	ASCSTR_PASCAL = `1`
	ASCSTR_LEN2 = `2`
	ASCSTR_UNICODE = `3`
	ASCSTR_LEN4 = `4`
	ASCSTR_ULEN2 = `5`
	ASCSTR_ULEN4 = `6`
	INF_AF2 = `158`
	AF2_JUMPTBL = `1`
	AF2_DODATA = `2`
	AF2_HFLIRT = `4`
	AF2_STKARG = `8`
	AF2_REGARG = `16`
	AF2_CHKUNI = `32`
	AF2_SIGCMT = `64`
	AF2_SIGMLT = `128`
	AF2_FTAIL = `256`
	AF2_DATOFF = `512`
	AF2_ANORET = `1024`
	AF2_VERSP = `2048`
	AF2_DOCODE = `4096`
	INF_NAMELEN = `160`
	INF_MARGIN = `162`
	INF_LENXREF = `164`
	INF_LPREFIX = `166`
	INF_LPREFIXLEN = `182`
	INF_COMPILER = `183`
	COMP_MASK = `15`
	COMP_UNK = `0`
	COMP_MS = `1`
	COMP_BC = `2`
	COMP_WATCOM = `3`
	COMP_GNU = `6`
	COMP_VISAGE = `7`
	COMP_BP = `8`
	INF_MODEL = `184`
	INF_SIZEOF_INT = `185`
	INF_SIZEOF_BOOL = `186`
	INF_SIZEOF_ENUM = `187`
	INF_SIZEOF_ALGN = `188`
	INF_SIZEOF_SHORT = `189`
	INF_SIZEOF_LONG = `190`
	INF_SIZEOF_LLONG = `191`
	SETPROC_COMPAT = `0`
	SETPROC_ALL = `1`
	SETPROC_USER = `2`
	SETPROC_FATAL = `128`
	IDA_STATUS_READY = `0`
	IDA_STATUS_THINKING = `1`
	IDA_STATUS_WAITING = `2`
	IDA_STATUS_WORK = `3`
	SEGDEL_PERM = `1`
	SEGDEL_KEEP = `2`
	SEGDEL_SILENT = `4`
	saAbs = `0`
	saRelByte = `1`
	saRelWord = `2`
	saRelPara = `3`
	saRelPage = `4`
	saRelDble = `5`
	saRel4K = `6`
	saGroup = `7`
	saRel32Bytes = `8`
	saRel64Bytes = `9`
	saRelQword = `10`
	scPriv = `0`
	scPub = `2`
	scPub2 = `4`
	scStack = `5`
	scCommon = `6`
	scPub3 = `7`
	SEG_NORM = `0`
	SEG_XTRN = `1`
	SEG_CODE = `2`
	SEG_DATA = `3`
	SEG_IMP = `4`
	SEG_GRP = `6`
	SEG_NULL = `7`
	SEG_UNDF = `8`
	SEG_BSS = `9`
	SEG_ABSSYM = `10`
	SEG_COMM = `11`
	SEG_IMEM = `12`
	SEGATTR_START = `0`
	SEGATTR_END = `4`
	SEGATTR_ORGBASE = `16`
	SEGATTR_ALIGN = `20`
	SEGATTR_COMB = `21`
	SEGATTR_PERM = `22`
	SEGATTR_BITNESS = `23`
	SEGATTR_FLAGS = `24`
	SEGATTR_SEL = `26`
	SEGATTR_ES = `30`
	SEGATTR_CS = `34`
	SEGATTR_SS = `38`
	SEGATTR_DS = `42`
	SEGATTR_FS = `46`
	SEGATTR_GS = `50`
	SEGATTR_TYPE = `94`
	SEGATTR_COLOR = `95`
	fl_CF = `16`
	fl_CN = `17`
	fl_JF = `18`
	fl_JN = `19`
	fl_F = `21`
	XREF_USER = `32`
	dr_O = `1`
	dr_W = `2`
	dr_R = `3`
	dr_T = `4`
	dr_I = `5`
	FUNCATTR_START = `0`
	FUNCATTR_END = `4`
	FUNCATTR_FLAGS = `8`
	FUNCATTR_FRAME = `10`
	FUNCATTR_FRSIZE = `14`
	FUNCATTR_FRREGS = `18`
	FUNCATTR_ARGSIZE = `20`
	FUNCATTR_FPD = `24`
	FUNCATTR_COLOR = `28`
	FUNC_NORET = `1`
	FUNC_FAR = `2`
	FUNC_LIB = `4`
	FUNC_STATIC = `8`
	FUNC_FRAME = `16`
	FUNC_USERFAR = `32`
	FUNC_HIDDEN = `64`
	FUNC_THUNK = `128`
	FUNC_BOTTOMBP = `256`
	FIXUP_MASK = `15`
	FIXUP_OFF8 = `0`
	FIXUP_BYTE = `0`
	FIXUP_OFF16 = `1`
	FIXUP_SEG16 = `2`
	FIXUP_PTR32 = `3`
	FIXUP_OFF32 = `4`
	FIXUP_PTR48 = `5`
	FIXUP_HI8 = `6`
	FIXUP_HI16 = `7`
	FIXUP_LOW8 = `8`
	FIXUP_LOW16 = `9`
	FIXUP_REL = `16`
	FIXUP_SELFREL = `0`
	FIXUP_EXTDEF = `32`
	FIXUP_UNUSED = `64`
	FIXUP_CREATED = `128`
	STRUC_ERROR_MEMBER_NAME = `-1`
	STRUC_ERROR_MEMBER_OFFSET = `-2`
	STRUC_ERROR_MEMBER_SIZE = `-3`
	STRUC_ERROR_MEMBER_TINFO = `-4`
	STRUC_ERROR_MEMBER_STRUCT = `-5`
	STRUC_ERROR_MEMBER_UNIVAR = `-6`
	STRUC_ERROR_MEMBER_VARLAST = `-7`
	CONST_ERROR_NAME = `1`
	CONST_ERROR_VALUE = `2`
	CONST_ERROR_ENUM = `3`
	CONST_ERROR_MASK = `4`
	CONST_ERROR_ILLV = `5`
	PT_FILE = `1`
	PT_SILENT = `2`
	PT_PAKDEF = `0`
	PT_PAK1 = `16`
	PT_PAK2 = `32`
	PT_PAK4 = `48`
	PT_PAK8 = `64`
	PT_PAK16 = `80`
	BPTATTR_EA = `0`
	BPTATTR_SIZE = `4`
	BPTATTR_TYPE = `8`
	BPTATTR_COUNT = `12`
	BPTATTR_FLAGS = `16`
	BPTATTR_COND = `20`
	BPT_EXEC = `0`
	BPT_WRITE = `1`
	BPT_RDWR = `3`
	BPT_SOFT = `4`
	BPT_BRK = `1`
	BPT_TRACE = `2`
	CIC_ITEM = `1`
	CIC_FUNC = `2`
	CIC_SEGM = `3`
	DEFCOLOR = `4294967295`

Function Details

atoa(ea)

Convert address value to a string Return address in the form 'seg000:1234' (the same as in line prefixes)

Parameters:

ea - address to format

rotate_left(value, count, nbits, offset)

Rotate a value to the left (or right)

Parameters:

x - value to rotate
count - number of times to rotate. negative counter means rotate to the right
nbits - number of bits to rotate
offset - offset of the first bit to rotate

Returns:

the value with the specified field rotated all other bits are not modified

AddHotkey(hotkey, idcfunc)

Add hotkey for IDC function

Parameters:

hotkey - hotkey name ('a', "Alt-A", etc)
idcfunc - IDC function name

Returns:

None

Note: GUI version doesn't support hotkeys

DelHotkey(hotkey)

Delete IDC function hotkey

Parameters:

hotkey - hotkey code to delete

Jump(ea)

Move cursor to the specifed linear address

Parameters:

ea - linear address

Wait()

Process all entries in the autoanalysis queue Wait for the end of autoanalysis

Note: This function will suspend execution of the calling script till the autoanalysis queue is empty.

Compile(filename)

Compile an IDC file.

The file being compiled should not contain functions that are currently executing - otherwise the behaviour of the replaced functions is undefined.

Parameters:

filename - name of file to compile

Returns:

0 - ok, otherwise it returns an error message

Exit(code)

Stop execution of IDC program, close the database and exit to OS

Parameters:

code - code to exit with.

Returns:

Exec(command)

Execute an OS command.

Parameters:

command - command line to execute

Returns:

error code from OS

Note: IDA will wait for the started program to finish. In order to start the command in parallel, use OS methods. For example, you may start another program in parallel using "start" command.

RunPlugin(name, arg)

Load and run a plugin

Parameters:

name - The plugin name is a short plugin name without an extension
arg - integer argument

Returns:

0 if could not load the plugin, 1 if ok

ApplySig(name)

Load (plan to apply) a FLIRT signature file

Parameters:

name - signature name without path and extension

Returns:

0 if could not load the signature file, !=0 otherwise

DeleteAll()

Delete all segments, instructions, comments, i.e. everything except values of bytes.

MakeCode(ea)

Create an instruction at the specified address

Parameters:

ea - linear address

Returns:

0 - can not create an instruction (no such opcode, the instruction would overlap with existing items, etc) otherwise returns length of the instruction in bytes

AnalyzeArea(sEA, eEA)

Perform full analysis of the area

Parameters:

sEA - starting linear address
eEA - ending linear address (excluded)

Returns:

1-ok, 0-Ctrl-Break was pressed.

MakeNameEx(ea, name, flags)

Rename an address

Parameters:

ea - linear address
name - new name of address. If name == "", then delete old name
flags - combination of SN_... constants

Returns:

1-ok, 0-failure

MakeComm(ea, comment)

Set an indented regular comment of an item

Parameters:

ea - linear address
comment - comment string

Returns:

None

MakeRptCmt(ea, comment)

Set an indented repeatable comment of an item

Parameters:

ea - linear address
comment - comment string

Returns:

None

MakeArray(ea, nitems)

Create an array.

Parameters:

ea - linear address
nitems - size of array in items

Note: This function will create an array of the items with the same type as the type of the item at 'ea'. If the byte at 'ea' is undefined, then this function will create an array of bytes.

MakeStr(ea, endea)

Create a string.

This function creates a string (the string type is determined by the value of GetLongPrm(INF_STRTYPE))

Parameters:

ea - linear address
endea - ending address of the string (excluded) if endea == BADADDR, then length of string will be calculated by the kernel

Returns:

1-ok, 0-failure

Note: The type of an existing string is returned by GetStringType()

MakeData(ea, flags, size, tid)

Create a data item at the specified address

Parameters:

ea - linear address
flags - FF_BYTE..FF_PACKREAL
size - size of item in bytes
tid - for FF_STRU the structure id

Returns:

1-ok, 0-failure

MakeByte(ea)

Convert the current item to a byte

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakeWord(ea)

Convert the current item to a word (2 bytes)

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakeDword(ea)

Convert the current item to a double word (4 bytes)

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakeQword(ea)

Convert the current item to a quadro word (8 bytes)

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakeOword(ea)

Convert the current item to a octa word (16 bytes)

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakeFloat(ea)

Convert the current item to a floating point (4 bytes)

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakeDouble(ea)

Convert the current item to a double floating point (8 bytes)

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakePackReal(ea)

Convert the current item to a packed real (10 or 12 bytes)

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakeTbyte(ea)

Convert the current item to a tbyte (10 or 12 bytes)

Parameters:

ea - linear address

Returns:

1-ok, 0-failure

MakeStructEx(ea, size, strname)

Convert the current item to a structure instance

Parameters:

ea - linear address
size - structure size in bytes. -1 means that the size will be calculated automatically
strname - name of a structure type

Returns:

1-ok, 0-failure

MakeAlign(ea, count, align)

Convert the current item to an alignment directive

Parameters:

ea - linear address
count - number of bytes to convert
align - 0 or 1..32 if it is 0, the correct alignment will be calculated by the kernel

Returns:

1-ok, 0-failure

MakeLocal(start, end, location, name)

Create a local variable

Parameters:

start - start of address range for the local variable
end - end of address range for the local variable
location - the variable location in the "[bp+xx]" form where xx is a number. The location can also be specified as a register name.
name - name of the local variable

Returns:

1-ok, 0-failure

Note: For the stack variables the end address is ignored. If there is no function at 'start' then this function. will fail.

MakeUnkn(ea, flags)

Convert the current item to an explored item

Parameters:

ea - linear address
flags - combination of DOUNK_* constants

Returns:

None

MakeUnknown(ea, size, flags)

Convert the current item to an explored item

Parameters:

ea - linear address
size - size of the range to undefine (for MakeUnknown)
flags - combination of DOUNK_* constants

Returns:

None

OpBinary(ea, n)

Convert an operand of the item (instruction or data) to a binary number

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

Returns:

1-ok, 0-failure

Note: the data items use only the type of the first operand

OpOctal(ea, n)

Convert an operand of the item (instruction or data) to an octal number

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpDecimal(ea, n)

Convert an operand of the item (instruction or data) to a decimal number

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpHex(ea, n)

Convert an operand of the item (instruction or data) to a hexadecimal number

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpChr(ea, n)

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpOff(ea, n, base)

Convert operand to an offset (for the explanations of 'ea' and 'n' please see OpBinary())

Example:

seg000:2000 dw 1234h

and there is a segment at paragraph 0x1000 and there is a data item within the segment at 0x1234:

seg000:1234 MyString db 'Hello, world!',0

Then you need to specify a linear address of the segment base to create a proper offset:

OpOffset(["seg000",0x2000],0,0x10000);

and you will have:

seg000:2000 dw offset MyString

Motorola 680x0 processor have a concept of "outer offsets". If you want to create an outer offset, you need to combine number of the operand with the following bit:

Please note that the outer offsets are meaningful only for Motorola 680x0.

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands
base - base of the offset as a linear address If base == BADADDR then the current operand becomes non-offset

OpOffEx(ea, n, reftype, target, base, tdelta)

Convert operand to a complex offset expression This is a more powerful version of OpOff() function. It allows to explicitly specify the reference type (off8,off16, etc) and the expression target with a possible target delta. The complex expressions are represented by IDA in the following form:

target + tdelta - base

If the target is not present, then it will be calculated using

target = operand_value - tdelta + base

The target must be present for LOW.. and HIGH.. reference types

Parameters:

ea - linear address of the instruction/data
n - number of operand to convert (the same as in OpOff)
reftype - one of REF_... constants
target - an explicitly specified expression target. if you don't want to specify it, use -1. Please note that LOW... and HIGH... reference type requre the target.
base - the offset base (a linear address)
tdelta - a displacement from the target which will be displayed in the expression.

Returns:

success (boolean)

OpSeg(ea, n)

Convert operand to a segment expression

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpNumber(ea, n)

Convert operand to a number (with default number base, radix)

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpAlt(ea, n, opstr)

Specify operand represenation manually.

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands
opstr - a string represenation of the operand

Note: IDA will not check the specified operand, it will simply display it instead of the orginal representation of the operand.

OpSign(ea, n)

Change sign of the operand

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpNot(ea, n)

Toggle the bitwise not operator for the operand

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpEnumEx(ea, n, enumid, serial)

Convert operand to a symbolic constant

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands
enumid - id of enumeration type
serial - serial number of the constant in the enumeration The serial numbers are used if there are more than one symbolic constant with the same value in the enumeration. In this case the first defined constant get the serial number 0, then second 1, etc. There could be 256 symbolic constants with the same value in the enumeration.

OpStroffEx(ea, n, strid, delta)

Convert operand to an offset in a structure

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands
strid - id of a structure type
delta - struct offset delta. usually 0. denotes the difference between the structure base and the pointer into the structure.

OpStkvar(ea, n)

Convert operand to a stack variable

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands

OpHigh(ea, n, target)

Convert operand to a high offset High offset is the upper 16bits of an offset. This type is used by TMS320C6 processors (and probably by other RISC processors too)

Parameters:

ea - linear address
n - number of operand
- 0 - the first operand
- 1 - the second, third and all other operands
- -1 - all operands
target - the full value (all 32bits) of the offset

MakeVar(ea)

Mark the location as "variable"

Parameters:

ea - address to mark

Returns:

None

Note: All that IDA does is to mark the location as "variable". Nothing else, no additional analysis is performed. This function may disappear in the future.

ExtLinA(ea, n, line)

Specify an additional line to display before the generated ones.

Parameters:

ea - linear address
n - number of anterior additioal line (0..MAX_ITEM_LINES)
line - the line to display

Returns:

None

Note: IDA displays additional lines from number 0 up to the first unexisting additional line. So, if you specify additional line #150 and there is no additional line #149, your line will not be displayed. MAX_ITEM_LINES is defined in IDA.CFG

ExtLinB(ea, n, line)

Specify an additional line to display after the generated ones.

Parameters:

ea - linear address
n - number of posterior additioal line (0..MAX_ITEM_LINES)
line - the line to display

Returns:

None

DelExtLnA(ea, n)

Delete an additional anterior line

Parameters:

ea - linear address
n - number of anterior additioal line (0..500)

Returns:

None

DelExtLnB(ea, n)

Delete an additional posterior line

Parameters:

ea - linear address
n - number of posterior additioal line (0..500)

Returns:

None

SetManualInsn(ea, insn)

Specify instruction represenation manually.

Parameters:

ea - linear address
insn - a string represenation of the operand

Note: IDA will not check the specified instruction, it will simply display it instead of the orginal representation.

GetManualInsn(ea)

Get manual representation of instruction

Parameters:

ea - linear address

Note: This function returns value set by SetManualInsn earlier.

PatchByte(ea, value)

Change value of a program byte

Parameters:

ea - linear address
value - new value of the byte

Returns:

None

PatchWord(ea, value)

Change value of a program word (2 bytes)

Parameters:

ea - linear address
value - new value of the word

PatchDword(ea, value)

Change value of a double word

Parameters:

ea - linear address
value - new value of the double word

SetFlags(ea, flags)

Set new value of flags This function should not used be used directly if possible. It changes properties of a program byte and if misused, may lead to very-very strange results.

Parameters:

ea - adress
flags - new flags value

SetReg(ea, reg, value)

Set value of a segment register.

Parameters:

ea - linear address
reg - name of a register, like "cs", "ds", "es", etc.
value - new value of the segment register.

Note: IDA keeps tracks of all the points where segment register change their values. This function allows you to specify the correct value of a segment register if IDA is not able to find the corrent value.

AutoMark2(start, end, queuetype)

Plan to perform an action in the future. This function will put your request to a special autoanalysis queue. Later IDA will retrieve the request from the queue and process it. There are several autoanalysis queue types. IDA will process all queries from the first queue and then switch to the second queue, etc.

GenerateFile(filetype, path, ea1, ea2, flags)

Generate an output file

Parameters:

type - type of output file. One of OFILE_... symbols. See below.
path - the output file path (will be overwritten!)
ea1 - start address. For some file types this argument is ignored
ea2 - end address. For some file types this argument is ignored
flags - bit combination of GENFLG_...

Returns:

number of the generated lines. -1 if an error occured OFILE_EXE: 0-can't generate exe file, 1-ok

GetIdaDirectory()

Get IDA directory

This function returns the directory where IDA.EXE resides

GetInputFile()

Get input file name

This function returns name of the file being disassembled

GetInputFilePath()

Get input file path

This function returns the full path of the file being disassembled

GetIdbPath()

Get IDB full path

This function returns full path of the current IDB database

GetFlags(ea)

Get internal flags

Parameters:

ea - linear address

Returns:

32-bit value of internal flags. See start of IDC.IDC file for explanations.

Byte(ea)

Get value of program byte

Parameters:

ea - linear address

Returns:

value of byte. If byte has no value then returns 0xFF If the current byte size is different from 8 bits, then the returned value might have more 1's. To check if a byte has a value, use functions hasValue(GetFlags(ea))

GetOriginalByte(ea)

Get original value of program byte

Parameters:

ea - linear address

Returns:

the original value of byte before any patch applied to it

Word(ea)

Get value of program word (2 bytes)

Parameters:

ea - linear address

Returns:

the value of the word. If word has no value then returns 0xFFFF If the current byte size is different from 8 bits, then the returned value might have more 1's.

Dword(ea)

Get value of program double word (4 bytes)

Parameters:

ea - linear address

Returns:

the value of the double word. If double word has no value then returns 0xFFFFFFFF.

GetFloat(ea)

Get value of a floating point number (4 bytes)

Parameters:

ea - linear address

Returns:

float

GetDouble(ea)

Get value of a floating point number (8 bytes)

Parameters:

ea - linear address

Returns:

double

LocByName(name)

Get linear address of a name

Parameters:

name - name of program byte

Returns:

address of the name badaddr - no such name

LocByNameEx(fromaddr, name)

Get linear address of a name

Parameters:

fromaddr - the referring address. Allows to retrieve local label addresses in functions. If a local name is not found, then address of a global name is returned.
name - name of program byte

Returns:

address of the name (BADADDR - no such name)

SegByBase(base)

Get segment by segment base

Parameters:

base - segment base paragraph or selector

Returns:

linear address of the start of the segment or BADADDR if no such segment

GetCurrentLine()

Get the disassembly line at the cursor

Returns:: string

SelEnd()

Get end address of the selected area

Returns:: BADADDR - the user has not selected an area

GetReg(ea, reg)

Get value of segment register at the specified address

Parameters:

ea - linear address
reg - name of segment register

Returns:

the value of the segment register or 0xFFFF on error

Note: The segment registers in 32bit program usually contain selectors, so to get paragraph pointed by the segment register you need to call AskSelector() function.

NextAddr(ea)

Get next address in the program

Parameters:

ea - linear address

Returns:

BADADDR - the specified address in the last used address

PrevAddr(ea)

Get previous address in the program

Parameters:

ea - linear address

Returns:

BADADDR - the specified address in the first address

NextHead(ea, maxea)

Get next defined item (instruction or data) in the program

Parameters:

ea - linear address to start search from
maxea - the search will stop at the address maxea is not included in the search range

Returns:

BADADDR - no (more) defined items

PrevHead(ea, minea)

Get previous defined item (instruction or data) in the program

Parameters:

ea - linear address to start search from
minea - the search will stop at the address minea is included in the search range

Returns:

BADADDR - no (more) defined items

NextNotTail(ea)

Get next not-tail address in the program This function searches for the next displayable address in the program. The tail bytes of instructions and data are not displayable.

Parameters:

ea - linear address

Returns:

BADADDR - no (more) not-tail addresses

PrevNotTail(ea)

Get previous not-tail address in the program This function searches for the previous displayable address in the program. The tail bytes of instructions and data are not displayable.

Parameters:

ea - linear address

Returns:

BADADDR - no (more) not-tail addresses

ItemEnd(ea)

Get address of the end of the item (instruction or data)

Parameters:

ea - linear address

Returns:

address past end of the item at 'ea'

ItemSize(ea)

Get size of instruction or data item in bytes

Parameters:

ea - linear address

Returns:

1..n

NameEx(fromaddr, ea)

Get visible name of program byte

This function returns name of byte as it is displayed on the screen. If a name contains illegal characters, IDA replaces them by the substitution character during displaying. See IDA.CFG for the definition of the substitution character.

Parameters:

fromaddr - the referring address. May be BADADDR. Allows to retrieve local label addresses in functions. If a local name is not found, then a global name is returned.
ea - linear address

Returns:

"" - byte has no name

GetTrueNameEx(fromaddr, ea)

Get true name of program byte

This function returns name of byte as is without any replacements.

Parameters:

fromaddr - the referring address. May be BADADDR. Allows to retrieve local label addresses in functions. If a local name is not found, then a global name is returned.
ea - linear address

Returns:

"" - byte has no name

Demangle(name, disable_mask)

Demangle a name

Parameters:

name - name to demangle
disable_mask - a mask that tells how to demangle the name it is a good idea to get this mask using GetLongPrm(INF_SHORT_DN) or GetLongPrm(INF_LONG_DN)

Returns:

a demangled name If the input name cannot be demangled, returns None

GetDisasm(ea)

Get disassembly line

Parameters:

ea - linear address of instruction

Returns:

"" - no instruction at the specified location

Note: this function may not return exactly the same mnemonics as you see on the screen.

GetMnem(ea)

Get instruction mnemonics

Parameters:

ea - linear address of instruction

Returns:

"" - no instruction at the specified location

Note: this function may not return exactly the same mnemonics as you see on the screen.

GetOpnd(ea, n)

Get operand of an instruction

Parameters:

ea - linear address of instruction
n - number of operand: 0 - the first operand 1 - the second operand

Returns:

the current text representation of operand

GetOpType(ea, n)

Get type of instruction operand

Parameters:

ea - linear address of instruction
n - number of operand: 0 - the first operand 1 - the second operand

Returns:

-1 bad operand number passed
0 None
1 General Register
2 Memory Reference
3 Base + Index
4 Base + Index + Displacement
5 Immediate
6 Immediate Far Address (with a Segment Selector)
7 Immediate Near Address
PC:
8 386 Trace register
9 386 Debug register
10 386 Control register
11 FPP register
12 MMX register
8051:
8 bit
9 /bit
10 bit
80196:
8 [intmem]
9 [intmem]+
10 offset[intmem]
11 bit
ARM:
8 shifted register
9 MLA operands
10 register list (for LDM/STM)
11 coprocessor register list (for CDP)
12 coprocessor register (for LDC/STC)
PPC:
8 SPR
9 2 FPRs
10 SH & MB & ME
11 CR field
12 CR bit
TMS320C5:
8 bit
9 bit not
10 condition
TMS320C6:
8 register pair (A1:A0..B15:B14)
Z8:
8 @intmem
9 @Rx
Z80:
8 condition

GetOperandValue(ea, n)

Get number used in the operand

This function returns an immediate number used in the operand

Parameters:

ea - linear address of instruction
n - the operand number

Returns:

value operand is an immediate value => immediate value operand has a displacement => displacement operand is a direct memory ref => memory address operand is a register => register number operand is a register phrase => phrase number otherwise => -1

LineA(ea, num)

Get anterior line

Parameters:

ea - linear address
num - number of anterior line (0..MAX_ITEM_LINES) MAX_ITEM_LINES is defined in IDA.CFG

Returns:

anterior line string

LineB(ea, num)

Get posterior line

Parameters:

ea - linear address
num - number of posterior line (0..MAX_ITEM_LINES)

Returns:

posterior line string

GetCommentEx(ea, repeatable)

Get regular indented comment

Parameters:

ea - linear address

Returns:

string or None if it fails

AltOp(ea, n)

Get manually entered operand string

Parameters:

ea - linear address
n - number of operand: 0 - the first operand 1 - the second operand

Returns:

string or None if it fails

GetString(ea, length, strtype)

Get string contents

Parameters:

ea - linear address
len - string length. -1 means to calculate the max string length
type - the string type (one of ASCSTR_... constants)

Returns:

string contents or empty string

GetStringType(ea)

Get string type

Parameters:

ea - linear address

Returns:

One of ASCSTR_... constants

FindText(ea, flag, y, x, searchstr)

Parameters:

ea - start address
flag - combination of SEARCH_* flags
y - number of text line at ea to start from (0..MAX_ITEM_LINES)
x - coordinate in this line
searchstr - search string

Returns:

ea of result or BADADDR if not found

FindBinary(ea, flag, searchstr, radix=16)

Parameters:

ea - start address
flag - combination of SEARCH_* flags
searchstr - a string as a user enters it for Search Text in Core
radix - radix of the numbers (default=16)

Returns:

ea of result or BADADDR if not found

Note: Example: "41 42" - find 2 bytes 41h,42h (radix is 16)

SetProcessorType(processor, level)


Change current processor

@param processor: name of processor in short form.
                  run 'ida ?' to get list of allowed processor types
@param level: the power of request:
              SETPROC_COMPAT - search for the processor type in the current module
              SETPROC_ALL    - search for the processor type in all modules
                               only if there were not calls with SETPROC_USER
              SETPROC_USER   - search for the processor type in all modules
                               and prohibit level SETPROC_USER
              SETPROC_FATAL  - can be combined with previous bits.
                               means that if the processor type can't be
                               set, IDA should display an error message and exit.

Batch(batch)

Enable/disable batch mode of operation

Parameters:

batch - Batch mode 0 - ida will display dialog boxes and wait for the user input 1 - ida will not display dialog boxes, warnings, etc.

Returns:

old balue of batch flag

AskStr(defval, prompt)

Ask the user to enter a string

Parameters:

defval - the default string value. This value will appear in the dialog box.
prompt - the prompt to display in the dialog box

Returns:

the entered string or 0.

AskFile(forsave, mask, prompt)

Ask the user to choose a file

Parameters:

forsave - 0: "Open" dialog box, 1: "Save" dialog box
mask - the input file mask as "*.*" or the default file name.
prompt - the prompt to display in the dialog box

Returns:

the selected file or 0.

AskAddr(defval, prompt)

Ask the user to enter an address

Parameters:

defval - the default address value. This value will appear in the dialog box.
prompt - the prompt to display in the dialog box

Returns:

the entered address or BADADDR.

AskLong(defval, prompt)

Ask the user to enter a number

Parameters:

defval - the default value. This value will appear in the dialog box.
prompt - the prompt to display in the dialog box

Returns:

the entered number or -1.

AskSeg(defval, prompt)

Ask the user to enter a segment value

Parameters:

defval - the default value. This value will appear in the dialog box.
prompt - the prompt to display in the dialog box

Returns:

the entered segment selector or BADSEL.

AskIdent(defval, prompt)

Ask the user to enter an identifier

Parameters:

defval - the default identifier. This value will appear in the dialog box.
prompt - the prompt to display in the dialog box

Returns:

the entered identifier or 0.

AskYN(defval, prompt)

Ask the user a question and let him answer Yes/No/Cancel

Parameters:

defval - the default answer. This answer will be selected if the user presses Enter. -1:cancel,0-no,1-ok
prompt - the prompt to display in the dialog box

Returns:

-1:cancel,0-no,1-ok

Message(msg)

Display a message in the message window

Parameters:

msg - message to print (formatting is done in Python)
This function can be used to debug IDC scripts

Warning(msg)

Display a message in a message box

Parameters:

msg - message to print (formatting is done in Python)
This function can be used to debug IDC scripts The user will be able to hide messages if they appear twice in a row on the screen

Fatal(format)

Display a fatal message in a message box and quit IDA

Parameters:

format - message to print

SetStatus(status)

Change IDA indicator.

Parameters:

status - new status

Returns:

the previous status.

AskSelector(sel)

Get a selector value

Parameters:

sel - the selector number

Returns:

selector value if found otherwise the input value (sel)

Note: selector values are always in paragraphs

FindSelector(val)

Find a selector which has the specifed value

Parameters:

val - value to search for

Returns:

the selector number if found, otherwise the input value (val & 0xFFFF)

Note: selector values are always in paragraphs

SetSelector(sel, value)

Set a selector value

Parameters:

sel - the selector number
value - value of selector

Returns:

None

Note: ida supports up to 4096 selectors. if 'sel' == 'val' then the selector is destroyed because it has no significance

DelSelector(sel)

Delete a selector

Parameters:

sel - the selector number to delete

Returns:

None

Note: if the selector is found, it will be deleted

FirstSeg()

Get first segment

Returns:: address of the start of the first segment BADADDR - no segments are defined

NextSeg(ea)


Get next segment

@param ea: linear address

@return: start of the next segment
         BADADDR - no next segment

TODO: Any better way of doing this?

SegStart(ea)

Get start address of a segment

Parameters:

ea - any address in the segment

Returns:

start of segment BADADDR - the specified address doesn't belong to any segment

SegEnd(ea)

Get end address of a segment

Parameters:

ea - any address in the segment

Returns:

end of segment (an address past end of the segment) BADADDR - the specified address doesn't belong to any segment

SegName(ea)

Get name of a segment

Parameters:

ea - any address in the segment

Returns:

"" - no segment at the specified address

SegCreate(startea, endea, base, use32, align, comb)

Create a new segment

Parameters:

startea - linear address of the start of the segment
endea - linear address of the end of the segment this address will not belong to the segment 'endea' should be higher than 'startea'
base - base paragraph or selector of the segment. a paragraph is 16byte memory chunk. If a selector value is specified, the selector should be already defined.
use32 - 0: 16bit segment, 1: 32bit segment, 2: 64bit segment
align - segment alignment. see below for alignment values
comb - segment combination. see below for combination values.

Returns:

0-failed, 1-ok

SegDelete(ea, flags)

Delete a segment

Parameters:

ea - any address in the segment
flags - combination of SEGDEL_* flags

Returns:

boolean success

SegBounds(ea, startea, endea, disable)

Change segment boundaries

Parameters:

ea - any address in the segment
startea - new start address of the segment
endea - new end address of the segment
disable - discard bytes that go out of the segment

Returns:

boolean success

SegRename(ea, name)

Change name of the segment

Parameters:

ea - any address in the segment
name - new name of the segment

Returns:

success (boolean)

SegClass(ea, segclass)

Change class of the segment

Parameters:

ea - any address in the segment
segclass - new class of the segment

Returns:

success (boolean)

SegAlign(ea, alignment)

Change alignment of the segment

Parameters:

ea - any address in the segment
alignment - new alignment of the segment (one of the sa... constants)

Returns:

success (boolean)

SegComb(segea, comb)

Change combination of the segment

Parameters:

segea - any address in the segment
comb - new combination of the segment (one of the sc... constants)

Returns:

success (boolean)

SegAddrng(ea, bitness)

Change segment addressing

Parameters:

ea - any address in the segment
bitness - 0: 16bit, 1: 32bit, 2: 64bit

Returns:

success (boolean)

SegByName(segname)

Get segment by name

Parameters:

segname - name of segment

Returns:

segment selector or BADADDR

SegDefReg(ea, reg, value)

Set default segment register value for a segment

Parameters:

ea - any address in the segment if no segment is present at the specified address then all segments will be affected
reg - name of segment register
value - default value of the segment register. -1-undefined.

SetSegmentType(segea, segtype)

Set segment type

Parameters:

segea - any address within segment
segtype - new segment type:

Returns:

!=0 - ok

GetSegmentAttr(segea, attr)

Get segment attribute

Parameters:

segea - any address within segment
attr - one of SEGATTR_... constants

SetSegmentAttr(segea, attr, value)

Set segment attribute

Parameters:

segea - any address within segment
attr - one of SEGATTR_... constants

Note: Please note that not all segment attributes are modifiable. Also some of them should be modified using special functions like SegAddrng, etc.

DelCodeXref(From, To, undef)

Unmark exec flow 'from' 'to'

Parameters:

undef - make 'To' undefined if no more references to it

Returns:

1 - planned to be made undefined

XrefType()

Return type of the last xref obtained by [RD]first/next[B0] functions.

Returns:: constants fl_* or dr_*

LoadFile(filepath, pos, ea, size)

Load file into IDA database

Parameters:

filepath - path to input file
pos - position in the file
ea - linear address to load
size - number of bytes to load

Returns:

0 - error, 1 - ok

SaveFile(filepath, pos, ea, size)

Save from IDA database to file

Parameters:

filepath - path to output file
pos - position in the file
ea - linear address to save from
size - number of bytes to save

Returns:

0 - error, 1 - ok

MakeFunction(start, end)

Create a function

Parameters:

start - function bounds
end - function bounds
If the function end address is BADADDR, then IDA will try to determine the function bounds automatically. IDA will define all necessary instructions to determine the function bounds.

Returns:

!=0 - ok

Note: an instruction should be present at the start address

DelFunction(ea)

Delete a function

Parameters:

ea - any address belonging to the function

Returns:

!=0 - ok

SetFunctionEnd(ea, end)

Change function end address

Parameters:

ea - any address belonging to the function
end - new function end address

Returns:

!=0 - ok

NextFunction(ea)

Find next function

Parameters:

ea - any address belonging to the function

Returns:

-1 - no more functions otherwise returns the next function start address

PrevFunction(ea)

Find previous function

Parameters:

ea - any address belonging to the function

Returns:

-1 - no more functions otherwise returns the previous function start address

GetFunctionAttr(ea, attr)

Get a function attribute

Parameters:

ea - any address belonging to the function
attr - one of FUNCATTR_... constants

Returns:

-1 - error otherwise returns the attribute value

SetFunctionAttr(ea, attr, value)

Set a function attribute

Parameters:

ea - any address belonging to the function
attr - one of FUNCATTR_... constants
value - new value of the attribute

Returns:

1-ok, 0-failed

GetFunctionFlags(ea)

Retrieve function flags

Parameters:

ea - any address belonging to the function

Returns:

-1 - function doesn't exist otherwise returns the flags

SetFunctionFlags(ea, flags)

Change function flags

Parameters:

ea - any address belonging to the function
flags - see GetFunctionFlags() for explanations

Returns:

!=0 - ok

GetFunctionName(ea)

Retrieve function name

Parameters:

ea - any address belonging to the function

Returns:

null string - function doesn't exist otherwise returns function name

GetFunctionCmt(ea, repeatable)

Retrieve function comment

Parameters:

ea - any address belonging to the function
repeatable - 1: get repeatable comment 0: get regular comment

Returns:

function comment string

SetFunctionCmt(ea, cmt, repeatable)

Set function comment

Parameters:

ea - any address belonging to the function
cmt - a function comment line
repeatable - 1: get repeatable comment 0: get regular comment

ChooseFunction(title)

Ask the user to select a function

Arguments:

Parameters:

title - title of the dialog box

Returns:

-1 - user refused to select a function otherwise returns the selected function start address

GetFuncOffset(ea)

Convert address to 'funcname+offset' string

@param ea - address to convert

Returns:: if the address belongs to a function then return a string formed as 'name+offset' where 'name' is a function name 'offset' is offset within the function else return null string

FindFuncEnd(ea)

Determine a new function boundaries

Parameters:

ea - starting address of a new function

Returns:

if a function already exists, then return its end address. If a function end cannot be determined, the return BADADDR otherwise return the end address of the new function

GetFrame(ea)

Get ID of function frame structure

Parameters:

ea - any address belonging to the function

Returns:

ID of function frame or None In order to access stack variables you need to use structure member manipulaion functions with the obtained ID.

GetFrameLvarSize(ea)

Get size of local variables in function frame

Parameters:

ea - any address belonging to the function

Returns:

Size of local variables in bytes. If the function doesn't have a frame, return 0 If the function does't exist, return None

GetFrameRegsSize(ea)

Get size of saved registers in function frame

Parameters:

ea - any address belonging to the function

Returns:

Size of saved registers in bytes. If the function doesn't have a frame, return 0 This value is used as offset for BP (if FUNC_FRAME is set) If the function does't exist, return None

GetFrameArgsSize(ea)

Get size of arguments in function frame which are purged upon return

Parameters:

ea - any address belonging to the function

Returns:

Size of function arguments in bytes. If the function doesn't have a frame, return 0 If the function does't exist, return -1

GetFrameSize(ea)

Get full size of function frame

Parameters:

ea - any address belonging to the function

Returns:

Size of function frame in bytes. This function takes into account size of local variables + size of saved registers + size of return address + size of function arguments If the function doesn't have a frame, return size of function return address in the stack. If the function does't exist, return 0

MakeFrame(ea, lvsize, frregs, argsize)

Make function frame

Parameters:

ea - any address belonging to the function
lvsize - size of function local variables
frregs - size of saved registers
argsize - size of function arguments

Returns:

ID of function frame or -1 If the function did not have a frame, the frame will be created. Otherwise the frame will be modified

GetSpd(ea)

Get current delta for the stack pointer

Parameters:

ea - end address of the instruction i.e.the last address of the instruction+1

Returns:

The difference between the original SP upon entering the function and SP for the specified address

GetSpDiff(ea)

Get modification of SP made by the instruction

Parameters:

ea - end address of the instruction i.e.the last address of the instruction+1

Returns:

Get modification of SP made at the specified location If the specified location doesn't contain a SP change point, return 0 Otherwise return delta of SP modification

SetSpDiff(ea, delta)

Setup modification of SP made by the instruction

Parameters:

ea - end address of the instruction i.e.the last address of the instruction+1
delta - the difference made by the current instruction.

Returns:

1-ok, 0-failed

GetEntryPointQty()

Retrieve number of entry points

Returns:: number of entry points

AddEntryPoint(ordinal, ea, name, makecode)

Add entry point

Parameters:

ordinal - entry point number if entry point doesn't have an ordinal number, 'ordinal' should be equal to 'ea'
ea - address of the entry point
name - name of the entry point. If null string, the entry point won't be renamed.
makecode - if 1 then this entry point is a start of a function. Otherwise it denotes data bytes.

Returns:

0 - entry point with the specifed ordinal already exists 1 - ok

GetEntryOrdinal(index)

Retrieve entry point ordinal number

Parameters:

index - 0..GetEntryPointQty()-1

Returns:

0 if entry point doesn't exist otherwise entry point ordinal

GetEntryPoint(ordinal)

Retrieve entry point address

Parameters:

ordinal - entry point number it is returned by GetEntryPointOrdinal()

Returns:

-1 if entry point doesn't exist otherwise entry point address. If entry point address is equal to its ordinal number, then the entry point has no ordinal.

RenameEntryPoint(ordinal, name)

Rename entry point

Parameters:

ordinal - entry point number
name - new name

Returns:

!=0 - ok

GetNextFixupEA(ea)

Find next address with fixup information

Parameters:

ea - current address

Returns:

-1 - no more fixups otherwise returns the next address with fixup information

GetPrevFixupEA(ea)

Find previous address with fixup information

Parameters:

ea - current address

Returns:

-1 - no more fixups otherwise returns the previous address with fixup information

GetFixupTgtType(ea)

Get fixup target type

Parameters:

ea - address to get information about

Returns:

-1 - no fixup at the specified address otherwise returns fixup target type:

GetFixupTgtSel(ea)

Get fixup target selector

Parameters:

ea - address to get information about

Returns:

-1 - no fixup at the specified address otherwise returns fixup target selector

GetFixupTgtOff(ea)

Get fixup target offset

Parameters:

ea - address to get information about

Returns:

-1 - no fixup at the specified address otherwise returns fixup target offset

GetFixupTgtDispl(ea)

Get fixup target displacement

Parameters:

ea - address to get information about

Returns:

-1 - no fixup at the specified address otherwise returns fixup target displacement

SetFixup(ea, fixuptype, targetsel, targetoff, displ)

Set fixup information

Parameters:

ea - address to set fixup information about
fixuptype - fixup type. see GetFixupTgtType() for possible fixup types.
targetsel - target selector
targetoff - target offset
displ - displacement

Returns:

none

DelFixup(ea)

Delete fixup information

Parameters:

ea - address to delete fixup information about

Returns:

None

MarkPosition(ea, lnnum, x, y, slot, comment)

Mark position

Parameters:

ea - address to mark
lnnum - number of generated line for the 'ea'
x - x coordinate of cursor
y - y coordinate of cursor
slot - slot number: 1..1024 if the specifed value is not within the range, IDA will ask the user to select slot.
comment - description of the mark. Should be not empty.

Returns:

None

GetMarkedPos(slot)

Get marked position

Parameters:

slot - slot number: 1..1024 if the specifed value is <= 0 range, IDA will ask the user to select slot.

Returns:

BADADDR - the slot doesn't contain a marked address otherwise returns the marked address

GetMarkComment(slot)

Get marked position comment

Parameters:

slot - slot number: 1..1024

Returns:

None if the slot doesn't contain a marked address otherwise returns the marked address comment

GetStrucQty()

Get number of defined structure types

Returns:: number of structure types

GetFirstStrucIdx()

Get index of first structure type

Returns:: -1 if no structure type is defined index of first structure type. Each structure type has an index and ID. INDEX determines position of structure definition in the list of structure definitions. Index 1 is listed first, after index 2 and so on. The index of a structure type can be changed any time, leading to movement of the structure definition in the list of structure definitions. ID uniquely denotes a structure type. A structure gets a unique ID at the creation time and this ID can't be changed. Even when the structure type gets deleted, its ID won't be resued in the future.

GetLastStrucIdx()

Get index of last structure type

Returns:: -1 if no structure type is defined index of last structure type. See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetNextStrucIdx(index)

Get index of next structure type

Parameters:

index - current structure index

Returns:

-1 if no (more) structure type is defined index of the next structure type. See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetPrevStrucIdx(index)

Get index of previous structure type

Parameters:

index - current structure index

Returns:

-1 if no (more) structure type is defined index of the presiouvs structure type. See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetStrucIdx(sid)

Get structure index by structure ID

Parameters:

sid - structure ID

Returns:

-1 if bad structure ID is passed otherwise returns structure index. See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetStrucId(index)

Get structure ID by structure index

Parameters:

index - structure index

Returns:

-1 if bad structure index is passed otherwise returns structure ID.

Note: See GetFirstStrucIdx() for the explanation of structure indices and IDs.

GetStrucIdByName(name)

Get structure ID by structure name

Parameters:

name - structure type name

Returns:

-1 if bad structure type name is passed otherwise returns structure ID.

GetStrucName(sid)

Get structure type name

Parameters:

sid - structure type ID

Returns:

-1 if bad structure type ID is passed otherwise returns structure type name.

GetStrucComment(sid, repeatable)

Get structure type comment

Parameters:

sid - structure type ID
repeatable - 1: get repeatable comment 0: get regular comment

Returns:

None if bad structure type ID is passed otherwise returns comment.

GetStrucSize(sid)

Get size of a structure

Parameters:

sid - structure type ID

Returns:

-1 if bad structure type ID is passed otherwise returns size of structure in bytes.

GetMemberQty(sid)

Get number of members of a structure

Parameters:

sid - structure type ID

Returns:

-1 if bad structure type ID is passed otherwise returns number of members.

GetStrucPrevOff(sid, offset)

Get previous offset in a structure

Parameters:

sid - structure type ID
offset - current offset

Returns:

-1 if bad structure type ID is passed or no (more) offsets in the structure otherwise returns previous offset in a structure.

Note: IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes. This function returns a member offset or a hole offset. It will return size of the structure if input 'offset' is bigger than the structure size.

GetStrucNextOff(sid, offset)

Get next offset in a structure

Parameters:

sid - structure type ID
offset - current offset

Returns:

-1 if bad structure type ID is passed or no (more) offsets in the structure otherwise returns next offset in a structure.

GetFirstMember(sid)

Get offset of the first member of a structure

Parameters:

sid - structure type ID

Returns:

-1 if bad structure type ID is passed or structure has no members otherwise returns offset of the first member.

Note: IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes.

GetLastMember(sid)

Get offset of the last member of a structure

Parameters:

sid - structure type ID

Returns:

-1 if bad structure type ID is passed or structure has no members otherwise returns offset of the last member.

Note: IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes.

GetMemberOffset(sid, member_name)

Get offset of a member of a structure by the member name

Parameters:

sid - structure type ID
member_name - name of structure member

Returns:

-1 if bad structure type ID is passed or no such member in the structure otherwise returns offset of the specified member.

GetMemberNames(sid, member_offset)

Get name of a member of a structure

Parameters:

sid - structure type ID
member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.

Returns:

None if bad structure type ID is passed or no such member in the structure otherwise returns name of the specified member.

GetMemberComment(sid, member_offset, repeatable)

Get comment of a member

Parameters:

sid - structure type ID
member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.
repeatable - 1: get repeatable comment 0: get regular comment

Returns:

None if bad structure type ID is passed or no such member in the structure otherwise returns comment of the specified member.

GetMemberSize(sid, member_offset)

Get size of a member

Parameters:

sid - structure type ID
member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.

Returns:

-1 if bad structure type ID is passed or no such member in the structure otherwise returns size of the specified member in bytes.

GetMemberFlag(sid, member_offset)

Get type of a member

Parameters:

sid - structure type ID
member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.

Returns:

-1 if bad structure type ID is passed or no such member in the structure otherwise returns type of the member, see bit definitions above. If the member type is a structure then function GetMemberStrid() should be used to get the structure type id.

GetMemberStrId(sid, member_offset)

Get structure id of a member

Parameters:

sid - structure type ID
member_offset - member offset. The offset can be any offset in the member. For example, is a member is 4 bytes long and starts at offset 2, then 2,3,4,5 denote the same structure member.

Returns:

-1 if bad structure type ID is passed or no such member in the structure otherwise returns structure id of the member. If the current member is not a structure, returns -1.

IsUnion(sid)

Is a structure a union?

Parameters:

sid - structure type ID

Returns:

1: yes, this is a union id 0: no

Note: Unions are a special kind of structures

AddStrucEx(index, name, is_union)

Define a new structure type

Parameters:

index - index of new structure type If another structure has the specified index, then index of that structure and all other structures will be incremented, freeing the specifed index. If index is == -1, then the biggest index number will be used. See GetFirstStrucIdx() for the explanation of structure indices and IDs.
name - name of the new structure type.
is_union - 0: structure 1: union

Returns:

-1 if can't define structure type because of bad structure name: the name is ill-formed or is already used in the program. otherwise returns ID of the new structure type

DelStruc(sid)

Delete a structure type

Parameters:

sid - structure type ID

Returns:

0 if bad structure type ID is passed 1 otherwise the structure type is deleted. All data and other structure types referencing to the deleted structure type will be displayed as array of bytes.

SetStrucIdx(sid, index)

Change structure index

Parameters:

sid - structure type ID
index - new index of the structure

Returns:

!= 0 - ok

Note: See GetFirstStrucIdx() for the explanation of structure indices and IDs.

SetStrucName(sid, name)

Change structure name

Parameters:

sid - structure type ID
name - new name of the structure

Returns:

!= 0 - ok

SetStrucComment(sid, comment, repeatable)

Change structure comment

Parameters:

sid - structure type ID
comment - new comment of the structure
repeatable - 1: change repeatable comment 0: change regular comment

Returns:

!= 0 - ok

AddStrucMember(sid, name, offset, flag, typeid, nbytes)

Add structure member

Parameters:

sid - structure type ID
name - name of the new member
offset - offset of the new member -1 means to add at the end of the structure
flag - type of the new member. Should be one of FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA
typeid - structure id if 'flag' == FF_STRU Denotes type of the member if the member itself is a structure. if isOff0(flag) then typeid specifies the offset base. if isASCII(flag) then typeid specifies the string type (ASCSTR_...). if isStroff(flag) then typeid specifies the structure id Otherwise should be -1.
nbytes - number of bytes in the new member

Returns:

0 - ok, otherwise error code (one of STRUC_ERROR_*)

DelStrucMember(sid, member_offset)

Delete structure member

Parameters:

sid - structure type ID
member_offset - offset of the member

Returns:

!= 0 - ok.

Note: IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes.

SetMemberName(sid, member_offset, name)

Change structure member name

Parameters:

sid - structure type ID
member_offset - offset of the member
name - new name of the member

Returns:

!= 0 - ok.

SetMemberType(sid, member_offset, flag, typeid, nitems)

Change structure member type

Parameters:

sid - structure type ID
member_offset - offset of the member
flag - new type of the member. Should be one of FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA
typeid - structure id if 'flag' == FF_STRU Denotes type of the member is the member itself is a structure. Otherwise should be -1. if isOff0(flag) then typeid specifies the offset base. if isASCII(flag) then typeid specifies the string type (ASCSTR_...).
nitems - number of items in the member

Returns:

!=0 - ok.

SetMemberComment(sid, member_offset, comment, repeatable)

Change structure member comment

Parameters:

sid - structure type ID
member_offset - offset of the member
comment - new comment of the structure member
repeatable - 1: change repeatable comment 0: change regular comment

Returns:

!= 0 - ok

GetFchunkAttr(ea, attr)


Get a function chunk attribute

@param ea: any address in the chunk
                     @param attr: one of: FUNCATTR_START, FUNCATTR_END, FUNCATTR_COLOR

@return: desired attribute or -1

SetFchunkAttr(ea, attr, value)

Set a function chunk attribute

Parameters:

ea - any address in the chunk
attr - only FUNCATTR_COLOR
value - desired bg color (RGB)

Returns:

0 if failed, 1 if success

NextFchunk(ea)

Get next function chunk

Parameters:

ea - any address

Returns:

the starting address of the next function chunk or BADADDR

Note: This function enumerates all chunks of all functions in the database

PrevFchunk(ea)

Get previous function chunk

Parameters:

ea - any address

Returns:

the starting address of the function chunk or BADADDR

Note: This function enumerates all chunks of all functions in the database

AppendFchunk(funcea, ea1, ea2)

Append a function chunk to the function

Parameters:

funcea - any address in the function
ea1 - start of function tail
ea2 - end of function tail

Returns:

0 if failed, 1 if success

Note: If a chunk exists at the specified addresses, it must have exactly the specified boundaries

RemoveFchunk(funcea, tailea)

Remove a function chunk from the function

Parameters:

funcea - any address in the function
ea1 - any address in the function chunk to remove

Returns:

0 if failed, 1 if success

SetFchunkOwner(tailea, funcea)

Change the function chunk owner

Parameters:

tailea - any address in the function chunk
funcea - the starting address of the new owner

Returns:

0 if failed, 1 if success

Note: The new owner must already have the chunk appended before the call

FirstFuncFchunk(funcea)

Get the first function chunk of the specified function

Parameters:

funcea - any address in the function

Returns:

the function entry point or BADADDR

Note: This function returns the first (main) chunk of the specified function

NextFuncFchunk(funcea, tailea)

Get the next function chunk of the specified function

Parameters:

funcea - any address in the function
tailea - any address in the current chunk

Returns:

the starting address of the next function chunk or BADADDR

Note: This function returns the next chunk of the specified function

GetEnumQty()

Get number of enum types

Returns:: number of enumerations

GetnEnum(idx)

Get ID of the specified enum by its serial number

Parameters:

idx - number of enum (0..GetEnumQty()-1)

Returns:

ID of enum or -1 if error

GetEnumIdx(enum_id)

Get serial number of enum by its ID

Parameters:

enum_id - ID of enum

Returns:

(0..GetEnumQty()-1) or -1 if error

GetEnum(name)

Get enum ID by the name of enum

Arguments: name - name of enum

returns: ID of enum or -1 if no such enum exists

GetEnumName(enum_id)

Get name of enum

Parameters:

enum_id - ID of enum

Returns:

name of enum or empty string

GetEnumCmt(enum_id, repeatable)

Get comment of enum

Parameters:

enum_id - ID of enum
repeatable - 0:get regular comment 1:get repeatable comment

Returns:

comment of enum

GetEnumSize(enum_id)

Get size of enum

Parameters:

enum_id - ID of enum

Returns:

number of constants in the enum Returns 0 if enum_id is bad.

GetEnumFlag(enum_id)

Get flag of enum

Parameters:

enum_id - ID of enum

Returns:

flags of enum. These flags determine representation of numeric constants (binary,octal,decimal,hex) in the enum definition. See start of this file for more information about flags. Returns 0 if enum_id is bad.

GetConstByName(name)

Get member of enum - a symbolic constant ID

Parameters:

name - name of symbolic constant

Returns:

ID of constant or -1

GetConstValue(const_id)

Get value of symbolic constant

Parameters:

const_id - id of symbolic constant

Returns:

value of constant or 0

GetConstBmask(const_id)

Get bit mask of symbolic constant

Parameters:

const_id - id of symbolic constant

Returns:

bitmask of constant or 0 ordinary enums have bitmask = -1

GetConstEnum(const_id)

Get id of enum by id of constant

Parameters:

const_id - id of symbolic constant

Returns:

id of enum the constant belongs to. -1 if const_id is bad.

GetConstEx(enum_id, value, serial, bmask)

Get id of constant

Parameters:

enum_id - id of enum
value - value of constant
serial - serial number of the constant in the enumeration. See OpEnumEx() for details.
bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask

Returns:

id of constant or -1 if error

GetFirstBmask(enum_id)

Get first bitmask in the enum (bitfield)

Parameters:

enum_id - id of enum (bitfield)

Returns:

the smallest bitmask of constant or -1 no bitmasks are defined yet All bitmasks are sorted by their values as unsigned longs.

GetLastBmask(enum_id)

Get last bitmask in the enum (bitfield)

Parameters:

enum_id - id of enum

Returns:

the biggest bitmask or -1 no bitmasks are defined yet All bitmasks are sorted by their values as unsigned longs.

GetNextBmask(enum_id, value)

Get next bitmask in the enum (bitfield)

Parameters:

enum_id - id of enum
value - value of the current bitmask

Returns:

value of a bitmask with value higher than the specified value. -1 if no such bitmasks exist. All bitmasks are sorted by their values as unsigned longs.

GetPrevBmask(enum_id, value)

Get prev bitmask in the enum (bitfield)

Parameters:

enum_id - id of enum
value - value of the current bitmask

Returns:

value of a bitmask with value lower than the specified value. -1 no such bitmasks exist. All bitmasks are sorted by their values as unsigned longs.

GetBmaskName(enum_id, bmask)

Get bitmask name (only for bitfields)

Parameters:

enum_id - id of enum
bmask - bitmask of the constant

Returns:

name of bitmask or None

GetBmaskCmt(enum_id, bmask, repeatable)

Get bitmask comment (only for bitfields)

Parameters:

enum_id - id of enum
bmask - bitmask of the constant
repeatable - type of comment, 0-regular, 1-repeatable

Returns:

comment attached to bitmask or None

SetBmaskName(enum_id, bmask, name)

Set bitmask name (only for bitfields)

Parameters:

enum_id - id of enum
bmask - bitmask of the constant
name - name of bitmask

Returns:

1-ok, 0-failed

SetBmaskCmt(enum_id, bmask, cmt, repeatable)

Set bitmask comment (only for bitfields)

Parameters:

enum_id - id of enum
bmask - bitmask of the constant
cmt - comment repeatable - type of comment, 0-regular, 1-repeatable

Returns:

1-ok, 0-failed

GetFirstConst(enum_id, bmask)

Get first constant in the enum

Parameters:

enum_id - id of enum
bmask - bitmask of the constant (ordinary enums accept only -1 as a bitmask)

Returns:

value of constant or -1 no constants are defined All constants are sorted by their values as unsigned longs.

GetLastConst(enum_id, bmask)

Get last constant in the enum

Parameters:

enum_id - id of enum
bmask - bitmask of the constant (ordinary enums accept only -1 as a bitmask)

Returns:

value of constant or -1 no constants are defined All constants are sorted by their values as unsigned longs.

GetNextConst(enum_id, value, bmask)

Get next constant in the enum

Parameters:

enum_id - id of enum
bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask
value - value of the current constant

Returns:

value of a constant with value higher than the specified value. -1 no such constants exist. All constants are sorted by their values as unsigned longs.

GetPrevConst(enum_id, value, bmask)

Get prev constant in the enum

Parameters:

enum_id - id of enum
bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask
value - value of the current constant

Returns:

value of a constant with value lower than the specified value. -1 no such constants exist. All constants are sorted by their values as unsigned longs.

GetConstName(const_id)

Get name of a constant

Parameters:

const_id - id of const
Returns: name of constant

GetConstCmt(const_id, repeatable)

Get comment of a constant

Parameters:

const_id - id of const
repeatable - 0:get regular comment, 1:get repeatable comment

Returns:

comment string

AddEnum(idx, name, flag)

Add a new enum type

Parameters:

idx - serial number of the new enum. If another enum with the same serial number exists, then all enums with serial numbers >= the specified idx get their serial numbers incremented (in other words, the new enum is put in the middle of the list of enums).
If idx >= GetEnumQty() or idx == -1 then the new enum is created at the end of the list of enums.
name - name of the enum.
flag - flags for representation of numeric constants in the definition of enum.

Returns:

id of new enum or -1.

DelEnum(enum_id)

Delete enum type

Parameters:

enum_id - id of enum

Returns:

None

SetEnumIdx(enum_id, idx)

Give another serial number to a enum

Parameters:

enum_id - id of enum
idx - new serial number. If another enum with the same serial number exists, then all enums with serial numbers >= the specified idx get their serial numbers incremented (in other words, the new enum is put in the middle of the list of enums).
If idx >= GetEnumQty() then the enum is moved to the end of the list of enums.

Returns:

comment string

SetEnumName(enum_id, name)

Rename enum

Parameters:

enum_id - id of enum
name - new name of enum

Returns:

1-ok,0-failed

SetEnumCmt(enum_id, cmt, repeatable)

Set comment of enum

Parameters:

enum_id - id of enum
cmt - new comment for the enum
repeatable - is the comment repeatable?
- 0:set regular comment
- 1:set repeatable comment

Returns:

1-ok,0-failed

SetEnumFlag(enum_id, flag)

Set flag of enum

Parameters:

enum_id - id of enum
flag - flags for representation of numeric constants in the definition of enum.

Returns:

1-ok,0-failed

SetEnumBf(enum_id, flag)

Set bitfield property of enum

Parameters:

enum_id - id of enum
flag - flags
- 1: convert to bitfield
- 0: convert to ordinary enum

Returns:

1-ok,0-failed

IsBitfield(enum_id)

Is enum a bitfield?

Parameters:

enum_id - id of enum

Returns:

1-yes, 0-no, ordinary enum

AddConstEx(enum_id, name, value, bmask)

Add a member of enum - a symbolic constant

Parameters:

enum_id - id of enum
name - name of symbolic constant. Must be unique in the program.
value - value of symbolic constant.
bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask all bits set in value should be set in bmask too

Returns:

0-ok, otherwise error code (one of CONST_ERROR_*)

DelConstEx(enum_id, value, serial, bmask)

Delete a member of enum - a symbolic constant

Parameters:

enum_id - id of enum
value - value of symbolic constant.
serial - serial number of the constant in the enumeration. See OpEnumEx() for for details.
bmask - bitmask of the constant ordinary enums accept only -1 as a bitmask

Returns:

1-ok, 0-failed

SetConstName(const_id, name)

Rename a member of enum - a symbolic constant

Parameters:

const_id - id of const
name - new name of constant

Returns:

1-ok, 0-failed

SetConstCmt(const_id, cmt, repeatable)

Set a comment of a symbolic constant

Parameters:

const_id - id of const
cmt - new comment for the constant
repeatable - is the comment repeatable? 0: set regular comment 1: set repeatable comment

Returns:

1-ok, 0-failed

AddSourceFile(ea1, ea2, filename)

Mark a range of address as belonging to a source file An address range may belong only to one source file. A source file may be represented by several address ranges.

Parameters:

ea1 - linear address of start of the address range
ea2 - linear address of end of the address range
filename - name of source file.

Returns:

1-ok, 0-failed.

Note: IDA can keep information about source files used to create the program. Each source file is represented by a range of addresses. A source file may contains several address ranges.

GetSourceFile(ea)

Get name of source file occupying the given address

Parameters:

ea - linear address

Returns:

NULL - source file information is not found otherwise returns pointer to file name

DelSourceFile(ea)

Delete information about the source file

Parameters:

ea - linear address belonging to the source file

Returns:

NULL - source file information is not found otherwise returns pointer to file name

SetLineNumber(ea, lnnum)

Set source line number

Parameters:

ea - linear address
lnnum - number of line in the source file

Returns:

None

GetLineNumber(ea)

Get source line number

Parameters:

ea - linear address

Returns:

number of line in the source file or -1

DelLineNumber(ea)

Delete information about source line number

Parameters:

ea - linear address

Returns:

None

LoadTil(name, tildir=None)

Load a type library

Parameters:

name - name of type library.
tildir - drectory to load the TIL from (defaults to "til/pc")

Returns:

1-ok, 0-failed.

Til2Idb(idx, type_name)

Copy information from type library to database Copy structure, union, or enum definition from the type library to the IDA database.

Parameters:

idx - the position of the new type in the list of types (structures or enums) -1 means at the end of the list
type_name - name of type to copy

Returns:

BADNODE-failed, otherwise the type id (structure id or enum id)

GetType(ea)

Get type of function/variable

Parameters:

ea - the address of the object

Returns:

type string or None if failed

GuessType(ea)

Guess type of function/variable

Parameters:

ea - the address of the object, can be the structure member id too

Returns:

type string or None if failed

SetType(ea, newtype)


Set type of function/variable

@param ea: the address of the object
@param newtype: the type string in C declaration form. 
             Must contain the closing ';'
            if specified as an empty string, then the
            assciated with 'ea' will be deleted

@return: 1-ok, 0-failed.

ParseTypes(inputtype, flags)

Parse type declarations

Parameters:

input - file name or C declarations (depending on the flags)
flags - combination of PT_... constants or 0

Returns:

number of errors

HideArea(start, end, description, header, footer, color)

Hide an area

Hidden areas - address ranges which can be replaced by their descriptions

Parameters:

start - area start
end - area end
description - description to display if the area is collapsed
header - header lines to display if the area is expanded
footer - footer lines to display if the area is expanded
color - RGB color code (-1 means default color)

Returns:

!=0 - ok

SetHiddenArea(ea, visible)

Set hidden area state

Parameters:

ea - any address belonging to the hidden area
visible - new state of the area

Returns:

!= 0 - ok

DelHiddenArea(ea)

Delete a hidden area

Parameters:

ea - any address belonging to the hidden area

Returns:

!= 0 - ok

GetRegValue(name)

Get register value

Parameters:

name - the register name

Returns:

Note: The debugger should be running. otherwise the function fails the register name should be valid. It is not necessary to use this function to get register values because a register name in the script will do too.

SetRegValue(value, name)

Set register value

Parameters:

name - the register name
value - new register value

Note: The debugger should be running It is not necessary to use this function to set register values. A register name in the left side of an assignment will do too.

GetBptQty()

Get number of breakpoints.

Returns:: number of breakpoints

GetBptEA(n)

Get breakpoint address

Parameters:

n - number of breakpoint, is in range 0..GetBptQty()-1

Returns:

addresss of the breakpoint or BADADDR

GetBptAttr(ea, bptattr)

Get the characteristics of a breakpoint

Parameters:

address - any address in the breakpoint range
bptattr - the desired attribute code, one of BPTATTR_... constants

Returns:

the desired attribute value or -1

SetBptAttr(address, bptattr, value)

modifiable characteristics of a breakpoint

Parameters:

address - any address in the breakpoint range
bptattr - the attribute code, one of BPTATTR_* constants BPTATTR_CND is not allowed, see SetBptCnd()
value - the attibute value

Returns:

success

SetBptCnd(ea, cnd)

Set breakpoint condition

Parameters:

address - any address in the breakpoint range
cnd - breakpoint condition

Returns:

success

AddBptEx(ea, size, bpttype)

Add a new breakpoint

Parameters:

ea - any address in the process memory space:
size - size of the breakpoint (irrelevant for software breakpoints):
type - type of the breakpoint (one of BPT_... constants)

Returns:

success

Note: Only one breakpoint can exist at a given address.

DelBpt(ea)

Delete breakpoint

Parameters:

ea - any address in the process memory space:

Returns:

success

EnableBpt(ea, enable)

Enable/disable breakpoint

Parameters:

ea - any address in the process memory space:

Returns:

success

Note: Disabled breakpoints are not written to the process memory

GetColor(ea, what)

Get item color

Parameters:

ea - address of the item
what - type of the item (one of CIC_* constants)

Returns:

color code in RGB (hex 0xBBGGRR)

SetColor(ea, what, color)

Set item color

Parameters:

ea - address of the item
what - type of the item (one of CIC_* constants)
color - new color code in RGB (hex 0xBBGGRR)

Returns:

success (True or False)

SetXML(path, name, value)

Set or update one or more XML values.

Parameters:

path - XPath expression of elements where to create value(s)
name - name of the element/attribute (use @XXX for an attribute) to create. If 'name' is empty, the elements or attributes returned by XPath are directly updated to contain the new 'value'.
value - value of the element/attribute

Returns:

success (True or False)

GetXML(path)

Get one XML value.

Parameters:

path - XPath expression to an element or attribute whose value is requested

Returns:

the value, None if failed