Module pywraps :: Class IDP_Hooks

Class IDP_Hooks

object --+
         |
        IDP_Hooks

Instance Methods

hook(self)
Creates an IDP hook

unhook(self)
Removes the IDP hook

custom_ana(self)
Analyzes and decodes an instruction at idaapi.cmd.ea

custom_out(self)
Outputs the instruction defined in idaapi.cmd

custom_emu(self)
Emulate instruction, create cross-references, plan to analyze subsequent instructions, modify flags etc.

custom_outop(self, op)
Notification to generate operand text.

custom_mnem(self)
Prints the mnemonic of the instruction defined in idaapi.cmd

is_sane_insn(self, no_crefs)
is the instruction sane for the current file type?

may_be_func(self, no_crefs)
Can a function start here?

closebase(self)
The database will be closed now

savebase(self)
The database is being saved.

rename(self, ea, new_name)
The kernel is going to rename a byte.

renamed(self, ea, new_name, local_name)
The kernel has renamed a byte

undefine(self, ea)
An item in the database (insn or data) is being deleted

make_code(self, ea, size)
An instruction is being created

make_data(self, ea, flags, tid, len)
A data item is being created

load_idasgn(self, short_sig_name)
FLIRT signature have been loaded for normal processing (not for recognition of startup sequences)

add_func(self, func)
The kernel has added a function

del_func(self, func)
The kernel is about to delete a function

is_call_insn(self, ea, func_name)
Is the instruction a "call"?

is_ret_insn(self, ea, func_name)
Is the instruction a "return"?

assemble(self, ea, cs, ip, use32, line)
Assembles an instruction

Inherited from object: __delattr__, __getattribute__, __hash__, __init__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __str__

Properties
Inherited from `object`: `__class__`

Method Details

hook(self)

Creates an IDP hook

Returns:: Boolean true on success

unhook(self)

Removes the IDP hook

Returns:: Boolean true on success

custom_ana(self)

Analyzes and decodes an instruction at idaapi.cmd.ea

cmd.itype must be set >= idaapi.CUSTOM_CMD_ITYPE
cmd.size must be set to the instruction length

Returns:

Boolean

False if the instruction is not recognized
True if the instruction was decoded. idaapi.cmd should be filled in that case.

custom_out(self)

Outputs the instruction defined in idaapi.cmd

Returns:: Boolean (whether this instruction can be outputted or not)

custom_emu(self)

Emulate instruction, create cross-references, plan to analyze subsequent instructions, modify flags etc. Upon entrance to this function all information about the instruction is in 'cmd' structure.

Returns:: Boolean (whether this instruction has been emulated or not)

custom_outop(self, op)

Notification to generate operand text. If False was returned, then the standard operand output function will be called. The output buffer is inited with init_output_buffer() and this notification may use out_...() functions to form the operand text

Returns:: Boolean (whether the operand has been outputted or not)

custom_mnem(self)

Prints the mnemonic of the instruction defined in idaapi.cmd

Returns:

None: No mnemonic. IDA will use the default mnemonic value if present
String: The desired mnemonic string

is_sane_insn(self, no_crefs)

is the instruction sane for the current file type?

Parameters:

no_crefs -
- 1: the instruction has no code refs to it. ida just tries to convert unexplored bytes to an instruction (but there is no other reason to convert them into an instruction)
- 0: the instruction is created because of some coderef, user request or another weighty reason.

Returns:

1-ok, <=0-no, the instruction isn't likely to appear in the program

may_be_func(self, no_crefs)

Can a function start here?

Parameters:

state - autoanalysis phase 0: creating functions 1: creating chunks

Returns:

integer (probability 0..100)

savebase(self)

The database is being saved. Processor module should

rename(self, ea, new_name)

The kernel is going to rename a byte.

Parameters:

ea - Address
new_name - The new name

Returns:

If returns value <=0, then the kernel should not rename it. See also the 'renamed' event

renamed(self, ea, new_name, local_name)

The kernel has renamed a byte

Parameters:

ea - Address
new_name - The new name
local_name - Is local name

Returns:

Ignored

undefine(self, ea)

An item in the database (insn or data) is being deleted

Parameters:

ea - Address

Returns:

returns: >0-ok, <=0-the kernel should stop
if the return value is positive: bit0 - ignored bit1 - do not delete srareas at the item end

make_code(self, ea, size)

An instruction is being created

Parameters:

ea - Address
size - Instruction size

Returns:

1-ok, <=0-the kernel should stop

make_data(self, ea, flags, tid, len)

A data item is being created

Parameters:

ea - Address
tid - type id
flags - item flags
len - data item size

Returns:

1-ok, <=0-the kernel should stop

load_idasgn(self, short_sig_name)

FLIRT signature have been loaded for normal processing (not for recognition of startup sequences)

Parameters:

short_sig_name - signature name

Returns:

Ignored

add_func(self, func)

The kernel has added a function

Parameters:

func - the func_t instance

Returns:

Ignored

del_func(self, func)

The kernel is about to delete a function

Parameters:

func - the func_t instance

Returns:

1-ok,<=0-do not delete

is_call_insn(self, ea, func_name)

Is the instruction a "call"?

Parameters:

ea - instruction address

Returns:

1-unknown, 0-no, 2-yes

is_ret_insn(self, ea, func_name)

Is the instruction a "return"?

Parameters:

ea - instruction address
strict - - True: report only ret instructions False: include instructions like "leave" which begins the function epilog

Returns:

1-unknown, 0-no, 2-yes

assemble(self, ea, cs, ip, use32, line)

Assembles an instruction

Parameters:

ea - linear address of instruction
cs - cs of instruction
ip - ip of instruction
use32 - is 32bit segment?
line - line to assemble

Returns:

- None to let the underlying processor module assemble the line

or a string containing the assembled buffer