### Implement a custom MicroBlockOptimizer Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Example of creating and installing a custom block optimizer. ```python class MyOpt(MicroBlockOptimizer): def optimize(self, block): ... return 1 # modified opt = MyOpt() opt.install() ``` -------------------------------- ### Install IDA Domain Package Source: https://ida-domain.docs.hex-rays.com/getting_started/index Commands to create a virtual environment and install the library. ```bash # Create and activate virtual environment python -m venv ida-env source ida-env/bin/activate # On Windows: ida-env\Scripts\activate # Install the package pip install ida-domain ``` -------------------------------- ### Verify Installation Source: https://ida-domain.docs.hex-rays.com/getting_started/index A simple script to check if the ida_domain module is correctly installed. ```python # test_install.py try: from ida_domain import Database print("✓ Installation successful!") except ImportError as e: print(f"✗ Installation failed: {e}") ``` -------------------------------- ### dbg_process_start Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Triggered when a process starts. ```APIDOC ## dbg_process_start(pid, tid, ea, modinfo_name, modinfo_base, modinfo_size) ### Description Called on process started. ### Parameters - **pid** (pid_t) - Process ID. - **tid** (thid_t) - Thread ID. - **ea** (ea_t) - Address. - **modinfo_name** (str) - Module info name. - **modinfo_base** (ea_t) - Module info base address. - **modinfo_size** (asize_t) - Module info size. ``` -------------------------------- ### ev_out_segstart Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Produce the start of a segment in disassembled output. ```APIDOC ## ev_out_segstart(outctx: 'outctx_t *', seg: 'segment_t *') -> int ### Description Produce the start of a segment in disassembled output. ### Parameters - **outctx** (outctx_t *) - Required - Output context. - **seg** (segment_t *) - Required - Segment. ### Returns - **int** - 1 if OK, 0 if not implemented. ``` -------------------------------- ### ev_out_header Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Produce the start of disassembled text. ```APIDOC ## ev_out_header(outctx: 'outctx_t *') -> int ### Description Produce the start of disassembled text. ### Parameters - **outctx** (outctx_t *) - Required - Output context. ``` -------------------------------- ### Quick Usage Example Source: https://ida-domain.docs.hex-rays.com/index Demonstrates opening a database and iterating over functions to count instructions. ```python import argparse from ida_domain import Database parser = argparse.ArgumentParser(description='Quick Usage Example') parser.add_argument('-f', '--input-file', type=str, required=True) args = parser.parse_args() # Open any binary format IDA supports with Database() as db: if db.open(args.input_file): # Pythonic iteration over functions for func in db.functions: print(f'{func.name}: {len(list(db.functions.get_instructions(func)))} instructions') ``` -------------------------------- ### MicrocodeLifter.install Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Installs the custom microcode lifter into the decompiler. ```APIDOC ## install() ### Description Installs the custom microcode lifter. ### Returns - None ``` -------------------------------- ### ev_may_be_func Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Checks if a function can start at this instruction. ```APIDOC ## ev_may_be_func(insn: 'insn_t const *', state: int) -> int ### Description Checks if a function can start at this instruction. ### Parameters - **insn** (insn_t const *) - The instruction. - **state** (int) - Autoanalysis phase. 0 for creating functions, 1 for creating chunks. ### Returns - **int** - Probability (1..100). ``` -------------------------------- ### Get Entry Point Names Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Returns an iterator over all entry point names. ```python get_names() -> Iterator[str] ``` -------------------------------- ### StructBuilder Usage Example Source: https://ida-domain.docs.hex-rays.com/ref/types/index Demonstrates creating a struct, adding members, and building the final type. ```python >>> builder = db.types.create_struct("MyStruct") builder.add_member("x", db.types.create_primitive(4)) builder.add_member("y", db.types.create_primitive(4)) my_struct = builder.build() ``` -------------------------------- ### Implement a Custom PseudocodeVisitor Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Example of subclassing PseudocodeVisitor to collect all expressions and instructions during traversal. ```python class CollectAll(PseudocodeVisitor): def __init__(self): super().__init__() self.items = [] def visit_expression(self, expr): self.items.append(expr) return 0 def visit_instruction(self, insn): self.items.append(insn) return 0 ``` -------------------------------- ### Create a function type Source: https://ida-domain.docs.hex-rays.com/ref/types/index Example demonstrating the use of the builder to define a function signature. ```python builder = db.types.create_func_type() builder.set_return_type(db.types.create_primitive(4)) builder.add_argument("count", db.types.create_primitive(4)) builder.add_argument("buffer", db.types.create_pointer(db.types.create_primitive(1))) func_type = builder.build() ``` -------------------------------- ### Get Entry Point by Ordinal Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Retrieves an entry point using its ordinal number. ```python get_by_ordinal(ordinal: int) -> Optional[EntryInfo] ``` -------------------------------- ### get_previous_head Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Gets the previous head (start of data item) before the specified address. ```APIDOC ## get_previous_head(ea: ea_t, min_ea: ea_t = None) -> Optional[ea_t] ### Description Gets the previous head (start of data item) before the specified address. ### Parameters - **ea** (ea_t) - Required - The effective address. - **min_ea** (ea_t) - Optional - Minimum address to search. ### Returns - **Optional[ea_t]** - Address of previous head, or None if not found. ### Raises - **InvalidEAError** - If the effective address is invalid. ``` -------------------------------- ### is_head_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Checks if the address is the start of a data item. ```APIDOC ## is_head_at(ea: ea_t) -> bool ### Description Checks if the address is the start of a data item. ### Parameters - **ea** (ea_t) - Required - The effective address. ### Returns - **bool** - True if head, False otherwise. ### Raises - **InvalidEAError** - If the effective address is invalid. ``` -------------------------------- ### Open Database Usage Examples Source: https://ida-domain.docs.hex-rays.com/ref/database/index Demonstrates opening a database in library mode with custom arguments and connecting to an existing database in GUI mode. ```python # Library mode: Open a new database with custom options with Database.open( "malware.exe", args={"processor": "arm", "load_addr": 0x1000}, save_on_close=True ) as db: # Analyze the binary pass # Automatically saved and closed # IDA GUI mode: Get current database db = Database.open() # path=None # Work with the currently open database ``` -------------------------------- ### get_next_head Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Gets the next head (start of data item) after the specified address. ```APIDOC ## get_next_head(ea: ea_t, max_ea: ea_t = None) -> Optional[ea_t] ### Description Gets the next head (start of data item) after the specified address. ### Parameters - **ea** (ea_t) - Required - The effective address. - **max_ea** (ea_t) - Optional - Maximum address to search. ### Returns - **Optional[ea_t]** - Address of next head, or None if not found. ### Raises - **InvalidEAError** - If the effective address is invalid. ``` -------------------------------- ### Get Entry Point by Address Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Searches for an entry point at a specific linear address. ```python get_at(ea: ea_t) -> Optional[EntryInfo] ``` -------------------------------- ### Get Item Bounds Source: https://ida-domain.docs.hex-rays.com/ref/heads/index Retrieves the start and end addresses of the item containing the specified effective address. ```python bounds(ea: ea_t) -> tuple[ea_t, ea_t] ``` -------------------------------- ### Initialize Instructions Source: https://ida-domain.docs.hex-rays.com/ref/instructions/index Constructor for the Instructions class requiring an active database reference. ```python Instructions(database: Database) ``` -------------------------------- ### Add Entry Point Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Adds a new entry point to the database, optionally converting bytes to instructions. ```python add( address: ea_t, name: str, ordinal: Optional[int] = None, make_code: bool = True, ) -> bool ``` -------------------------------- ### Handle pre-structural analysis Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Triggered at the start of structure analysis. ```python pre_structural( ct: 'control_graph_t *', cfunc: cfunc_t, g: simple_graph_t, ) -> int ``` -------------------------------- ### for_all_instructions Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Visit all instructions across all blocks. ```APIDOC ## for_all_instructions(visitor: MicroInstructionVisitor) -> int ### Description Visit all instructions (including sub-instructions) across all blocks. ### Returns - **int** - Non-zero if the visitor stopped early. ``` -------------------------------- ### create_qword_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Creates qword data items at consecutive addresses starting from the specified address. ```APIDOC ## create_qword_at(ea: ea_t, count: int = 1, force: bool = False) -> bool ### Description Creates qword data items at consecutive addresses starting from the specified address. ### Parameters - **ea** (ea_t) - Required - The effective address to start creating qwords. - **count** (int) - Optional - Number of consecutive qword elements to create (default: 1). - **force** (bool) - Optional - Forces creation overriding an existing item if there is one (default: False). ### Returns - **bool** - True if successful, False otherwise. ### Raises - **InvalidEAError** - If the effective address is invalid. - **InvalidParameterError** - If count is not positive. ``` -------------------------------- ### Instructions(database: Database) Source: https://ida-domain.docs.hex-rays.com/ref/instructions/index Initializes the Instructions class with a reference to the active IDA database. ```APIDOC ## Instructions(database: Database) ### Description Initializes the instruction handler for the provided IDA database. ### Parameters - **database** (Database) - Required - Reference to the active IDA database. ``` -------------------------------- ### get_comment Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get comment for type. ```APIDOC ## get_comment(type_info: tinfo_t) -> str ### Description Get comment for type. ### Parameters - **type_info** (tinfo_t) - Required - The type info object to get comment from. ### Returns - **str** - Comment text, or empty string if no comment exists. ``` -------------------------------- ### get_comment Source: https://ida-domain.docs.hex-rays.com/ref/functions/index Get comment for function. ```APIDOC ## get_comment(func: func_t, repeatable: bool = False) -> str ### Description Get comment for function. ### Parameters - **func** (func_t) - Required - The function to get comment from. - **repeatable** (bool) - Optional - If True, retrieves repeatable comment. If False, retrieves non-repeatable comment. ### Returns - **str** - Comment text, or empty string if no comment exists. ``` -------------------------------- ### Initialize PseudocodeVisitor Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Constructor for the visitor class, accepting optional flags. ```python PseudocodeVisitor(flags: int = CV_FAST) ``` -------------------------------- ### get_comment Source: https://ida-domain.docs.hex-rays.com/ref/segments/index Get comment for segment. ```APIDOC ## get_comment(segment: segment_t, repeatable: bool = False) -> str ### Description Get comment for segment. ### Parameters - **segment** (segment_t) - Required - The segment to get comment from. - **repeatable** (bool) - Optional - If True, retrieves repeatable comment. ``` -------------------------------- ### Visit All Instructions Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Traverses all instructions in the block using a visitor pattern. ```python for_all_instructions( visitor: MicroInstructionVisitor, ) -> int ``` -------------------------------- ### Set IDADIR Environment Variable Source: https://ida-domain.docs.hex-rays.com/getting_started/index Configure the IDA installation directory for the API to access the IDA SDK. ```bash export IDADIR="/Applications/IDA Professional 9.2.app/Contents/MacOS/" ``` ```bash export IDADIR="/opt/ida-9.2/" ``` ```batch set IDADIR="C:\Program Files\IDA Professional 9.2\" ``` -------------------------------- ### ev_next_exec_insn Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Get next address to be executed. ```APIDOC ## ev_next_exec_insn(target: 'ea_t *', ea: ea_t, tid: int, getreg: 'processor_t::regval_getter_t *', regvalues: regval_t) -> int ### Description Get next address to be executed. Essential if single step is not supported in hardware. ### Parameters - **target** (ea_t *) - Out: pointer to the answer. - **ea** (ea_t) - Instruction address. - **tid** (int) - Current thread id. - **getreg** (processor_t) - Function to get register values. - **regvalues** (regval_t) - Register values array. ### Returns - **int** - 0 if unimplemented, 1 if implemented. ``` -------------------------------- ### Database Lifecycle Management Source: https://ida-domain.docs.hex-rays.com/ref/database/index Demonstrates opening and closing databases in library mode versus obtaining a handle in IDA mode. ```python # Library mode: Open and automatically close a database with Database.open("path/to/file.exe", save_on_close=True) as db: print(f"Loaded: {db.path}") # Database is automatically closed here # Library mode: Manual control db = Database.open("path/to/file.exe", save_on_close=True) db.close() # IDA mode: Get handle to current database db = Database.open() # or Database.open(None) ``` -------------------------------- ### get_udt_member_count Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get the number of members in a UDT. ```APIDOC ## get_udt_member_count(type_info: tinfo_t) ### Description Get the number of members in a UDT. ### Parameters - **type_info** (tinfo_t) - Required - A UDT type. ### Returns - int - Member count, or 0 if not a UDT. ``` -------------------------------- ### get_enum_member_count Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get the number of members in an enum. ```APIDOC ## get_enum_member_count(type_info: tinfo_t) -> int ### Description Get the number of members in an enum. ### Parameters - **type_info** (tinfo_t) - Required - An enum type. ### Returns - **int** - Member count, or 0 if not an enum. ``` -------------------------------- ### MicroInstructionVisitor Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index A visitor pattern implementation for traversing microcode instructions. ```APIDOC ## MicroInstructionVisitor ### Description Visitor class used to traverse microcode instructions. Override the `visit` method to process each instruction. ### Methods - **visit(insn)** - Called for each instruction. Return 0 to continue traversal, or non-zero to stop. ``` -------------------------------- ### get_details Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get type details and attributes. ```APIDOC ## get_details(type_info: tinfo_t) -> TypeDetails ### Description Get type details and attributes. ### Parameters - **type_info** (tinfo_t) - Required - The type information object for which to gather details. ### Returns - **TypeDetails** - Type details object. ``` -------------------------------- ### ev_init Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Initialization callback triggered when the IDP module is loaded. ```APIDOC ## ev_init(idp_modname) ### Description Called when the IDP module is loaded. ### Parameters - **idp_modname** (str) - Processor module name. ### Returns - (int) - <0 on failure. ``` -------------------------------- ### get_string_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Gets a string from the specified address. ```APIDOC ## get_string_at(ea: ea_t, max_length: Optional[int] = None) -> Optional[str] ### Description Gets a string from the specified address. ### Parameters - **ea** (ea_t) - Required - The effective address. - **max_length** (Optional[int]) - Optional - Maximum string length to read. ### Returns - **Optional[str]** - The string if it was successfully extracted or None in case of error. ### Raises - **InvalidEAError** - If the effective address is invalid. - **InvalidParameterError** - If max_length is specified but not positive. ``` -------------------------------- ### Get Entry Point by Index Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Retrieves an entry point by its internal index in the entry table. ```python get_at_index(index: int) -> EntryInfo ``` -------------------------------- ### get_original_bytes_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Gets the original bytes before any patches. ```APIDOC ## get_original_bytes_at(ea: ea_t, size: int) -> Optional[bytes] ### Description Gets the original bytes before any patches by reading individual bytes. ### Parameters - **ea** (ea_t) - Required - The effective address. - **size** (int) - Required - Number of bytes to read. ### Returns - **Optional[bytes]** - The original bytes or None in case of error. ### Raises - **InvalidEAError** - If the effective address is invalid. - **InvalidParameterError** - If size is not positive. ``` -------------------------------- ### Manage Type Information Libraries with IDA Domain Source: https://ida-domain.docs.hex-rays.com/examples/index Demonstrates creating a TIL from C declarations, importing types into a database, and exporting existing database types to an external library file. ```python #!/usr/bin/env python3 """ Types example for IDA Domain API. This example demonstrates how to work with IDA's type information libraries. """ import argparse import tempfile from pathlib import Path import ida_domain from ida_domain import Database def print_section_header(title: str, char: str = '=') -> None: """Print a formatted section header for better output organization.""" print(f'\n{char * 60}') print(f' {title}') print(f'{char * 60}') def print_subsection_header(title: str) -> None: """Print a formatted subsection header.""" print(f'\n--- {title} ---') declarations = """ typedef unsigned char uint8_t; typedef unsigned int uint32_t; struct STRUCT_EXAMPLE { char *text; unsigned int length; uint32_t reserved; }; """ def create_types(db: Database, library_path: Path): """Create a type library and fill it with types parsed from declaration""" til = db.types.create_library(library_path, 'Example type information library') db.types.parse_declarations(til, declarations) db.types.save_library(til, library_path) db.types.unload_library(til) def import_types(db: Database, library_path: Path): """Import all types from external library""" til = db.types.load_library(library_path) print_subsection_header(f'Type names from external library {library_path}') for name in db.types.get_all(library=til): print(name) print_subsection_header('Type information objects in local library (before import)') for item in sorted(list(db.types), key=lambda i: i.get_ordinal()): print(f'{item.get_ordinal()}. {item}') db.types.import_from_library(til) print_subsection_header('Type information objects in local library (after import)') for item in sorted(list(db.types), key=lambda i: i.get_ordinal()): print(f'{item.get_ordinal()}. {item}') db.types.unload_library(til) def export_types(db: Database, library_path: Path): """Export all types from database to external library""" til = db.types.create_library(library_path, 'Exported type library') db.types.export_to_library(til) db.types.save_library(til, library_path) db.types.unload_library(til) print_subsection_header(f'Types exported to {library_path}') til = db.types.load_library(library_path) for t in db.types.get_all(library=til): print(t) db.types.unload_library(til) def main(): parser = argparse.ArgumentParser( description=f'IDA Domain usage example, version {ida_domain.__version__}' ) parser.add_argument( '-f', '--input-file', help='Binary input file to be loaded', type=str, required=True ) args = parser.parse_args() library_dir = Path(tempfile.gettempdir()) / 'ida_domain_example' library_dir.mkdir(parents=True, exist_ok=True) library_create_path = library_dir / 'new.til' library_import_path = library_dir / 'new.til' library_export_path = library_dir / 'exported.til' print_section_header('Working with type information libraries') with Database.open(args.input_file) as db: create_types(db, library_create_path) import_types(db, library_import_path) export_types(db, library_export_path) if __name__ == '__main__': main() ``` -------------------------------- ### Initialize DecompilerHooks Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Instantiate the convenience class for handling decompiler events. ```python DecompilerHooks() ``` -------------------------------- ### get_cstring_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Gets a C-style null-terminated string. ```APIDOC ## get_cstring_at(ea: ea_t, max_length: int = 1024) -> Optional[str] ### Description Gets a C-style null-terminated string. ### Parameters - **ea** (ea_t) - Required - The effective address. - **max_length** (int) - Optional - Maximum string length to read (default: 1024). ### Returns - **Optional[str]** - The string if it was successfully extracted or None in case of error. ``` -------------------------------- ### get_flags Source: https://ida-domain.docs.hex-rays.com/ref/functions/index Get function attribute flags. ```APIDOC ## get_flags(func: func_t) -> FunctionFlags ### Description Get function attribute flags. ### Parameters - **func** (func_t) - Required - Function object. ### Returns - **FunctionFlags** - FunctionFlags enum with all active flags. ``` -------------------------------- ### get_callers Source: https://ida-domain.docs.hex-rays.com/ref/functions/index Gets all functions that call this function. ```APIDOC ## get_callers(func: func_t) -> List[func_t] ### Description Gets all functions that call this function. ### Parameters - **func** (func_t) - Required - The function instance. ### Returns - **List[func_t]** - List of calling functions. ``` -------------------------------- ### get_callees Source: https://ida-domain.docs.hex-rays.com/ref/functions/index Gets all functions called by this function. ```APIDOC ## get_callees(func: func_t) -> List[func_t] ### Description Gets all functions called by this function. ### Parameters - **func** (func_t) - Required - The function instance. ### Returns - **List[func_t]** - List of called functions. ``` -------------------------------- ### desktop_applied callback Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Triggered when a desktop configuration is applied from the IDB or registry. ```python desktop_applied( name: str, from_idb: bool, type: int ) -> None ``` -------------------------------- ### Initialize Entries Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Constructor for the Entries class requiring an active database reference. ```python Entries(database: Database) ``` -------------------------------- ### get_class Source: https://ida-domain.docs.hex-rays.com/ref/segments/index Get segment class name. ```APIDOC ## get_class(segment: segment_t) -> Optional[str] ### Description Get segment class name. ``` -------------------------------- ### get_bitness Source: https://ida-domain.docs.hex-rays.com/ref/segments/index Get segment bitness (16/32/64). ```APIDOC ## get_bitness(segment: segment_t) -> int ### Description Get segment bitness (16/32/64). ``` -------------------------------- ### Database Class Constructor Source: https://ida-domain.docs.hex-rays.com/ref/database/index Initializes a Database instance with optional hooks. ```python Database(hooks: Optional[HooksList] = None) ``` -------------------------------- ### Execute IDA Domain Python Script Source: https://ida-domain.docs.hex-rays.com/examples/index Command to run a Python script after setting up the environment and installing the package. ```bash python example_script.py ``` -------------------------------- ### Initialize PseudocodeInstruction Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Constructor for wrapping an existing IDA cinsn_t node. ```python PseudocodeInstruction( raw: cinsn_t, _parent: Optional[Any] = None ) ``` -------------------------------- ### create_struct_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Creates struct data items at consecutive addresses starting from the specified address. ```APIDOC ## create_struct_at(ea: ea_t, count: int, tid: int, force: bool = False) -> bool ### Description Creates struct data items at consecutive addresses starting from the specified address. ### Parameters - **ea** (ea_t) - Required - The effective address to start creating structs. - **count** (int) - Required - Number of consecutive struct elements to create. - **tid** (int) - Required - Structure type ID. - **force** (bool) - Optional - Forces creation overriding an existing item if there is one (default: False). ### Returns - **bool** - True if successful, False otherwise. ### Raises - **InvalidEAError** - If the effective address is invalid. - **InvalidParameterError** - If count is not positive or tid is invalid. ``` -------------------------------- ### Initialize IdaCommandOptions Source: https://ida-domain.docs.hex-rays.com/ref/database/index The constructor defines all available configuration parameters for IDA command line execution. ```python IdaCommandOptions( auto_analysis: bool = True, loading_address: Optional[int] = None, new_database: bool = False, compiler: Optional[str] = None, first_pass_directives: List[str] = list(), second_pass_directives: List[str] = list(), disable_fpp: bool = False, entry_point: Optional[int] = None, jit_debugger: Optional[bool] = None, log_file: Optional[str] = None, disable_mouse: bool = False, plugin_options: Optional[str] = None, output_database: Optional[str] = None, processor: Optional[str] = None, db_compression: Optional[str] = None, run_debugger: Optional[str] = None, load_resources: bool = False, script_file: Optional[str] = None, script_args: List[str] = list(), file_type: Optional[str] = None, file_member: Optional[str] = None, empty_database: bool = False, windows_dir: Optional[str] = None, no_segmentation: bool = False, debug_flags: Union[int, List[str]] = 0, ) ``` -------------------------------- ### get_instructions Source: https://ida-domain.docs.hex-rays.com/ref/functions/index Retrieves all instructions within the given function. ```APIDOC ## get_instructions(func: func_t) -> Iterator[insn_t] ### Description Retrieves all instructions within the given function. ### Parameters - **func** (func_t) - Required - The function instance. ### Returns - **Iterator[insn_t]** - An iterator over all instructions in the function. ``` -------------------------------- ### changing_segm_start Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Triggered when a segment start address is about to be changed. ```APIDOC ## changing_segm_start(s: 'segment_t *', new_start: ea_t, segmod_flags: int) ### Description Segment start address is to be changed. ### Parameters - **s** (segment_t *) - The segment. - **new_start** (ea_t) - New start address. - **segmod_flags** (int) - Segment modification flags. ``` -------------------------------- ### Find Entry Point by Name Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Searches for an entry point matching the provided name. ```python get_by_name(name: str) -> Optional[EntryInfo] ``` -------------------------------- ### Retrieve Instructions in Range Source: https://ida-domain.docs.hex-rays.com/ref/instructions/index Returns an iterator for instructions found between the start and end addresses. ```python get_between(start: ea_t, end: ea_t) -> Iterator[insn_t] ``` -------------------------------- ### desktop_applied Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Called when a desktop has been applied. ```APIDOC ## desktop_applied(name: str, from_idb: bool, type: int) -> None ### Description Called when a desktop has been applied. ### Parameters - **name** (str) - Required - The desktop name. - **from_idb** (bool) - Required - True if the desktop was stored in the IDB, False if it comes from the registry. - **type** (int) - Required - The desktop type (1-disassembly, 2-debugger, 3-merge). ``` -------------------------------- ### ev_max_ptr_size Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Get maximal size of a pointer in bytes. ```APIDOC ## ev_max_ptr_size() -> int ### Description Get maximal size of a pointer in bytes. ### Returns - **int** - Maximum possible size of a pointer. ``` -------------------------------- ### Get Import at Address Source: https://ida-domain.docs.hex-rays.com/ref/imports/index Retrieves import information for a specific linear address. ```python get_import_at(ea: ea_t) -> Optional[ImportInfo] ``` -------------------------------- ### Create qword data items Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Creates qword data items at consecutive addresses starting from the specified address. ```python create_qword_at( ea: ea_t, count: int = 1, force: bool = False ) -> bool ``` -------------------------------- ### to_text Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Get the decompiled pseudocode as text lines. ```APIDOC ## to_text(remove_tags: bool = True) -> List[str] ### Description Get the decompiled pseudocode as text lines. ### Parameters - **remove_tags** (bool) - Optional - If True, strips IDA color/formatting tags. ### Returns - **List[str]** - A list of strings, each a line of pseudocode. ``` -------------------------------- ### get_comment Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Get a user comment at the given address. ```APIDOC ## get_comment(ea: int, placement: CommentPlacement = SEMI) -> Optional[str] ### Description Get a user comment at the given address. ### Parameters - **ea** (int) - Required - Address to look up. - **placement** (CommentPlacement) - Optional - Item tree position (default CommentPlacement.SEMI). ### Returns - **Optional[str]** - The comment text, or None if no comment exists. ``` -------------------------------- ### Accessing Database Entities Source: https://ida-domain.docs.hex-rays.com/usage/index Demonstrates initializing a database connection and accessing collections of functions, segments, and entries. ```python db = Database() db.open('/path/to/your/database.idb') db.functions.get_all() db.segments.get_all() db.entries.get_all() ... ``` -------------------------------- ### get_udt_member_by_name Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get a specific UDT member by name. ```APIDOC ## get_udt_member_by_name(type_info: tinfo_t, name: str) ### Description Get a specific UDT member by name. ### Parameters - **type_info** (tinfo_t) - Required - A UDT (struct or union) type. - **name** (str) - Required - Member name to find. ### Returns - Optional[UdtMemberInfo] - UdtMemberInfo if found, None otherwise. ``` -------------------------------- ### Traverse and display instructions Source: https://ida-domain.docs.hex-rays.com/examples/index Iterates through database instructions and prints their disassembly, limited to the first 20 items to manage output volume. ```python def traverse_instructions(db: ida_domain.Database) -> None: """ Traverse and display instructions with disassembly. Args: db: The IDA database instance """ print_section_header('INSTRUCTIONS') instructions = list(db.instructions) print(f'Total instructions: {len(instructions)}') # Show first 20 instructions to avoid overwhelming output display_count = min(20, len(instructions)) if display_count < len(instructions): print(f'Displaying first {display_count} instructions:') for i, inst in enumerate(instructions[:display_count], 1): disasm = db.instructions.get_disassembly(inst) if disasm: print(f' [{i:2d}] 0x{inst.ea:08x}: {disasm}') else: print(f' [{i:2d}] 0x{inst.ea:08x}: ') if display_count < len(instructions): print(f' ... and {len(instructions) - display_count} more instructions') ``` -------------------------------- ### get_return_type Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get the return type of a function type. ```APIDOC ## get_return_type(type_info: tinfo_t) ### Description Get the return type of a function type. ### Parameters - **type_info** (tinfo_t) - Required - A function type. ### Returns - Optional[tinfo_t] - The return type, or None if not a function type. ``` -------------------------------- ### get_pointed_type Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get the type pointed to by a pointer type. ```APIDOC ## get_pointed_type(type_info: tinfo_t) ### Description Get the type pointed to by a pointer type. ### Parameters - **type_info** (tinfo_t) - Required - A pointer type. ### Returns - Optional[tinfo_t] - The pointed-to type, or None if not a pointer. ``` -------------------------------- ### Initialize PseudocodeExpressionVisitor Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Constructor for the expression visitor class. ```python PseudocodeExpressionVisitor(flags: int = CV_FAST) ``` -------------------------------- ### create_byte_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Creates byte data items at consecutive addresses starting from the specified address. ```APIDOC ## create_byte_at(ea: ea_t, count: int = 1, force: bool = False) -> bool ### Description Creates byte data items at consecutive addresses starting from the specified address. ### Parameters - **ea** (ea_t) - Required - The effective address to start creating bytes. - **count** (int) - Optional - Number of consecutive byte elements to create. Default: 1. - **force** (bool) - Optional - Forces creation overriding an existing item if there is one. Default: False. ### Returns - **bool** - True if successful, False otherwise. ### Raises - **InvalidEAError** - If the effective address is invalid. - **InvalidParameterError** - If count is not positive. ``` -------------------------------- ### Initialize Pseudocode Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Constructor for the Pseudocode class. ```python Pseudocode(database: Database) ``` -------------------------------- ### get_func_argument_count Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get the number of arguments in a function type. ```APIDOC ## get_func_argument_count(type_info: tinfo_t) -> int ### Description Get the number of arguments in a function type. ### Parameters - **type_info** (tinfo_t) - Required - A function type. ### Returns - **int** - Argument count, or 0 if not a function type. ``` -------------------------------- ### get_func_argument_by_index Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get a specific function argument by index. ```APIDOC ## get_func_argument_by_index(type_info: tinfo_t, index: int) -> Optional[FuncArgumentInfo] ### Description Get a specific function argument by index. ### Parameters - **type_info** (tinfo_t) - Required - A function type. - **index** (int) - Required - Argument index (0-based). ### Returns - **Optional[FuncArgumentInfo]** - FuncArgumentInfo if found, None otherwise. ``` -------------------------------- ### Initialize BitfieldDetails Source: https://ida-domain.docs.hex-rays.com/ref/types/index Constructor for the BitfieldDetails class. ```python BitfieldDetails() ``` -------------------------------- ### get_enum_member_by_value Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get a specific enum member by value. ```APIDOC ## get_enum_member_by_value(type_info: tinfo_t, value: int) -> Optional[EnumMemberInfo] ### Description Get a specific enum member by value. ### Parameters - **type_info** (tinfo_t) - Required - An enum type. - **value** (int) - Required - Numeric value to find. ### Returns - **Optional[EnumMemberInfo]** - EnumMemberInfo if found, None otherwise. ``` -------------------------------- ### Get Entry Point Count Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Returns the total number of entry points defined in the program. ```python get_count() -> int ``` -------------------------------- ### for_all_instructions Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Iterates over all instructions in the block using a visitor pattern. ```APIDOC ## for_all_instructions(visitor: MicroInstructionVisitor) -> int ### Description Visit all instructions in this block (including sub-instructions). Returns non-zero if the visitor stopped early. ``` -------------------------------- ### get_enum_member_by_name Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get a specific enum member by name. ```APIDOC ## get_enum_member_by_name(type_info: tinfo_t, name: str) -> Optional[EnumMemberInfo] ### Description Get a specific enum member by name. ### Parameters - **type_info** (tinfo_t) - Required - An enum type. - **name** (str) - Required - Member name to find. ### Returns - **Optional[EnumMemberInfo]** - EnumMemberInfo if found, None otherwise. ``` -------------------------------- ### Create Desktop Widget Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Create a widget for the widget tree during desktop creation. ```python create_desktop_widget( title: str, cfg: jobj_wrapper_t ) -> 'PyObject *' ``` -------------------------------- ### get_array_length Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get the number of elements in an array type. ```APIDOC ## get_array_length(type_info: tinfo_t) -> Optional[int] ### Description Get the number of elements in an array type. ### Parameters - **type_info** (tinfo_t) - Required - An array type. ### Returns - **Optional[int]** - The array length, or None if not an array. ``` -------------------------------- ### get_array_element_type Source: https://ida-domain.docs.hex-rays.com/ref/types/index Get the element type of an array type. ```APIDOC ## get_array_element_type(type_info: tinfo_t) -> Optional[tinfo_t] ### Description Get the element type of an array type. ### Parameters - **type_info** (tinfo_t) - Required - An array type. ### Returns - **Optional[tinfo_t]** - The element type, or None if not an array. ``` -------------------------------- ### Initialize Strings Class Source: https://ida-domain.docs.hex-rays.com/ref/strings/index Constructor for the Strings class requiring a database reference. ```python Strings(database: Database) ``` -------------------------------- ### get_original_word_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Get original word value before patching. ```APIDOC ## get_original_word_at(ea: ea_t) -> Optional[int] ### Description Get original word value (that was before patching). ### Parameters - **ea** (ea_t) - Required - The effective address. ### Returns - **Optional[int]** - The original word value, or None if an error occurs. ### Raises - **InvalidEAError** - If the effective address is invalid. ``` -------------------------------- ### Initialize MicroOperand Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Constructor for the MicroOperand wrapper class. ```python MicroOperand( raw: mop_t, _parent_insn: Optional[Any] = None ) ``` -------------------------------- ### get_original_qword_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Get original qword value before patching. ```APIDOC ## get_original_qword_at(ea: ea_t) -> Optional[int] ### Description Get original qword value (that was before patching). ### Parameters - **ea** (ea_t) - Required - The effective address. ### Returns - **Optional[int]** - The original qword value, or None if an error occurs. ### Raises - **InvalidEAError** - If the effective address is invalid. ``` -------------------------------- ### Retrieve All Instructions Source: https://ida-domain.docs.hex-rays.com/ref/instructions/index Returns an iterator over every instruction present in the database. ```python get_all() -> Iterator[insn_t] ``` -------------------------------- ### Create Byte Data Items Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Create one or more byte data items starting at the specified address. ```python create_byte_at( ea: ea_t, count: int = 1, force: bool = False ) -> bool ``` -------------------------------- ### get_original_dword_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Get original dword value before patching. ```APIDOC ## get_original_dword_at(ea: ea_t) -> Optional[int] ### Description Get original dword value (that was before patching). ### Parameters - **ea** (ea_t) - Required - The effective address. ### Returns - **Optional[int]** - The original dword value, or None if an error occurs. ### Raises - **InvalidEAError** - If the effective address is invalid. ``` -------------------------------- ### Create MicroOperand Instances Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Static factory methods for creating new MicroOperand instances. ```python num = MicroOperand.number(42, size=4) reg = MicroOperand.reg(mreg, size=8) blk = MicroOperand.new_block_ref(3) ``` -------------------------------- ### Implement PseudocodeInstructionVisitor Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Visitor class for traversing ctree instructions, requiring an override of visit_instruction. ```python PseudocodeInstructionVisitor( flags: int = CV_FAST | CV_INSNS, ) ``` ```python class FindReturns(PseudocodeInstructionVisitor): def __init__(self): super().__init__() self.returns = [] def visit_instruction(self, insn): if insn.is_return: self.returns.append(insn) return 0 visitor = FindReturns() visitor.apply_to(decomp.body) ``` ```python apply_to( body: PseudocodeInstruction, parent: Optional[Any] = None, ) -> int ``` ```python visit_insn(raw_insn: Any) -> int ``` ```python visit_instruction(insn: PseudocodeInstruction) -> int ``` -------------------------------- ### get_original_byte_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Get original byte value before patching. ```APIDOC ## get_original_byte_at(ea: ea_t) -> Optional[int] ### Description Get original byte value (that was before patching). ### Parameters - **ea** (ea_t) - Required - The effective address. ### Returns - **Optional[int]** - The original byte value, or None if an error occurs. ### Raises - **InvalidEAError** - If the effective address is invalid. ``` -------------------------------- ### Implement a custom expression visitor Source: https://ida-domain.docs.hex-rays.com/ref/pseudocode/index Example of extending PseudocodeExpressionVisitor to collect call expressions during traversal. ```python class FindCalls(PseudocodeExpressionVisitor): def __init__(self): super().__init__() self.calls = [] def visit_expression(self, expr): if expr.is_call: self.calls.append(expr) return 0 visitor = FindCalls() visitor.apply_to(decomp.body) ``` -------------------------------- ### get_bytes_at Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Gets the specified number of bytes of the program. ```APIDOC ## get_bytes_at(ea: ea_t, size: int) -> Optional[bytes] ### Description Gets the specified number of bytes of the program. ### Parameters - **ea** (ea_t) - Required - The effective address. - **size** (int) - Required - Number of bytes to read. ### Returns - **Optional[bytes]** - The bytes (as bytes object), or None in case of failure. ``` -------------------------------- ### Retrieve Entry Point Addresses Source: https://ida-domain.docs.hex-rays.com/ref/entries/index Returns an iterator over all entry point addresses. ```python get_addresses() -> Iterator[ea_t] ``` -------------------------------- ### Get microcode Source: https://ida-domain.docs.hex-rays.com/ref/functions/index Generates microcode for the specified function. ```python get_microcode(func: func_t) -> MicroBlockArray ``` -------------------------------- ### Build Arguments Method Source: https://ida-domain.docs.hex-rays.com/ref/database/index Constructs the command line arguments string from the configured options. ```python build_args() -> str ``` -------------------------------- ### get_chunks Source: https://ida-domain.docs.hex-rays.com/ref/functions/index Get all chunks (main and tail) of a function. ```APIDOC ## get_chunks(func: func_t) -> Iterator[FunctionChunk] ### Description Get all chunks (main and tail) of a function. ### Parameters - **func** (func_t) - Required - The function to analyze. ### Returns - **Iterator[FunctionChunk]** - FunctionChunk objects representing each chunk. ``` -------------------------------- ### instructions Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Returns an iterator over all instructions in the block. ```APIDOC ## instructions() -> Iterator[MicroInstruction] ### Description Iterate over all instructions in this block. ``` -------------------------------- ### Create oword data items Source: https://ida-domain.docs.hex-rays.com/ref/bytes/index Creates oword data items at consecutive addresses starting from the specified address. ```python create_oword_at( ea: ea_t, count: int = 1, force: bool = False ) -> bool ``` -------------------------------- ### Initialize StringListConfig Source: https://ida-domain.docs.hex-rays.com/ref/strings/index Constructor for configuring the internal string list generation. ```python StringListConfig( string_types: list[StringType] = lambda: [C](), min_len: int = 5, only_ascii_7bit: bool = True, only_existing: bool = False, ignore_instructions: bool = False, ) ``` -------------------------------- ### get_chunk_at Source: https://ida-domain.docs.hex-rays.com/ref/functions/index Get function chunk at exact address. ```APIDOC ## get_chunk_at(ea: int) -> Optional[func_t] ### Description Get function chunk at exact address. ### Parameters - **ea** (int) - Required - Address within function chunk. ### Returns - **Optional[func_t]** - Function chunk or None. ### Raises - **InvalidEAError** - If the effective address is invalid. ``` -------------------------------- ### shift_operand Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Shifts the operand start by a specified number of bytes. ```APIDOC ## shift_operand(offset: int) -> bool ### Description Shift the operand start by offset bytes. Positive offsets move toward higher bytes, negative offsets move toward lower bytes. ### Parameters - **offset** (int) - Required - Number of bytes to shift. ``` -------------------------------- ### Initialize UIHooks Source: https://ida-domain.docs.hex-rays.com/ref/hooks/index Instantiate the UIHooks convenience class for UI event handling. ```python UIHooks() ``` -------------------------------- ### SignatureFiles.create Source: https://ida-domain.docs.hex-rays.com/ref/signature_files/index Generates signature files (.pat and .sig) from the current database. ```APIDOC ## SignatureFiles.create(pat_only: bool = False) -> List[str] | None ### Description Creates signature files from the current database. Optionally generates only the PAT file. ### Parameters - **pat_only** (bool) - Optional - If true, generate only PAT file. ### Returns - **List[str] | None** - A list containing paths to the generated files, or None in case of failure. ``` -------------------------------- ### Get text representation Source: https://ida-domain.docs.hex-rays.com/ref/microcode/index Returns the text representation of the operand. ```python to_text(remove_tags: bool = True) -> str ```