.. py:module:: database database -- Database module =========================== This module exposes a number of tools that can be used on a database and on addresses within the database. There are a number of namespaces that allow one to query information about the database as a whole, or to read/write to an address within the database. The base argument type for many of the utilites within this module is the address. This can allow one to modify the colors or comments for an address, or to read/write from the different types of data that might exist at an address. Some namespaces are also provided for querying the available symbolic information that IDA has discovered about a binary. This can be used to search and navigate the database. Some of the available namespaces that can be used for querying are :py:obj:`functions`, :py:obj:`segments`, :py:obj:`names`, :py:obj:`imports`, :py:obj:`entries`, and :py:obj:`marks`. ------------- Function list ------------- The functions that are available in this module use multicased functions and aliases. For more information on this, please see :ref:`multicase-aliases` and :ref:`multicase-functions`. .. py:function:: bottom() Return the very highest address within the database. .. py:function:: color() Return the color (RGB) for the item at the current address. .. py:function:: color(none) Remove the color from the item at the current address. :param none: the python value :py:obj:`None` :type none: None .. py:function:: color(ea) Return the color (RGB) for the item at the address specified by ``ea``. :param ea: an address in the database :type ea: int or long .. py:function:: color(ea, none) Remove the color from the item at the the address specified by ``ea``. :param ea: an address in the database :type ea: int or long :param none: the python value :py:obj:`None` :type none: None .. py:function:: color(ea, rgb) Set the color for the item at address ``ea`` to ``rgb``. :param ea: an address in the database :type ea: int or long :param rgb: the color as a red, green, and blue integer (``0x00RRGGBB``) :type rgb: int or long .. py:function:: comment(\*\*repeatable) Return the comment at the current address. :param \*\*repeatable: a boolean specifying that the repeatable comment should be returned .. py:function:: comment(ea, \*\*repeatable) Return the comment at the address ``ea``. If the bool ``repeatable`` is specified, then return the repeatable comment. :param ea: an address in the database :type ea: int or long :param \*\*repeatable: a boolean specifying that the repeatable comment should be returned .. py:function:: comment(string, \*\*repeatable) Set the comment at the current address to ``string``. :param string: the comment to apply :type string: str :param \*\*repeatable: a boolean specifying that the repeatable comment should be modified .. py:function:: comment(none, \*\*repeatable) Remove the comment at the current address. :param none: the python value :py:obj:`None` :type none: None :param \*\*repeatable: a boolean specifying that the repeatable comment should be removed .. py:function:: comment(ea, string, \*\*repeatable) Set the comment at the address ``ea`` to ``string``. If the bool ``repeatable`` is specified, then modify the repeatable comment. :param ea: an address in the database :type ea: int or long :param string: the comment to apply :type string: str :param \*\*repeatable: a boolean specifying that the repeatable comment should be modified .. py:function:: comment(ea, none, \*\*repeatable) Remove the comment at the address ``ea``. If the bool ``repeatable`` is specified, then remove the repeatable comment. :param ea: an address in the database :type ea: int or long :param none: the python value :py:obj:`None` :type none: None :param \*\*repeatable: a boolean specifying that the repeatable comment should be removed .. py:function:: disassemble(\*\*options) Disassemble the instructions at the current address. :param \*\*options: if ``count`` is specified as an integer, this will specify the number of instructions to disassemble. if ``comments`` is specified as a boolean, this will determine whether comments are included or not. .. py:function:: disassemble(ea, \*\*options) Disassemble the instructions at the address specified by ``ea``. If the integer ``count`` is specified, then return ``count`` number of instructions. If the bool ``comments`` is true, then return the comments for each instruction as well. Aliases: :py:func:`database.disasm` :param ea: an address within the database :type ea: int or long :param \*\*options: if ``count`` is specified as an integer, this will specify the number of instructions to disassemble. if ``comments`` is specified as a boolean, this will determine whether comments are included or not. .. py:function:: go(ea) Jump to the specified address at ``ea``. :param ea: an address in the database .. py:function:: go_offset(offset) Jump to the specified ``offset`` within the database. Aliases: :py:func:`database.goof`, :py:func:`database.gotooffset`, :py:func:`database.gooffset`, :py:func:`database.goto_offset` :param offset: an offset from the base address .. py:function:: here() Return the current address. .. py:function:: instruction() Return the instruction at the current address as a string. .. py:function:: instruction(ea) Return the instruction at the address ``ea`` as a string. :param ea: an address within the database :type ea: int or long .. py:function:: mangled() Return the mangled name at the current address. Aliases: :py:func:`database.mangle` .. py:function:: mangled(ea) Return the mangled name at the address specified by ``ea``. Aliases: :py:func:`database.mangle` :param ea: an address in the database containing a name :type ea: int or long .. py:function:: mangled(string, \*suffix) Rename the current address to the mangled version of ``string`` and return its previous mangled value. Aliases: :py:func:`database.mangle` :param string: a string to use as the name :type string: str :param \*suffix: any other integers or strings to append to the name .. py:function:: mangled(none) Remove the mangled name at the current address and return its previous mangled value. Aliases: :py:func:`database.mangle` :param none: the python value :py:obj:`None` :type none: None .. py:function:: mangled(ea, string, \*suffix) Rename the address specified by ``ea`` to the mangled version of ``string`` and return its previous mangled value. Aliases: :py:func:`database.mangle` :param ea: an address in the database :type ea: int or long :param string: a string to use as the name :type string: str :param \*suffix: any other integers or strings to append to the name .. py:function:: mangled(ea, none) Remove the name at the address specified by ``ea`` and return its previous mangled value. Aliases: :py:func:`database.mangle` :param ea: an address in the database containing a name :type ea: int or long :param none: the python value :py:obj:`None` :type none: None .. py:function:: mark() Return the mark at the current address. .. py:function:: mark(none) Remove the mark at the current address. :param none: the python value :py:obj:`None` :type none: None .. py:function:: mark(ea) Return the mark at the specified address ``ea``. :param ea: an address within the database containing a mark :type ea: int or long .. py:function:: mark(description) Set the mark at the current address to the specified ``description``. :param description: the description to set the mark with :type description: str .. py:function:: mark(ea, none) Erase the mark at address ``ea``. :param ea: the address of an existing mark within the database :type ea: int or long :param none: the python value :py:obj:`None` :type none: None .. py:function:: mark(ea, description) Sets the mark at address ``ea`` to the specified ``description``. :param ea: the address within the database to set a mark at :type ea: int or long :param description: the address to set the mark with :type description: str .. py:function:: name(\*\*flags) Return the name at the current address. :param \*\*flags: any number of :py:obj:`idaapi.GN_\*` flags to use when fetching the name .. py:function:: name(ea, \*\*flags) Return the name defined at the address specified by ``ea``. If ``flags`` is specified, then use the specified value as the flags. :param ea: an address in the database :type ea: int or long :param \*\*flags: any number of :py:obj:`idaapi.GN_\*` flags to use when fetching the name .. py:function:: name(packed, \*\*flags) Renames the current address to the given ``packed`` name. :param packed: a tuple of integers or strings to use for the name :type packed: tuple :param \*\*flags: any number of :py:obj:`idaapi.SN_\*` flags to use when setting the name .. py:function:: name(string, \*suffix, \*\*flags) Renames the current address to ``string``. :param string: a string to use as the name :type string: str :param \*suffix: any other integers or strings to append to the name :param \*\*flags: any number of :py:obj:`idaapi.SN_\*` flags to use when setting the name .. py:function:: name(none, \*\*flags) Removes the name at the current address. :param none: the python value :py:obj:`None` :type none: None :param \*\*flags: any number of :py:obj:`idaapi.SN_\*` flags to use when setting the name .. py:function:: name(ea, packed, \*\*flags) Renames the address specifed by ``ea`` to the given ``packed`` name. :param ea: an address in the database :param packed: a tuple of integers or strings to use for the name :type packed: tuple :param \*\*flags: any number of :py:obj:`idaapi.SN_\*` flags to use when setting the name .. py:function:: name(ea, string, \*suffix, \*\*flags) Renames the address specified by ``ea`` to ``string``. If ``ea`` is pointing to a global and is not contained by a function, then by default the label will be added to the Names list. If ``flags`` is specified, then use the specified value as the flags. If the boolean ``listed`` is specified, then specify whether to add the label to the Names list or not. :param ea: an address in the database :type ea: int or long :param string: a string to use as the name :type string: str :param \*suffix: any other integers or strings to append to the name :param \*\*flags: any number of :py:obj:`idaapi.SN_\*` flags to use when setting the name .. py:function:: name(ea, none, \*\*flags) Removes the name defined at the address ``ea``. :param ea: an address in the database :type ea: int or long :param none: the python value :py:obj:`None` :type none: None :param \*\*flags: any number of :py:obj:`idaapi.SN_\*` flags to use when removing the name .. py:function:: read() Return the bytes defined at the current address. .. py:function:: read(ea) Return the number of bytes associated with the address ``ea``. :param ea: the address to read bytes from :type ea: int or long .. py:function:: read(ea, size) Return ``size`` number of bytes from address ``ea``. :param ea: the address to read bytes from :type ea: int or long :param size: the number of bytes to read :type size: int or long .. py:function:: read(bounds) Return the bytes within the specified ``bounds``. :param bounds: a tuple containing the boundaries to return the bytes from :type bounds: tuple .. py:function:: select(tag, \*And, \*\*boolean) Query all of the global tags in the database for the specified ``tag`` and any others specified as ``And``. :param tag: a required tag name to search for :type tag: str :param \*And: any other required tag names :param \*\*boolean: either ``And`` or ``Or`` which specifies required or optional tags (respectively) .. py:function:: select(\*\*boolean) Query all the global tags for any tags specified by ``boolean``. Yields each address found along with the matching tags as a dictionary. If ``And`` contains an iterable then require the returned address contains them. If ``Or`` contains an iterable then include any other tags that are specified. :param \*\*boolean: either ``And`` or ``Or`` which specifies required or optional tags (respectively) .. py:function:: selectcontents(tag, \*Or, \*\*boolean) Query all function contents for the specified ``tag`` or any others specified as ``Or``. :param tag: a required tag name to search for :type tag: str :param \*Or: any other optional tag names :param \*\*boolean: either ``And`` or ``Or`` which specifies required or optional tags (respectively) .. py:function:: selectcontents(\*\*boolean) Query all function contents for any tags specified by ``boolean``. Yields each function and the tags that match as a set. If ``And`` contains an iterable then require the returned function contains them. If ``Or`` contains an iterable then include any other tags that are specified. :param \*\*boolean: either ``And`` or ``Or`` which specifies required or optional tags (respectively) .. py:function:: tag() Return all of the tags defined at the current address. .. py:function:: tag(ea) Return all of the tags defined at address ``ea``. :param ea: an address in the database :type ea: int or long .. py:function:: tag(key) Return the tag identified by ``key`` at the current address. :param key: a string representing the tag name to return :type key: str .. py:function:: tag(key, value) Set the tag identified by ``key`` to ``value`` at the current address. :param key: a string representing the tag name to assign to :type key: str :param value: a python object to store at the tag .. py:function:: tag(ea, key) Return the tag identified by ``key`` from the address ``ea``. :param ea: an address in the database :type ea: int or long :param key: a string representing the tag name to return :type key: str .. py:function:: tag(ea, key, value) Set the tag identified by ``key`` to ``value`` at the address ``ea``. :param ea: an address in the database :type ea: int or long :param key: a string representing the tag name to assign :type key: str :param value: a python object to store at the tag .. py:function:: tag(key, none) Remove the tag identified by ``key`` from the current address. :param key: a string representing the tag name to remove :type key: str :param none: the python value :py:obj:`None` :type none: None .. py:function:: tag(ea, key, none) Removes the tag identified by ``key`` at the address ``ea``. :param ea: an address in the database :type ea: int or long :param key: a string representing the tag name to remove :type key: str :param none: the python value :py:obj:`None` :type none: None .. py:function:: tags() Return all of the tag names used globally within the database. .. py:function:: top() Return the very lowest address within the database. .. py:function:: unmangled() Return the name at the current address in its unmangled form. Aliases: :py:func:`database.unmangle`, :py:func:`database.demangled`, :py:func:`database.demangle` .. py:function:: unmangled(ea) Return the name at the address specified by ``ea`` in its unmangled form. Aliases: :py:func:`database.unmangle`, :py:func:`database.demangled`, :py:func:`database.demangle` :param ea: an address in the database containing a name :type ea: int or long .. py:function:: unmangled(string, \*suffix) Rename the current address using the mangled version of ``string`` and return its previous unmangled value. Aliases: :py:func:`database.unmangle`, :py:func:`database.demangled`, :py:func:`database.demangle` :param string: a string to use as the name :type string: str :param \*suffix: any other strings to append to the name .. py:function:: unmangled(none) Remove the name at the current address and return its previous unmangled value. Aliases: :py:func:`database.unmangle`, :py:func:`database.demangled`, :py:func:`database.demangle` :param none: the python value :py:obj:`None` :type none: None .. py:function:: unmangled(ea, string, \*suffix) Rename the address specified by ``ea`` using the mangled version of ``string`` and return its previous unmangled value. Aliases: :py:func:`database.unmangle`, :py:func:`database.demangled`, :py:func:`database.demangle` :param ea: an address in the database :type ea: int or long :param string: a string to use as the name :type string: str :param \*suffix: any other strings to append to the name .. py:function:: unmangled(ea, none) Remove the name at the address specified by ``ea`` and return its previous unmangled value. Aliases: :py:func:`database.unmangle`, :py:func:`database.demangled`, :py:func:`database.demangle` :param ea: an address in the database containing a name :type ea: int or long :param none: the python value :py:obj:`None` :type none: None .. py:function:: within() Should always return true. Aliases: :py:func:`database.contains` .. py:function:: within(ea) Return true if address ``ea`` is within the bounds of the database. Aliases: :py:func:`database.contains` :param ea: an address within the database :type ea: int or long .. py:function:: write(data, \*\*persist) Modify the database at the current address with the bytes specified in ``data``. :param data: the data to write :type data: bytes :param \*\*persist: if ``persist`` is set to true, then write to the original bytes in the database .. py:function:: write(ea, data, \*\*persist) Modify the database at address ``ea`` with the bytes specified in ``data`` If the bool ``persist`` is specified, then modify what IDA considers the original bytes. :param ea: the address to write to :type ea: int or long :param data: the data to write :type data: bytes :param \*\*persist: if ``persist`` is set to true, then write to the original bytes in the database -------------- Namespace list -------------- These are the namespaces available within this module. Namespaces group similar functions that can be used typically for the same concept. Please see :ref:`multicase-namespaces` for more information on namespaces. For more information on multicase functions or aliases, please see :ref:`multicase-functions` or :ref:`multicase-aliases`. .. _ns-database-address: **************** database.address **************** Aliases: :ref:`database.a` This namespace is used for translating an address in the database to another address according to a number of constraints or types. Essentially these functions are used to assist with navigation. As an example, these functions allow one to navigate between the next and previous "call" instructions, addresses that contain data references, or even to navigate to unknown (undefined) addresses. This namespace is also aliased as :py:obj:`database.a`. Some of the more common functions are used so often that they're also aliased as globals. Each of these can be used for navigation or for determining the next valid address. These are: - :py:obj:`database.next` - Return the "next" defined address - :py:obj:`database.prev` - Return the "previous" defined address - :py:obj:`database.nextref` - Return the "next" address with a reference. - :py:obj:`database.prevref` - Return the "previous" address with a reference - :py:obj:`database.nextreg` - Return the "next" address using a register - :py:obj:`database.prevreg` - Return the "previous" address using a register Some examples of using this namespace can be:: > ea = database.a.next(ea) > ea = database.a.prevreg(ea, 'edx', write=1) > ea = database.a.nextref(ea) > ea = database.a.prevcall(ea) .. py:function:: address() Return the current address or a list of addresses for the current selection. .. py:function:: address(ea) Return the address of the item containing the address ``ea``. :param ea: an address of an item in the database to return :type ea: int or long .. py:function:: address(start, end) Return a list containing each of the addresses from ``start`` to ``end``. :param start: the address to start at :type start: int or long :param end: the address to stop at :type end: int or long .. py:function:: address(start, end, step) Return a list containing each of the addresses from ``start`` to ``end`` using the callable ``step`` to determine the next address. :param start: the address to start at :type start: int or long :param end: the address to stop at :type end: int or long :param step: a callable that seeks to the next address such as :py:obj:`address.next` :type step: callable .. py:function:: address(bounds) Return a list containing each of the addresses within ``bounds``. :param bounds: the address boundaries to return :type bounds: tuple .. py:function:: address(bounds, step) Return a list containing each of the addresses within ``bounds`` using the callable ``step`` to determine the next address. :param bounds: the address boundaries to return :type bounds: tuple :param step: a callable that seeks to the next address such as :py:obj:`address.next` :type step: callable .. py:function:: address\.blocks() Iterate through the currently selected blocks. .. py:function:: address\.blocks(end) Yields the boundaries of each block from the current address to ``end``. :param end: the address to stop at :type end: int or long .. py:function:: address\.blocks(bounds) Yields the boundaries of each block within the specified ``bounds``. :param bounds: the boundaries of the blocks to return :type bounds: tuple .. py:function:: address\.blocks(start, end) Yields the boundaries of each block between the addresses ``start`` and ``end``. :param start: the address to start at :type start: int or long :param end: the address to stop at :type end: int or long .. py:function:: address\.bounds() Return the bounds of the current address or selection in a tuple formatted as ``(left, right)``. .. py:function:: address\.bounds(ea) Return the bounds of the specified address ``ea`` in a tuple formatted as ``(left, right)``. :param ea: the address within the database to return an :py:obj:`interface.bounds_t` from :type ea: int or long .. py:function:: address\.by_fileoffset(offset) Return the address in the database for the specified file ``offset`` of the input file. Aliases: :py:func:`database.address.byfileoffset` :param offset: the file offset to convert into a database address :type offset: int or long .. py:function:: address\.by_offset(offset) Return the specified ``offset`` translated to an address in the database. Aliases: :py:func:`database.address.byoffset`, :py:func:`database.by_offset`, :py:func:`database.byoffset` :param offset: .. py:function:: address\.fileoffset() Return the file offset in the input file for the current address. .. py:function:: address\.fileoffset(ea) Return the file offset in the input file for the address ``ea``. :param ea: an address within the database to translate to the file offset :type ea: int or long .. py:function:: address\.head() Return the address of the byte at the beginning of the current address. .. py:function:: address\.head(ea) Return the address of the byte at the beginning of the address ``ea``. :param ea: an unaligned address within the database :type ea: int or long .. py:function:: address\.iterate() Iterate through the currently selected addresses. .. py:function:: address\.iterate(end) Iterate from the current address to ``end``. :param end: the address to stop iterating at :type end: int or long .. py:function:: address\.iterate(end, step) Iterate from the current address to ``end`` using the callable ``step`` to determine the next address. :param end: the address to stop iterating at :type end: int or long :param step: a callable that seeks to the next address such as :py:obj:`address.next` :type step: callable .. py:function:: address\.iterate(start, end) Iterate from address ``start`` to ``end``. :param start: the address to start iterating at :type start: int or long :param end: the address to stop iterating at :type end: int or long .. py:function:: address\.iterate(start, end, step) Iterate from address ``start`` to ``end`` using the callable ``step`` to determine the next address. :param start: the address to start iterating at :type start: int or long :param end: the address to stop iterating at :type end: int or long :param step: a callable that seeks to the next address such as :py:obj:`address.next` :type step: callable .. py:function:: address\.iterate(bounds) Iterate through all of the addresses defined within ``bounds``. :param bounds: the address boundaries to iterate through :type bounds: tuple .. py:function:: address\.iterate(bounds, step) Iterate through all of the addresses defined within ``bounds`` using the callable ``step`` to determine the next address. :param bounds: the address boundaries to iterate through :type bounds: tuple :param step: a callable that seeks to the next address such as :py:obj:`address.next` :type step: callable .. py:function:: address\.next(\*\*count) Return the next address from the current address. Aliases: :py:func:`database.next` :param \*\*count: the number of results to skip .. py:function:: address\.next(predicate, \*\*count) Return the next address from the current address that satisfies the provided ``predicate``. Aliases: :py:func:`database.next` :param predicate: a callable to use when filtering instructions :type predicate: callable :param \*\*count: the number of results to skip .. py:function:: address\.next(ea) Return the next address from the address ``ea``. Aliases: :py:func:`database.next` :param ea: an address within the database :type ea: int or long .. py:function:: address\.next(ea, predicate) Return the next address from the address ``ea`` that satisfies the provided ``predicate``. Aliases: :py:func:`database.next` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions :type predicate: callable .. py:function:: address\.next(ea, count) Return the next ``count`` addresses from the address specified by ``ea``. Aliases: :py:func:`database.next` :param ea: an address within the database :type ea: int or long :param count: the number of results to skip :type count: int or long .. py:function:: address\.next(ea, predicate, count) Return the next ``count`` addresses from the address ``ea`` that satisfies the provided ``predicate``. Aliases: :py:func:`database.next` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions :type predicate: callable :param count: the number of results to skip :type count: int or long .. py:function:: address\.nextF(predicate, \*\*count) Return the next address from the current one that satisfies the provided ``predicate``. :param predicate: a callable to use when filtering instructions :type predicate: callable :param \*\*count: the number of results to skip .. py:function:: address\.nextF(ea, predicate, \*\*count) Return the next address from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions :type predicate: callable :param \*\*count: the number of results to skip .. py:function:: address\.nextF(ea, predicate, count) Return the next ``count`` addresses from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions :type predicate: callable :param count: the number of results to skip :type count: int or long .. py:function:: address\.nextbranch(\*\*count) Return the next branch instruction from the current one. :param \*\*count: the number of branch instructions to skip .. py:function:: address\.nextbranch(predicate, \*\*count) Return the next branch instruction that satisfies the provided ``predicate``. :param predicate: a callable to use when filtering instructions by branch :type predicate: callable :param \*\*count: the number of branch instructions to skip .. py:function:: address\.nextbranch(ea) Return the next branch instruction from the address ``ea``. :param ea: an address within the database :type ea: int or long .. py:function:: address\.nextbranch(ea, predicate, \*\*count) Return the next branch instruction from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions by branch :type predicate: callable :param \*\*count: the number of branch instructions to skip .. py:function:: address\.nextbranch(ea, count) Return the next ``count`` branch instructions from the address ``ea``. :param ea: an address within the database :type ea: int or long :param count: the number of branch instructions to skip :type count: int or long .. py:function:: address\.nextcall(\*\*count) Return the next call instruction from the current address. :param \*\*count: the number of call instructions to skip .. py:function:: address\.nextcall(predicate, \*\*count) Return the next call instruction from the current address that satisfies the provided ``predicate``. :param predicate: a callable to use when filtering instructions by call :type predicate: callable :param \*\*count: the number of call instructions to skip .. py:function:: address\.nextcall(ea) Return the next call instruction from the address ``ea``. :param ea: an address within the database :type ea: int or long .. py:function:: address\.nextcall(ea, predicate, \*\*count) Return the next call instruction from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions by call :type predicate: callable :param \*\*count: the number of call instructions to skip .. py:function:: address\.nextcall(ea, count) Return the next ``count`` call instructions from the address ``ea``. :param ea: an address within the database :type ea: int or long :param count: the number of call instructions to skip :type count: int or long .. py:function:: address\.nextcomment(\*\*repeatable) Return the next address from the current one that has any type of comment. :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.nextcomment(predicate, \*\*repeatable) Return the next address from the current one that has any type of comment and satisfies the provided ``predicate``. :param predicate: a callable to use when filtering addresses by comment :type predicate: callable :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.nextcomment(ea, \*\*repeatable) Return the next address from the address ``ea`` that has any type of comment. :param ea: an address within the database :type ea: int or long :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.nextcomment(ea, predicate, \*\*repeatable) Return the next address from the address ``ea`` that has any type of comment and satisfies the provided ``predicate``. If the bool ``repeatable`` is defined, then use it to determine whether to only track repeatable or non-repeatable comments. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering addresses by comment :type predicate: callable :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.nextcomment(ea, count, \*\*repeatable) Return the next ``count`` addresses from the address ``ea`` that has any type of comment. If the bool ``repeatable`` is defined, then use it to determine whether to only track repeatable or non-repeatable comments. :param ea: an address within the database :type ea: int or long :param count: the number of comments to skip :type count: int or long :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.nextcref(\*\*count) Return the next address from the current one that has code referencing it. Aliases: :py:func:`database.address.nextcode` :param \*\*count: the number of code references to skip .. py:function:: address\.nextcref(predicate, \*\*count) Return the next address from the current one that has code referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.nextcode` :param predicate: a callable to use when filtering code references :type predicate: callable :param \*\*count: the number of code references to skip .. py:function:: address\.nextcref(ea) Return the next address from the address ``ea`` that has code referencing it. Aliases: :py:func:`database.address.nextcode` :param ea: an address within the database :type ea: int or long .. py:function:: address\.nextcref(ea, predicate, \*\*count) Return the next address from the address ``ea`` that has code referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.nextcode` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering code references :type predicate: callable :param \*\*count: .. py:function:: address\.nextcref(ea, count) Return the next ``count`` addresses from the address ``ea`` that has code referencing it. Aliases: :py:func:`database.address.nextcode` :param ea: an address within the database :type ea: int or long :param count: the number of code references to skip :type count: int or long .. py:function:: address\.nextdref(\*\*count) Return the next address from the current one that has data referencing it. Aliases: :py:func:`database.address.nextdata` :param \*\*count: the number of data references to skip .. py:function:: address\.nextdref(predicate, \*\*count) Return the next address from the current one that has data referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.nextdata` :param predicate: a callable to use when filtering data references :type predicate: callable :param \*\*count: the number of data references to skip .. py:function:: address\.nextdref(ea) Return the next address from the address ``ea`` that has data referencing it. Aliases: :py:func:`database.address.nextdata` :param ea: an address within the database :type ea: int or long .. py:function:: address\.nextdref(ea, predicate, \*\*count) Return the next address from the address ``ea`` that has data referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.nextdata` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering data references :type predicate: callable :param \*\*count: the number of data references to skip .. py:function:: address\.nextdref(ea, count) Return the next ``count`` addresses from the address ``ea`` that has data referencing it. Aliases: :py:func:`database.address.nextdata` :param ea: an address within the database :type ea: int or long :param count: the number of data references to skip :type count: int or long .. py:function:: address\.nextfunction(\*\*count) Return the next address from the current address that is within a function. Aliases: :py:func:`database.address.nextfunc` :param \*\*count: the number of function addresses to skip .. py:function:: address\.nextfunction(ea) Return the next address from the address ``ea`` that is within a function. Aliases: :py:func:`database.address.nextfunc` :param ea: an address within the database :type ea: int or long .. py:function:: address\.nextfunction(ea, predicate, \*\*count) Return the next address from the address ``ea`` that is within a function and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.nextfunc` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering function addresses :type predicate: callable :param \*\*count: the number of function addresses to skip .. py:function:: address\.nextfunction(ea, count) Return the next ``count`` addresses from the address ``ea`` that is within a function. Aliases: :py:func:`database.address.nextfunc` :param ea: an address within the database :type ea: int or long :param count: the number of function addresses to skip :type count: int or long .. py:function:: address\.nextlabel(\*\*count) Return the address of the next label from the current address. :param \*\*count: the number of labels to skip .. py:function:: address\.nextlabel(predicate, \*\*count) Return the address of the next label from the current address that satisfies the provided ``predicate``. :param predicate: a callable to use when filtering instructions by label :type predicate: callable :param \*\*count: the number of labels to skip .. py:function:: address\.nextlabel(ea) Return the address of the next label from the address ``ea``. :param ea: an address within the database :type ea: int or long .. py:function:: address\.nextlabel(ea, predicate, \*\*count) Return the address of the next label from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions by label :type predicate: callable :param \*\*count: the number of labels to skip .. py:function:: address\.nextlabel(ea, count) Return the address of the next ``count`` labels from the address ``ea``. :param ea: an address within the database :type ea: int or long :param count: the number of labels to skip :type count: int or long .. py:function:: address\.nextmnemonic(mnemonics) Return the address of the next instruction from the current address that uses any of the specified ``mnemonics``. :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple .. py:function:: address\.nextmnemonic(mnemonics, predicate, \*\*count) Return the address of the next instruction from the current address that uses any of the specified ``mnemonics`` and satisfies the provided ``predicate``. :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple :param predicate: a callable to use when filtering instructions by mnemonic :type predicate: callable :param \*\*count: the number of instructions to skip .. py:function:: address\.nextmnemonic(mnemonics, count) Return the address of the next ``count`` instructions from the current address that uses any of the specified ``mnemonics``. :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple :param count: the number of instructions to skip :type count: int or long .. py:function:: address\.nextmnemonic(ea, mnemonics) Return the address of the next instruction from the address ``ea`` that uses any of the specified ``mnemonics``. :param ea: an address within the database :type ea: int or long :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple .. py:function:: address\.nextmnemonic(ea, mnemonics, predicate, \*\*count) Return the address of the next instruction from the address ``ea`` that uses any of the specified ``mnemonics`` and satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple :param predicate: a callable to use when filtering instructions by mnemonic :type predicate: callable :param \*\*count: the number of instructions to skip .. py:function:: address\.nextmnemonic(ea, mnemonics, count) Return the address of the next ``count`` instructions from the address ``ea`` that uses any of the specified ``mnemonics``. :param ea: an address within the database :type ea: int or long :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple :param count: the number of instructions to skip :type count: int or long .. py:function:: address\.nextref(\*\*count) Return the next address from the current one that has anything referencing it. Aliases: :py:func:`database.nextref` :param \*\*count: the number of references to skip .. py:function:: address\.nextref(predicate, \*\*count) Return the next address from the current one that has anything referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.nextref` :param predicate: a callable to use when filtering instruction references :type predicate: callable :param \*\*count: the number of references to skip .. py:function:: address\.nextref(ea) Return the next address from the address ``ea`` that has anything referencing it. Aliases: :py:func:`database.nextref` :param ea: an address within the database :type ea: int or long .. py:function:: address\.nextref(ea, predicate, \*\*count) Return the next address from the address ``ea`` that has anything referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.nextref` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instruction references :type predicate: callable :param \*\*count: the number of references to skip .. py:function:: address\.nextref(ea, count) Return the next ``count`` addresses from the address ``ea`` that has anything referencing it. Aliases: :py:func:`database.nextref` :param ea: an address within the database :type ea: int or long :param count: the number of references to skip :type count: int or long .. py:function:: address\.nextreg(reg, \*regs, \*\*modifiers) Return the next address containing an instruction that uses ``reg`` or any one of the specified ``regs``. Aliases: :py:func:`database.nextreg` :param reg: a register of some kind :type reg: str or register_t :param \*regs: any other registers to match for :param \*\*modifiers: if ``write`` or ``read`` is true, then only return addresses where the specified registers are written to or read from (respectively) .. py:function:: address\.nextreg(predicate, reg, \*regs, \*\*modifiers) Return the next address containing an instruction uses ``reg`` or any one of the specified ``regs`` and satisfies the provided ``predicate``. Aliases: :py:func:`database.nextreg` :param predicate: a callable to use when filtering instructions by register :type predicate: callable :param reg: a register of some kind :type reg: str or register_t :param \*regs: any other registers to match for :param \*\*modifiers: if ``write`` or ``read`` is true, then only return addresses where the specified registers are written to or read from (respectively) .. py:function:: address\.nextreg(ea, reg, \*regs, \*\*modifiers) Return the next address from the address ``ea`` containing an instruction that uses ``reg`` or any one of the specified ``regs``. Aliases: :py:func:`database.nextreg` :param ea: an address within the database :type ea: int or long :param reg: a register of some kind :type reg: str or register_t :param \*regs: any other registers to match for :param \*\*modifiers: if ``write`` or ``read`` is true, then only return addresses where the specified registers are written to or read from (respectively) .. py:function:: address\.nextreg(ea, predicate, reg, \*regs, \*\*modifiers) Return the next address from the address ``ea`` containing an instruction that uses ``reg`` or any one of the specified ``regs`` and satisfies the provided ``predicate``. Aliases: :py:func:`database.nextreg` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions by register :type predicate: callable :param reg: a register of some kind :type reg: str or register_t :param \*regs: any other registers to match for :param \*\*modifiers: if ``write`` or ``read`` is true, then only return addresses where the specified registers are written to or read from (respectively) .. py:function:: address\.nextstack(delta) Return the next instruction from the current one that is past the sp ``delta``. Aliases: :py:func:`database.address.nextdelta` :param delta: the stack delta to find the edge of :type delta: int or long .. py:function:: address\.nextstack(ea, delta) Return the next instruction from the address ``ea`` that is past the sp ``delta``. Aliases: :py:func:`database.address.nextdelta` :param ea: an address within the database :type ea: int or long :param delta: the stack delta to find the edge of :type delta: int or long .. py:function:: address\.nexttag(\*\*tagname) Return the next address that contains a tag using the specified ``tagname``. :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.nexttag(predicate, \*\*tagname) Return the next address that contains a tag using the specified ``tagname`` and satisfies the provided ``predicate``. :param predicate: a callable to use when filtering addresses by tag :type predicate: callable :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.nexttag(ea, \*\*tagname) Return the next address from ``ea`` that contains a tag using the specified ``tagname``. Aliases: :py:func:`database.address.nextcomment` :param ea: an address within the database :type ea: int or long :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.nexttag(ea, predicate, \*\*tagname) Return the next address from ``ea`` that contains a tag using the specified ``tagname`` and satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering addresses by tag :type predicate: callable :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.nexttag(ea, count, \*\*tagname) Return the next ``count`` addresses from ``ea`` that contains a tag using the specified ``tagname``. :param ea: an address within the database :type ea: int or long :param count: the number of tags to skip :type count: int or long :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.nextunknown(\*\*count) Return the next address from the current one that is undefined. :param \*\*count: the number of unknown addresses to skip .. py:function:: address\.nextunknown(predicate, \*\*count) Return the next address from the current one that is undefined and satisfies the provided ``predicate``. :param predicate: a callable to use when filtering unknown addresses :type predicate: callable :param \*\*count: the number of unknown addresses to skip .. py:function:: address\.nextunknown(ea) Return the next address from the address ``ea`` that is undefined. :param ea: an address within the database :type ea: int or long .. py:function:: address\.nextunknown(ea, predicate, \*\*count) Return the next address from the address ``ea`` that is undefined and satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering unknown addresses :type predicate: callable :param \*\*count: the number of unknown addresses to skip .. py:function:: address\.nextunknown(ea, count) Return the next ``count`` addresses from the address ``ea`` that is undefined. :param ea: an address within the database :type ea: int or long :param count: the number of unknown addresses to skip :type count: int or long .. py:function:: address\.offset() Return the current address translated to an offset relative to the base address of the database. Aliases: :py:func:`database.get_offset`, :py:func:`database.address.getoffset`, :py:func:`database.getoffset`, :py:func:`database.offset` .. py:function:: address\.offset(ea) Return the address ``ea`` translated to an offset relative to the base address of the database. Aliases: :py:func:`database.get_offset`, :py:func:`database.address.getoffset`, :py:func:`database.getoffset`, :py:func:`database.offset` :param ea: an address within the database to translate to an offset from the beginning of the database :type ea: int or long .. py:function:: address\.prev(\*\*count) Return the previous address from the current address. Aliases: :py:func:`database.prev` :param \*\*count: the number of results to skip .. py:function:: address\.prev(predicate, \*\*count) Return the previous address from the current address that satisfies the provided ``predicate``. Aliases: :py:func:`database.prev` :param predicate: a callable to use when filtering instructions :type predicate: callable :param \*\*count: the number of results to skip .. py:function:: address\.prev(ea) Return the previous address from the address specified by ``ea``. Aliases: :py:func:`database.prev` :param ea: an unaligned address within the database :type ea: int or long .. py:function:: address\.prev(ea, predicate) Return the previous address from the address ``ea`` that satisfies the provided ``predicate``. Aliases: :py:func:`database.prev` :param ea: an unaligned address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions :type predicate: callable .. py:function:: address\.prev(ea, count) Return the previous ``count`` addresses from the address specified by ``ea``. Aliases: :py:func:`database.prev` :param ea: an unaligned address within the database :type ea: int or long :param count: the number of results to skip :type count: int or long .. py:function:: address\.prev(ea, predicate, count) Return the previous ``count`` addresses from the address ``ea`` that satisfies the provided ``predicate``. Aliases: :py:func:`database.prev` :param ea: an unaligned address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions :type predicate: callable :param count: the number of results to skip :type count: int or long .. py:function:: address\.prevF(predicate, \*\*count) Return the previous address from the current one that satisfies the provided ``predicate``. :param predicate: a callable to use when filtering instructions :type predicate: callable :param \*\*count: the number of results to skip .. py:function:: address\.prevF(ea, predicate, \*\*count) Return the previous address from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions :type predicate: callable :param \*\*count: the number of results to skip .. py:function:: address\.prevF(ea, predicate, count) Return the previous ``count`` addresses from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions :type predicate: callable :param count: the number of results to skip :type count: int or long .. py:function:: address\.prevbranch(\*\*count) Return the previous branch instruction from the current one. :param \*\*count: the number of branch instructions to skip .. py:function:: address\.prevbranch(predicate, \*\*count) Return the previous branch instruction from the current one that satisfies the provided ``predicate``. :param predicate: a callable to use when filtering instructions by branch :type predicate: callable :param \*\*count: the number of branch instructions to skip .. py:function:: address\.prevbranch(ea) Return the previous branch instruction from the address ``ea``. :param ea: an address within the database :type ea: int or long .. py:function:: address\.prevbranch(ea, predicate, \*\*count) Return the previous branch instruction from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions by branch :type predicate: callable :param \*\*count: the number of branch instructions to skip .. py:function:: address\.prevbranch(ea, count) Return the previous ``count`` branch instructions from the address ``ea``. :param ea: an address within the database :type ea: int or long :param count: the number of branch instructions to skip :type count: int or long .. py:function:: address\.prevcall(\*\*count) Return the previous call instruction from the current address. :param \*\*count: the number of call instructions to skip .. py:function:: address\.prevcall(predicate, \*\*count) Return the previous call instruction from the current address that satisfies the provided ``predicate``. :param predicate: a callable to use when filtering instructions by call :type predicate: callable :param \*\*count: the number of call instructions to skip .. py:function:: address\.prevcall(ea) Return the previous call instruction from the address ``ea``. :param ea: an address within the database :type ea: int or long .. py:function:: address\.prevcall(ea, predicate, \*\*count) Return the previous call instruction from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions by call :type predicate: callable :param \*\*count: the number of call instructions to skip .. py:function:: address\.prevcall(ea, count) Return the previous ``count`` call instructions from the address ``ea``. :param ea: an address within the database :type ea: int or long :param count: the number of call instructions to skip :type count: int or long .. py:function:: address\.prevcomment(\*\*repeatable) Return the previous address from the current one that has any type of comment. :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.prevcomment(predicate, \*\*repeatable) Return the previous address from the current one that has any type of comment and satisfies the provided ``predicate``. :param predicate: a callable to use when filtering addresses by comment :type predicate: callable :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.prevcomment(ea, \*\*repeatable) Return the previous address from the address ``ea`` that has any type of comment. :param ea: an address within the database :type ea: int or long :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.prevcomment(ea, predicate, \*\*repeatable) Return the previous address from the address ``ea`` that has any type of comment and satisfies the provided ``predicate``. If the bool ``repeatable`` is defined, then use it to determine whether to only track repeatable or non-repeatable comments. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering addresses by comment :type predicate: callable :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.prevcomment(ea, count, \*\*repeatable) Return the previous ``count`` addresses from the address ``ea`` that has any type of comment. If the bool ``repeatable`` is defined, then use it to determine whether to only track repeatable or non-repeatable comments. :param ea: an address within the database :type ea: int or long :param count: the number of comments to skip :type count: int or long :param \*\*repeatable: used to specify whether to filter by repeatable or non-repeatable comment .. py:function:: address\.prevcref(\*\*count) Return the previous address from the current one that has code referencing it. Aliases: :py:func:`database.address.prevcode` :param \*\*count: the number of code references to skip .. py:function:: address\.prevcref(predicate, \*\*count) Return the previous address from the current one that has code referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.prevcode` :param predicate: a callable to use when filtering data references :type predicate: callable :param \*\*count: the number of code references to skip .. py:function:: address\.prevcref(ea) Return the previous address from the address ``ea`` that has code referencing it. Aliases: :py:func:`database.address.prevcode` :param ea: an address within the database :type ea: int or long .. py:function:: address\.prevcref(ea, predicate, \*\*count) Return the previous address from the address ``ea`` that has code referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.prevcode` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering code references :type predicate: callable :param \*\*count: the number of code references to skip .. py:function:: address\.prevcref(ea, count) Return the previous ``count`` addresses from the address ``ea`` that has code referencing it. Aliases: :py:func:`database.address.prevcode` :param ea: an address within the database :type ea: int or long :param count: the number of code references to skip :type count: int or long .. py:function:: address\.prevdref(\*\*count) Return the previous address from the current one that has data referencing it. Aliases: :py:func:`database.address.prevdata` :param \*\*count: the number of data references to skip .. py:function:: address\.prevdref(predicate, \*\*count) Return the previous address from the current one that has data referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.prevdata` :param predicate: a callable to use when filtering data references :type predicate: callable :param \*\*count: the number of data references to skip .. py:function:: address\.prevdref(ea) Return the previous address from the address ``ea`` that has data referencing it. Aliases: :py:func:`database.address.prevdata` :param ea: an address within the database :type ea: int or long .. py:function:: address\.prevdref(ea, predicate, \*\*count) Return the previous address from the address ``ea`` that has data referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.prevdata` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering data references :type predicate: callable :param \*\*count: the number of data references to skip .. py:function:: address\.prevdref(ea, count) Return the previous ``count`` addresses from the address ``ea`` that has data referencing it. Aliases: :py:func:`database.address.prevdata` :param ea: an address within the database :type ea: int or long :param count: the number of data references to skip :type count: int or long .. py:function:: address\.prevfunction(\*\*count) Return the previous address from the current address that is within a function. Aliases: :py:func:`database.address.prevfunc` :param \*\*count: the number of function addresses to skip .. py:function:: address\.prevfunction(ea) Return the previous address from the address ``ea`` that is within a function. Aliases: :py:func:`database.address.prevfunc` :param ea: an address within the database :type ea: int or long .. py:function:: address\.prevfunction(ea, predicate, \*\*count) Return the previous address from the address ``ea`` that is within a function and satisfies the provided ``predicate``. Aliases: :py:func:`database.address.prevfunc` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering function addresses :type predicate: callable :param \*\*count: the number of function addresses to skip .. py:function:: address\.prevfunction(ea, count) Return the previous ``count`` addresses from the address ``ea`` that is within a function. Aliases: :py:func:`database.address.prevfunc` :param ea: an address within the database :type ea: int or long :param count: the number of function addresses to skip :type count: int or long .. py:function:: address\.prevlabel(\*\*count) Return the address of the previous label from the current address. :param \*\*count: the number of labels to skip .. py:function:: address\.prevlabel(predicate, \*\*count) Return the address of the previous label from the current address that satisfies the provided ``predicate``. :param predicate: a callable to use when filtering instructions by label :type predicate: callable :param \*\*count: the number of labels to skip .. py:function:: address\.prevlabel(ea) Return the address of the previous label from the address ``ea``. :param ea: an address within the database :type ea: int or long .. py:function:: address\.prevlabel(ea, predicate, \*\*count) Return the address of the previous label from the address ``ea`` that satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions by label :type predicate: callable :param \*\*count: the number of labels to skip .. py:function:: address\.prevlabel(ea, count) Return the address of the previous ``count`` labels from the address ``ea``. :param ea: an address within the database :type ea: int or long :param count: the number of labels to skip :type count: int or long .. py:function:: address\.prevmnemonic(mnemonics) Return the address of the previous instruction from the current address that uses any of the specified ``mnemonics``. :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple .. py:function:: address\.prevmnemonic(mnemonics, predicate, \*\*count) Return the address of the previous instruction from the current address that uses any of the specified ``mnemonics`` and satisfies the provided ``predicate``. :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple :param predicate: a callable to use when filtering instructions by mnemonic :type predicate: callable :param \*\*count: the number of instructions to skip .. py:function:: address\.prevmnemonic(mnemonics, count) Return the address of the previous ``count`` instructions from the current address that uses any of the specified ``mnemonics``. :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple :param count: the number of instructions to skip :type count: int or long .. py:function:: address\.prevmnemonic(ea, mnemonics) Return the address of the previous instruction from the address ``ea`` that uses any of the specified ``mnemonics``. :param ea: an address within the database :type ea: int or long :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple .. py:function:: address\.prevmnemonic(ea, mnemonics, predicate, \*\*count) Return the address of the previous instruction from the address ``ea`` that uses any of the specified ``mnemonics`` and satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple :param predicate: a callable to use when filtering instructions by mnemonic :type predicate: callable :param \*\*count: the number of instructions to skip .. py:function:: address\.prevmnemonic(ea, mnemonics, count) Return the address of the previous ``count`` instructions from the address ``ea`` that uses any of the specified ``mnemonics``. :param ea: an address within the database :type ea: int or long :param mnemonics: a string or iterable of strings containing a mnemonic to match an instruction against :type mnemonics: str or list or set or tuple :param count: the number of instructions to skip :type count: int or long .. py:function:: address\.prevref(\*\*count) Return the previous address from the current one that has anything referencing it. Aliases: :py:func:`database.prevref` :param \*\*count: the number of references to skip .. py:function:: address\.prevref(predicate, \*\*count) Return the previous address from the current one that has anything referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.prevref` :param predicate: a callable to use when filtering instruction references :type predicate: callable :param \*\*count: the number of references to skip .. py:function:: address\.prevref(ea) Return the previous address from the address ``ea`` that has anything referencing it. Aliases: :py:func:`database.prevref` :param ea: an address within the database :type ea: int or long .. py:function:: address\.prevref(ea, predicate, \*\*count) Return the previous address from the address ``ea`` that has anything referencing it and satisfies the provided ``predicate``. Aliases: :py:func:`database.prevref` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instruction references :type predicate: callable :param \*\*count: the number of references to skip .. py:function:: address\.prevref(ea, count) Return the previous ``count`` addresses from the address ``ea`` that has anything referencing it. Aliases: :py:func:`database.prevref` :param ea: an address within the database :type ea: int or long :param count: the number of references to skip :type count: int or long .. py:function:: address\.prevreg(reg, \*regs, \*\*modifiers) Return the previous address containing an instruction that uses ``reg`` or any one of the specified ``regs``. Aliases: :py:func:`database.prevreg` :param reg: a register of some kind :type reg: str or register_t :param \*regs: any other registers to match for :param \*\*modifiers: if ``write`` or ``read`` is true, then only return addresses where the specified registers are written to or read from (respectively) .. py:function:: address\.prevreg(predicate, reg, \*regs, \*\*modifiers) Return the previous address containing an instruction that uses ``reg`` or any one of the specified ``regs`` and satisfies the provided ``predicate``. Aliases: :py:func:`database.prevreg` :param predicate: a callable to use when filtering instructions by register :type predicate: callable :param reg: a register of some kind :type reg: str or register_t :param \*regs: any other registers to match for :param \*\*modifiers: if ``write`` or ``read`` is true, then only return addresses where the specified registers are written to or read from (respectively) .. py:function:: address\.prevreg(ea, reg, \*regs, \*\*modifiers) Return the previous address from the address ``ea`` containing an instruction that uses ``reg`` or any one of the specified ``regs``. Aliases: :py:func:`database.prevreg` :param ea: an address within the database :type ea: int or long :param reg: a register of some kind :type reg: str or register_t :param \*regs: any other registers to match for :param \*\*modifiers: if ``write`` or ``read`` is true, then only return addresses where the specified registers are written to or read from (respectively) .. py:function:: address\.prevreg(ea, predicate, reg, \*regs, \*\*modifiers) Return the previous address from the address ``ea`` containing an instruction that uses ``reg`` or any one of the specified ``regs`` and satisfies the provided ``predicate``. Aliases: :py:func:`database.prevreg` :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering instructions by register :type predicate: callable :param reg: a register of some kind :type reg: str or register_t :param \*regs: any other registers to match for :param \*\*modifiers: if ``write`` or ``read`` is true, then only return addresses where the specified registers are written to or read from (respectively) .. py:function:: address\.prevstack(delta) Return the previous instruction from the current one that is past the specified sp ``delta``. Aliases: :py:func:`database.address.prevdelta` :param delta: the stack delta to find the edge of :type delta: int or long .. py:function:: address\.prevstack(ea, delta) Return the previous instruction from the address ``ea`` that is past the specified sp ``delta``. Aliases: :py:func:`database.address.prevdelta` :param ea: an address within the database :type ea: int or long :param delta: the stack delta to find the edge of :type delta: int or long .. py:function:: address\.prevtag(\*\*tagname) Return the previous address that contains a tag using the specified ``tagname``. :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.prevtag(predicate, \*\*tagname) Return the previous address that contains a tag using the specified ``tagname`` and satisfies the provided ``predicate``. :param predicate: a callable to use when filtering addresses by tag :type predicate: callable :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.prevtag(ea, \*\*tagname) Return the previous address from ``ea`` that contains a tag using the specified ``tagname``. :param ea: an address within the database :type ea: int or long :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.prevtag(ea, predicate, \*\*tagname) Return the previous address from ``ea`` that contains a tag using the specified ``tagname`` and satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering addresses by tag :type predicate: callable :param \*\*tagname: if ``tagname`` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.prevtag(ea, count, \*\*tagname) Return the previous ``count`` addresses from ``ea`` that contains a tag using the specified ``tagname``. :param ea: an address within the database :type ea: int or long :param count: the number of tags to skip :type count: int or long :param \*\*tagname: if ``tagname`` is assigned a string, then only match against the specified tag otherwise look for any kind of comment .. py:function:: address\.prevunknown(\*\*count) Return the previous address from the current one that is undefined. :param \*\*count: the number of unknown addresses to skip .. py:function:: address\.prevunknown(predicate, \*\*count) Return the previous address from the current one that is undefined and satisfies the provided ``predicate``. :param predicate: a callable to use when filtering unknown addresses :type predicate: callable :param \*\*count: the number of unknown addresses to skip .. py:function:: address\.prevunknown(ea) Return the previous address from the address ``ea`` that is undefined. :param ea: an address within the database :type ea: int or long .. py:function:: address\.prevunknown(ea, predicate, \*\*count) Return the previous address from the address ``ea`` that is undefined and satisfies the provided ``predicate``. :param ea: an address within the database :type ea: int or long :param predicate: a callable to use when filtering unknown addresses :type predicate: callable :param \*\*count: the number of unknown addresses to skip .. py:function:: address\.prevunknown(ea, count) Return the previous ``count`` addresses from the address ``ea`` that is undefined. :param ea: an address within the database :type ea: int or long :param count: the number of unknown addresses to skip :type count: int or long .. py:function:: address\.tail() Return the last byte at the end of the current address. .. py:function:: address\.tail(ea) Return the address of the last byte at the end of the address at ``ea``. :param ea: an unaligned address within the database :type ea: int or long .. _ns-database-config: *************** database.config *************** This namespace contains various read-only properties about the database. This includes things such as the database boundaries, its filename, the path to the generated database, etc. Some tools for determining the type of the binary are also included. .. py:function:: config\.apptype() Return the application type identified by the loader when creating the database. .. py:function:: config\.apptype(apptype_t) Set the application type for the database to the specified ``apptype_t``. :param apptype_t: a string representing one of the :py:obj:`idaapi.APPT_\*` types to apply :type apptype_t: int or long .. py:function:: config\.apptype(APPT_) Set the application type for the database to the value for the string ``APPT_``. :param APPT_: an enumeration containing one of the :py:obj:`idaapi.APPT_\*` types to apply :type APPT_: str .. py:function:: config\.baseaddress() Return the baseaddress of the database. Aliases: :py:func:`database.baseaddress`, :py:func:`database.base` .. py:function:: config\.bits() Return number of bits of the processor used by the database. .. py:function:: config\.bitsize() Return the number of bits used by the database. .. py:function:: config\.bounds() Return the bounds of the current database in a tuple formatted as ``(left, right)``. Aliases: :py:func:`database.range` .. py:function:: config\.byteorder() Return a string representing the byte-order used by integers in the database. .. py:function:: config\.changes() Return the number of changes within the database. .. py:function:: config\.compiler() Return the compiler that was configured for the database. .. py:function:: config\.entry() Return the first entry point for the database. .. py:function:: config\.filename() Return the filename that the database was built from. .. py:function:: config\.filetype() Return the file type identified by the loader when creating the database. .. py:function:: config\.filetype(filetype_t) Set the file type identified by the loader to the specified ``filetype_t``. :param filetype_t: a string representing one of the :py:obj:`idaapi.FT_\*` types to apply :type filetype_t: int or long .. py:function:: config\.filetype(FT_) Set the file type identified by the loader to the value for the string ``FT_``. :param FT_: an enumeration containing one of the :py:obj:`idaapi.FT_\*` types to apply :type FT_: str .. py:function:: config\.idb() Return the full path to the database. Aliases: :py:func:`database.config.database`, :py:func:`database.idb` .. py:function:: config\.is_kernelspace() Return whether the database is using a kernelmode address space or not. Aliases: :py:func:`database.config.kernelQ`, :py:func:`database.config.kernelspaceQ` .. py:function:: config\.is_readonly() Return whether the database is read-only or not. Aliases: :py:func:`database.config.readonlyQ` .. py:function:: config\.is_sharedobject() Return whether the database is a shared-object or not. Aliases: :py:func:`database.config.sharedQ`, :py:func:`database.config.is_shared`, :py:func:`database.config.sharedobject` .. py:function:: config\.lflags() Return the value of the :py:obj:`idainfo.lflags` field from the database. .. py:function:: config\.lflags(mask) Return the value of the :py:obj:`idainfo.lflags` field from the database with the specified ``mask``. :param mask: the mask to apply to the lflags that are returned :type mask: int or long .. py:function:: config\.lflags(mask, value) Set the :py:obj:`idainfo.lflags` with the provided ``mask`` from the database to the specified ``value``. :param mask: the mask to apply to the lflags before applying the value :type mask: int or long :param value: the value to apply to the lflags :type value: int or long .. py:function:: config\.main() .. py:function:: config\.margin() Return the current margin position for the current database. .. py:function:: config\.module() Return the module name as per the windows loader. Aliases: :py:func:`database.module` .. py:function:: config\.ostype() Return the operating system type identified by the loader when creating the database. .. py:function:: config\.ostype(ostype_t) Set the operating system type for the database to the specified ``ostype_t``. :param ostype_t: a string representing one of the :py:obj:`idaapi.OSTYPE_\*` types to apply :type ostype_t: int or long .. py:function:: config\.ostype(OSTYPE_) Set the operating system type for the database to the value for the string ``OSTYPE_``. :param OSTYPE_: :type OSTYPE_: str .. py:function:: config\.path() Return the absolute path to the directory containing the database. Aliases: :py:func:`database.path` .. py:function:: config\.path(pathname, \*components) Return an absolute path composed of the provided ``pathname`` and any additional ``components`` relative to the directory containing the database. :param pathname: :type pathname: str :param \*components: .. py:function:: config\.processor() Return the name of the processor used by the database. .. py:function:: config\.size() Return the number of bytes used by the database which can be used to distinguish whether you're running 32-bit or 64-bit. .. py:function:: config\.type(typestr) Evaluates a type string and returns its size according to the compiler used by the database. :param typestr: this is a c-like type specification .. py:function:: config\.version() Return the version of the database. .. _ns-database-config-register: ^^^^^^^^^^^^^^^^^^^^^^^^ database.config.register ^^^^^^^^^^^^^^^^^^^^^^^^ This namespace returns the available register names and their sizes for the database. .. py:function:: config\.register\.codesegment() Return all of the code segment registers in the database. .. py:function:: config\.register\.datasegment() Return all of the data segment registers in the database. .. py:function:: config\.register\.names() Return all of the register names in the database. .. py:function:: config\.register\.segmentbits() Return the segment register size for the database. .. py:function:: config\.register\.segments() Return all of the segment registers in the database. .. _ns-database-entries: **************** database.entries **************** Aliases: :ref:`database.exports` This namespace can be used to enumerate all of the entry points and exports that are defined within the database By default the address of each entrypoint will be yielded. This namespace is also aliased as :py:obj:`database.exports`. When listing entry points that are matched, the following legend can be used to identify certain characteristics about them: - ``F`` - The entry point is referencing a function - ``C`` - The entry point is referencing code - ``A`` - The entry point is referencing data (address) - ``D`` - The entry point is referencing a decompiled function - ``T`` - The address of the entry point has a type applied to it - ``t`` - The address of the entry point has a guessable type - ``C`` - The address of the entry point is marked as code - ``D`` - The address of the entry point is marked as data - ``^`` - The address of the entry point is marked as unknown - ``+`` - The entry point has an implicit tag applied to it (named or typed) - ``\*`` - The entry point has an explicit tag applied to it The different types that one can match entrypoints with are the following: - ``address`` or ``ea`` - Match according to the entrypoint's address - ``name`` - Match according to the exact name - ``like`` - Filter the entrypoint names according to a glob - ``regex`` - Filter the entrypoint names according to a regular-expression - ``index`` - Match according to the entrypoint's index - ``ordinal`` - Match according to the entrypoint's ordinal - ``greater`` or ``ge`` - Filter the entrypoints for any after the specified address (inclusive) - ``gt`` - Filter the entrypoints for any after the specified address (exclusive) - ``less`` or ``le`` - Filter the entrypoints for any before the specified address (inclusive) - ``lt`` - Filter the entrypoints for any before the specified address (exclusive) - ``function`` - Filter the entrypoints for any that are referencing a function - ``typed`` - Filter the entrypoints for any that have type information applied to them - ``tagged`` - Filter the entrypoints for any that use the specified tag(s) - ``predicate`` - Filter the entrypoints by passing its index (ordinal) to a callable Some examples of using these keywords are as follows:: > database.entries.list(greater=h()) > iterable = database.entries.iterate(like='Nt*') > result = database.entries.search(index=0) .. py:function:: entries() Yield the address of each entry point defined within the database. .. py:function:: entries\.iterate(string) Iterate through all of the entry points in the database with a glob that matches ``string``. :param string: the glob to use when filtering the available entry points :type string: str .. py:function:: entries\.iterate(\*\*type) Iterate through all of the entry points in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the available entry points .. py:function:: entries\.list(string) List all of the entry points matching the glob ``string`` against the name. :param string: the glob to use when filtering the available entry points :type string: str .. py:function:: entries\.list(\*\*type) List all of the entry points in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the available entry points .. py:function:: entries\.name() Return the name of the entry point at the current address. .. py:function:: entries\.name(ea) Return the name of the entry point at the address ``ea``. :param ea: an address of an entry point in the database :type ea: int or long .. py:function:: entries\.new() Makes an entry point at the current address. .. py:function:: entries\.new(ea) Makes an entry point at the specified address ``ea``. :param ea: an address in the database :type ea: int or long .. py:function:: entries\.new(name) Adds the current address as an entry point using ``name`` and the next available index as the ordinal. :param name: the name of the entry point :type name: str .. py:function:: entries\.new(ea, name) Makes the specified address ``ea`` an entry point having the specified ``name``. :param ea: an address in the database :type ea: int or long :param name: the name of the entry point :type name: str .. py:function:: entries\.new(name, ordinal) Adds an entry point with the specified ``name`` to the database using ``ordinal`` as its index. :param name: the name of the entry point :type name: str :param ordinal: the ordinal index for the entry point :type ordinal: int or long .. py:function:: entries\.new(ea, name, ordinal) Adds an entry point at ``ea`` with the specified ``name`` and ``ordinal``. :param ea: an address in the database :type ea: int or long :param name: the name of the entry point :type name: str :param ordinal: the ordinal index for the entry point :type ordinal: int or long .. py:function:: entries\.ordinal() Return the ordinal of the entry point at the current address. .. py:function:: entries\.ordinal(ea) Return the ordinal of the entry point at the address ``ea``. :param ea: an address of an entry point in the database :type ea: int or long .. py:function:: entries\.search(string) Search through all of the entry point names matching the glob ``string`` and return the first result. :param string: the glob to use when filtering the available entry points :type string: str .. py:function:: entries\.search(\*\*type) Search through all of the entry points within the database and return the first result matching the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the available entry points .. _ns-database-extra: ************** database.extra ************** Aliases: :ref:`database.ex` This namespace is for interacting with IDA's "extra" comments that can be associated with an address. This allows one to prefix or suffix an address with a large block of text simulating a multilined or paragraph comment. To add extra comments, one can do this like:: > res = database.ex.prefix(ea, 'this\nis\na\nmultilined\ncomment') > res = database.ex.suffix(ea, "whee\nok...i'm over it.") > database.ex.insert(ea, 1) > database.extra.append(ea, 2) .. py:function:: extra\.has_prefix() Return true if there are any extra comments that prefix the item at the current address. Aliases: :py:func:`database.extra.prefixQ` .. py:function:: extra\.has_prefix(ea) Return true if there are any extra comments that prefix the item at the address ``ea``. Aliases: :py:func:`database.extra.prefixQ` :param ea: the address to check for the existence of a prefix comment :type ea: int or long .. py:function:: extra\.has_suffix() Return true if there are any extra comments that suffix the item at the current address. Aliases: :py:func:`database.extra.suffixQ` .. py:function:: extra\.has_suffix(ea) Return true if there are any extra comments that suffix the item at the address ``ea``. Aliases: :py:func:`database.extra.suffixQ` :param ea: the address to check for the existence of a suffix comment :type ea: int or long .. py:function:: extra\.postappend(ea, count) Append ``count`` lines after the item at address ``ea``. :param ea: the address of the suffix to append lines into :type ea: int or long :param count: the number of lines to append :type count: int or long .. py:function:: extra\.postappend(count) Append ``count`` lines after the item at the current address. :param count: the number of lines to append :type count: int or long .. py:function:: extra\.postinsert(ea, count) Insert ``count`` lines after the item at address ``ea``. :param ea: the address of the suffix to insert lines into :type ea: int or long :param count: the number of lines to insert :type count: int or long .. py:function:: extra\.postinsert(count) Insert ``count`` lines after the item at the current address. :param count: the number of lines to insert :type count: int or long .. py:function:: extra\.preappend(ea, count) Append ``count`` lines in front of the item at address ``ea``. Aliases: :py:func:`database.extra.append` :param ea: the address of the prefix to append newlines into :type ea: int or long :param count: the number of lines to append :type count: int or long .. py:function:: extra\.preappend(count) Append ``count`` lines in front of the item at the current address. Aliases: :py:func:`database.extra.append` :param count: the number of lines to append :type count: int or long .. py:function:: extra\.prefix() Return the prefixed comment at the current address. .. py:function:: extra\.prefix(string) Set the prefixed comment at the current address to the specified ``string``. :param string: the comment to insert :type string: str .. py:function:: extra\.prefix(none) Delete the prefixed comment at the current address. :param none: the python value :py:obj:`None` :type none: None .. py:function:: extra\.prefix(ea) Return the prefixed comment at address ``ea``. :param ea: the address containing the prefix comment to return :type ea: int or long .. py:function:: extra\.prefix(ea, string) Set the prefixed comment at address ``ea`` to the specified ``string``. :param ea: the address to modify the prefix comment of :type ea: int or long :param string: the comment to insert :type string: str .. py:function:: extra\.prefix(ea, none) Delete the prefixed comment at address ``ea``. :param ea: the address containing the prefix comment to remove :type ea: int or long :param none: the python value :py:obj:`None` :type none: None .. py:function:: extra\.preinsert(ea, count) Insert ``count`` lines in front of the item at address ``ea``. Aliases: :py:func:`database.extra.insert` :param ea: the address of the prefix to insert lines into :type ea: int or long :param count: the number of lines to insert :type count: int or long .. py:function:: extra\.preinsert(count) Insert ``count`` lines in front of the item at the current address. Aliases: :py:func:`database.extra.insert` :param count: the number of lines to insert :type count: int or long .. py:function:: extra\.suffix() Return the suffixed comment at the current address. .. py:function:: extra\.suffix(string) Set the suffixed comment at the current address to the specified ``string``. :param string: the comment to append :type string: str .. py:function:: extra\.suffix(none) Delete the suffixed comment at the current address. :param none: the python value :py:obj:`None` :type none: None .. py:function:: extra\.suffix(ea) Return the suffixed comment at address ``ea``. :param ea: the address containing the suffix comment to return :type ea: int or long .. py:function:: extra\.suffix(ea, string) Set the suffixed comment at address ``ea`` to the specified ``string``. :param ea: the address to modify the suffix comment of :type ea: int or long :param string: the comment to append :type string: str .. py:function:: extra\.suffix(ea, none) Delete the suffixed comment at address ``ea``. :param ea: the address containing the suffix comment to remove :type ea: int or long :param none: the python value :py:obj:`None` :type none: None .. _ns-database-functions: ****************** database.functions ****************** This namespace is used for listing all the functions inside the database. By default a list is returned containing the address of each function. When listing functions that are matched, the following legend can be used to identify certain characteristics about them: - ``+`` - The function has an implicit tag (named or typed) - ``\*`` - The function has been explicitly tagged - ``J`` - The function is a wrapper or a thunk - ``L`` - The function was pattern matched as a library - ``S`` - The function is declared statically - ``^`` - The function does not contain a frame - ``?`` - The function has its stack points calculated incorrectly and may be incorrect - ``T`` - The function has a prototype that was applied to it manually or via decompilation - ``t`` - The function has a prototype that was guessed - ``D`` - The function has been previously decompiled The different types that one can match functions with are the following: - ``address`` or ``ea`` - Match according to the function's address - ``name`` - Match according to the exact name - ``like`` - Filter the function names according to a glob - ``regex`` - Filter the function names according to a regular-expression - ``typed`` - Filter the functions for any that have type information applied to them - ``decompiled`` - Filter the functions for any that have been decompiled - ``frame`` - Filter the functions for any that contain a frame - ``problems`` - Filter the functions for any that contain problems with their stack - ``library`` - Filter the functions that any which were detected as a library function - ``wrapper`` - Filter the functions that are flagged as wrappers (thunks) - ``exceptions`` Filter the functions for any that either handles an exception or sets up a handler - ``tagged`` - Filter the functions for any that use the specified tag(s) - ``predicate`` - Filter the functions by passing their :py:obj:`idaapi.func_t` to a callable Some examples of how to use these keywords are as follows:: > for ea in database.functions(): ... > database.functions.list('*sub*') > iterable = database.functions.iterate(regex='.*alloc') > result = database.functions.search(like='*alloc*') .. py:function:: functions() Return a list of all of the functions in the current database. .. py:function:: functions\.iterate(string) Iterate through all of the functions in the database with a glob that matches ``string``. :param string: the glob to filter the function names with :type string: str .. py:function:: functions\.iterate(\*\*type) Iterate through all of the functions in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter functions with .. py:function:: functions\.list(string) List all of the functions in the database with a glob that matches ``string``. :param string: the glob to filter the function names with :type string: str .. py:function:: functions\.list(\*\*type) List all of the functions in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the functions with .. py:function:: functions\.search(string) Search through all of the functions matching the glob ``string`` and return the first result. :param string: the glob to filter the function names with :type string: str .. py:function:: functions\.search(\*\*type) Search through all of the functions within the database and return the first result matching the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the functions with .. _ns-database-get: ************ database.get ************ This namespace used to fetch and decode the data from the database at a given address. This allows one to interpret the semantics of parts of the database and then perform an action based on what was decoded. This includes standard functions for reading integers of different sizes, decoding structures, and even reading of arrays from the database. In order to decode various things out of the database, some of the following examples can be used:: > res = database.get.signed() > res = database.get.unsigned(ea, 8, byteorder='big') > res = database.get.array(ea) > res = database.get.array(length=42) > res = database.get.structure(ea) > res = database.get.structure(ea, structure=structure.by('mystructure')) .. py:function:: get\.array(\*\*length) Return the values of the array at the current address. :param \*\*length: if ``length`` is specified, then use it as the length of the array instead of determining it automatically .. py:function:: get\.array(bounds) Return the values within the provided ``bounds`` as an array. :param bounds: a tuple containing the boundaries of the array to return :type bounds: tuple .. py:function:: get\.array(bounds, type) Return the values within the provided ``bounds`` as an array of the pythonic element ``type``. :param bounds: a tuple containing the boundaries of the array to return :type bounds: tuple :param type: the pythonic type to use for each element .. py:function:: get\.array(ea, \*\*length) Return the values of the array at the address specified by ``ea``. If the integer ``length`` is defined, then use it as the number of elements for the array. If a pythonic type is passed to ``type``, then use it for the element type of the array when decoding. :param ea: the address of an array within the database :type ea: int or long :param \*\*length: if ``length`` is specified, then use it as the length of the array instead of determining it automatically .. py:function:: get\.info() Return the type information for the current address as an :py:obj:`idaapi.tinfo_t`. Aliases: :py:func:`database.get.typeinfo` .. py:function:: get\.info(ea) Return the type information for the address ``ea`` as an :py:obj:`idaapi.tinfo_t`. Aliases: :py:func:`database.get.typeinfo` :param ea: an address within the database :type ea: int or long .. py:function:: get\.signed(\*\*byteorder) Read a signed integer from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.signed(ea, \*\*byteorder) Read a signed integer from the address ``ea`` using the size defined in the database. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.signed(ea, size, \*\*byteorder) Read a signed integer from the address ``ea`` with the specified ``size``. If ``byteorder`` is 'big' then read in big-endian form. If ``byteorder`` is 'little' then read in little-endian form. The default value of ``byteorder`` is the same as specified by the database architecture. :param ea: an address within the database :type ea: int or long :param size: the size of the integer to return in bytes :type size: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.string(\*\*length) Return the array at the current address as a string. :param \*\*length: an integer specifying the :py:obj:`length` to use for the string or a :py:obj:`strtype` describing the type of the string .. py:function:: get\.string(bounds, \*\*length) Return the array described by the specified ``bounds`` as a string. :param bounds: the boundaries of the string to return :type bounds: tuple :param \*\*length: an integer specifying the :py:obj:`length` to use for the string or a :py:obj:`strtype` describing the type of the string .. py:function:: get\.string(ea, \*\*length) Return the array at the address specified by ``ea`` as a string. If an integer ``length`` is provided, then use it explicitly as the string's length when reading. If an integer ``strtype`` is provided, then use it as the string's character width when reading. If a tuple ``strtype`` is specified, then the first item is the character width and the second is the size of the length prefix when reading. :param ea: the address of the string to return :type ea: int or long :param \*\*length: an integer specifying the :py:obj:`length` to use for the string or a :py:obj:`strtype` describing the type of the string .. py:function:: get\.structure() Return a dictionary of ctypes for the :py:obj:`structure_t` that is applied to the current address. Aliases: :py:func:`database.get.struct`, :py:func:`database.get.struc` .. py:function:: get\.structure(ea) Return a dictionary of ctypes for the :py:obj:`structure_t` that is applied to the address ``ea``. Aliases: :py:func:`database.get.struct`, :py:func:`database.get.struc` :param ea: the address of a structure within the database :type ea: int or long .. py:function:: get\.structure(ea, sptr) Return a dictionary of ctypes for the :py:obj:`structure_t` identified by ``sptr`` at the address ``ea``. Aliases: :py:func:`database.get.struct`, :py:func:`database.get.struc` :param ea: the address within the database :type ea: int or long :param sptr: an :py:obj:`idaapi.struc_t` of the structure to decode from the specified address :type sptr: idaapi.struc_t .. py:function:: get\.structure(ea, name) Return a dictionary of ctypes for the :py:obj:`structure_t` with the specified ``name`` at the address ``ea``. Aliases: :py:func:`database.get.struct`, :py:func:`database.get.struc` :param ea: the address within the database :type ea: int or long :param name: the name of the structure to decode from the specified address :type name: str .. py:function:: get\.structure(ea, type) Return a dictionary of ctypes for the :py:obj:`structure_t` specified by ``type`` at the address ``ea``. Aliases: :py:func:`database.get.struct`, :py:func:`database.get.struc` :param ea: the address within the database :type ea: int or long :param type: the :py:obj:`structure_t` to decode from the specified address :type type: structure_t .. py:function:: get\.structure(ea, identifier) Return a dictionary of ctypes for the :py:obj:`structure_t` with the specified ``identifier`` at the address ``ea``. Aliases: :py:func:`database.get.struct`, :py:func:`database.get.struc` :param ea: the address within the database :type ea: int or long :param identifier: the identifier of the structure to decode from the specified address :type identifier: int or long .. py:function:: get\.unsigned(\*\*byteorder) Read an unsigned integer from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.unsigned(ea, \*\*byteorder) Read an unsigned integer from the address ``ea`` using the size defined in the database. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.unsigned(ea, size, \*\*byteorder) Read an unsigned integer from the address ``ea`` with the specified ``size``. If ``byteorder`` is 'big' then read in big-endian form. If ``byteorder`` is 'little' then read in little-endian form. The default value of ``byteorder`` is the same as specified by the database architecture. :param ea: an address within the database :type ea: int or long :param size: the size of the integer to return in bytes :type size: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. _ns-database-get-float: ^^^^^^^^^^^^^^^^^^ database.get.float ^^^^^^^^^^^^^^^^^^ Aliases: :ref:`database.get.f` This namespace contains a number of functions for fetching floating point numbers out of the database. These floating-point numbers are encoded according to the IEEE-754 specification. This namespace is also aliased as :py:obj:`database.get.f` and can be used as in the following examples:: > res = database.get.f.half() > res = database.get.f.single(ea) > res = database.get.f.double(ea) If one needs to describe a non-standard encoding for a floating-point number, one can use the :py:obj:`database.float` function. This function takes a tuple representing the number of bits for the different components of a floating-point number. This can be used as in the following for reading a floating-point "half" from the database:: > res = database.get.float(components=(10, 5, 1)) This specifies 10-bits for the mantissa, 5 for the exponent, and 1 bit for the signed flag. This allows one to specify arbitrary encodings for different floating-point numbers. .. py:function:: get\.float(\*\*byteorder) Read a floating-number from the current address using the number type that matches its size. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float(ea, \*\*byteorder) Read a floating-number at the address ``ea`` using the number type that matches its size. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float(components, \*\*byteorder) Read a floating-point number at the current address encoded with the specified ``components``. :param components: a tuple describing the component sizes for decoding the floating-point number :type components: tuple :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float(ea, components, \*\*byteorder) Read a floating-point number at the address ``ea`` that is encoded with the specified ``components``. The ``components`` parameter is a tuple (mantissa, exponent, sign) representing the number of bits for each component of the floating-point number. If ``byteorder`` is 'big' then read in big-endian form. If ``byteorder`` is 'little' then read in little-endian form. The default value of ``byteorder`` is the same as specified by the database architecture. :param ea: an address within the database :type ea: int or long :param components: a tuple describing the component sizes for decoding the floating-point number :type components: tuple :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float\.double(\*\*byteorder) Read a double from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float\.double(ea, \*\*byteorder) Read a double from the address ``ea``. :param ea: an address within the database :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float\.half(\*\*byteorder) Read a half from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float\.half(ea, \*\*byteorder) Read a half from the address ``ea``. :param ea: an address within the database :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float\.single(\*\*byteorder) Read a single from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. py:function:: get\.float\.single(ea, \*\*byteorder) Read a single from the address ``ea``. :param ea: an address within the database :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the floating-point number .. _ns-database-get-integer: ^^^^^^^^^^^^^^^^^^^^ database.get.integer ^^^^^^^^^^^^^^^^^^^^ Aliases: :ref:`database.get.i` This namespace contains the different ISO standard integer types that can be used to read integers out of the database. This namespace is also aliased as :py:obj:`database.get.i` and can be used like in the following examples:: > res = database.get.i.uint32_t() > res = database.get.i.sint64_t(ea) > res = database.get.i.uint8_t(ea) .. py:function:: get\.integer(\*\*byteorder) Read an integer from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer(ea, \*\*byteorder) Read an integer from the address ``ea``. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer(ea, size, \*\*byteorder) Read an integer of the specified ``size`` from the address ``ea``. :param ea: an address within the database :type ea: int or long :param size: the size of the integer to return in bytes :type size: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint128_t(\*\*byteorder) Read a sint128_t from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint128_t(ea, \*\*byteorder) Read a sint128_t from the address ``ea``. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint16_t(\*\*byteorder) Read a sint16_t from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint16_t(ea, \*\*byteorder) Read a sint16_t from the address ``ea``. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint32_t(\*\*byteorder) Read a sint32_t from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint32_t(ea, \*\*byteorder) Read a sint32_t from the address ``ea``. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint64_t(\*\*byteorder) Read a sint64_t from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint64_t(ea, \*\*byteorder) Read a sint64_t from the address ``ea``. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint8_t(\*\*byteorder) Read a sint8_t from the current address. :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.sint8_t(ea, \*\*byteorder) Read a sint8_t from the address ``ea``. :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint128_t(\*\*byteorder) Read a uint128_t from the current address. Aliases: :py:func:`database.get.integer.oword` :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint128_t(ea, \*\*byteorder) Read a uint128_t from the address ``ea``. Aliases: :py:func:`database.get.integer.oword` :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint16_t(\*\*byteorder) Read a uint16_t from the current address. Aliases: :py:func:`database.get.integer.word` :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint16_t(ea, \*\*byteorder) Read a uint16_t from the address ``ea``. Aliases: :py:func:`database.get.integer.word` :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint32_t(\*\*byteorder) Read a uint32_t from the current address. Aliases: :py:func:`database.get.integer.dword` :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint32_t(ea, \*\*byteorder) Read a uint32_t from the address ``ea``. Aliases: :py:func:`database.get.integer.dword` :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint64_t(\*\*byteorder) Read a uint64_t from the current address. Aliases: :py:func:`database.get.integer.qword` :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint64_t(ea, \*\*byteorder) Read a uint64_t from the address ``ea``. Aliases: :py:func:`database.get.integer.qword` :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint8_t(\*\*byteorder) Read a uint8_t from the current address. Aliases: :py:func:`database.get.integer.byte` :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. py:function:: get\.integer\.uint8_t(ea, \*\*byteorder) Read a uint8_t from the address ``ea``. Aliases: :py:func:`database.get.integer.byte` :param ea: an address within the database :type ea: int or long :param \*\*byteorder: if ``byteorder`` is provided, use it to determine the byteorder of the integer .. _ns-database-get-switch: ^^^^^^^^^^^^^^^^^^^ database.get.switch ^^^^^^^^^^^^^^^^^^^ Function for fetching an instance of a :py:obj:`switch_t` from a given address. Despite this being a namespace, by default it is intended to be used as a function against any known component of a switch. It will then return a class that allows one to query the different attributes of an :py:obj:`idaapi.switch_info_t`. This namespace can be used as in the following example:: > sw = database.get.switch(ea) > print( sw ) .. py:function:: get\.switch() Return the switch that is referenced at the current address. .. py:function:: get\.switch(ea) Return the switch that is referenced by the address at ``ea``. :param ea: the address of a switch within the database :type ea: int or long .. _ns-database-imports: **************** database.imports **************** This namespace is used for listing all of the imports within the database. Each import is represented by an address along with any naming information that is required to dynamically link external symbols with the binary. By default a tuple is yielded for each import with the format ``(address, (shared-object, name, hint))``. In this tuple, ``shared-object`` represents the name of the shared object the import is imported from. The ``name`` is the symbol name to link with, and ``hint`` is the import ordinal hint which is used to speed up the linking process. When listing the imports that are matched, the following legend can be used to identify certain characteristics about them: - ``T`` - The import has a type that was explicitly applied - ``t`` - The import has a type that was guessted - ``H`` - The import contains an ordinal number as a hint - ``+`` - The import has an implicit tag applied to it (named or typed) - ``\*`` - The import has an explicit tag applied to it The different types that one can match imports with are the following: - ``address`` or ``ea`` - Match according to the import's address - ``name`` - Match according to the import's symbol name - ``module`` - Filter the imports according to the specified module name - ``fullname`` - Match according to the full symbol name (module + symbol) - ``like`` - Filter the symbol names of all the imports according to a glob - ``regex`` - Filter the symbol names of all the imports according to a regular-expression - ``ordinal`` - Match according to the import's hint (ordinal) - ``index`` - Match according index of the import - ``typed`` - Filter all of the imports based on whether they have a type applied to them - ``tagged`` - Filter the imports for any that use the specified tag(s) - ``predicate`` Filter the imports by passing the above (default) tuple to a callable Some examples of using these keywords are as follows:: > database.imports.list(module='kernelbase.dll') > iterable = database.imports.iterate(like='*alloc*') > result = database.imports.search(index=42) .. py:function:: imports() .. py:function:: imports\.at() Return the import at the current address. .. py:function:: imports\.at(ea) Return the import at the address ``ea``. :param ea: the address of an import within the database :type ea: int or long .. py:function:: imports\.fullname() Return the full name of the import at the current address. .. py:function:: imports\.fullname(ea) Return the full name of the import at address ``ea``. :param ea: the address of an import within the database .. py:function:: imports\.iterate(string) Iterate through all of the imports in the database with a glob that matches ``string``. :param string: the glob to use when filtering the available imports :type string: str .. py:function:: imports\.iterate(\*\*type) Iterate through all of the imports in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the available imports .. py:function:: imports\.list(string) List all of the imports matching the glob ``string`` against the fullname. :param string: the glob to use when filtering the available imports :type string: str .. py:function:: imports\.list(\*\*type) List all of the imports in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the available imports .. py:function:: imports\.module() Return the import module at the current address. .. py:function:: imports\.module(ea) Return the import module at the specified address ``ea``. :param ea: the address of an import within the database :type ea: int or long .. py:function:: imports\.modules() Return all of the import modules defined in the database. .. py:function:: imports\.name() Return the name of the import at the current address. .. py:function:: imports\.name(ea) Return the name of the import at address ``ea``. :param ea: the address of an import within the database .. py:function:: imports\.ordinal() Return the ordinal of the import at the current address. .. py:function:: imports\.ordinal(ea) Return the ordinal of the import at the address ``ea``. :param ea: the address of an import within the database .. py:function:: imports\.search(string) Search through all of the imports matching the fullname glob ``string``. :param string: the glob to use when filtering the available imports :type string: str .. py:function:: imports\.search(\*\*type) Search through all of the imports within the database and return the first result matching the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the available imports .. _ns-database-marks: ************** database.marks ************** This namespace is for interacting with the marks table within the database. By default, this namespace is capable of yielding the ``(address, description)`` of each mark within the database. This allows one to manage the marks. Although it is suggested to utilize "tags" as they provide significantly more flexibility. Using marks allows for one to use IDA's mark window for quick navigation to a mark. The functions in this namespace can be used like:: > for ea, descr in database.marks(): ... > database.marks.new('this is my description') > database.marks.remove(ea) > ea, descr = database.marks.by(ea) .. py:function:: marks() Yields each of the marked positions within the database. .. py:function:: marks\.by_address() Return the mark at the current address. Aliases: :py:func:`database.marks.by` .. py:function:: marks\.by_address(ea) Return the ``(address, description)`` of the mark at the given address ``ea``. Aliases: :py:func:`database.marks.by` :param ea: the address of a mark within the database :type ea: int or long .. py:function:: marks\.by_index(index) Return the ``(address, description)`` of the mark at the specified ``index`` in the mark list. Aliases: :py:func:`database.marks.byIndex` :param index: the index of a mark .. py:function:: marks\.iterate() Iterate through all of the marks in the database. .. py:function:: marks\.length() Return the number of marks in the database. .. py:function:: marks\.new(description) Create a mark at the current address with the given ``description``. :param description: the description associated with the mark :type description: str .. py:function:: marks\.new(ea, description, \*\*extra) Create a mark at the address ``ea`` with the given ``description`` and return its index. :param ea: the address within the database to set the mark at :type ea: int or long :param description: the description associated with the mark :type description: str :param \*\*extra: allows you to assign the ``x``, ``y``, or ``lnnum`` fields of the mark .. py:function:: marks\.remove() Remove the mark at the current address. .. py:function:: marks\.remove(ea) Remove the mark at the specified address ``ea`` returning the previous description. :param ea: the address within the database containing a mark :type ea: int or long .. _ns-database-names: ************** database.names ************** This namespace is used for listing all of the names (symbols) within the database. By default the ``(address, name)`` is yielded in its mangled form. When listing names that are matched, the following legend can be used to identify certain characteristics about the address of the returned name: - ``I`` - The symbol is residing in an import segment - ``C`` - The address of the symbol is marked as code - ``D`` - The address of the symbol is marked as data - ``^`` - The address of the symbol is is initialized - ``+`` - The symbol has an implicit tag applied to it (named or typed) - ``\*`` - The symbol has an explicit tag applied to it The available types that one can filter the symbols with are as follows: - ``address`` - Match according to the address of the symbol - ``name`` - Match according to the name of the unmangled symbol - ``unmangled`` - Filter the unmangled symbol names according to a regular-expression - ``like`` - Filter the symbol names according to a glob - ``regex`` - Filter the symbol names according to a regular-expression - ``index`` - Match the symbol according to its index - ``function`` - Filter the symbol names for any that are referring to a function - ``imports`` - Filter the symbol names for any that are imports - ``typed`` - Filter the symbol names for any that have type information applied to them - ``tagged`` - Filter the symbol names for any that use the specified tag(s) - ``predicate`` - Filter the symbols by passing their address to a callable Some examples of using these keywords are as follows:: > list(database.names()) > database.names.list(index=31) > iterable = database.names.iterate(like='str.*') > result = database.names.search(name='some_really_sick_symbol_name') .. py:function:: names() Iterate through all of the names in the database yielding a tuple of the address and its name. .. py:function:: names\.address(index) Return the address of the symbol at ``index``. :param index: the index of the symbol in the names list .. py:function:: names\.at() Return the index, symbol address, and name at the current address. .. py:function:: names\.at(ea) Return the index, symbol address, and name at the address ``ea``. :param ea: the address of a symbol :type ea: int or long .. py:function:: names\.iterate(string) Iterate through all of the names in the database with a glob that matches ``string``. :param string: the glob to filter the symbol names with :type string: str .. py:function:: names\.iterate(\*\*type) Iterate through all of the names in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter symbols with .. py:function:: names\.list(string) List all of the names in the database with a glob that matches ``string``. :param string: the glob to filter the symbol names with :type string: str .. py:function:: names\.list(\*\*type) List all of the names in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter symbols with .. py:function:: names\.search(string) Search through all of the names matching the glob ``string`` and return the first result. :param string: the glob to filter the symbol names with :type string: str .. py:function:: names\.search(\*\*type) Search through all of the names within the database and return the first result matching the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter symbols with .. py:function:: names\.symbol() Return the symbol name of the current address. Aliases: :py:func:`database.names.name` .. py:function:: names\.symbol(ea) Return the symbol name of the address ``ea``. Aliases: :py:func:`database.names.name` :param ea: the address of a symbol :type ea: int or long .. _ns-database-search: *************** database.search *************** This namespace used for searching the database using IDA's find functionality. By default the name is used, however there are 4 search methods that are available. The methods that are provided are: - :py:obj:`search.by_bytes` - Search by the specified hex bytes - :py:obj:`search.by_regex` - Search by the specified regex - :py:obj:`search.by_text` - Search by the specified text - :py:obj:`search.by_name` - Search by the specified name Each search method has its own options, but all of them take an extra boolean option, ``reverse``, which specifies whether to search backwards from the starting position or forwards. The :py:obj:`search.iterate` function allows one to iterate through all the results discovered in the database. One variation of :py:obj:`search.iterate` takes a 3rd parameter ``predicate``. This allows usage of one of the search methods provided or to allow a user to include their own. This function will then yield each matched search result. .. py:function:: search(pattern, \*\*direction) Search through the database at the current address for the specified ``pattern``. :param pattern: the bytes or pattern to search for :param \*\*direction: if ``reverse`` is specified as true then search backwards .. py:function:: search(ea, pattern, \*\*direction) Search through the database at address ``ea`` for the specified ``pattern``.''' If ``reverse`` is specified as a bool, then search backwards from the given address. If ``radix`` is specified, then use it as the numerical radix for describing the bytes. If ``radix`` is not specified, then assume that ``data`` represents the exact bytes to search. :param ea: the starting address to search from :type ea: int or long :param pattern: the bytes or pattern to search for :param \*\*direction: if ``reverse`` is specified as true then search backwards .. py:function:: search\.by_bytes(data, \*\*direction) Search through the database at the current address for the bytes specified by ``data``. Aliases: :py:func:`database.search.bybytes` :param data: the bytes or pattern to search for :param \*\*direction: if ``reverse`` is specified as true then search backwards .. py:function:: search\.by_bytes(ea, data, \*\*direction) Search through the database at address ``ea`` for the bytes specified by ``data``. If ``reverse`` is specified as a bool, then search backwards from the given address. If ``radix`` is specified, then use it as the numerical radix for describing the bytes. If ``radix`` is not specified, then assume that ``data`` represents the exact bytes to search. Aliases: :py:func:`database.search.bybytes` :param ea: the starting address to search from :type ea: int or long :param data: the bytes or pattern to search for :param \*\*direction: if ``reverse`` is specified as true then search backwards .. py:function:: search\.by_name(\*\*options) Search through the database at the current address for the symbol ``name``. Aliases: :py:func:`database.by_name`, :py:func:`database.search.byname`, :py:func:`database.byname` :param \*\*options: if ``reverse`` is specified as true then search backwards. if ``sensitive`` is true, then search with regards to the case. .. py:function:: search\.by_name(name, \*\*options) Search through the database at address ``ea`` for the symbol ``name``. If ``reverse`` is specified as a bool, then search backwards from the given address. If ``sensitive`` is specified as bool, then perform a case-sensitive search. Aliases: :py:func:`database.by_name`, :py:func:`database.search.byname`, :py:func:`database.byname` :param name: the identifier to search for :type name: str :param \*\*options: if ``reverse`` is specified as true then search backwards. if ``sensitive`` is true, then search with regards to the case. .. py:function:: search\.by_regex(\*\*options) Search through the database at the current address for the regex matched by ``string``. Aliases: :py:func:`database.search.byregex` :param \*\*options: if ``reverse`` is specified as true then search backwards. if ``sensitive`` is true, then search with regards to the case. .. py:function:: search\.by_regex(ea, string, \*\*options) Search the database at address ``ea`` for the regex matched by ``string``. If ``reverse`` is specified as a bool, then search backwards from the given address. If ``sensitive`` is specified as bool, then perform a case-sensitive search. Aliases: :py:func:`database.search.byregex` :param ea: the starting address to search from :type ea: int or long :param string: the regex to search for :type string: str :param \*\*options: if ``reverse`` is specified as true then search backwards. if ``sensitive`` is true, then search with regards to the case. .. py:function:: search\.by_text(\*\*options) Search through the database at the current address for the text matched by ``string``. Aliases: :py:func:`database.search.bystring`, :py:func:`database.search.by_string`, :py:func:`database.search.bytext` :param \*\*options: if ``reverse`` is specified as true then search backwards. if ``sensitive`` is true, then search with regards to the case. .. py:function:: search\.by_text(ea, string, \*\*options) Search the database at address ``ea`` for the text matched by ``string``. If ``reverse`` is specified as a bool, then search backwards from the given address. If ``sensitive`` is specified as bool, then perform a case-sensitive search. Aliases: :py:func:`database.search.bystring`, :py:func:`database.search.by_string`, :py:func:`database.search.bytext` :param ea: the starting address to search from :type ea: int or long :param string: the text string to search for :type string: str :param \*\*options: if ``reverse`` is specified as true then search backwards. if ``sensitive`` is true, then search with regards to the case. .. py:function:: search\.iterate(pattern, \*\*options) Iterate through all search results that match the ``pattern`` starting at the current address. :param pattern: the bytes or pattern to search for :type pattern: str or bytes or bytearray :param \*\*options: any options to pass to the ``predicate`` .. py:function:: search\.iterate(ea, pattern, \*\*options) Iterate through all search results that match the specified ``pattern`` starting at address ``ea``. :param ea: the starting address to search from :type ea: int or long :param pattern: :type pattern: str or bytes or bytearray :param \*\*options: any options to search with .. py:function:: search\.iterate(pattern, predicate, \*\*options) Iterate through all search results matched by the function ``predicate`` with the specified ``pattern`` starting at the current address. :param pattern: the bytes or pattern to pass to the ``predicate`` :type pattern: str or bytes or bytearray :param predicate: the callable to search with :param \*\*options: any options to pass to the ``predicate`` .. py:function:: search\.iterate(ea, pattern, predicate, \*\*options) Iterate through all search results matched by the function ``predicate`` with the specified ``pattern`` starting at address ``ea``. :param ea: the starting address to search from :type ea: int or long :param pattern: the bytes or pattern to pass to the predicate :type pattern: str or bytes or bytearray :param predicate: the callable to search with :param \*\*options: any options to pass to the ``predicate`` .. _ns-database-segments: ***************** database.segments ***************** This namespace is used for listing all the segments inside the database. By default each segment's boundaries are yielded. The different types that one can match segments with are the following: - ``name`` - Match according to the true segment name - ``like`` - Filter the segment names according to a glob - ``regex`` - Filter the segment names according to a regular-expression - ``index`` - Match the segment by its index - ``identifier`` - Match the segment by its identifier (:py:obj:`idaapi.segment_t.name`) - ``selector`` - Match the segment by its selector (:py:obj:`idaapi.segment_t.sel`) - ``greater`` or ``gt`` - Filter the segments for any after the specified address - ``less`` or ``lt`` - Filter the segments for any before the specified address - ``predicate`` - Filter the segments by passing its :py:obj:`idaapi.segment_t` to a callable Some examples of using these keywords are as follows:: > for l, r in database.segments(): ... > database.segments.list(regex=r'\.r?data') > iterable = database.segments.iterate(like='*text*') > result = database.segments.search(greater=0x401000) .. py:function:: segments() Yield the bounds of each segment within the current database. .. py:function:: segments\.iterate(name) Iterate through all of the segments in the database with a glob that matches ``name``. :param name: the glob to filter the segment names with :type name: str .. py:function:: segments\.iterate(\*\*type) Iterate through all the segments defined in the database matching the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter segments with .. py:function:: segments\.list(name) List all of the segments defined in the database that match the glob ``name``. :param name: the glob to filter the segment names with :type name: str .. py:function:: segments\.list(\*\*type) List all of the segments in the database that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the segments with .. py:function:: segments\.search(name) Search through all of the segments matching the glob ``name`` and return the first result. :param name: the glob to filter the segment names with :type name: str .. py:function:: segments\.search(\*\*type) Search through all of the segments within the database and return the first result matching the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the segments with .. _ns-database-set: ************ database.set ************ This namespace for setting the type of an address within the database. This allows one to apply a particular type to a given address. This allows one to specify whether a type is a string, undefined, code, data, an array, or even a structure. This can be used as in the following examples:: > database.set.unknown(ea) > database.set.aligned(ea, alignment=0x10) > database.set.string(ea) > database.set.structure(ea, structure.by('mystructure')) .. py:function:: set(info) Set the type information at the current address to ``info``. Aliases: :py:func:`database.set.typeinfo`, :py:func:`database.set.info` :param info: the type information to apply to the address :type info: str or idaapi.tinfo_t .. py:function:: set(ea, info) Set the type information at the address ``ea`` to ``info``. Aliases: :py:func:`database.set.typeinfo`, :py:func:`database.set.info` :param ea: an address within the database :type ea: int or long :param info: the type information to apply to the address :type info: str or idaapi.tinfo_t .. py:function:: set\.alignment(\*\*alignment) Set the data at the current address as aligned with the specified ``alignment``. Aliases: :py:func:`database.set.align`, :py:func:`database.set.aligned` :param \*\*alignment: the number of bytes to align with .. py:function:: set\.alignment(ea, \*\*alignment) Set the data at address ``ea`` as aligned. If ``alignment`` is specified, then use it as the number of bytes to align the data to. If ``size`` is specified, then align that number of bytes. Aliases: :py:func:`database.set.align`, :py:func:`database.set.aligned` :param ea: an address within the database :type ea: int or long :param \*\*alignment: the number of bytes to align with .. py:function:: set\.array() Set the data at the current selection to an array of the type at the current address. .. py:function:: set\.array(length) Set the data at the current selection to an array of the specified ``length`` using the type at the current address. :param length: the number of elements to use when applying the array :type length: int or long .. py:function:: set\.array(type, \*\*length) Set the data at the current address to an array of the specified ``type`` using the length determined from the current selection if ``length`` is not specified. :param type: a pythonic type to apply as an array element to the current address :param \*\*length: the number of elements to use when applying the array .. py:function:: set\.array(ea, type) Set the data at the address ``ea`` to an array of the given ``type``. :param ea: an address within the database :type ea: int or long :param type: a pythonic type to use as the array element for the specified address .. py:function:: set\.array(bounds, type) Set the data at the provided ``bounds`` to an array of the given ``type``. :param bounds: a tuple containing the boundaries of the array to apply :type bounds: tuple :param type: a pythonic type to use as the array element for the specified address .. py:function:: set\.array(ea, type, length) Set the data at the address ``ea`` to an array with the given ``length`` and ``type``. :param ea: an address within the database :type ea: int or long :param type: a pythonic type to use as the array element for the specified address :param length: the number of elements to use for the array :type length: int or long .. py:function:: set\.code() Set the data at the current address to code. .. py:function:: set\.code(ea) Set the data at address ``ea`` to code. :param ea: an address within the database :type ea: int or long .. py:function:: set\.data(size, \*\*type) Set the data at the current address to have the specified ``size`` and ``type``. :param size: the number of bytes to set :type size: int or long :param \*\*type: if ``type`` is specified as an IDA type (:py:obj:`idaapi.FF_\*`) or a :py:obj:`structure_t` then apply it to the given address .. py:function:: set\.data(ea, size, \*\*type) Set the data at address ``ea`` to have the specified ``size`` and ``type``. If ``type`` is not specified, then choose the correct type based on the size. :param ea: an address in the database :type ea: int or long :param size: the number of bytes to set :type size: int or long :param \*\*type: if ``type`` is specified then as an IDA type (:py:obj:`idaapi.FF_\*`) or a :py:obj:`structure_t` then apply it to the given address .. py:function:: set\.string(\*\*strtype) Set the data at the current address to a string with the specified ``strtype``. :param \*\*strtype: if ``strtype`` is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix .. py:function:: set\.string(bounds, \*\*strtype) Set the data within the provided ``bounds`` to a string with the specified ``strtype``. :param bounds: the boundaries of the string to return :type bounds: tuple :param \*\*strtype: if ``strtype`` is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix .. py:function:: set\.string(ea, \*\*strtype) Set the data at address ``ea`` to a string with the specified ``strtype``. :param ea: an address within the database :type ea: int or long :param \*\*strtype: if ``strtype`` is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix .. py:function:: set\.string(ea, length, \*\*strtype) Set the data at address ``ea`` to a string with the specified ``length``. If the integer ``strtype`` is specified, then apply a string of the specified character width. If the tuple ``strtype`` is specified, the first item is the string's character width and the second item is the size of the length prefix. :param ea: an address within the database :type ea: int or long :param length: the length of the string :type length: int or long :param \*\*strtype: if ``strtype`` is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix .. py:function:: set\.structure(type) Set the data at the current address to the structure_t specified by ``type``. Aliases: :py:func:`database.set.struc`, :py:func:`database.set.struct` :param type: the :py:obj:`structure_t` to apply to the current address :type type: structure_t .. py:function:: set\.structure(name) Set the data at the current address to the structure_t with the given ``name``. Aliases: :py:func:`database.set.struc`, :py:func:`database.set.struct` :param name: the name of the structure to apply to the current address :type name: str .. py:function:: set\.structure(sptr) Set the data at the current address to the structure_t for the specified ``sptr``. Aliases: :py:func:`database.set.struc`, :py:func:`database.set.struct` :param sptr: the :py:obj:`idaapi.struc_t` to apply to the current address :type sptr: idaapi.struc_t .. py:function:: set\.structure(ea, type) Set the data at address ``ea`` to the structure_t specified by ``type``. Aliases: :py:func:`database.set.struc`, :py:func:`database.set.struct` :param ea: an address within the database :type ea: int or long :param type: the :py:obj:`structure_t` to apply to the specified address :type type: structure_t .. py:function:: set\.structure(ea, name) Set the data at address ``ea`` to the structure_t with the given ``name``. Aliases: :py:func:`database.set.struc`, :py:func:`database.set.struct` :param ea: an address within the database :type ea: int or long :param name: the name of the structure to apply to the specified address :type name: str .. py:function:: set\.structure(ea, sptr) Set the data at address ``ea`` to the structure_t for the specified ``sptr``. Aliases: :py:func:`database.set.struc`, :py:func:`database.set.struct` :param ea: an address within the database :type ea: int or long :param sptr: the :py:obj:`idaapi.struc_t` to apply to the specified address :type sptr: idaapi.struc_t .. py:function:: set\.structure(ea, identifier) Set the data at address ``ea`` to the structure_t that has the specified ``identifier``. Aliases: :py:func:`database.set.struc`, :py:func:`database.set.struct` :param ea: an address within the database :type ea: int or long :param identifier: the identifier of the structure to apply to the specified address :type identifier: int or long .. py:function:: set\.unknown() Set the data at the current address or selection to undefined. Aliases: :py:func:`database.set.undef`, :py:func:`database.set.undefined` .. py:function:: set\.unknown(ea) Set the data at address ``ea`` to undefined. Aliases: :py:func:`database.set.undef`, :py:func:`database.set.undefined` :param ea: an address within the database :type ea: int or long .. py:function:: set\.unknown(ea, size) Set the data at address ``ea`` to undefined. Aliases: :py:func:`database.set.undef`, :py:func:`database.set.undefined` :param ea: an address within the database :type ea: int or long :param size: the number of bytes to set :type size: int or long .. _ns-database-set-float: ^^^^^^^^^^^^^^^^^^ database.set.float ^^^^^^^^^^^^^^^^^^ Aliases: :ref:`database.set.f` This namespace used for applying various sized floating-point types to a particular address. This namespace is aliased as :py:obj:`database.set.f` and can be used as follows:: > database.set.f.single(ea) > database.set.f.double(ea) .. py:function:: set\.float() Sets the data at the current address to an IEEE-754 floating-point number based on its size. .. py:function:: set\.float(ea) Sets the data at address ``ea`` to an IEEE-754 floating-point number based on its size. :param ea: an address within the database .. py:function:: set\.float\.double() Set the data at the current address to an IEEE-754 double .. py:function:: set\.float\.double(ea) Set the data at address ``ea`` to an IEEE-754 double. :param ea: an address within the database .. py:function:: set\.float\.single() Set the data at the current address to an IEEE-754 single .. py:function:: set\.float\.single(ea) Set the data at address ``ea`` to an IEEE-754 single. :param ea: an address within the database .. _ns-database-set-integer: ^^^^^^^^^^^^^^^^^^^^ database.set.integer ^^^^^^^^^^^^^^^^^^^^ Aliases: :ref:`database.set.i` This namespace used for applying various sized integer types to a particular address. This namespace is also aliased as :py:obj:`database.set.i` and can be used as follows:: > database.set.i.uint8_t(ea) > database.set.i.uint64_t(ea) .. py:function:: set\.integer() Set the data at the current address to an integer. .. py:function:: set\.integer(ea) Set the data at address ``ea`` to an integer of a type determined by its size. :param ea: an address within the database to set as an integer :type ea: int or long .. py:function:: set\.integer(ea, size) Set the data at the address ``ea`` to an integer of the specified ``size``. :param ea: an address within the database to set as an integer :type ea: int or long :param size: the size of the integer :type size: int or long .. py:function:: set\.integer\.sint128_t() Set the data at the current address to a sint128_t. .. py:function:: set\.integer\.sint128_t(ea) Set the data at address ``ea`` to an sint128_t. :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.sint16_t() Set the data at the current address to a sint16_t. .. py:function:: set\.integer\.sint16_t(ea) Set the data at address ``ea`` to a sint16_t. :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.sint32_t() Set the data at the current address to a sint32_t. .. py:function:: set\.integer\.sint32_t(ea) Set the data at address ``ea`` to a sint32_t. :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.sint64_t() Set the data at the current address to a sint64_t. .. py:function:: set\.integer\.sint64_t(ea) Set the data at address ``ea`` to a sint64_t. :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.sint8_t() Set the data at the current address to a sint8_t. .. py:function:: set\.integer\.sint8_t(ea) Set the data at address ``ea`` to a sint8_t. :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.uint128_t() Set the data at the current address to an uint128_t. Aliases: :py:func:`database.set.integer.oword` .. py:function:: set\.integer\.uint128_t(ea) Set the data at address ``ea`` to an uint128_t. Aliases: :py:func:`database.set.integer.oword` :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.uint16_t() Set the data at the current address to a uint16_t. Aliases: :py:func:`database.set.integer.word` .. py:function:: set\.integer\.uint16_t(ea) Set the data at address ``ea`` to a uint16_t. Aliases: :py:func:`database.set.integer.word` :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.uint32_t() Set the data at the current address to a uint32_t. Aliases: :py:func:`database.set.integer.dword` .. py:function:: set\.integer\.uint32_t(ea) Set the data at address ``ea`` to a uint32_t. Aliases: :py:func:`database.set.integer.dword` :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.uint64_t() Set the data at the current address to a uint64_t. Aliases: :py:func:`database.set.integer.qword` .. py:function:: set\.integer\.uint64_t(ea) Set the data at address ``ea`` to a uint64_t. Aliases: :py:func:`database.set.integer.qword` :param ea: an address within the database :type ea: int or long .. py:function:: set\.integer\.uint8_t() Set the data at the current address to a uint8_t. Aliases: :py:func:`database.set.integer.byte` .. py:function:: set\.integer\.uint8_t(ea) Set the data at address ``ea`` to a uint8_t. Aliases: :py:func:`database.set.integer.byte` :param ea: an address within the database :type ea: int or long .. _ns-database-type: ************* database.type ************* Aliases: :ref:`database.t` This namespace is for fetching type information from the different addresses defined within the database. The functions within this namespace allow one to extract various type information from the different locations within the database. This namespace is also aliased as :py:obj:`database.t`. By default, this namespace will return the :py:obj:`idaapi.DT_TYPE` of the specified address. Some examples of using this namespace can be:: > print( database.type.size(ea) ) > print( database.type.is_initialized(ea) ) > print( database.type.is_data(ea) ) > length = database.t.array.length(ea) > st = database.t.structure(ea) .. py:function:: type() Return the type information for the current address as an :py:obj:`idaapi.tinfo_t`. .. py:function:: type(ea) Return the type information for the address ``ea`` as an :py:obj:`idaapi.tinfo_t`. :param ea: an address within the database :type ea: int or long .. py:function:: type(none) Remove the type information from the current address. :param none: the python value :py:obj:`None` :type none: None .. py:function:: type(info, \*\*guessed) Apply the type information in ``info`` to the current address. :param info: the type information to apply to the address :type info: str or idaapi.tinfo_t :param \*\*guessed: if ``guessed`` is specified, the mark it as guessed by the disassembler of the user .. py:function:: type(ea, info, \*\*guessed) Apply the :py:obj:`idaapi.tinfo_t` in ``info`` to the address ``ea``. If ``guess`` is true, then apply the type information as a guess. If ``force`` is true, then apply the type as-is regardless of its location. :param ea: an address within the database :type ea: int or long :param info: the :py:obj:`idaapi.tinfo_t` to apply to the address :type info: idaapi.tinfo_t :param \*\*guessed: if ``guessed`` is specified, the mark it as guessed by the disassembler of the user .. py:function:: type(ea, none) Remove the type information from the address ``ea``. :param ea: an address within the database :param none: the python value :py:obj:`None` :type none: None .. py:function:: type(ea, string, \*\*guessed) Parse the type information in ``string`` into an :py:obj:`idaapi.tinfo_t` and apply it to the address ``ea``. :param ea: an address within the database :type ea: int or long :param string: a string describing the type information to apply to the address :type string: str :param \*\*guessed: if ``guessed`` is specified, the mark it as guessed by the disassembler of the user .. py:function:: type\.flags() Return the flags of the item at the current address. .. py:function:: type\.flags(ea) Return the flags of the item at the address ``ea``. :param ea: an address within the database :type ea: int or long .. py:function:: type\.flags(ea, mask) Return the flags at the address ``ea`` masked with ``mask``. :param ea: an address within the database :type ea: int or long :param mask: a bitmask used to select specific bits from the flags :type mask: int or long .. py:function:: type\.flags(ea, mask, value) Sets the flags at the address ``ea`` masked with ``mask`` set to ``value``. :param ea: an address within the database :type ea: int or long :param mask: a bitmask used to select specific bits from the flags :type mask: int or long :param value: the bits to write :type value: int or long .. py:function:: type\.has_autoname() Return if the current address was automatically named. Aliases: :py:func:`database.type.autonameQ` .. py:function:: type\.has_autoname(ea) Return if the address ``ea`` was automatically named. Aliases: :py:func:`database.type.autonameQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_comment() Return if the current address is commented. Aliases: :py:func:`database.type.commentQ` .. py:function:: type\.has_comment(ea) Return if the address at ``ea`` is commented. Aliases: :py:func:`database.type.commentQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_customname() Return if the current address has a custom name. Aliases: :py:func:`database.type.customnameQ` .. py:function:: type\.has_customname(ea) Return if the address at ``ea`` has a custom name. Aliases: :py:func:`database.type.customnameQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_dummyname() Return if the current address has a dummy name. Aliases: :py:func:`database.type.dummynameQ` .. py:function:: type\.has_dummyname(ea) Return if the address at ``ea`` has a dummy name. Aliases: :py:func:`database.type.dummynameQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_label() Return if the current address has a label. Aliases: :py:func:`database.type.has_name`, :py:func:`database.type.labelQ`, :py:func:`database.type.nameQ` .. py:function:: type\.has_label(ea) Return if the address at ``ea`` has a label. Aliases: :py:func:`database.type.has_name`, :py:func:`database.type.labelQ`, :py:func:`database.type.nameQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_listedname() Return if the current address has a name that is listed. Aliases: :py:func:`database.type.listednameQ` .. py:function:: type\.has_listedname(ea) Return if the address at ``ea`` has a name that is listed. Aliases: :py:func:`database.type.listednameQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_publicname() Return if the current address has a public name. Aliases: :py:func:`database.type.publicnameQ` .. py:function:: type\.has_publicname(ea) Return if the address at ``ea`` has a public name. Aliases: :py:func:`database.type.publicnameQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_reference() Return if the current address is referencing another address. Aliases: :py:func:`database.type.referenceQ` .. py:function:: type\.has_reference(ea) Return if the address at ``ea`` is referencing another address. Aliases: :py:func:`database.type.referenceQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_typeinfo() Return if the current address has any type information associated with it. Aliases: :py:func:`database.type.infoQ`, :py:func:`database.type.typeinfoQ` .. py:function:: type\.has_typeinfo(ea) Return if the address at ``ea`` has any type information associated with it. Aliases: :py:func:`database.type.infoQ`, :py:func:`database.type.typeinfoQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.has_weakname() Return if the current address has a name with a weak type. Aliases: :py:func:`database.type.weaknameQ` .. py:function:: type\.has_weakname(ea) Return if the address at ``ea`` has a name with a weak type. Aliases: :py:func:`database.type.weaknameQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_align() Return if the current address is defined as an alignment. Aliases: :py:func:`database.type.alignQ`, :py:func:`database.is_align` .. py:function:: type\.is_align(ea) Return if the address at ``ea`` is defined as an alignment. Aliases: :py:func:`database.type.alignQ`, :py:func:`database.is_align` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_code() Return if the current address is marked as code. Aliases: :py:func:`database.is_code`, :py:func:`database.type.codeQ` .. py:function:: type\.is_code(ea) Return if the address specified by ``ea`` is marked as code. Aliases: :py:func:`database.is_code`, :py:func:`database.type.codeQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_code(ea, size) Return if the address specified by ``ea`` up to ``size`` bytes is marked as code. Aliases: :py:func:`database.is_code`, :py:func:`database.type.codeQ` :param ea: an address within the database :type ea: int or long :param size: the number of bytes to check :type size: int or long .. py:function:: type\.is_data() Return if the current address is marked as data. Aliases: :py:func:`database.is_data`, :py:func:`database.type.dataQ` .. py:function:: type\.is_data(ea) Return if the address specified by ``ea`` is marked as data. Aliases: :py:func:`database.is_data`, :py:func:`database.type.dataQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_data(ea, size) Return if the address specified by ``ea`` up to ``size`` bytes is marked as data. Aliases: :py:func:`database.is_data`, :py:func:`database.type.dataQ` :param ea: an address within the database :type ea: int or long :param size: the number of bytes to check :type size: int or long .. py:function:: type\.is_exception(\*\*flags) Return if the current address or selection is guarded by an exception or part of an exception handler. Aliases: :py:func:`database.type.hasexception`, :py:func:`database.type.has_exception`, :py:func:`database.type.isexception`, :py:func:`database.type.exceptionQ` :param \*\*flags: any of the ``idaapi.TBEA_\*`` flags that are used to match the block type. .. py:function:: type\.is_exception(ea, \*\*flags) Return if the address or boundaries in ``ea`` is guarded by an exception or part of an exception handler. If ``seh`` or ``cpp`` is specified, then include or exclude that exception type. If ``guarded`` or ``try`` is true, then return if the address is guarded by an exception. If ``handler`` or ``catch`` is true, then return if the address is part of an exception handler. If ``fallthrough`` is true, then return if the address is part of the fall-through case for a handler. If ``filter`` or ``finally`` is true, then return if the address is part of an SEH filter or SEH finalizer (respectively). Aliases: :py:func:`database.type.hasexception`, :py:func:`database.type.has_exception`, :py:func:`database.type.isexception`, :py:func:`database.type.exceptionQ` :param ea: an address within the database :type ea: int or long or tuple :param \*\*flags: any of the ``idaapi.TBEA_\*`` flags that are used to match the block type. .. py:function:: type\.is_exception(ea, flags) Return if the address in ``ea`` is referenced by an exception matching the specified ``flags`` (:py:obj:`idaapi.TBEA_\*`). Aliases: :py:func:`database.type.hasexception`, :py:func:`database.type.has_exception`, :py:func:`database.type.isexception`, :py:func:`database.type.exceptionQ` :param ea: an address within the database :type ea: int or long :param flags: any of the ``idaapi.TBEA_\*`` flags that are used to match the block type. :type flags: int or long .. py:function:: type\.is_exception(bounds, flags) Return if the given ``bounds`` is referenced by an exception matching the specified ``flags`` (:py:obj:`idaapi.TBEA_\*`). Aliases: :py:func:`database.type.hasexception`, :py:func:`database.type.has_exception`, :py:func:`database.type.isexception`, :py:func:`database.type.exceptionQ` :param bounds: the boundaries of the range to check :type bounds: tuple :param flags: any of the ``idaapi.TBEA_\*`` flags that are used to match the block type. :type flags: int or long .. py:function:: type\.is_globalref() Return true if the instruction at the current address references a global. Aliases: :py:func:`database.type.isglobalref`, :py:func:`database.type.globalrefQ` .. py:function:: type\.is_globalref(ea) Return true if the instruction at ``ea`` references a global. Aliases: :py:func:`database.type.isglobalref`, :py:func:`database.type.globalrefQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_head() Return if the current address is aligned to a definition in the database. Aliases: :py:func:`database.is_head`, :py:func:`database.type.headQ` .. py:function:: type\.is_head(ea) Return if the address ``ea`` is aligned to a definition in the database. Aliases: :py:func:`database.is_head`, :py:func:`database.type.headQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_importref() Return true if the instruction at the current address references an import. Aliases: :py:func:`database.type.isimportref`, :py:func:`database.type.importrefQ` .. py:function:: type\.is_importref(ea) Return true if the instruction at ``ea`` references an import. Aliases: :py:func:`database.type.isimportref`, :py:func:`database.type.importrefQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_initialized() Return if the current address is initialized. Aliases: :py:func:`database.type.initializedQ` .. py:function:: type\.is_initialized(ea) Return if the address specified by ``ea`` is initialized. Aliases: :py:func:`database.type.initializedQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_initialized(ea, size) Return if the address specified by ``ea`` up to ``size`` bytes is initialized. Aliases: :py:func:`database.type.initializedQ` :param ea: an address within the database :type ea: int or long :param size: the number of bytes to check :type size: int or long .. py:function:: type\.is_reference() Return if the data at the current address is referenced by another address. Aliases: :py:func:`database.type.is_referenced`, :py:func:`database.type.is_ref` .. py:function:: type\.is_reference(ea) Return if the data at the address ``ea`` is referenced by another address. Aliases: :py:func:`database.type.is_referenced`, :py:func:`database.type.is_ref` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_string() Return if the current address is defined as a string. Aliases: :py:func:`database.type.stringQ` .. py:function:: type\.is_string(ea) Return if the address at ``ea`` is defined as a string. Aliases: :py:func:`database.type.stringQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_structure() Return if the current address is defined as a structure. Aliases: :py:func:`database.type.is_struct`, :py:func:`database.type.structQ`, :py:func:`database.type.is_struc` .. py:function:: type\.is_structure(ea) Return if the address at ``ea`` is defined as a structure. Aliases: :py:func:`database.type.is_struct`, :py:func:`database.type.structQ`, :py:func:`database.type.is_struc` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_tail() Return if the current address is not aligned to a definition in the database. Aliases: :py:func:`database.is_tail`, :py:func:`database.type.tailQ` .. py:function:: type\.is_tail(ea) Return if the address ``ea`` is not aligned to a definition in the database. Aliases: :py:func:`database.is_tail`, :py:func:`database.type.tailQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_unknown() Return if the current address is marked as unknown. Aliases: :py:func:`database.type.undefinedQ`, :py:func:`database.is_unknown`, :py:func:`database.type.is_undefined`, :py:func:`database.type.unknownQ` .. py:function:: type\.is_unknown(ea) Return if the address specified by ``ea`` is marked as unknown. Aliases: :py:func:`database.type.undefinedQ`, :py:func:`database.is_unknown`, :py:func:`database.type.is_undefined`, :py:func:`database.type.unknownQ` :param ea: an address within the database :type ea: int or long .. py:function:: type\.is_unknown(ea, size) Return if the address specified by ``ea`` up to ``size`` bytes is marked as unknown. Aliases: :py:func:`database.type.undefinedQ`, :py:func:`database.is_unknown`, :py:func:`database.type.is_undefined`, :py:func:`database.type.unknownQ` :param ea: an address within the database :type ea: int or long :param size: the number of bytes to check :type size: int or long .. py:function:: type\.size() Return the size of the item at the current address. Aliases: :py:func:`database.size` .. py:function:: type\.size(ea) Return the size of the item at the address ``ea``. Aliases: :py:func:`database.size` :param ea: an address within the database :type ea: int or long .. py:function:: type\.switch() Return the switch_t at the current address. .. py:function:: type\.switch(ea) Return the switch_t at the address ``ea``. :param ea: an address within the database containing a switch :type ea: int or long .. _ns-database-type-array: ^^^^^^^^^^^^^^^^^^^ database.type.array ^^^^^^^^^^^^^^^^^^^ This namespace is for returning type information about an array that is defined within the database. By default this namespace will return the array's element type and its number of elements as a list ``[size, count]``. Some examples of using this namespace can be:: > type, length = database.t.array() > print( database.t.array.size(ea) ) > print( database.t.array.member(ea) ) > print( database.t.array.element(ea) ) > print( database.t.array.length(ea) ) .. py:function:: type\.array() Return the ``[type, length]`` of the array at the current address. .. py:function:: type\.array(ea) Return the ``[type, length]`` of the array at the address specified by ``ea``. :param ea: an address within the database containing an array :type ea: int or long .. py:function:: type\.array(bounds) Return the ``[type, length]`` of the specified ``bounds`` as an array. :param bounds: :type bounds: tuple .. py:function:: type\.array(ea, size) Return the ``[type, length]`` of the address ``ea`` if it was an array using the specified ``size`` (in bytes). :param ea: :type ea: int or long :param size: .. py:function:: type\.array\.element() Return the type information for the member of the array defined at the current address. Aliases: :py:func:`database.type.typeinfo`, :py:func:`database.type.info` .. py:function:: type\.array\.element(ea) Return the type information for the member of the array defined at the address specified by ``ea``. Aliases: :py:func:`database.type.typeinfo`, :py:func:`database.type.info` :param ea: an address within the database containing an array :type ea: int or long .. py:function:: type\.array\.length() Return the number of members in the array at the current address. .. py:function:: type\.array\.length(ea) Return the number of members in the array at the address specified by ``ea``. :param ea: an address within the database containing an array :type ea: int or long .. py:function:: type\.array\.member() Return the type for the member of the array at the current address. .. py:function:: type\.array\.member(ea) Return the type for the member of the array at the address specified by ``ea``. :param ea: an address within the database containing an array :type ea: int or long .. py:function:: type\.array\.size() Return the size of a member in the array at the current address. .. py:function:: type\.array\.size(ea) Return the size of a member in the array at the address specified by ``ea``. :param ea: an address within the database containing an array :type ea: int or long .. _ns-database-type-structure: ^^^^^^^^^^^^^^^^^^^^^^^ database.type.structure ^^^^^^^^^^^^^^^^^^^^^^^ Aliases: :ref:`database.type.struc` This namespace for returning type information about a structure that is defined within the database. By default this namespace will return the :py:obj:`structure_t` at the given address. Some of the ways to use this namespace are:: > st = database.t.struct() > print( database.t.struct.size() ) > st = structure.by(database.t.id(ea)) .. py:function:: type\.structure() Return the structure type at the current address. .. py:function:: type\.structure(ea) Return the structure type at address ``ea``. :param ea: an address within the database containing a structure :type ea: int or long .. py:function:: type\.structure\.id() Return the identifier of the structure at the current address. Aliases: :py:func:`database.get_structureid`, :py:func:`database.get_strucid`, :py:func:`database.getStructureId` .. py:function:: type\.structure\.id(ea) Return the identifier of the structure at address ``ea``. Aliases: :py:func:`database.get_structureid`, :py:func:`database.get_strucid`, :py:func:`database.getStructureId` :param ea: an address within the database containing a structure :type ea: int or long .. py:function:: type\.structure\.size() Return the total size of the structure at the current address. .. py:function:: type\.structure\.size(ea) Return the total size of the structure at address ``ea``. :param ea: an address within the database containing a structure :type ea: int or long .. _ns-database-types: ************** database.types ************** This namespace is for interacting with the local types that are defined within the database. The functions within this namespace can be used to create, query, or fetch the types that have been defined. When listing the types that are matched, the following legend can be used to identify certain characteristics about them: - ``L`` - The type originated from a type library - ``I`` - The type originated from an inherited type library - ``T`` - The type is a type definition and references another type - ``P`` - The contents of the type is a pointer - ``F`` - The contents of the type is a floating-point value (float, double, long double) - ``E`` - The contents of the type is an enumeration - ``I`` - The contents of the type is an integral - ``A`` - The type represents an array - ``F`` - The type represents a function - ``S`` - The type represents a structure - ``V`` - The type represents a virtual function table - ``C`` - The type represents a structure containing a virtual function table - ``U`` - The type represents a union - ``?`` - The type is currently not defined The available types that one can filter the local types with are as follows: - ``ordinal`` - Match according to the ordinal of the local type. - ``name`` - Match according to the name of the local type. - ``like`` - Filter the names of the local types according to a glob. - ``definition`` - Filter the local types by applying a glob to their definition. - ``regex`` - Filter the local types by applying a regular-expression to their definition. - ``typeref`` or ``typedef`` - Filter the local types for any that are an alias declared with typedef. - ``defined`` or ``present`` - Filter the local types for any that are defined. - ``size`` - Filter the local types according to their size. - ``greater`` or ``ge`` - Filter the local types for the ones that are larger or equal to a certain size. - ``gt`` - Filter the local types for the ones that are larger than a certain size. - ``less`` or ``le`` - Filter the local types for the ones that are less or equal to a certain size. - ``lt`` - Filter the local types for the ones that are less than a certain size. - ``integer`` - Filter the local types for any that are integers. - ``pointer`` - Filter the local types for any that are pointers. - ``function`` - Filter the local types for any that are functions. - ``float`` - Filter the local types for any that are floating-point. - ``array`` - Filter the local types for any that describe an array. - ``structure`` - Filter the local types for any that describe a structure. - ``union`` - Filter the local types for any that describe a union. - ``enumeration`` - Filter the local types for any that describe an enumeration. - ``predicate`` - Filter the types by passing their ordinal and :py:obj:`idaapi.tinfo_t` to a callable. Some examples of using these keywords are as follows:: > database.types.list('*::*') > iterable = database.types.iterate(definition='*Cookie*') > result = database.types.search(regex='.*const.*') .. py:function:: types\.add(name, \*\*mangled) Add an empty type with the provided ``name`` to the current type library. :param name: the name of the type to add :type name: str :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.add(name, library, \*\*mangled) Add an empty type with the provided ``name`` to the specified type ``library``. :param name: the name of the type to add :type name: str :param library: the :py:obj:`idaapi.til_t` of the library to be added to :type library: idaapi.til_t :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.add(name, info, \*\*mangled) Add the type information in ``info`` to the current type library using the provided ``name``. :param name: the name of the type to add :type name: str :param info: the string or :py:obj:`idaapi.tinfo_t` of the type to add :type info: str or idaapi.tinfo_t :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.add(name, string, library, \*\*mangled) Add the type information in ``string`` to the specified type ``library`` using the provided ``name``. :param name: the name of the type to add :type name: str :param string: a string describing the type to add :type string: str :param library: the :py:obj:`idaapi.til_t` of the library to be added to :type library: idaapi.til_t :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.add(name, info, library, \*\*mangled) Add the type information in ``info`` to the specified type ``library`` using the provided ``name``. If the boolean ``mangled`` is specified, then the given name is mangled. :param name: the name of the type to add :type name: str :param info: the :py:obj:`idaapi.tinfo_t` to use when adding the type :type info: idaapi.tinfo_t :param library: the :py:obj:`idaapi.til_t` of the library to be added to :type library: idaapi.til_t :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.by(ordinal) Return the type information that is at the given ``ordinal``. :param ordinal: the numerical index of the type to return :type ordinal: int or long .. py:function:: types\.by(name) Return the type information that has the specified ``name``. :param name: the name of the type to return :type name: str .. py:function:: types\.by(ordinal, library) Return the type information from the specified ``library`` that is at the given ``ordinal``. :param ordinal: the numerical index of the type to return :type ordinal: int or long :param library: the :py:obj:`idaapi.til_t` of the library to return the type from :type library: idaapi.til_t .. py:function:: types\.by(name, library) Return the type information from the specified ``library`` that is using the given ``name``. :param name: the name of the type to return :type name: str :param library: the :py:obj:`idaapi.til_t` of the library to return the type from :type library: idaapi.til_t .. py:function:: types\.by_index(ordinal) Return the type information that is at the given ``ordinal``. :param ordinal: the numerical index of the type to return :type ordinal: int or long .. py:function:: types\.by_index(ordinal, library) Return the type information from the specified ``library`` that is at the given ``ordinal``. :param ordinal: the numerical index of the type to return :type ordinal: int or long :param library: the :py:obj:`idaapi.til_t` of the library to return the type from :type library: idaapi.til_t .. py:function:: types\.by_name(name) Return the type information that has the specified ``name``. :param name: the name of the type to return :type name: str .. py:function:: types\.by_name(name, library) Return the type information from the specified ``library`` that is using the given ``name``. :param name: the name of the type to return :type name: str :param library: the :py:obj:`idaapi.til_t` of the library to return the type from :type library: idaapi.til_t .. py:function:: types\.count() Return the number of types that are available in the current type library. .. py:function:: types\.count(library) Return the number of types that are available in the specified type ``library``. :param library: the :py:obj:`idaapi.til_t` of the library to return the number of types from :type library: idaapi.til_t .. py:function:: types\.declare(string, \*\*flags) Parse the given ``string`` into an :py:obj:`idaapi.tinfo_t` using the current type library and return it. Aliases: :py:func:`database.types.decl`, :py:func:`database.types.parse` :param string: the type as a string to parse :type string: str :param \*\*flags: any of the ``idaapi.PT_\*`` flags to use when parsing the type .. py:function:: types\.declare(string, library, \*\*flags) Parse the given ``string`` into an :py:obj:`idaapi.tinfo_t` using the specified type ``library`` and return it. If the integer ``flags`` is provided, then use the specified flags (:py:obj:`idaapi.PT_\*`) when parsing the ``string``. Aliases: :py:func:`database.types.decl`, :py:func:`database.types.parse` :param string: the type as a string to parse :type string: str :param library: the ``idaapi.til_t`` describing the target type library :type library: idaapi.til_t :param \*\*flags: any of the ``idaapi.PT_\*`` flags to use when parsing the type .. py:function:: types\.get(ordinal) Get the type information at the given ``ordinal`` of the current type library and return it. :param ordinal: the numerical index of the type to get :type ordinal: int or long .. py:function:: types\.get(name) Get the type information with the given ``name`` from the current type library and return it. :param name: the name of the type to get :type name: str .. py:function:: types\.get(ordinal, library) Get the type information at the given ``ordinal`` of the specified type ``library`` and return it. :param ordinal: the numerical index of the type to get :type ordinal: int or long :param library: the :py:obj:`idaapi.til_t` of the library to fetch the type from :type library: idaapi.til_t .. py:function:: types\.get(name, library) Get the type information with the given ``name`` from the specified type ``library`` and return it. :param name: the name of the type to get :type name: str :param library: the :py:obj:`idaapi.til_t` of the library to fetch the type from :type library: idaapi.til_t .. py:function:: types\.get(serialized) Convert the ``serialized`` type information from the current type library and return it. :param serialized: the tuple containing the fields that describe the serialized type :type serialized: tuple .. py:function:: types\.get(serialized, library) Convert the ``serialized`` type information from the specified type ``library`` and return it. :param serialized: the tuple containing the fields that describe the serialized type :type serialized: tuple :param library: the :py:obj:`idaapi.til_t` of the library to serialize the type from :type library: idaapi.til_t .. py:function:: types\.has(ordinal) Return whether the current type library has a type at the given ``ordinal``. :param ordinal: the ordinal of the type to check :type ordinal: int or long .. py:function:: types\.has(name) Return whether the current type library has a type with the specified ``name``. :param name: the name of the type to check :type name: str .. py:function:: types\.has(ordinal, library) Return whether the provided type ``library`` has a type at the given ``ordinal``. :param ordinal: :type ordinal: int or long :param library: the :py:obj:`idaapi.til_t` of the library to check :type library: idaapi.til_t .. py:function:: types\.has(name, library) Return whether the provided type ``library`` has a type with the specified ``name``. :param name: the name of the type to check :type name: str :param library: the :py:obj:`idaapi.til_t` of the library to check :type library: idaapi.til_t .. py:function:: types\.iterate(string) Iterate through all of the types in current type library with a glob that matches ``string``. :param string: the glob to filter the names of the types with :type string: str .. py:function:: types\.iterate(string, library) Iterate through all of the types in the specified type ``library`` with a glob that matches ``string``. :param string: the glob to filter the names of the types with :type string: str :param library: the :py:obj:`idaapi.til_t` containing the types to iterate :type library: idaapi.til_t .. py:function:: types\.iterate(\*\*type) Iterate through all of the types in the current type library that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter types with .. py:function:: types\.iterate(library, \*\*type) Iterate through all of the types in the specified type ``library`` that match the keyword specified by ``type``. :param library: the :py:obj:`idaapi.til_t` of the library containing the types :type library: idaapi.til_t :param \*\*type: any keyword that can be used to filter types with .. py:function:: types\.list(string) List all of the types in the current type library with a glob that matches ``string``. :param string: the glob to filter the type names with :type string: str .. py:function:: types\.list(string, library) List all of the types in the specified type ``library`` with a glob that matches ``string``. :param string: the glob to filter the type names with :type string: str :param library: the :py:obj:`idaapi.til_t` containing the types to list :type library: idaapi.til_t .. py:function:: types\.list(\*\*type) List all of the types in the specified type ``library`` that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the types with .. py:function:: types\.list(library, \*\*type) List all of the types in the specified type ``library`` that match the keyword specified by ``type``. :param library: the :py:obj:`idaapi.til_t` containing the types to list :type library: idaapi.til_t :param \*\*type: any keyword that can be used to filter the types with .. py:function:: types\.name(info) Return the name of the type from the current type library that matches the given type ``info``. :param info: the type information to return the name of :type info: idaapi.tinfo_t .. py:function:: types\.name(ordinal) Return the name of the type from the current type library at the specified ``ordinal``. :param ordinal: the numerical index of the type to get the name from :type ordinal: int or long .. py:function:: types\.name(info, library) Return the name of the type from the specified type ``library`` that matches the given type ``info``. :param info: the type information to return the name of :type info: idaapi.tinfo_t :param library: the :py:obj:`idaapi.til_t` of the library containing the type :type library: idaapi.til_t .. py:function:: types\.name(ordinal, library) Return the name of the type from the specified type ``library`` at the given ``ordinal``. :param ordinal: the numerical index of the type to get the name from :type ordinal: int or long :param library: the :py:obj:`idaapi.til_t` of the library containing the type :type library: idaapi.til_t .. py:function:: types\.name(ordinal, string, \*\*mangled) Set the name of the type at the specified ``ordinal`` from the current library to ``string``. :param ordinal: the numerical index of the type to rename :type ordinal: int or long :param string: the new name of the type :type string: str :param \*\*mangled: a boolean that specifies whether the name is mangled .. py:function:: types\.name(ordinal, string, library, \*\*mangled) Set the name of the type at the specified ``ordinal`` of the given type ``library`` to ``string``. If the boolean ``mangled`` is specified, then the given name is mangled. :param ordinal: the numerical index of the type to rename :type ordinal: int or long :param string: the new name of the type :type string: str :param library: the :py:obj:`idaapi.til_t` of the library containing the type to rename :type library: idaapi.til_t :param \*\*mangled: a boolean that specifies whether the name is mangled .. py:function:: types\.remove(ordinal) Remove the type information at the specified ``ordinal`` of the current type library. :param ordinal: the numerical index of the type to remove :type ordinal: int or long .. py:function:: types\.remove(ordinal, library) Remove the type information at the ``ordinal`` of the specified type ``library``. :param ordinal: the numerical index of the type to remove :type ordinal: int or long :param library: the :py:obj:`idaapi.til_t` of the library to remove the type from :type library: idaapi.til_t .. py:function:: types\.remove(name, \*\*mangled) Remove the type information with the specified ``name`` from the current type library. :param name: the name of the type to remove :type name: str :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.remove(name, library, \*\*mangled) Remove the type information with the specified ``name`` from the specified type ``library``. If the boolean ``mangled`` is specified, then the given name is mangled. :param name: the name of the type to remove :type name: str :param library: the :py:obj:`idaapi.til_t` of the library to remove the type from :type library: idaapi.til_t :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.search(string) Search through all of the type names in the current type library matching the glob ``string`` and return the first result. :param string: the glob to filter the names of the types with :type string: str .. py:function:: types\.search(string, library) Search through all of the type names in the specified type ``library`` matching the glob ``string`` and return the first result. :param string: the glob to filter the names of the types with :type string: str :param library: the :py:obj:`idaapi.til_t` containing the types to search :type library: idaapi.til_t .. py:function:: types\.search(\*\*type) Search through all of the types in the current type library that match the keyword specified by ``type``. :param \*\*type: any keyword that can be used to filter the types with .. py:function:: types\.search(library, \*\*type) Search through all of the types in the specified type ``library`` that match the keyword specified by ``type``. :param library: the :py:obj:`idaapi.til_t` containing the types to search :type library: idaapi.til_t :param \*\*type: any keyword that can be used to filter the types with .. py:function:: types\.set(ordinal, info) Assign the type information ``info`` to the type at the specified ``ordinal`` of the current type library. :param ordinal: the numerical index of the type to set :type ordinal: int or long :param info: the string or :py:obj:`idaapi.tinfo_t` of the type to assign :type info: str or idaapi.tinfo_t .. py:function:: types\.set(ordinal, name, info, \*\*mangled) Assign the type information ``info`` with the specified ``name`` to the given ``ordinal`` of the current type library. :param ordinal: the numerical index of the type to set :type ordinal: int or long :param name: the name of the type to set :type name: str :param info: the string or :py:obj:`idaapi.tinfo_t` of the type to assign :type info: str or idaapi.tinfo_t :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.set(ordinal, info, library) Assign the type information ``info`` to the type at the ``ordinal`` of the specified type ``library``. :param ordinal: the numerical index of the type to set :type ordinal: int or long :param info: the string or :py:obj:`idaapi.tinfo_t` of the type to assign :type info: str or idaapi.tinfo_t :param library: the :py:obj:`idaapi.til_t` of the library for the type :type library: idaapi.til_t .. py:function:: types\.set(ordinal, name, string, library, \*\*mangled) Assign the type information in ``string`` with the specified ``name`` to the specified ``ordinal`` of the given type ``library``. :param ordinal: the numerical index of the type to set :type ordinal: int or long :param name: the name of the type to set :type name: str :param string: a string describing the type to assign :type string: str :param library: the :py:obj:`idaapi.til_t` of the library for the type :type library: idaapi.til_t :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. py:function:: types\.set(ordinal, name, info, library, \*\*mangled) Assign the type information ``info`` with the specified ``name`` to the given ``ordinal`` of the type ``library``. If the boolean ``mangled`` is specified, then the given name is mangled. :param ordinal: the numerical index of the type to set :type ordinal: int or long :param name: the name of the type to set :type name: str :param info: the :py:obj:`idaapi.tinfo_t` of the type to assign :type info: idaapi.tinfo_t :param library: the :py:obj:`idaapi.til_t` of the library for the type :type library: idaapi.til_t :param \*\*mangled: a boolean that specifies whether the name of the type is mangled .. _ns-database-xref: ************* database.xref ************* Aliases: :ref:`database.x` This namespace is for navigating the cross-references (xrefs) associated with an address in the database. This lets one identify code xrefs from data xrefs and even allows one to add or remove xrefs as they see fit. This namespace is also aliased as :py:obj:`database.x`. Some of the more common functions are used so often that they're also aliased as globals. Some of these are: - :py:obj:`database.up` - Return all addresses that reference an address - :py:obj:`database.down` - Return all addresses that an address references - :py:obj:`database.drefs` - Return all the data references for an address - :py:obj:`database.crefs` - Return all the code references for an address - :py:obj:`database.dxup` - Return all the data references that reference an address - :py:obj:`database.dxdown` - Return all the data references that an address references - :py:obj:`database.cxup` - Return all the code references that reference an address - :py:obj:`database.cxdown` - Return all the code references that an address references Some ways to utilize this namespace can be:: > print( database.x.up() ) > for ea in database.x.down(): ... > for ea in database.x.cu(ea): ... > ok = database.x.add_code(ea, target) > ok = database.x.rm_data(ea) .. py:function:: xref\.add_code(target, \*\*reftype) Add a code reference from the current address to ``target``. Aliases: :py:func:`database.xref.ac` :param target: the target address to add a code reference to :type target: int or long :param \*\*reftype: if ``call`` is set to true, this specify that this reference is a function call .. py:function:: xref\.add_code(ea, target, \*\*reftype) Add a code reference from address ``ea`` to ``target``. If the reftype ``call`` is true, then specify this ref as a function call. Aliases: :py:func:`database.xref.ac` :param ea: an address within the database :type ea: int or long :param target: the target address to add a code reference to :type target: int or long :param \*\*reftype: if ``call`` is set to true, this specify that this reference is a function call .. py:function:: xref\.add_data(target, \*\*reftype) Add a data reference from the current address to ``target``. Aliases: :py:func:`database.xref.ad` :param target: the target address to add a data reference to :type target: int or long :param \*\*reftype: if ``write`` is set to true, then specify that this reference writes to its target .. py:function:: xref\.add_data(ea, target, \*\*reftype) Add a data reference from the address ``ea`` to ``target``. If the reftype ``write`` is true, then specify that this ref is writing to the target. Aliases: :py:func:`database.xref.ad` :param ea: an address within the database :type ea: int or long :param target: the target address to add a data reference to :type target: int or long :param \*\*reftype: if ``write`` is set to true, then specify that this reference writes to its target .. py:function:: xref\.code() Return all of the code xrefs that refer to the current address. Aliases: :py:func:`database.crefs` .. py:function:: xref\.code(descend) Aliases: :py:func:`database.crefs`, :py:func:`database.xref.c` :param descend: a boolean that specifies to only return references that are referred by the current address :type descend: bool .. py:function:: xref\.code(ea) Return all of the code xrefs that refer to the address ``ea``. Aliases: :py:func:`database.crefs`, :py:func:`database.xref.c` :param ea: an address within the database :type ea: int or long .. py:function:: xref\.code(ea, descend) Return all of the code xrefs that refer to the address ``ea``. If the bool ``descend`` is defined, then return only code refs that are referred by the specified address. Aliases: :py:func:`database.crefs`, :py:func:`database.xref.c` :param ea: an address within the database :type ea: int or long :param descend: a boolean that specifies to only return references that are referred by the address :type descend: bool .. py:function:: xref\.code_down() Return all of the code xrefs that are referenced by the current address. Aliases: :py:func:`database.cxdown`, :py:func:`database.xref.cd` .. py:function:: xref\.code_down(ea) Return all of the code xrefs that are referenced by the address ``ea``. Aliases: :py:func:`database.cxdown`, :py:func:`database.xref.cd` :param ea: an address within the database :type ea: int or long .. py:function:: xref\.code_up() Return all of the code xrefs that are referenced by the current address. Aliases: :py:func:`database.xref.cu`, :py:func:`database.cxup` .. py:function:: xref\.code_up(ea) Return all of the code xrefs that refer to the address ``ea``. Aliases: :py:func:`database.xref.cu`, :py:func:`database.cxup` :param ea: an address within the database :type ea: int or long .. py:function:: xref\.data() Return all of the data xrefs that refer to the current address. Aliases: :py:func:`database.xref.d`, :py:func:`database.drefs` .. py:function:: xref\.data(descend) Aliases: :py:func:`database.xref.d`, :py:func:`database.drefs` :param descend: a boolean that specifies to only return references that are referred by the current address :type descend: bool .. py:function:: xref\.data(ea) Return all of the data xrefs that refer to the address ``ea``. Aliases: :py:func:`database.xref.d`, :py:func:`database.drefs` :param ea: an address within the database :type ea: int or long .. py:function:: xref\.data(ea, descend) Return all of the data xrefs that refer to the address ``ea``. If the bool ``descend`` is defined, then return only the data refs that are referred by the specified address. Aliases: :py:func:`database.xref.d`, :py:func:`database.drefs` :param ea: an address within the database :type ea: int or long :param descend: a boolean that specifies to only return references that are referred by the current address :type descend: bool .. py:function:: xref\.data_down() Return all of the data xrefs that are referenced by the current address. Aliases: :py:func:`database.xref.dd`, :py:func:`database.dxdown` .. py:function:: xref\.data_down(ea) Return all of the data xrefs that are referenced by the address ``ea``. Aliases: :py:func:`database.xref.dd`, :py:func:`database.dxdown` :param ea: an address within the database :type ea: int or long .. py:function:: xref\.data_up() Return all of the data xrefs that refer to the current address. Aliases: :py:func:`database.xref.du`, :py:func:`database.dxup` .. py:function:: xref\.data_up(ea) Return all of the data xrefs that refer to the address ``ea``. Aliases: :py:func:`database.xref.du`, :py:func:`database.dxup` :param ea: an address within the database :type ea: int or long .. py:function:: xref\.down() Return all of the references that are referred by the current address. Aliases: :py:func:`database.down`, :py:func:`database.xref.d` .. py:function:: xref\.down(ea) Return all of the references that are referred by the address ``ea``. Aliases: :py:func:`database.down`, :py:func:`database.xref.d` :param ea: an address within the database :type ea: int or long .. py:function:: xref\.erase() Clear all references at the current address. Aliases: :py:func:`database.xref.rx` .. py:function:: xref\.erase(ea) Clear all references at the address ``ea``. Aliases: :py:func:`database.xref.rx` :param ea: an address within the database containing a code or a data reference :type ea: int or long .. py:function:: xref\.rm_code() Delete _all_ the code references at the current address. Aliases: :py:func:`database.xref.rc` .. py:function:: xref\.rm_code(ea) Delete _all_ the code references at ``ea``. Aliases: :py:func:`database.xref.rc` :param ea: an address within the database containing a code reference :type ea: int or long .. py:function:: xref\.rm_code(ea, target) Delete any code references at ``ea`` that point to address ``target``. Aliases: :py:func:`database.xref.rc` :param ea: an address within the database containing a code reference :type ea: int or long :param target: the target address that the reference points to :type target: int or long .. py:function:: xref\.rm_data() Delete _all_ the data references at the current address. Aliases: :py:func:`database.xref.rd` .. py:function:: xref\.rm_data(ea) Delete _all_ the data references at ``ea``. Aliases: :py:func:`database.xref.rd` :param ea: an address within the database containing a data reference :type ea: int or long .. py:function:: xref\.rm_data(ea, target) Delete any data references at ``ea`` that point to address ``target``. Aliases: :py:func:`database.xref.rd` :param ea: an address within the database containing a data reference :type ea: int or long :param target: the target address that the reference points to :type target: int or long .. py:function:: xref\.up() Return all of the references that refer to the current address. Aliases: :py:func:`database.xref.u`, :py:func:`database.up` .. py:function:: xref\.up(ea) Return all of the references that refer to the address ``ea``. Aliases: :py:func:`database.xref.u`, :py:func:`database.up` :param ea: an address within the database :type ea: int or long