3.1.1. database – Database module¶

This module exposes a number of tools that can be used on a database and on addresses within the database. There are a number of namespaces that allow one to query information about the database as a whole, or to read/write to an address within the database.

The base argument type for many of the utilites within this module is the address. This can allow one to modify the colors or comments for an address, or to read/write from the different types of data that might exist at an address.

Some namespaces are also provided for querying the available symbolic information that IDA has discovered about a binary. This can be used to search and navigate the database. Some of the available namespaces that can be used for querying are functions, segments, names, imports, entries, and marks.

3.1.1.1. Function list¶

The functions that are available in this module use multicased functions and aliases. For more information on this, please see Aliases and Multicased functions.

database.bottom()¶: Return the very highest address within the database.

database.color()¶: Return the color (RGB) for the item at the current address.

database.color(none)

Remove the color from the item at the current address.

Parameters:	none (None) – the python value `None`

database.color(ea)

Return the color (RGB) for the item at the address specified by ea.

Parameters:	ea (int or long) – an address in the database

database.color(ea, none)

Remove the color from the item at the the address specified by ea.

Parameters:	ea (int or long) – an address in the database none (None) – the python value `None`

database.color(ea, rgb)

Set the color for the item at address ea to rgb.

Parameters:	ea (int or long) – an address in the database rgb (int or long) – the color as a red, green, and blue integer (`0x00RRGGBB`)

database.comment(**repeatable)¶

Return the comment at the current address.

Parameters:	**repeatable – a boolean specifying that the repeatable comment should be returned

database.comment(ea, **repeatable)

Return the comment at the address ea.

If the bool repeatable is specified, then return the repeatable comment.

Parameters:	ea (int or long) – an address in the database **repeatable – a boolean specifying that the repeatable comment should be returned

database.comment(string, **repeatable)

Set the comment at the current address to string.

Parameters:	string (str) – the comment to apply **repeatable – a boolean specifying that the repeatable comment should be modified

database.comment(none, **repeatable)

Remove the comment at the current address.

Parameters:	none (None) – the python value `None` **repeatable – a boolean specifying that the repeatable comment should be removed

database.comment(ea, string, **repeatable)

Set the comment at the address ea to string.

If the bool repeatable is specified, then modify the repeatable comment.

Parameters:	ea (int or long) – an address in the database string (str) – the comment to apply **repeatable – a boolean specifying that the repeatable comment should be modified

database.comment(ea, none, **repeatable)

Remove the comment at the address ea.

If the bool repeatable is specified, then remove the repeatable comment.

Parameters:	ea (int or long) – an address in the database none (None) – the python value `None` **repeatable – a boolean specifying that the repeatable comment should be removed

database.disassemble(**options)¶

Disassemble the instructions at the current address.

Parameters:	**options – if `count` is specified as an integer, this will specify the number of instructions to disassemble. if `comments` is specified as a boolean, this will determine whether comments are included or not.

database.disassemble(ea, **options)

Disassemble the instructions at the address specified by ea.

If the integer count is specified, then return count number of instructions. If the bool comments is true, then return the comments for each instruction as well.

Aliases: database.disasm

Parameters:	ea (int or long) – an address within the database **options – if `count` is specified as an integer, this will specify the number of instructions to disassemble. if `comments` is specified as a boolean, this will determine whether comments are included or not.

database.go(ea)¶

Jump to the specified address at ea.

Parameters:	ea – an address in the database

database.go_offset(offset)¶

Jump to the specified offset within the database.

Aliases: database.goof, database.gotooffset, database.gooffset, database.goto_offset

Parameters:	offset – an offset from the base address

database.here()¶: Return the current address.

database.instruction()¶: Return the instruction at the current address as a string.

database.instruction(ea)

Return the instruction at the address ea as a string.

Parameters:	ea (int or long) – an address within the database

database.mangled()¶

Return the mangled name at the current address.

Aliases: database.mangle

database.mangled(ea)

Return the mangled name at the address specified by ea.

Aliases: database.mangle

Parameters:	ea (int or long) – an address in the database containing a name

database.mangled(string, *suffix)

Rename the current address to the mangled version of string and return its previous mangled value.

Aliases: database.mangle

Parameters:	string (str) – a string to use as the name *suffix – any other integers or strings to append to the name

database.mangled(none)

Remove the mangled name at the current address and return its previous mangled value.

Aliases: database.mangle

Parameters:	none (None) – the python value `None`

database.mangled(ea, string, *suffix)

Rename the address specified by ea to the mangled version of string and return its previous mangled value.

Aliases: database.mangle

Parameters:	ea (int or long) – an address in the database string (str) – a string to use as the name *suffix – any other integers or strings to append to the name

database.mangled(ea, none)

Remove the name at the address specified by ea and return its previous mangled value.

Aliases: database.mangle

Parameters:	ea (int or long) – an address in the database containing a name none (None) – the python value `None`

database.mark()¶: Return the mark at the current address.

database.mark(none)

Remove the mark at the current address.

Parameters:	none (None) – the python value `None`

database.mark(ea)

Return the mark at the specified address ea.

Parameters:	ea (int or long) – an address within the database containing a mark

database.mark(description)

Set the mark at the current address to the specified description.

Parameters:	description (str) – the description to set the mark with

database.mark(ea, none)

Erase the mark at address ea.

Parameters:	ea (int or long) – the address of an existing mark within the database none (None) – the python value `None`

database.mark(ea, description)

Sets the mark at address ea to the specified description.

Parameters:	ea (int or long) – the address within the database to set a mark at description (str) – the address to set the mark with

database.name(**flags)¶

Return the name at the current address.

Parameters:	*flags – any number of `idaapi.GN_` flags to use when fetching the name

database.name(ea, **flags)

Return the name defined at the address specified by ea.

If flags is specified, then use the specified value as the flags.

Parameters:	ea (int or long) – an address in the database *flags – any number of `idaapi.GN_` flags to use when fetching the name

database.name(packed, **flags)

Renames the current address to the given packed name.

Parameters:	packed (tuple) – a tuple of integers or strings to use for the name *flags – any number of `idaapi.SN_` flags to use when setting the name

database.name(string, *suffix, **flags)

Renames the current address to string.

Parameters:	string (str) – a string to use as the name suffix – any other integers or strings to append to the name flags – any number of `idaapi.SN_` flags to use when setting the name

database.name(none, **flags)

Removes the name at the current address.

Parameters:	none (None) – the python value `None` *flags – any number of `idaapi.SN_` flags to use when setting the name

database.name(ea, packed, **flags)

Renames the address specifed by ea to the given packed name.

Parameters:	ea – an address in the database packed (tuple) – a tuple of integers or strings to use for the name *flags – any number of `idaapi.SN_` flags to use when setting the name

database.name(ea, string, *suffix, **flags)

Renames the address specified by ea to string.

If ea is pointing to a global and is not contained by a function, then by default the label will be added to the Names list. If flags is specified, then use the specified value as the flags. If the boolean listed is specified, then specify whether to add the label to the Names list or not.

Parameters:	ea (int or long) – an address in the database string (str) – a string to use as the name suffix – any other integers or strings to append to the name flags – any number of `idaapi.SN_` flags to use when setting the name

database.name(ea, none, **flags)

Removes the name defined at the address ea.

Parameters:	ea (int or long) – an address in the database none (None) – the python value `None` *flags – any number of `idaapi.SN_` flags to use when removing the name

database.read()¶: Return the bytes defined at the current address.

database.read(ea)

Return the number of bytes associated with the address ea.

Parameters:	ea (int or long) – the address to read bytes from

database.read(ea, size)

Return size number of bytes from address ea.

Parameters:	ea (int or long) – the address to read bytes from size (int or long) – the number of bytes to read

database.read(bounds)

Return the bytes within the specified bounds.

Parameters:	bounds (tuple) – a tuple containing the boundaries to return the bytes from

database.select(tag, *And, **boolean)¶

Query all of the global tags in the database for the specified tag and any others specified as And.

Parameters:	tag (str) – a required tag name to search for And – any other required tag names *boolean – either `And` or `Or` which specifies required or optional tags (respectively)

database.select(**boolean)

Query all the global tags for any tags specified by boolean. Yields each address found along with the matching tags as a dictionary.

If And contains an iterable then require the returned address contains them. If Or contains an iterable then include any other tags that are specified.

Parameters:	**boolean – either `And` or `Or` which specifies required or optional tags (respectively)

database.selectcontents(tag, *Or, **boolean)¶

Query all function contents for the specified tag or any others specified as Or.

Parameters:	tag (str) – a required tag name to search for Or – any other optional tag names *boolean – either `And` or `Or` which specifies required or optional tags (respectively)

database.selectcontents(**boolean)

Query all function contents for any tags specified by boolean. Yields each function and the tags that match as a set.

If And contains an iterable then require the returned function contains them. If Or contains an iterable then include any other tags that are specified.

Parameters:	**boolean – either `And` or `Or` which specifies required or optional tags (respectively)

database.tag()¶: Return all of the tags defined at the current address.

database.tag(ea)

Return all of the tags defined at address ea.

Parameters:	ea (int or long) – an address in the database

database.tag(key)

Return the tag identified by key at the current address.

Parameters:	key (str) – a string representing the tag name to return

database.tag(key, value)

Set the tag identified by key to value at the current address.

Parameters:	key (str) – a string representing the tag name to assign to value – a python object to store at the tag

database.tag(ea, key)

Return the tag identified by key from the address ea.

Parameters:	ea (int or long) – an address in the database key (str) – a string representing the tag name to return

database.tag(ea, key, value)

Set the tag identified by key to value at the address ea.

Parameters:	ea (int or long) – an address in the database key (str) – a string representing the tag name to assign value – a python object to store at the tag

database.tag(key, none)

Remove the tag identified by key from the current address.

Parameters:	key (str) – a string representing the tag name to remove none (None) – the python value `None`

database.tag(ea, key, none)

Removes the tag identified by key at the address ea.

Parameters:	ea (int or long) – an address in the database key (str) – a string representing the tag name to remove none (None) – the python value `None`

database.tags()¶: Return all of the tag names used globally within the database.

database.top()¶: Return the very lowest address within the database.

database.unmangled()¶

Return the name at the current address in its unmangled form.

Aliases: database.unmangle, database.demangled, database.demangle

database.unmangled(ea)

Return the name at the address specified by ea in its unmangled form.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:	ea (int or long) – an address in the database containing a name

database.unmangled(string, *suffix)

Rename the current address using the mangled version of string and return its previous unmangled value.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:	string (str) – a string to use as the name *suffix – any other strings to append to the name

database.unmangled(none)

Remove the name at the current address and return its previous unmangled value.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:	none (None) – the python value `None`

database.unmangled(ea, string, *suffix)

Rename the address specified by ea using the mangled version of string and return its previous unmangled value.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:	ea (int or long) – an address in the database string (str) – a string to use as the name *suffix – any other strings to append to the name

database.unmangled(ea, none)

Remove the name at the address specified by ea and return its previous unmangled value.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:	ea (int or long) – an address in the database containing a name none (None) – the python value `None`

database.within()¶

Should always return true.

Aliases: database.contains

database.within(ea)

Return true if address ea is within the bounds of the database.

Aliases: database.contains

Parameters:	ea (int or long) – an address within the database

database.write(data, **persist)¶

Modify the database at the current address with the bytes specified in data.

Parameters:	data (bytes) – the data to write **persist – if `persist` is set to true, then write to the original bytes in the database

database.write(ea, data, **persist)

Modify the database at address ea with the bytes specified in data

If the bool persist is specified, then modify what IDA considers the original bytes.

Parameters:	ea (int or long) – the address to write to data (bytes) – the data to write **persist – if `persist` is set to true, then write to the original bytes in the database

3.1.1.2. Namespace list¶

These are the namespaces available within this module. Namespaces group similar functions that can be used typically for the same concept. Please see Classes as namespaces for more information on namespaces. For more information on multicase functions or aliases, please see Multicased functions or Aliases.

3.1.1.2.1. database.address¶

Aliases: database.a

This namespace is used for translating an address in the database to another address according to a number of constraints or types. Essentially these functions are used to assist with navigation. As an example, these functions allow one to navigate between the next and previous “call” instructions, addresses that contain data references, or even to navigate to unknown (undefined) addresses.

This namespace is also aliased as database.a.

Some of the more common functions are used so often that they’re also aliased as globals. Each of these can be used for navigation or for determining the next valid address. These are:

database.next - Return the “next” defined address
database.prev - Return the “previous” defined address
database.nextref - Return the “next” address with a reference.
database.prevref - Return the “previous” address with a reference
database.nextreg - Return the “next” address using a register
database.prevreg - Return the “previous” address using a register

Some examples of using this namespace can be:

> ea = database.a.next(ea)
> ea = database.a.prevreg(ea, 'edx', write=1)
> ea = database.a.nextref(ea)
> ea = database.a.prevcall(ea)

database.address()¶: Return the current address or a list of addresses for the current selection.

database.address(ea)

Return the address of the item containing the address ea.

Parameters:	ea (int or long) – an address of an item in the database to return

database.address(start, end)

Return a list containing each of the addresses from start to end.

Parameters:	start (int or long) – the address to start at end (int or long) – the address to stop at

database.address(start, end, step)

Return a list containing each of the addresses from start to end using the callable step to determine the next address.

Parameters:	start (int or long) – the address to start at end (int or long) – the address to stop at step (callable) – a callable that seeks to the next address such as `address.next`

database.address(bounds)

Return a list containing each of the addresses within bounds.

Parameters:	bounds (tuple) – the address boundaries to return

database.address(bounds, step)

Return a list containing each of the addresses within bounds using the callable step to determine the next address.

Parameters:	bounds (tuple) – the address boundaries to return step (callable) – a callable that seeks to the next address such as `address.next`

address.blocks()¶: Iterate through the currently selected blocks.

address.blocks(end)

Yields the boundaries of each block from the current address to end.

Parameters:	end (int or long) – the address to stop at

address.blocks(bounds)

Yields the boundaries of each block within the specified bounds.

Parameters:	bounds (tuple) – the boundaries of the blocks to return

address.blocks(start, end)

Yields the boundaries of each block between the addresses start and end.

Parameters:	start (int or long) – the address to start at end (int or long) – the address to stop at

address.bounds()¶: Return the bounds of the current address or selection in a tuple formatted as (left, right).

address.bounds(ea)

Return the bounds of the specified address ea in a tuple formatted as (left, right).

Parameters:	ea (int or long) – the address within the database to return an `interface.bounds_t` from

address.by_fileoffset(offset)¶

Return the address in the database for the specified file offset of the input file.

Aliases: database.address.byfileoffset

Parameters:	offset (int or long) – the file offset to convert into a database address

address.by_offset(offset)¶

Return the specified offset translated to an address in the database.

Aliases: database.address.byoffset, database.by_offset, database.byoffset

Parameters:	offset –

address.fileoffset()¶: Return the file offset in the input file for the current address.

address.fileoffset(ea)

Return the file offset in the input file for the address ea.

Parameters:	ea (int or long) – an address within the database to translate to the file offset

address.head()¶: Return the address of the byte at the beginning of the current address.

address.head(ea)

Return the address of the byte at the beginning of the address ea.

Parameters:	ea (int or long) – an unaligned address within the database

address.iterate()¶: Iterate through the currently selected addresses.

address.iterate(end)

Iterate from the current address to end.

Parameters:	end (int or long) – the address to stop iterating at

address.iterate(end, step)

Iterate from the current address to end using the callable step to determine the next address.

Parameters:	end (int or long) – the address to stop iterating at step (callable) – a callable that seeks to the next address such as `address.next`

address.iterate(start, end)

Iterate from address start to end.

Parameters:	start (int or long) – the address to start iterating at end (int or long) – the address to stop iterating at

address.iterate(start, end, step)

Iterate from address start to end using the callable step to determine the next address.

Parameters:	start (int or long) – the address to start iterating at end (int or long) – the address to stop iterating at step (callable) – a callable that seeks to the next address such as `address.next`

address.iterate(bounds)

Iterate through all of the addresses defined within bounds.

Parameters:	bounds (tuple) – the address boundaries to iterate through

address.iterate(bounds, step)

Iterate through all of the addresses defined within bounds using the callable step to determine the next address.

Parameters:	bounds (tuple) – the address boundaries to iterate through step (callable) – a callable that seeks to the next address such as `address.next`

address.next(**count)¶

Return the next address from the current address.

Aliases: database.next

Parameters:	**count – the number of results to skip

address.next(predicate, **count)

Return the next address from the current address that satisfies the provided predicate.

Aliases: database.next

Parameters:	predicate (callable) – a callable to use when filtering instructions **count – the number of results to skip

address.next(ea)

Return the next address from the address ea.

Aliases: database.next

Parameters:	ea (int or long) – an address within the database

address.next(ea, predicate)

Return the next address from the address ea that satisfies the provided predicate.

Aliases: database.next

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions

address.next(ea, count)

Return the next count addresses from the address specified by ea.

Aliases: database.next

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of results to skip

address.next(ea, predicate, count)

Return the next count addresses from the address ea that satisfies the provided predicate.

Aliases: database.next

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions count (int or long) – the number of results to skip

address.nextF(predicate, **count)¶

Return the next address from the current one that satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering instructions **count – the number of results to skip

address.nextF(ea, predicate, **count)

Return the next address from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions **count – the number of results to skip

address.nextF(ea, predicate, count)

Return the next count addresses from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions count (int or long) – the number of results to skip

address.nextbranch(**count)¶

Return the next branch instruction from the current one.

Parameters:	**count – the number of branch instructions to skip

address.nextbranch(predicate, **count)

Return the next branch instruction that satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering instructions by branch **count – the number of branch instructions to skip

address.nextbranch(ea)

Return the next branch instruction from the address ea.

Parameters:	ea (int or long) – an address within the database

address.nextbranch(ea, predicate, **count)

Return the next branch instruction from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions by branch **count – the number of branch instructions to skip

address.nextbranch(ea, count)

Return the next count branch instructions from the address ea.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of branch instructions to skip

address.nextcall(**count)¶

Return the next call instruction from the current address.

Parameters:	**count – the number of call instructions to skip

address.nextcall(predicate, **count)

Return the next call instruction from the current address that satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering instructions by call **count – the number of call instructions to skip

address.nextcall(ea)

Return the next call instruction from the address ea.

Parameters:	ea (int or long) – an address within the database

address.nextcall(ea, predicate, **count)

Return the next call instruction from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions by call **count – the number of call instructions to skip

address.nextcall(ea, count)

Return the next count call instructions from the address ea.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of call instructions to skip

address.nextcomment(**repeatable)¶

Return the next address from the current one that has any type of comment.

Parameters:	**repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.nextcomment(predicate, **repeatable)

Return the next address from the current one that has any type of comment and satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering addresses by comment **repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.nextcomment(ea, **repeatable)

Return the next address from the address ea that has any type of comment.

Parameters:	ea (int or long) – an address within the database **repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.nextcomment(ea, predicate, **repeatable)

Return the next address from the address ea that has any type of comment and satisfies the provided predicate.

If the bool repeatable is defined, then use it to determine whether to only track repeatable or non-repeatable comments.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering addresses by comment **repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.nextcomment(ea, count, **repeatable)

Return the next count addresses from the address ea that has any type of comment.

If the bool repeatable is defined, then use it to determine whether to only track repeatable or non-repeatable comments.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of comments to skip **repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.nextcref(**count)¶

Return the next address from the current one that has code referencing it.

Aliases: database.address.nextcode

Parameters:	**count – the number of code references to skip

address.nextcref(predicate, **count)

Return the next address from the current one that has code referencing it and satisfies the provided predicate.

Aliases: database.address.nextcode

Parameters:	predicate (callable) – a callable to use when filtering code references **count – the number of code references to skip

address.nextcref(ea)

Return the next address from the address ea that has code referencing it.

Aliases: database.address.nextcode

Parameters:	ea (int or long) – an address within the database

address.nextcref(ea, predicate, **count)

Return the next address from the address ea that has code referencing it and satisfies the provided predicate.

Aliases: database.address.nextcode

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering code references **count –

address.nextcref(ea, count)

Return the next count addresses from the address ea that has code referencing it.

Aliases: database.address.nextcode

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of code references to skip

address.nextdref(**count)¶

Return the next address from the current one that has data referencing it.

Aliases: database.address.nextdata

Parameters:	**count – the number of data references to skip

address.nextdref(predicate, **count)

Return the next address from the current one that has data referencing it and satisfies the provided predicate.

Aliases: database.address.nextdata

Parameters:	predicate (callable) – a callable to use when filtering data references **count – the number of data references to skip

address.nextdref(ea)

Return the next address from the address ea that has data referencing it.

Aliases: database.address.nextdata

Parameters:	ea (int or long) – an address within the database

address.nextdref(ea, predicate, **count)

Return the next address from the address ea that has data referencing it and satisfies the provided predicate.

Aliases: database.address.nextdata

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering data references **count – the number of data references to skip

address.nextdref(ea, count)

Return the next count addresses from the address ea that has data referencing it.

Aliases: database.address.nextdata

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of data references to skip

address.nextfunction(**count)¶

Return the next address from the current address that is within a function.

Aliases: database.address.nextfunc

Parameters:	**count – the number of function addresses to skip

address.nextfunction(ea)

Return the next address from the address ea that is within a function.

Aliases: database.address.nextfunc

Parameters:	ea (int or long) – an address within the database

address.nextfunction(ea, predicate, **count)

Return the next address from the address ea that is within a function and satisfies the provided predicate.

Aliases: database.address.nextfunc

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering function addresses **count – the number of function addresses to skip

address.nextfunction(ea, count)

Return the next count addresses from the address ea that is within a function.

Aliases: database.address.nextfunc

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of function addresses to skip

address.nextlabel(**count)¶

Return the address of the next label from the current address.

Parameters:	**count – the number of labels to skip

address.nextlabel(predicate, **count)

Return the address of the next label from the current address that satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering instructions by label **count – the number of labels to skip

address.nextlabel(ea)

Return the address of the next label from the address ea.

Parameters:	ea (int or long) – an address within the database

address.nextlabel(ea, predicate, **count)

Return the address of the next label from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions by label **count – the number of labels to skip

address.nextlabel(ea, count)

Return the address of the next count labels from the address ea.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of labels to skip

address.nextmnemonic(mnemonics)¶

Return the address of the next instruction from the current address that uses any of the specified mnemonics.

Parameters:	mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against

address.nextmnemonic(mnemonics, predicate, **count)

Return the address of the next instruction from the current address that uses any of the specified mnemonics and satisfies the provided predicate.

Parameters:	mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against predicate (callable) – a callable to use when filtering instructions by mnemonic **count – the number of instructions to skip

address.nextmnemonic(mnemonics, count)

Return the address of the next count instructions from the current address that uses any of the specified mnemonics.

Parameters:	mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against count (int or long) – the number of instructions to skip

address.nextmnemonic(ea, mnemonics)

Return the address of the next instruction from the address ea that uses any of the specified mnemonics.

Parameters:	ea (int or long) – an address within the database mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against

address.nextmnemonic(ea, mnemonics, predicate, **count)

Return the address of the next instruction from the address ea that uses any of the specified mnemonics and satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against predicate (callable) – a callable to use when filtering instructions by mnemonic **count – the number of instructions to skip

address.nextmnemonic(ea, mnemonics, count)

Return the address of the next count instructions from the address ea that uses any of the specified mnemonics.

Parameters:	ea (int or long) – an address within the database mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against count (int or long) – the number of instructions to skip

address.nextref(**count)¶

Return the next address from the current one that has anything referencing it.

Aliases: database.nextref

Parameters:	**count – the number of references to skip

address.nextref(predicate, **count)

Return the next address from the current one that has anything referencing it and satisfies the provided predicate.

Aliases: database.nextref

Parameters:	predicate (callable) – a callable to use when filtering instruction references **count – the number of references to skip

address.nextref(ea)

Return the next address from the address ea that has anything referencing it.

Aliases: database.nextref

Parameters:	ea (int or long) – an address within the database

address.nextref(ea, predicate, **count)

Return the next address from the address ea that has anything referencing it and satisfies the provided predicate.

Aliases: database.nextref

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instruction references **count – the number of references to skip

address.nextref(ea, count)

Return the next count addresses from the address ea that has anything referencing it.

Aliases: database.nextref

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of references to skip

address.nextreg(reg, *regs, **modifiers)¶

Return the next address containing an instruction that uses reg or any one of the specified regs.

Aliases: database.nextreg

Parameters:	reg (str or register_t) – a register of some kind regs – any other registers to match for *modifiers – if `write` or `read` is true, then only return addresses where the specified registers are written to or read from (respectively)

address.nextreg(predicate, reg, *regs, **modifiers)

Return the next address containing an instruction uses reg or any one of the specified regs and satisfies the provided predicate.

Aliases: database.nextreg

Parameters:	predicate (callable) – a callable to use when filtering instructions by register reg (str or register_t) – a register of some kind regs – any other registers to match for *modifiers – if `write` or `read` is true, then only return addresses where the specified registers are written to or read from (respectively)

address.nextreg(ea, reg, *regs, **modifiers)

Return the next address from the address ea containing an instruction that uses reg or any one of the specified regs.

Aliases: database.nextreg

Parameters:	ea (int or long) – an address within the database reg (str or register_t) – a register of some kind regs – any other registers to match for *modifiers – if `write` or `read` is true, then only return addresses where the specified registers are written to or read from (respectively)

address.nextreg(ea, predicate, reg, *regs, **modifiers)

Return the next address from the address ea containing an instruction that uses reg or any one of the specified regs and satisfies the provided predicate.

Aliases: database.nextreg

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions by register reg (str or register_t) – a register of some kind regs – any other registers to match for *modifiers – if `write` or `read` is true, then only return addresses where the specified registers are written to or read from (respectively)

address.nextstack(delta)¶

Return the next instruction from the current one that is past the sp delta.

Aliases: database.address.nextdelta

Parameters:	delta (int or long) – the stack delta to find the edge of

address.nextstack(ea, delta)

Return the next instruction from the address ea that is past the sp delta.

Aliases: database.address.nextdelta

Parameters:	ea (int or long) – an address within the database delta (int or long) – the stack delta to find the edge of

address.nexttag(**tagname)¶

Return the next address that contains a tag using the specified tagname.

Parameters:	**tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.nexttag(predicate, **tagname)

Return the next address that contains a tag using the specified tagname and satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering addresses by tag **tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.nexttag(ea, **tagname)

Return the next address from ea that contains a tag using the specified tagname.

Aliases: database.address.nextcomment

Parameters:	ea (int or long) – an address within the database **tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.nexttag(ea, predicate, **tagname)

Return the next address from ea that contains a tag using the specified tagname and satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering addresses by tag **tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.nexttag(ea, count, **tagname)

Return the next count addresses from ea that contains a tag using the specified tagname.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of tags to skip **tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.nextunknown(**count)¶

Return the next address from the current one that is undefined.

Parameters:	**count – the number of unknown addresses to skip

address.nextunknown(predicate, **count)

Return the next address from the current one that is undefined and satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering unknown addresses **count – the number of unknown addresses to skip

address.nextunknown(ea)

Return the next address from the address ea that is undefined.

Parameters:	ea (int or long) – an address within the database

address.nextunknown(ea, predicate, **count)

Return the next address from the address ea that is undefined and satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering unknown addresses **count – the number of unknown addresses to skip

address.nextunknown(ea, count)

Return the next count addresses from the address ea that is undefined.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of unknown addresses to skip

address.offset()¶

Return the current address translated to an offset relative to the base address of the database.

Aliases: database.get_offset, database.address.getoffset, database.getoffset, database.offset

address.offset(ea)

Return the address ea translated to an offset relative to the base address of the database.

Aliases: database.get_offset, database.address.getoffset, database.getoffset, database.offset

Parameters:	ea (int or long) – an address within the database to translate to an offset from the beginning of the database

address.prev(**count)¶

Return the previous address from the current address.

Aliases: database.prev

Parameters:	**count – the number of results to skip

address.prev(predicate, **count)

Return the previous address from the current address that satisfies the provided predicate.

Aliases: database.prev

Parameters:	predicate (callable) – a callable to use when filtering instructions **count – the number of results to skip

address.prev(ea)

Return the previous address from the address specified by ea.

Aliases: database.prev

Parameters:	ea (int or long) – an unaligned address within the database

address.prev(ea, predicate)

Return the previous address from the address ea that satisfies the provided predicate.

Aliases: database.prev

Parameters:	ea (int or long) – an unaligned address within the database predicate (callable) – a callable to use when filtering instructions

address.prev(ea, count)

Return the previous count addresses from the address specified by ea.

Aliases: database.prev

Parameters:	ea (int or long) – an unaligned address within the database count (int or long) – the number of results to skip

address.prev(ea, predicate, count)

Return the previous count addresses from the address ea that satisfies the provided predicate.

Aliases: database.prev

Parameters:	ea (int or long) – an unaligned address within the database predicate (callable) – a callable to use when filtering instructions count (int or long) – the number of results to skip

address.prevF(predicate, **count)¶

Return the previous address from the current one that satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering instructions **count – the number of results to skip

address.prevF(ea, predicate, **count)

Return the previous address from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions **count – the number of results to skip

address.prevF(ea, predicate, count)

Return the previous count addresses from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions count (int or long) – the number of results to skip

address.prevbranch(**count)¶

Return the previous branch instruction from the current one.

Parameters:	**count – the number of branch instructions to skip

address.prevbranch(predicate, **count)

Return the previous branch instruction from the current one that satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering instructions by branch **count – the number of branch instructions to skip

address.prevbranch(ea)

Return the previous branch instruction from the address ea.

Parameters:	ea (int or long) – an address within the database

address.prevbranch(ea, predicate, **count)

Return the previous branch instruction from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions by branch **count – the number of branch instructions to skip

address.prevbranch(ea, count)

Return the previous count branch instructions from the address ea.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of branch instructions to skip

address.prevcall(**count)¶

Return the previous call instruction from the current address.

Parameters:	**count – the number of call instructions to skip

address.prevcall(predicate, **count)

Return the previous call instruction from the current address that satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering instructions by call **count – the number of call instructions to skip

address.prevcall(ea)

Return the previous call instruction from the address ea.

Parameters:	ea (int or long) – an address within the database

address.prevcall(ea, predicate, **count)

Return the previous call instruction from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions by call **count – the number of call instructions to skip

address.prevcall(ea, count)

Return the previous count call instructions from the address ea.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of call instructions to skip

address.prevcomment(**repeatable)¶

Return the previous address from the current one that has any type of comment.

Parameters:	**repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.prevcomment(predicate, **repeatable)

Return the previous address from the current one that has any type of comment and satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering addresses by comment **repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.prevcomment(ea, **repeatable)

Return the previous address from the address ea that has any type of comment.

Parameters:	ea (int or long) – an address within the database **repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.prevcomment(ea, predicate, **repeatable)

Return the previous address from the address ea that has any type of comment and satisfies the provided predicate.

If the bool repeatable is defined, then use it to determine whether to only track repeatable or non-repeatable comments.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering addresses by comment **repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.prevcomment(ea, count, **repeatable)

Return the previous count addresses from the address ea that has any type of comment.

If the bool repeatable is defined, then use it to determine whether to only track repeatable or non-repeatable comments.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of comments to skip **repeatable – used to specify whether to filter by repeatable or non-repeatable comment

address.prevcref(**count)¶

Return the previous address from the current one that has code referencing it.

Aliases: database.address.prevcode

Parameters:	**count – the number of code references to skip

address.prevcref(predicate, **count)

Return the previous address from the current one that has code referencing it and satisfies the provided predicate.

Aliases: database.address.prevcode

Parameters:	predicate (callable) – a callable to use when filtering data references **count – the number of code references to skip

address.prevcref(ea)

Return the previous address from the address ea that has code referencing it.

Aliases: database.address.prevcode

Parameters:	ea (int or long) – an address within the database

address.prevcref(ea, predicate, **count)

Return the previous address from the address ea that has code referencing it and satisfies the provided predicate.

Aliases: database.address.prevcode

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering code references **count – the number of code references to skip

address.prevcref(ea, count)

Return the previous count addresses from the address ea that has code referencing it.

Aliases: database.address.prevcode

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of code references to skip

address.prevdref(**count)¶

Return the previous address from the current one that has data referencing it.

Aliases: database.address.prevdata

Parameters:	**count – the number of data references to skip

address.prevdref(predicate, **count)

Return the previous address from the current one that has data referencing it and satisfies the provided predicate.

Aliases: database.address.prevdata

Parameters:	predicate (callable) – a callable to use when filtering data references **count – the number of data references to skip

address.prevdref(ea)

Return the previous address from the address ea that has data referencing it.

Aliases: database.address.prevdata

Parameters:	ea (int or long) – an address within the database

address.prevdref(ea, predicate, **count)

Return the previous address from the address ea that has data referencing it and satisfies the provided predicate.

Aliases: database.address.prevdata

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering data references **count – the number of data references to skip

address.prevdref(ea, count)

Return the previous count addresses from the address ea that has data referencing it.

Aliases: database.address.prevdata

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of data references to skip

address.prevfunction(**count)¶

Return the previous address from the current address that is within a function.

Aliases: database.address.prevfunc

Parameters:	**count – the number of function addresses to skip

address.prevfunction(ea)

Return the previous address from the address ea that is within a function.

Aliases: database.address.prevfunc

Parameters:	ea (int or long) – an address within the database

address.prevfunction(ea, predicate, **count)

Return the previous address from the address ea that is within a function and satisfies the provided predicate.

Aliases: database.address.prevfunc

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering function addresses **count – the number of function addresses to skip

address.prevfunction(ea, count)

Return the previous count addresses from the address ea that is within a function.

Aliases: database.address.prevfunc

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of function addresses to skip

address.prevlabel(**count)¶

Return the address of the previous label from the current address.

Parameters:	**count – the number of labels to skip

address.prevlabel(predicate, **count)

Return the address of the previous label from the current address that satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering instructions by label **count – the number of labels to skip

address.prevlabel(ea)

Return the address of the previous label from the address ea.

Parameters:	ea (int or long) – an address within the database

address.prevlabel(ea, predicate, **count)

Return the address of the previous label from the address ea that satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions by label **count – the number of labels to skip

address.prevlabel(ea, count)

Return the address of the previous count labels from the address ea.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of labels to skip

address.prevmnemonic(mnemonics)¶

Return the address of the previous instruction from the current address that uses any of the specified mnemonics.

Parameters:	mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against

address.prevmnemonic(mnemonics, predicate, **count)

Return the address of the previous instruction from the current address that uses any of the specified mnemonics and satisfies the provided predicate.

Parameters:	mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against predicate (callable) – a callable to use when filtering instructions by mnemonic **count – the number of instructions to skip

address.prevmnemonic(mnemonics, count)

Return the address of the previous count instructions from the current address that uses any of the specified mnemonics.

Parameters:	mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against count (int or long) – the number of instructions to skip

address.prevmnemonic(ea, mnemonics)

Return the address of the previous instruction from the address ea that uses any of the specified mnemonics.

Parameters:	ea (int or long) – an address within the database mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against

address.prevmnemonic(ea, mnemonics, predicate, **count)

Return the address of the previous instruction from the address ea that uses any of the specified mnemonics and satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against predicate (callable) – a callable to use when filtering instructions by mnemonic **count – the number of instructions to skip

address.prevmnemonic(ea, mnemonics, count)

Return the address of the previous count instructions from the address ea that uses any of the specified mnemonics.

Parameters:	ea (int or long) – an address within the database mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against count (int or long) – the number of instructions to skip

address.prevref(**count)¶

Return the previous address from the current one that has anything referencing it.

Aliases: database.prevref

Parameters:	**count – the number of references to skip

address.prevref(predicate, **count)

Return the previous address from the current one that has anything referencing it and satisfies the provided predicate.

Aliases: database.prevref

Parameters:	predicate (callable) – a callable to use when filtering instruction references **count – the number of references to skip

address.prevref(ea)

Return the previous address from the address ea that has anything referencing it.

Aliases: database.prevref

Parameters:	ea (int or long) – an address within the database

address.prevref(ea, predicate, **count)

Return the previous address from the address ea that has anything referencing it and satisfies the provided predicate.

Aliases: database.prevref

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instruction references **count – the number of references to skip

address.prevref(ea, count)

Return the previous count addresses from the address ea that has anything referencing it.

Aliases: database.prevref

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of references to skip

address.prevreg(reg, *regs, **modifiers)¶

Return the previous address containing an instruction that uses reg or any one of the specified regs.

Aliases: database.prevreg

Parameters:	reg (str or register_t) – a register of some kind regs – any other registers to match for *modifiers – if `write` or `read` is true, then only return addresses where the specified registers are written to or read from (respectively)

address.prevreg(predicate, reg, *regs, **modifiers)

Return the previous address containing an instruction that uses reg or any one of the specified regs and satisfies the provided predicate.

Aliases: database.prevreg

Parameters:	predicate (callable) – a callable to use when filtering instructions by register reg (str or register_t) – a register of some kind regs – any other registers to match for *modifiers – if `write` or `read` is true, then only return addresses where the specified registers are written to or read from (respectively)

address.prevreg(ea, reg, *regs, **modifiers)

Return the previous address from the address ea containing an instruction that uses reg or any one of the specified regs.

Aliases: database.prevreg

Parameters:	ea (int or long) – an address within the database reg (str or register_t) – a register of some kind regs – any other registers to match for *modifiers – if `write` or `read` is true, then only return addresses where the specified registers are written to or read from (respectively)

address.prevreg(ea, predicate, reg, *regs, **modifiers)

Return the previous address from the address ea containing an instruction that uses reg or any one of the specified regs and satisfies the provided predicate.

Aliases: database.prevreg

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering instructions by register reg (str or register_t) – a register of some kind regs – any other registers to match for *modifiers – if `write` or `read` is true, then only return addresses where the specified registers are written to or read from (respectively)

address.prevstack(delta)¶

Return the previous instruction from the current one that is past the specified sp delta.

Aliases: database.address.prevdelta

Parameters:	delta (int or long) – the stack delta to find the edge of

address.prevstack(ea, delta)

Return the previous instruction from the address ea that is past the specified sp delta.

Aliases: database.address.prevdelta

Parameters:	ea (int or long) – an address within the database delta (int or long) – the stack delta to find the edge of

address.prevtag(**tagname)¶

Return the previous address that contains a tag using the specified tagname.

Parameters:	**tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.prevtag(predicate, **tagname)

Return the previous address that contains a tag using the specified tagname and satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering addresses by tag **tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.prevtag(ea, **tagname)

Return the previous address from ea that contains a tag using the specified tagname.

Parameters:	ea (int or long) – an address within the database **tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.prevtag(ea, predicate, **tagname)

Return the previous address from ea that contains a tag using the specified tagname and satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering addresses by tag **tagname – if `tagname` is assigned as a string, then only match against the specified tag otherwise look for any kind of comment

address.prevtag(ea, count, **tagname)

Return the previous count addresses from ea that contains a tag using the specified tagname.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of tags to skip **tagname – if `tagname` is assigned a string, then only match against the specified tag otherwise look for any kind of comment

address.prevunknown(**count)¶

Return the previous address from the current one that is undefined.

Parameters:	**count – the number of unknown addresses to skip

address.prevunknown(predicate, **count)

Return the previous address from the current one that is undefined and satisfies the provided predicate.

Parameters:	predicate (callable) – a callable to use when filtering unknown addresses **count – the number of unknown addresses to skip

address.prevunknown(ea)

Return the previous address from the address ea that is undefined.

Parameters:	ea (int or long) – an address within the database

address.prevunknown(ea, predicate, **count)

Return the previous address from the address ea that is undefined and satisfies the provided predicate.

Parameters:	ea (int or long) – an address within the database predicate (callable) – a callable to use when filtering unknown addresses **count – the number of unknown addresses to skip

address.prevunknown(ea, count)

Return the previous count addresses from the address ea that is undefined.

Parameters:	ea (int or long) – an address within the database count (int or long) – the number of unknown addresses to skip

address.tail()¶: Return the last byte at the end of the current address.

address.tail(ea)

Return the address of the last byte at the end of the address at ea.

Parameters:	ea (int or long) – an unaligned address within the database

3.1.1.2.2. database.config¶

This namespace contains various read-only properties about the database. This includes things such as the database boundaries, its filename, the path to the generated database, etc. Some tools for determining the type of the binary are also included.

config.apptype()¶: Return the application type identified by the loader when creating the database.

config.apptype(apptype_t)

Set the application type for the database to the specified apptype_t.

Parameters:	apptype_t (int or long) – a string representing one of the `idaapi.APPT_*` types to apply

config.apptype(APPT_)

Set the application type for the database to the value for the string APPT_.

Parameters:	APPT (str) – an enumeration containing one of the `idaapi.APPT_*` types to apply

config.baseaddress()¶

Return the baseaddress of the database.

Aliases: database.baseaddress, database.base

config.bits()¶: Return number of bits of the processor used by the database.

config.bitsize()¶: Return the number of bits used by the database.

config.bounds()¶

Return the bounds of the current database in a tuple formatted as (left, right).

Aliases: database.range

config.byteorder()¶: Return a string representing the byte-order used by integers in the database.

config.changes()¶: Return the number of changes within the database.

config.compiler()¶: Return the compiler that was configured for the database.

config.entry()¶: Return the first entry point for the database.

config.filename()¶: Return the filename that the database was built from.

config.filetype()¶: Return the file type identified by the loader when creating the database.

config.filetype(filetype_t)

Set the file type identified by the loader to the specified filetype_t.

Parameters:	filetype_t (int or long) – a string representing one of the `idaapi.FT_*` types to apply

config.filetype(FT_)

Set the file type identified by the loader to the value for the string FT_.

Parameters:	FT (str) – an enumeration containing one of the `idaapi.FT_*` types to apply

config.idb()¶

Return the full path to the database.

Aliases: database.config.database, database.idb

config.is_kernelspace()¶

Return whether the database is using a kernelmode address space or not.

Aliases: database.config.kernelQ, database.config.kernelspaceQ

config.is_readonly()¶

Return whether the database is read-only or not.

Aliases: database.config.readonlyQ

config.is_sharedobject()¶

Return whether the database is a shared-object or not.

Aliases: database.config.sharedQ, database.config.is_shared, database.config.sharedobject

config.lflags()¶: Return the value of the idainfo.lflags field from the database.

config.lflags(mask)

Return the value of the idainfo.lflags field from the database with the specified mask.

Parameters:	mask (int or long) – the mask to apply to the lflags that are returned

config.lflags(mask, value)

Set the idainfo.lflags with the provided mask from the database to the specified value.

Parameters:	mask (int or long) – the mask to apply to the lflags before applying the value value (int or long) – the value to apply to the lflags

config.main()¶

config.margin()¶: Return the current margin position for the current database.

config.module()¶

Return the module name as per the windows loader.

Aliases: database.module

config.ostype()¶: Return the operating system type identified by the loader when creating the database.

config.ostype(ostype_t)

Set the operating system type for the database to the specified ostype_t.

Parameters:	ostype_t (int or long) – a string representing one of the `idaapi.OSTYPE_*` types to apply

config.ostype(OSTYPE_)

Set the operating system type for the database to the value for the string OSTYPE_.

Parameters:	OSTYPE (str) –

config.path()¶

Return the absolute path to the directory containing the database.

Aliases: database.path

config.path(pathname, *components)

Return an absolute path composed of the provided pathname and any additional components relative to the directory containing the database.

Parameters:	pathname (str) – *components –

config.processor()¶: Return the name of the processor used by the database.

config.size()¶: Return the number of bytes used by the database which can be used to distinguish whether you’re running 32-bit or 64-bit.

config.type(typestr)¶

Evaluates a type string and returns its size according to the compiler used by the database.

Parameters:	typestr – this is a c-like type specification

config.version()¶: Return the version of the database.

3.1.1.2.2.1. database.config.register¶

This namespace returns the available register names and their sizes for the database.

config.register.codesegment()¶: Return all of the code segment registers in the database.

config.register.datasegment()¶: Return all of the data segment registers in the database.

config.register.names()¶: Return all of the register names in the database.

config.register.segmentbits()¶: Return the segment register size for the database.

config.register.segments()¶: Return all of the segment registers in the database.

3.1.1.2.3. database.entries¶

Aliases: database.exports

This namespace can be used to enumerate all of the entry points and exports that are defined within the database By default the address of each entrypoint will be yielded.

This namespace is also aliased as database.exports.

When listing entry points that are matched, the following legend can be used to identify certain characteristics about them:

F - The entry point is referencing a function
C - The entry point is referencing code
A - The entry point is referencing data (address)
D - The entry point is referencing a decompiled function
T - The address of the entry point has a type applied to it
t - The address of the entry point has a guessable type
C - The address of the entry point is marked as code
D - The address of the entry point is marked as data
^ - The address of the entry point is marked as unknown
+ - The entry point has an implicit tag applied to it (named or typed)
\* - The entry point has an explicit tag applied to it

The different types that one can match entrypoints with are the following:

address or ea - Match according to the entrypoint’s address
name - Match according to the exact name
like - Filter the entrypoint names according to a glob
regex - Filter the entrypoint names according to a regular-expression
index - Match according to the entrypoint’s index
ordinal - Match according to the entrypoint’s ordinal
greater or ge - Filter the entrypoints for any after the specified address (inclusive)
gt - Filter the entrypoints for any after the specified address (exclusive)
less or le - Filter the entrypoints for any before the specified address (inclusive)
lt - Filter the entrypoints for any before the specified address (exclusive)
function - Filter the entrypoints for any that are referencing a function
typed - Filter the entrypoints for any that have type information applied to them
tagged - Filter the entrypoints for any that use the specified tag(s)
predicate - Filter the entrypoints by passing its index (ordinal) to a callable

Some examples of using these keywords are as follows:

> database.entries.list(greater=h())
> iterable = database.entries.iterate(like='Nt*')
> result = database.entries.search(index=0)

database.entries()¶: Yield the address of each entry point defined within the database.

entries.iterate(string)¶

Iterate through all of the entry points in the database with a glob that matches string.

Parameters:	string (str) – the glob to use when filtering the available entry points

entries.iterate(**type)

Iterate through all of the entry points in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the available entry points

entries.list(string)¶

List all of the entry points matching the glob string against the name.

Parameters:	string (str) – the glob to use when filtering the available entry points

entries.list(**type)

List all of the entry points in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the available entry points

entries.name()¶: Return the name of the entry point at the current address.

entries.name(ea)

Return the name of the entry point at the address ea.

Parameters:	ea (int or long) – an address of an entry point in the database

entries.new()¶: Makes an entry point at the current address.

entries.new(ea)

Makes an entry point at the specified address ea.

Parameters:	ea (int or long) – an address in the database

entries.new(name)

Adds the current address as an entry point using name and the next available index as the ordinal.

Parameters:	name (str) – the name of the entry point

entries.new(ea, name)

Makes the specified address ea an entry point having the specified name.

Parameters:	ea (int or long) – an address in the database name (str) – the name of the entry point

entries.new(name, ordinal)

Adds an entry point with the specified name to the database using ordinal as its index.

Parameters:	name (str) – the name of the entry point ordinal (int or long) – the ordinal index for the entry point

entries.new(ea, name, ordinal)

Adds an entry point at ea with the specified name and ordinal.

Parameters:	ea (int or long) – an address in the database name (str) – the name of the entry point ordinal (int or long) – the ordinal index for the entry point

entries.ordinal()¶: Return the ordinal of the entry point at the current address.

entries.ordinal(ea)

Return the ordinal of the entry point at the address ea.

Parameters:	ea (int or long) – an address of an entry point in the database

entries.search(string)¶

Search through all of the entry point names matching the glob string and return the first result.

Parameters:	string (str) – the glob to use when filtering the available entry points

entries.search(**type)

Search through all of the entry points within the database and return the first result matching the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the available entry points

3.1.1.2.4. database.extra¶

Aliases: database.ex

This namespace is for interacting with IDA’s “extra” comments that can be associated with an address. This allows one to prefix or suffix an address with a large block of text simulating a multilined or paragraph comment.

To add extra comments, one can do this like:

> res = database.ex.prefix(ea, 'this\nis\na\nmultilined\ncomment')
> res = database.ex.suffix(ea, "whee\nok...i'm over it.")
> database.ex.insert(ea, 1)
> database.extra.append(ea, 2)

extra.has_prefix()¶

Return true if there are any extra comments that prefix the item at the current address.

Aliases: database.extra.prefixQ

extra.has_prefix(ea)

Return true if there are any extra comments that prefix the item at the address ea.

Aliases: database.extra.prefixQ

Parameters:	ea (int or long) – the address to check for the existence of a prefix comment

extra.has_suffix()¶

Return true if there are any extra comments that suffix the item at the current address.

Aliases: database.extra.suffixQ

extra.has_suffix(ea)

Return true if there are any extra comments that suffix the item at the address ea.

Aliases: database.extra.suffixQ

Parameters:	ea (int or long) – the address to check for the existence of a suffix comment

extra.postappend(ea, count)¶

Append count lines after the item at address ea.

Parameters:	ea (int or long) – the address of the suffix to append lines into count (int or long) – the number of lines to append

extra.postappend(count)

Append count lines after the item at the current address.

Parameters:	count (int or long) – the number of lines to append

extra.postinsert(ea, count)¶

Insert count lines after the item at address ea.

Parameters:	ea (int or long) – the address of the suffix to insert lines into count (int or long) – the number of lines to insert

extra.postinsert(count)

Insert count lines after the item at the current address.

Parameters:	count (int or long) – the number of lines to insert

extra.preappend(ea, count)¶

Append count lines in front of the item at address ea.

Aliases: database.extra.append

Parameters:	ea (int or long) – the address of the prefix to append newlines into count (int or long) – the number of lines to append

extra.preappend(count)

Append count lines in front of the item at the current address.

Aliases: database.extra.append

Parameters:	count (int or long) – the number of lines to append

extra.prefix()¶: Return the prefixed comment at the current address.

extra.prefix(string)

Set the prefixed comment at the current address to the specified string.

Parameters:	string (str) – the comment to insert

extra.prefix(none)

Delete the prefixed comment at the current address.

Parameters:	none (None) – the python value `None`

extra.prefix(ea)

Return the prefixed comment at address ea.

Parameters:	ea (int or long) – the address containing the prefix comment to return

extra.prefix(ea, string)

Set the prefixed comment at address ea to the specified string.

Parameters:	ea (int or long) – the address to modify the prefix comment of string (str) – the comment to insert

extra.prefix(ea, none)

Delete the prefixed comment at address ea.

Parameters:	ea (int or long) – the address containing the prefix comment to remove none (None) – the python value `None`

extra.preinsert(ea, count)¶

Insert count lines in front of the item at address ea.

Aliases: database.extra.insert

Parameters:	ea (int or long) – the address of the prefix to insert lines into count (int or long) – the number of lines to insert

extra.preinsert(count)

Insert count lines in front of the item at the current address.

Aliases: database.extra.insert

Parameters:	count (int or long) – the number of lines to insert

extra.suffix()¶: Return the suffixed comment at the current address.

extra.suffix(string)

Set the suffixed comment at the current address to the specified string.

Parameters:	string (str) – the comment to append

extra.suffix(none)

Delete the suffixed comment at the current address.

Parameters:	none (None) – the python value `None`

extra.suffix(ea)

Return the suffixed comment at address ea.

Parameters:	ea (int or long) – the address containing the suffix comment to return

extra.suffix(ea, string)

Set the suffixed comment at address ea to the specified string.

Parameters:	ea (int or long) – the address to modify the suffix comment of string (str) – the comment to append

extra.suffix(ea, none)

Delete the suffixed comment at address ea.

Parameters:	ea (int or long) – the address containing the suffix comment to remove none (None) – the python value `None`

3.1.1.2.5. database.functions¶

This namespace is used for listing all the functions inside the database. By default a list is returned containing the address of each function.

When listing functions that are matched, the following legend can be used to identify certain characteristics about them:

+ - The function has an implicit tag (named or typed)
\* - The function has been explicitly tagged
J - The function is a wrapper or a thunk
L - The function was pattern matched as a library
S - The function is declared statically
^ - The function does not contain a frame
? - The function has its stack points calculated incorrectly and may be incorrect
T - The function has a prototype that was applied to it manually or via decompilation
t - The function has a prototype that was guessed
D - The function has been previously decompiled

The different types that one can match functions with are the following:

address or ea - Match according to the function’s address
name - Match according to the exact name
like - Filter the function names according to a glob
regex - Filter the function names according to a regular-expression
typed - Filter the functions for any that have type information applied to them
decompiled - Filter the functions for any that have been decompiled
frame - Filter the functions for any that contain a frame
problems - Filter the functions for any that contain problems with their stack
library - Filter the functions that any which were detected as a library function
wrapper - Filter the functions that are flagged as wrappers (thunks)
exceptions Filter the functions for any that either handles an exception or sets up a handler
tagged - Filter the functions for any that use the specified tag(s)
predicate - Filter the functions by passing their idaapi.func_t to a callable

Some examples of how to use these keywords are as follows:

> for ea in database.functions(): ...
> database.functions.list('*sub*')
> iterable = database.functions.iterate(regex='.*alloc')
> result = database.functions.search(like='*alloc*')

database.functions()¶: Return a list of all of the functions in the current database.

functions.iterate(string)¶

Iterate through all of the functions in the database with a glob that matches string.

Parameters:	string (str) – the glob to filter the function names with

functions.iterate(**type)

Iterate through all of the functions in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter functions with

functions.list(string)¶

List all of the functions in the database with a glob that matches string.

Parameters:	string (str) – the glob to filter the function names with

functions.list(**type)

List all of the functions in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the functions with

functions.search(string)¶

Search through all of the functions matching the glob string and return the first result.

Parameters:	string (str) – the glob to filter the function names with

functions.search(**type)

Search through all of the functions within the database and return the first result matching the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the functions with

3.1.1.2.6. database.get¶

This namespace used to fetch and decode the data from the database at a given address. This allows one to interpret the semantics of parts of the database and then perform an action based on what was decoded. This includes standard functions for reading integers of different sizes, decoding structures, and even reading of arrays from the database.

In order to decode various things out of the database, some of the following examples can be used:

> res = database.get.signed()
> res = database.get.unsigned(ea, 8, byteorder='big')
> res = database.get.array(ea)
> res = database.get.array(length=42)
> res = database.get.structure(ea)
> res = database.get.structure(ea, structure=structure.by('mystructure'))

get.array(**length)¶

Return the values of the array at the current address.

Parameters:	**length – if `length` is specified, then use it as the length of the array instead of determining it automatically

get.array(bounds)

Return the values within the provided bounds as an array.

Parameters:	bounds (tuple) – a tuple containing the boundaries of the array to return

get.array(bounds, type)

Return the values within the provided bounds as an array of the pythonic element type.

Parameters:	bounds (tuple) – a tuple containing the boundaries of the array to return type – the pythonic type to use for each element

get.array(ea, **length)

Return the values of the array at the address specified by ea.

If the integer length is defined, then use it as the number of elements for the array. If a pythonic type is passed to type, then use it for the element type of the array when decoding.

Parameters:	ea (int or long) – the address of an array within the database **length – if `length` is specified, then use it as the length of the array instead of determining it automatically

get.info()¶

Return the type information for the current address as an idaapi.tinfo_t.

Aliases: database.get.typeinfo

get.info(ea)

Return the type information for the address ea as an idaapi.tinfo_t.

Aliases: database.get.typeinfo

Parameters:	ea (int or long) – an address within the database

get.signed(**byteorder)¶

Read a signed integer from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.signed(ea, **byteorder)

Read a signed integer from the address ea using the size defined in the database.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.signed(ea, size, **byteorder)

Read a signed integer from the address ea with the specified size.

If byteorder is ‘big’ then read in big-endian form. If byteorder is ‘little’ then read in little-endian form.

The default value of byteorder is the same as specified by the database architecture.

Parameters:	ea (int or long) – an address within the database size (int or long) – the size of the integer to return in bytes **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.string(**length)¶

Return the array at the current address as a string.

Parameters:	**length – an integer specifying the `length` to use for the string or a `strtype` describing the type of the string

get.string(bounds, **length)

Return the array described by the specified bounds as a string.

Parameters:	bounds (tuple) – the boundaries of the string to return **length – an integer specifying the `length` to use for the string or a `strtype` describing the type of the string

get.string(ea, **length)

Return the array at the address specified by ea as a string.

If an integer length is provided, then use it explicitly as the string’s length when reading. If an integer strtype is provided, then use it as the string’s character width when reading. If a tuple strtype is specified, then the first item is the character width and the second is the size of the length prefix when reading.

Parameters:	ea (int or long) – the address of the string to return **length – an integer specifying the `length` to use for the string or a `strtype` describing the type of the string

get.structure()¶

Return a dictionary of ctypes for the structure_t that is applied to the current address.

Aliases: database.get.struct, database.get.struc

get.structure(ea)

Return a dictionary of ctypes for the structure_t that is applied to the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:	ea (int or long) – the address of a structure within the database

get.structure(ea, sptr)

Return a dictionary of ctypes for the structure_t identified by sptr at the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:	ea (int or long) – the address within the database sptr (idaapi.struc_t) – an `idaapi.struc_t` of the structure to decode from the specified address

get.structure(ea, name)

Return a dictionary of ctypes for the structure_t with the specified name at the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:	ea (int or long) – the address within the database name (str) – the name of the structure to decode from the specified address

get.structure(ea, type)

Return a dictionary of ctypes for the structure_t specified by type at the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:	ea (int or long) – the address within the database type (structure_t) – the `structure_t` to decode from the specified address

get.structure(ea, identifier)

Return a dictionary of ctypes for the structure_t with the specified identifier at the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:	ea (int or long) – the address within the database identifier (int or long) – the identifier of the structure to decode from the specified address

get.unsigned(**byteorder)¶

Read an unsigned integer from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.unsigned(ea, **byteorder)

Read an unsigned integer from the address ea using the size defined in the database.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.unsigned(ea, size, **byteorder)

Read an unsigned integer from the address ea with the specified size.

If byteorder is ‘big’ then read in big-endian form. If byteorder is ‘little’ then read in little-endian form.

The default value of byteorder is the same as specified by the database architecture.

Parameters:	ea (int or long) – an address within the database size (int or long) – the size of the integer to return in bytes **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

3.1.1.2.6.1. database.get.float¶

Aliases: database.get.f

This namespace contains a number of functions for fetching floating point numbers out of the database. These floating-point numbers are encoded according to the IEEE-754 specification.

This namespace is also aliased as database.get.f and can be used as in the following examples:

> res = database.get.f.half()
> res = database.get.f.single(ea)
> res = database.get.f.double(ea)

If one needs to describe a non-standard encoding for a floating-point number, one can use the database.float function. This function takes a tuple representing the number of bits for the different components of a floating-point number. This can be used as in the following for reading a floating-point “half” from the database:

> res = database.get.float(components=(10, 5, 1))

This specifies 10-bits for the mantissa, 5 for the exponent, and 1 bit for the signed flag. This allows one to specify arbitrary encodings for different floating-point numbers.

get.float(**byteorder)¶

Read a floating-number from the current address using the number type that matches its size.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float(ea, **byteorder)

Read a floating-number at the address ea using the number type that matches its size.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float(components, **byteorder)

Read a floating-point number at the current address encoded with the specified components.

Parameters:	components (tuple) – a tuple describing the component sizes for decoding the floating-point number **byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float(ea, components, **byteorder)

Read a floating-point number at the address ea that is encoded with the specified components.

The components parameter is a tuple (mantissa, exponent, sign) representing the number of bits for each component of the floating-point number. If byteorder is ‘big’ then read in big-endian form. If byteorder is ‘little’ then read in little-endian form.

The default value of byteorder is the same as specified by the database architecture.

Parameters:	ea (int or long) – an address within the database components (tuple) – a tuple describing the component sizes for decoding the floating-point number **byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float.double(**byteorder)¶

Read a double from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float.double(ea, **byteorder)

Read a double from the address ea.

Parameters:	ea – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float.half(**byteorder)¶

Read a half from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float.half(ea, **byteorder)

Read a half from the address ea.

Parameters:	ea – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float.single(**byteorder)¶

Read a single from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

get.float.single(ea, **byteorder)

Read a single from the address ea.

Parameters:	ea – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the floating-point number

3.1.1.2.6.2. database.get.integer¶

Aliases: database.get.i

This namespace contains the different ISO standard integer types that can be used to read integers out of the database.

This namespace is also aliased as database.get.i and can be used like in the following examples:

> res = database.get.i.uint32_t()
> res = database.get.i.sint64_t(ea)
> res = database.get.i.uint8_t(ea)

get.integer(**byteorder)¶

Read an integer from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer(ea, **byteorder)

Read an integer from the address ea.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer(ea, size, **byteorder)

Read an integer of the specified size from the address ea.

Parameters:	ea (int or long) – an address within the database size (int or long) – the size of the integer to return in bytes **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint128_t(**byteorder)¶

Read a sint128_t from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint128_t(ea, **byteorder)

Read a sint128_t from the address ea.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint16_t(**byteorder)¶

Read a sint16_t from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint16_t(ea, **byteorder)

Read a sint16_t from the address ea.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint32_t(**byteorder)¶

Read a sint32_t from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint32_t(ea, **byteorder)

Read a sint32_t from the address ea.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint64_t(**byteorder)¶

Read a sint64_t from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint64_t(ea, **byteorder)

Read a sint64_t from the address ea.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint8_t(**byteorder)¶

Read a sint8_t from the current address.

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.sint8_t(ea, **byteorder)

Read a sint8_t from the address ea.

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint128_t(**byteorder)¶

Read a uint128_t from the current address.

Aliases: database.get.integer.oword

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint128_t(ea, **byteorder)

Read a uint128_t from the address ea.

Aliases: database.get.integer.oword

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint16_t(**byteorder)¶

Read a uint16_t from the current address.

Aliases: database.get.integer.word

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint16_t(ea, **byteorder)

Read a uint16_t from the address ea.

Aliases: database.get.integer.word

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint32_t(**byteorder)¶

Read a uint32_t from the current address.

Aliases: database.get.integer.dword

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint32_t(ea, **byteorder)

Read a uint32_t from the address ea.

Aliases: database.get.integer.dword

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint64_t(**byteorder)¶

Read a uint64_t from the current address.

Aliases: database.get.integer.qword

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint64_t(ea, **byteorder)

Read a uint64_t from the address ea.

Aliases: database.get.integer.qword

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint8_t(**byteorder)¶

Read a uint8_t from the current address.

Aliases: database.get.integer.byte

Parameters:	**byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

get.integer.uint8_t(ea, **byteorder)

Read a uint8_t from the address ea.

Aliases: database.get.integer.byte

Parameters:	ea (int or long) – an address within the database **byteorder – if `byteorder` is provided, use it to determine the byteorder of the integer

3.1.1.2.6.3. database.get.switch¶

Function for fetching an instance of a switch_t from a given address. Despite this being a namespace, by default it is intended to be used as a function against any known component of a switch. It will then return a class that allows one to query the different attributes of an idaapi.switch_info_t.

This namespace can be used as in the following example:

> sw = database.get.switch(ea)
> print( sw )

get.switch()¶: Return the switch that is referenced at the current address.

get.switch(ea)

Return the switch that is referenced by the address at ea.

Parameters:	ea (int or long) – the address of a switch within the database

3.1.1.2.7. database.imports¶

This namespace is used for listing all of the imports within the database. Each import is represented by an address along with any naming information that is required to dynamically link external symbols with the binary.

By default a tuple is yielded for each import with the format (address, (shared-object, name, hint)). In this tuple, shared-object represents the name of the shared object the import is imported from. The name is the symbol name to link with, and hint is the import ordinal hint which is used to speed up the linking process.

When listing the imports that are matched, the following legend can be used to identify certain characteristics about them:

T - The import has a type that was explicitly applied
t - The import has a type that was guessted
H - The import contains an ordinal number as a hint
+ - The import has an implicit tag applied to it (named or typed)
\* - The import has an explicit tag applied to it

The different types that one can match imports with are the following:

address or ea - Match according to the import’s address
name - Match according to the import’s symbol name
module - Filter the imports according to the specified module name
fullname - Match according to the full symbol name (module + symbol)
like - Filter the symbol names of all the imports according to a glob
regex - Filter the symbol names of all the imports according to a regular-expression
ordinal - Match according to the import’s hint (ordinal)
index - Match according index of the import
typed - Filter all of the imports based on whether they have a type applied to them
tagged - Filter the imports for any that use the specified tag(s)
predicate Filter the imports by passing the above (default) tuple to a callable

Some examples of using these keywords are as follows:

> database.imports.list(module='kernelbase.dll')
> iterable = database.imports.iterate(like='*alloc*')
> result = database.imports.search(index=42)

database.imports()¶

imports.at()¶: Return the import at the current address.

imports.at(ea)

Return the import at the address ea.

Parameters:	ea (int or long) – the address of an import within the database

imports.fullname()¶: Return the full name of the import at the current address.

imports.fullname(ea)

Return the full name of the import at address ea.

Parameters:	ea – the address of an import within the database

imports.iterate(string)¶

Iterate through all of the imports in the database with a glob that matches string.

Parameters:	string (str) – the glob to use when filtering the available imports

imports.iterate(**type)

Iterate through all of the imports in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the available imports

imports.list(string)¶

List all of the imports matching the glob string against the fullname.

Parameters:	string (str) – the glob to use when filtering the available imports

imports.list(**type)

List all of the imports in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the available imports

imports.module()¶: Return the import module at the current address.

imports.module(ea)

Return the import module at the specified address ea.

Parameters:	ea (int or long) – the address of an import within the database

imports.modules()¶: Return all of the import modules defined in the database.

imports.name()¶: Return the name of the import at the current address.

imports.name(ea)

Return the name of the import at address ea.

Parameters:	ea – the address of an import within the database

imports.ordinal()¶: Return the ordinal of the import at the current address.

imports.ordinal(ea)

Return the ordinal of the import at the address ea.

Parameters:	ea – the address of an import within the database

imports.search(string)¶

Search through all of the imports matching the fullname glob string.

Parameters:	string (str) – the glob to use when filtering the available imports

imports.search(**type)

Search through all of the imports within the database and return the first result matching the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the available imports

3.1.1.2.8. database.marks¶

This namespace is for interacting with the marks table within the database. By default, this namespace is capable of yielding the (address, description) of each mark within the database.

This allows one to manage the marks. Although it is suggested to utilize “tags” as they provide significantly more flexibility. Using marks allows for one to use IDA’s mark window for quick navigation to a mark.

The functions in this namespace can be used like:

> for ea, descr in database.marks(): ...
> database.marks.new('this is my description')
> database.marks.remove(ea)
> ea, descr = database.marks.by(ea)

database.marks()¶: Yields each of the marked positions within the database.

marks.by_address()¶

Return the mark at the current address.

Aliases: database.marks.by

marks.by_address(ea)

Return the (address, description) of the mark at the given address ea.

Aliases: database.marks.by

Parameters:	ea (int or long) – the address of a mark within the database

marks.by_index(index)¶

Return the (address, description) of the mark at the specified index in the mark list.

Aliases: database.marks.byIndex

Parameters:	index – the index of a mark

marks.iterate()¶: Iterate through all of the marks in the database.

marks.length()¶: Return the number of marks in the database.

marks.new(description)¶

Create a mark at the current address with the given description.

Parameters:	description (str) – the description associated with the mark

marks.new(ea, description, **extra)

Create a mark at the address ea with the given description and return its index.

Parameters:	ea (int or long) – the address within the database to set the mark at description (str) – the description associated with the mark **extra – allows you to assign the `x`, `y`, or `lnnum` fields of the mark

marks.remove()¶: Remove the mark at the current address.

marks.remove(ea)

Remove the mark at the specified address ea returning the previous description.

Parameters:	ea (int or long) – the address within the database containing a mark

3.1.1.2.9. database.names¶

This namespace is used for listing all of the names (symbols) within the database. By default the (address, name) is yielded in its mangled form.

When listing names that are matched, the following legend can be used to identify certain characteristics about the address of the returned name:

I - The symbol is residing in an import segment
C - The address of the symbol is marked as code
D - The address of the symbol is marked as data
^ - The address of the symbol is is initialized
+ - The symbol has an implicit tag applied to it (named or typed)
\* - The symbol has an explicit tag applied to it

The available types that one can filter the symbols with are as follows:

address - Match according to the address of the symbol
name - Match according to the name of the unmangled symbol
unmangled - Filter the unmangled symbol names according to a regular-expression
like - Filter the symbol names according to a glob
regex - Filter the symbol names according to a regular-expression
index - Match the symbol according to its index
function - Filter the symbol names for any that are referring to a function
imports - Filter the symbol names for any that are imports
typed - Filter the symbol names for any that have type information applied to them
tagged - Filter the symbol names for any that use the specified tag(s)
predicate - Filter the symbols by passing their address to a callable

Some examples of using these keywords are as follows:

> list(database.names())
> database.names.list(index=31)
> iterable = database.names.iterate(like='str.*')
> result = database.names.search(name='some_really_sick_symbol_name')

database.names()¶: Iterate through all of the names in the database yielding a tuple of the address and its name.

names.address(index)¶

Return the address of the symbol at index.

Parameters:	index – the index of the symbol in the names list

names.at()¶: Return the index, symbol address, and name at the current address.

names.at(ea)

Return the index, symbol address, and name at the address ea.

Parameters:	ea (int or long) – the address of a symbol

names.iterate(string)¶

Iterate through all of the names in the database with a glob that matches string.

Parameters:	string (str) – the glob to filter the symbol names with

names.iterate(**type)

Iterate through all of the names in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter symbols with

names.list(string)¶

List all of the names in the database with a glob that matches string.

Parameters:	string (str) – the glob to filter the symbol names with

names.list(**type)

List all of the names in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter symbols with

names.search(string)¶

Search through all of the names matching the glob string and return the first result.

Parameters:	string (str) – the glob to filter the symbol names with

names.search(**type)

Search through all of the names within the database and return the first result matching the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter symbols with

names.symbol()¶

Return the symbol name of the current address.

Aliases: database.names.name

names.symbol(ea)

Return the symbol name of the address ea.

Aliases: database.names.name

Parameters:	ea (int or long) – the address of a symbol

3.1.1.2.10. database.search¶

This namespace used for searching the database using IDA’s find functionality.

By default the name is used, however there are 4 search methods that are available. The methods that are provided are:

search.by_bytes - Search by the specified hex bytes
search.by_regex - Search by the specified regex
search.by_text - Search by the specified text
search.by_name - Search by the specified name

Each search method has its own options, but all of them take an extra boolean option, reverse, which specifies whether to search backwards from the starting position or forwards.

The search.iterate function allows one to iterate through all the results discovered in the database. One variation of search.iterate takes a 3rd parameter predicate. This allows usage of one of the search methods provided or to allow a user to include their own. This function will then yield each matched search result.

database.search(pattern, **direction)¶

Search through the database at the current address for the specified pattern.

Parameters:	pattern – the bytes or pattern to search for **direction – if `reverse` is specified as true then search backwards

database.search(ea, pattern, **direction)

Search through the database at address ea for the specified pattern.’’’

If reverse is specified as a bool, then search backwards from the given address. If radix is specified, then use it as the numerical radix for describing the bytes. If radix is not specified, then assume that data represents the exact bytes to search.

Parameters:	ea (int or long) – the starting address to search from pattern – the bytes or pattern to search for **direction – if `reverse` is specified as true then search backwards

search.by_bytes(data, **direction)¶

Search through the database at the current address for the bytes specified by data.

Aliases: database.search.bybytes

Parameters:	data – the bytes or pattern to search for **direction – if `reverse` is specified as true then search backwards

search.by_bytes(ea, data, **direction)

Search through the database at address ea for the bytes specified by data.

If reverse is specified as a bool, then search backwards from the given address. If radix is specified, then use it as the numerical radix for describing the bytes. If radix is not specified, then assume that data represents the exact bytes to search.

Aliases: database.search.bybytes

Parameters:	ea (int or long) – the starting address to search from data – the bytes or pattern to search for **direction – if `reverse` is specified as true then search backwards

search.by_name(**options)¶

Search through the database at the current address for the symbol name.

Aliases: database.by_name, database.search.byname, database.byname

Parameters:	**options – if `reverse` is specified as true then search backwards. if `sensitive` is true, then search with regards to the case.

search.by_name(name, **options)

Search through the database at address ea for the symbol name.

If reverse is specified as a bool, then search backwards from the given address. If sensitive is specified as bool, then perform a case-sensitive search.

Aliases: database.by_name, database.search.byname, database.byname

Parameters:	name (str) – the identifier to search for **options – if `reverse` is specified as true then search backwards. if `sensitive` is true, then search with regards to the case.

search.by_regex(**options)¶

Search through the database at the current address for the regex matched by string.

Aliases: database.search.byregex

Parameters:	**options – if `reverse` is specified as true then search backwards. if `sensitive` is true, then search with regards to the case.

search.by_regex(ea, string, **options)

Search the database at address ea for the regex matched by string.

If reverse is specified as a bool, then search backwards from the given address. If sensitive is specified as bool, then perform a case-sensitive search.

Aliases: database.search.byregex

Parameters:	ea (int or long) – the starting address to search from string (str) – the regex to search for **options – if `reverse` is specified as true then search backwards. if `sensitive` is true, then search with regards to the case.

search.by_text(**options)¶

Search through the database at the current address for the text matched by string.

Aliases: database.search.bystring, database.search.by_string, database.search.bytext

Parameters:	**options – if `reverse` is specified as true then search backwards. if `sensitive` is true, then search with regards to the case.

search.by_text(ea, string, **options)

Search the database at address ea for the text matched by string.

If reverse is specified as a bool, then search backwards from the given address. If sensitive is specified as bool, then perform a case-sensitive search.

Aliases: database.search.bystring, database.search.by_string, database.search.bytext

Parameters:	ea (int or long) – the starting address to search from string (str) – the text string to search for **options – if `reverse` is specified as true then search backwards. if `sensitive` is true, then search with regards to the case.

search.iterate(pattern, **options)¶

Iterate through all search results that match the pattern starting at the current address.

Parameters:	pattern (str or bytes or bytearray) – the bytes or pattern to search for **options – any options to pass to the `predicate`

search.iterate(ea, pattern, **options)

Iterate through all search results that match the specified pattern starting at address ea.

Parameters:	ea (int or long) – the starting address to search from pattern (str or bytes or bytearray) – **options – any options to search with

search.iterate(pattern, predicate, **options)

Iterate through all search results matched by the function predicate with the specified pattern starting at the current address.

Parameters:	pattern (str or bytes or bytearray) – the bytes or pattern to pass to the `predicate` predicate – the callable to search with **options – any options to pass to the `predicate`

search.iterate(ea, pattern, predicate, **options)

Iterate through all search results matched by the function predicate with the specified pattern starting at address ea.

Parameters:	ea (int or long) – the starting address to search from pattern (str or bytes or bytearray) – the bytes or pattern to pass to the predicate predicate – the callable to search with **options – any options to pass to the `predicate`

3.1.1.2.11. database.segments¶

This namespace is used for listing all the segments inside the database. By default each segment’s boundaries are yielded.

The different types that one can match segments with are the following:

name - Match according to the true segment name
like - Filter the segment names according to a glob
regex - Filter the segment names according to a regular-expression
index - Match the segment by its index
identifier - Match the segment by its identifier (idaapi.segment_t.name)
selector - Match the segment by its selector (idaapi.segment_t.sel)
greater or gt - Filter the segments for any after the specified address
less or lt - Filter the segments for any before the specified address
predicate - Filter the segments by passing its idaapi.segment_t to a callable

Some examples of using these keywords are as follows:

> for l, r in database.segments(): ...
> database.segments.list(regex=r'\.r?data')
> iterable = database.segments.iterate(like='*text*')
> result = database.segments.search(greater=0x401000)

database.segments()¶: Yield the bounds of each segment within the current database.

segments.iterate(name)¶

Iterate through all of the segments in the database with a glob that matches name.

Parameters:	name (str) – the glob to filter the segment names with

segments.iterate(**type)

Iterate through all the segments defined in the database matching the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter segments with

segments.list(name)¶

List all of the segments defined in the database that match the glob name.

Parameters:	name (str) – the glob to filter the segment names with

segments.list(**type)

List all of the segments in the database that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the segments with

segments.search(name)¶

Search through all of the segments matching the glob name and return the first result.

Parameters:	name (str) – the glob to filter the segment names with

segments.search(**type)

Search through all of the segments within the database and return the first result matching the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the segments with

3.1.1.2.12. database.set¶

This namespace for setting the type of an address within the database. This allows one to apply a particular type to a given address. This allows one to specify whether a type is a string, undefined, code, data, an array, or even a structure.

This can be used as in the following examples:

> database.set.unknown(ea)
> database.set.aligned(ea, alignment=0x10)
> database.set.string(ea)
> database.set.structure(ea, structure.by('mystructure'))

database.set(info)¶

Set the type information at the current address to info.

Aliases: database.set.typeinfo, database.set.info

Parameters:	info (str or idaapi.tinfo_t) – the type information to apply to the address

database.set(ea, info)

Set the type information at the address ea to info.

Aliases: database.set.typeinfo, database.set.info

Parameters:	ea (int or long) – an address within the database info (str or idaapi.tinfo_t) – the type information to apply to the address

set.alignment(**alignment)¶

Set the data at the current address as aligned with the specified alignment.

Aliases: database.set.align, database.set.aligned

Parameters:	**alignment – the number of bytes to align with

set.alignment(ea, **alignment)

Set the data at address ea as aligned.

If alignment is specified, then use it as the number of bytes to align the data to. If size is specified, then align that number of bytes.

Aliases: database.set.align, database.set.aligned

Parameters:	ea (int or long) – an address within the database **alignment – the number of bytes to align with

set.array()¶: Set the data at the current selection to an array of the type at the current address.

set.array(length)

Set the data at the current selection to an array of the specified length using the type at the current address.

Parameters:	length (int or long) – the number of elements to use when applying the array

set.array(type, **length)

Set the data at the current address to an array of the specified type using the length determined from the current selection if length is not specified.

Parameters:	type – a pythonic type to apply as an array element to the current address **length – the number of elements to use when applying the array

set.array(ea, type)

Set the data at the address ea to an array of the given type.

Parameters:	ea (int or long) – an address within the database type – a pythonic type to use as the array element for the specified address

set.array(bounds, type)

Set the data at the provided bounds to an array of the given type.

Parameters:	bounds (tuple) – a tuple containing the boundaries of the array to apply type – a pythonic type to use as the array element for the specified address

set.array(ea, type, length)

Set the data at the address ea to an array with the given length and type.

Parameters:	ea (int or long) – an address within the database type – a pythonic type to use as the array element for the specified address length (int or long) – the number of elements to use for the array

set.code()¶: Set the data at the current address to code.

set.code(ea)

Set the data at address ea to code.

Parameters:	ea (int or long) – an address within the database

set.data(size, **type)¶

Set the data at the current address to have the specified size and type.

Parameters:	size (int or long) – the number of bytes to set *type – if `type` is specified as an IDA type (`idaapi.FF_`) or a `structure_t` then apply it to the given address

set.data(ea, size, **type)

Set the data at address ea to have the specified size and type.

If type is not specified, then choose the correct type based on the size.

Parameters:	ea (int or long) – an address in the database size (int or long) – the number of bytes to set *type – if `type` is specified then as an IDA type (`idaapi.FF_`) or a `structure_t` then apply it to the given address

set.string(**strtype)¶

Set the data at the current address to a string with the specified strtype.

Parameters:	**strtype – if `strtype` is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix

set.string(bounds, **strtype)

Set the data within the provided bounds to a string with the specified strtype.

Parameters:	bounds (tuple) – the boundaries of the string to return **strtype – if `strtype` is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix

set.string(ea, **strtype)

Set the data at address ea to a string with the specified strtype.

Parameters:	ea (int or long) – an address within the database **strtype – if `strtype` is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix

set.string(ea, length, **strtype)

Set the data at address ea to a string with the specified length.

If the integer strtype is specified, then apply a string of the specified character width. If the tuple strtype is specified, the first item is the string’s character width and the second item is the size of the length prefix.

Parameters:	ea (int or long) – an address within the database length (int or long) – the length of the string **strtype – if `strtype` is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix

set.structure(type)¶

Set the data at the current address to the structure_t specified by type.

Aliases: database.set.struc, database.set.struct

Parameters:	type (structure_t) – the `structure_t` to apply to the current address

set.structure(name)

Set the data at the current address to the structure_t with the given name.

Aliases: database.set.struc, database.set.struct

Parameters:	name (str) – the name of the structure to apply to the current address

set.structure(sptr)

Set the data at the current address to the structure_t for the specified sptr.

Aliases: database.set.struc, database.set.struct

Parameters:	sptr (idaapi.struc_t) – the `idaapi.struc_t` to apply to the current address

set.structure(ea, type)

Set the data at address ea to the structure_t specified by type.

Aliases: database.set.struc, database.set.struct

Parameters:	ea (int or long) – an address within the database type (structure_t) – the `structure_t` to apply to the specified address

set.structure(ea, name)

Set the data at address ea to the structure_t with the given name.

Aliases: database.set.struc, database.set.struct

Parameters:	ea (int or long) – an address within the database name (str) – the name of the structure to apply to the specified address

set.structure(ea, sptr)

Set the data at address ea to the structure_t for the specified sptr.

Aliases: database.set.struc, database.set.struct

Parameters:	ea (int or long) – an address within the database sptr (idaapi.struc_t) – the `idaapi.struc_t` to apply to the specified address

set.structure(ea, identifier)

Set the data at address ea to the structure_t that has the specified identifier.

Aliases: database.set.struc, database.set.struct

Parameters:	ea (int or long) – an address within the database identifier (int or long) – the identifier of the structure to apply to the specified address

set.unknown()¶

Set the data at the current address or selection to undefined.

Aliases: database.set.undef, database.set.undefined

set.unknown(ea)

Set the data at address ea to undefined.

Aliases: database.set.undef, database.set.undefined

Parameters:	ea (int or long) – an address within the database

set.unknown(ea, size)

Set the data at address ea to undefined.

Aliases: database.set.undef, database.set.undefined

Parameters:	ea (int or long) – an address within the database size (int or long) – the number of bytes to set

3.1.1.2.12.1. database.set.float¶

Aliases: database.set.f

This namespace used for applying various sized floating-point types to a particular address.

This namespace is aliased as database.set.f and can be used as follows:

> database.set.f.single(ea)
> database.set.f.double(ea)

set.float()¶: Sets the data at the current address to an IEEE-754 floating-point number based on its size.

set.float(ea)

Sets the data at address ea to an IEEE-754 floating-point number based on its size.

Parameters:	ea – an address within the database

set.float.double()¶: Set the data at the current address to an IEEE-754 double

set.float.double(ea)

Set the data at address ea to an IEEE-754 double.

Parameters:	ea – an address within the database

set.float.single()¶: Set the data at the current address to an IEEE-754 single

set.float.single(ea)

Set the data at address ea to an IEEE-754 single.

Parameters:	ea – an address within the database

3.1.1.2.12.2. database.set.integer¶

Aliases: database.set.i

This namespace used for applying various sized integer types to a particular address.

This namespace is also aliased as database.set.i and can be used as follows:

> database.set.i.uint8_t(ea)
> database.set.i.uint64_t(ea)

set.integer()¶: Set the data at the current address to an integer.

set.integer(ea)

Set the data at address ea to an integer of a type determined by its size.

Parameters:	ea (int or long) – an address within the database to set as an integer

set.integer(ea, size)

Set the data at the address ea to an integer of the specified size.

Parameters:	ea (int or long) – an address within the database to set as an integer size (int or long) – the size of the integer

set.integer.sint128_t()¶: Set the data at the current address to a sint128_t.

set.integer.sint128_t(ea)

Set the data at address ea to an sint128_t.

Parameters:	ea (int or long) – an address within the database

set.integer.sint16_t()¶: Set the data at the current address to a sint16_t.

set.integer.sint16_t(ea)

Set the data at address ea to a sint16_t.

Parameters:	ea (int or long) – an address within the database

set.integer.sint32_t()¶: Set the data at the current address to a sint32_t.

set.integer.sint32_t(ea)

Set the data at address ea to a sint32_t.

Parameters:	ea (int or long) – an address within the database

set.integer.sint64_t()¶: Set the data at the current address to a sint64_t.

set.integer.sint64_t(ea)

Set the data at address ea to a sint64_t.

Parameters:	ea (int or long) – an address within the database

set.integer.sint8_t()¶: Set the data at the current address to a sint8_t.

set.integer.sint8_t(ea)

Set the data at address ea to a sint8_t.

Parameters:	ea (int or long) – an address within the database

set.integer.uint128_t()¶

Set the data at the current address to an uint128_t.

Aliases: database.set.integer.oword

set.integer.uint128_t(ea)

Set the data at address ea to an uint128_t.

Aliases: database.set.integer.oword

Parameters:	ea (int or long) – an address within the database

set.integer.uint16_t()¶

Set the data at the current address to a uint16_t.

Aliases: database.set.integer.word

set.integer.uint16_t(ea)

Set the data at address ea to a uint16_t.

Aliases: database.set.integer.word

Parameters:	ea (int or long) – an address within the database

set.integer.uint32_t()¶

Set the data at the current address to a uint32_t.

Aliases: database.set.integer.dword

set.integer.uint32_t(ea)

Set the data at address ea to a uint32_t.

Aliases: database.set.integer.dword

Parameters:	ea (int or long) – an address within the database

set.integer.uint64_t()¶

Set the data at the current address to a uint64_t.

Aliases: database.set.integer.qword

set.integer.uint64_t(ea)

Set the data at address ea to a uint64_t.

Aliases: database.set.integer.qword

Parameters:	ea (int or long) – an address within the database

set.integer.uint8_t()¶

Set the data at the current address to a uint8_t.

Aliases: database.set.integer.byte

set.integer.uint8_t(ea)

Set the data at address ea to a uint8_t.

Aliases: database.set.integer.byte

Parameters:	ea (int or long) – an address within the database

3.1.1.2.13. database.type¶

Aliases: database.t

This namespace is for fetching type information from the different addresses defined within the database. The functions within this namespace allow one to extract various type information from the different locations within the database.

This namespace is also aliased as database.t.

By default, this namespace will return the idaapi.DT_TYPE of the specified address.

Some examples of using this namespace can be:

> print( database.type.size(ea) )
> print( database.type.is_initialized(ea) )
> print( database.type.is_data(ea) )
> length = database.t.array.length(ea)
> st = database.t.structure(ea)

database.type()¶: Return the type information for the current address as an idaapi.tinfo_t.

database.type(ea)

Return the type information for the address ea as an idaapi.tinfo_t.

Parameters:	ea (int or long) – an address within the database

database.type(none)

Remove the type information from the current address.

Parameters:	none (None) – the python value `None`

database.type(info, **guessed)

Apply the type information in info to the current address.

Parameters:	info (str or idaapi.tinfo_t) – the type information to apply to the address **guessed – if `guessed` is specified, the mark it as guessed by the disassembler of the user

database.type(ea, info, **guessed)

Apply the idaapi.tinfo_t in info to the address ea.

If guess is true, then apply the type information as a guess. If force is true, then apply the type as-is regardless of its location.

Parameters:	ea (int or long) – an address within the database info (idaapi.tinfo_t) – the `idaapi.tinfo_t` to apply to the address **guessed – if `guessed` is specified, the mark it as guessed by the disassembler of the user

database.type(ea, none)

Remove the type information from the address ea.

Parameters:	ea – an address within the database none (None) – the python value `None`

database.type(ea, string, **guessed)

Parse the type information in string into an idaapi.tinfo_t and apply it to the address ea.

Parameters:	ea (int or long) – an address within the database string (str) – a string describing the type information to apply to the address **guessed – if `guessed` is specified, the mark it as guessed by the disassembler of the user

type.flags()¶: Return the flags of the item at the current address.

type.flags(ea)

Return the flags of the item at the address ea.

Parameters:	ea (int or long) – an address within the database

type.flags(ea, mask)

Return the flags at the address ea masked with mask.

Parameters:	ea (int or long) – an address within the database mask (int or long) – a bitmask used to select specific bits from the flags

type.flags(ea, mask, value)

Sets the flags at the address ea masked with mask set to value.

Parameters:	ea (int or long) – an address within the database mask (int or long) – a bitmask used to select specific bits from the flags value (int or long) – the bits to write

type.has_autoname()¶

Return if the current address was automatically named.

Aliases: database.type.autonameQ

type.has_autoname(ea)

Return if the address ea was automatically named.

Aliases: database.type.autonameQ

Parameters:	ea (int or long) – an address within the database

type.has_comment()¶

Return if the current address is commented.

Aliases: database.type.commentQ

type.has_comment(ea)

Return if the address at ea is commented.

Aliases: database.type.commentQ

Parameters:	ea (int or long) – an address within the database

type.has_customname()¶

Return if the current address has a custom name.

Aliases: database.type.customnameQ

type.has_customname(ea)

Return if the address at ea has a custom name.

Aliases: database.type.customnameQ

Parameters:	ea (int or long) – an address within the database

type.has_dummyname()¶

Return if the current address has a dummy name.

Aliases: database.type.dummynameQ

type.has_dummyname(ea)

Return if the address at ea has a dummy name.

Aliases: database.type.dummynameQ

Parameters:	ea (int or long) – an address within the database

type.has_label()¶

Return if the current address has a label.

Aliases: database.type.has_name, database.type.labelQ, database.type.nameQ

type.has_label(ea)

Return if the address at ea has a label.

Aliases: database.type.has_name, database.type.labelQ, database.type.nameQ

Parameters:	ea (int or long) – an address within the database

type.has_listedname()¶

Return if the current address has a name that is listed.

Aliases: database.type.listednameQ

type.has_listedname(ea)

Return if the address at ea has a name that is listed.

Aliases: database.type.listednameQ

Parameters:	ea (int or long) – an address within the database

type.has_publicname()¶

Return if the current address has a public name.

Aliases: database.type.publicnameQ

type.has_publicname(ea)

Return if the address at ea has a public name.

Aliases: database.type.publicnameQ

Parameters:	ea (int or long) – an address within the database

type.has_reference()¶

Return if the current address is referencing another address.

Aliases: database.type.referenceQ

type.has_reference(ea)

Return if the address at ea is referencing another address.

Aliases: database.type.referenceQ

Parameters:	ea (int or long) – an address within the database

type.has_typeinfo()¶

Return if the current address has any type information associated with it.

Aliases: database.type.infoQ, database.type.typeinfoQ

type.has_typeinfo(ea)

Return if the address at ea has any type information associated with it.

Aliases: database.type.infoQ, database.type.typeinfoQ

Parameters:	ea (int or long) – an address within the database

type.has_weakname()¶

Return if the current address has a name with a weak type.

Aliases: database.type.weaknameQ

type.has_weakname(ea)

Return if the address at ea has a name with a weak type.

Aliases: database.type.weaknameQ

Parameters:	ea (int or long) – an address within the database

type.is_align()¶

Return if the current address is defined as an alignment.

Aliases: database.type.alignQ, database.is_align

type.is_align(ea)

Return if the address at ea is defined as an alignment.

Aliases: database.type.alignQ, database.is_align

Parameters:	ea (int or long) – an address within the database

type.is_code()¶

Return if the current address is marked as code.

Aliases: database.is_code, database.type.codeQ

type.is_code(ea)

Return if the address specified by ea is marked as code.

Aliases: database.is_code, database.type.codeQ

Parameters:	ea (int or long) – an address within the database

type.is_code(ea, size)

Return if the address specified by ea up to size bytes is marked as code.

Aliases: database.is_code, database.type.codeQ

Parameters:	ea (int or long) – an address within the database size (int or long) – the number of bytes to check

type.is_data()¶

Return if the current address is marked as data.

Aliases: database.is_data, database.type.dataQ

type.is_data(ea)

Return if the address specified by ea is marked as data.

Aliases: database.is_data, database.type.dataQ

Parameters:	ea (int or long) – an address within the database

type.is_data(ea, size)

Return if the address specified by ea up to size bytes is marked as data.

Aliases: database.is_data, database.type.dataQ

Parameters:	ea (int or long) – an address within the database size (int or long) – the number of bytes to check

type.is_exception(**flags)¶

Return if the current address or selection is guarded by an exception or part of an exception handler.

Aliases: database.type.hasexception, database.type.has_exception, database.type.isexception, database.type.exceptionQ

Parameters:	*flags – any of the `idaapi.TBEA_\` flags that are used to match the block type.

type.is_exception(ea, **flags)

Return if the address or boundaries in ea is guarded by an exception or part of an exception handler.

If seh or cpp is specified, then include or exclude that exception type. If guarded or try is true, then return if the address is guarded by an exception. If handler or catch is true, then return if the address is part of an exception handler. If fallthrough is true, then return if the address is part of the fall-through case for a handler. If filter or finally is true, then return if the address is part of an SEH filter or SEH finalizer (respectively).

Aliases: database.type.hasexception, database.type.has_exception, database.type.isexception, database.type.exceptionQ

Parameters:	ea (int or long or tuple) – an address within the database *flags – any of the `idaapi.TBEA_\` flags that are used to match the block type.

type.is_exception(ea, flags)

Return if the address in ea is referenced by an exception matching the specified flags (idaapi.TBEA_*).

Aliases: database.type.hasexception, database.type.has_exception, database.type.isexception, database.type.exceptionQ

Parameters:	ea (int or long) – an address within the database flags (int or long) – any of the `idaapi.TBEA_\*` flags that are used to match the block type.

type.is_exception(bounds, flags)

Return if the given bounds is referenced by an exception matching the specified flags (idaapi.TBEA_*).

Aliases: database.type.hasexception, database.type.has_exception, database.type.isexception, database.type.exceptionQ

Parameters:	bounds (tuple) – the boundaries of the range to check flags (int or long) – any of the `idaapi.TBEA_\*` flags that are used to match the block type.

type.is_globalref()¶

Return true if the instruction at the current address references a global.

Aliases: database.type.isglobalref, database.type.globalrefQ

type.is_globalref(ea)

Return true if the instruction at ea references a global.

Aliases: database.type.isglobalref, database.type.globalrefQ

Parameters:	ea (int or long) – an address within the database

type.is_head()¶

Return if the current address is aligned to a definition in the database.

Aliases: database.is_head, database.type.headQ

type.is_head(ea)

Return if the address ea is aligned to a definition in the database.

Aliases: database.is_head, database.type.headQ

Parameters:	ea (int or long) – an address within the database

type.is_importref()¶

Return true if the instruction at the current address references an import.

Aliases: database.type.isimportref, database.type.importrefQ

type.is_importref(ea)

Return true if the instruction at ea references an import.

Aliases: database.type.isimportref, database.type.importrefQ

Parameters:	ea (int or long) – an address within the database

type.is_initialized()¶

Return if the current address is initialized.

Aliases: database.type.initializedQ

type.is_initialized(ea)

Return if the address specified by ea is initialized.

Aliases: database.type.initializedQ

Parameters:	ea (int or long) – an address within the database

type.is_initialized(ea, size)

Return if the address specified by ea up to size bytes is initialized.

Aliases: database.type.initializedQ

Parameters:	ea (int or long) – an address within the database size (int or long) – the number of bytes to check

type.is_reference()¶

Return if the data at the current address is referenced by another address.

Aliases: database.type.is_referenced, database.type.is_ref

type.is_reference(ea)

Return if the data at the address ea is referenced by another address.

Aliases: database.type.is_referenced, database.type.is_ref

Parameters:	ea (int or long) – an address within the database

type.is_string()¶

Return if the current address is defined as a string.

Aliases: database.type.stringQ

type.is_string(ea)

Return if the address at ea is defined as a string.

Aliases: database.type.stringQ

Parameters:	ea (int or long) – an address within the database

type.is_structure()¶

Return if the current address is defined as a structure.

Aliases: database.type.is_struct, database.type.structQ, database.type.is_struc

type.is_structure(ea)

Return if the address at ea is defined as a structure.

Aliases: database.type.is_struct, database.type.structQ, database.type.is_struc

Parameters:	ea (int or long) – an address within the database

type.is_tail()¶

Return if the current address is not aligned to a definition in the database.

Aliases: database.is_tail, database.type.tailQ

type.is_tail(ea)

Return if the address ea is not aligned to a definition in the database.

Aliases: database.is_tail, database.type.tailQ

Parameters:	ea (int or long) – an address within the database

type.is_unknown()¶

Return if the current address is marked as unknown.

Aliases: database.type.undefinedQ, database.is_unknown, database.type.is_undefined, database.type.unknownQ

type.is_unknown(ea)

Return if the address specified by ea is marked as unknown.

Aliases: database.type.undefinedQ, database.is_unknown, database.type.is_undefined, database.type.unknownQ

Parameters:	ea (int or long) – an address within the database

type.is_unknown(ea, size)

Return if the address specified by ea up to size bytes is marked as unknown.

Aliases: database.type.undefinedQ, database.is_unknown, database.type.is_undefined, database.type.unknownQ

Parameters:	ea (int or long) – an address within the database size (int or long) – the number of bytes to check

type.size()¶

Return the size of the item at the current address.

Aliases: database.size

type.size(ea)

Return the size of the item at the address ea.

Aliases: database.size

Parameters:	ea (int or long) – an address within the database

type.switch()¶: Return the switch_t at the current address.

type.switch(ea)

Return the switch_t at the address ea.

Parameters:	ea (int or long) – an address within the database containing a switch

3.1.1.2.13.1. database.type.array¶

This namespace is for returning type information about an array that is defined within the database. By default this namespace will return the array’s element type and its number of elements as a list [size, count].

Some examples of using this namespace can be:

> type, length = database.t.array()
> print( database.t.array.size(ea) )
> print( database.t.array.member(ea) )
> print( database.t.array.element(ea) )
> print( database.t.array.length(ea) )

type.array()¶: Return the [type, length] of the array at the current address.

type.array(ea)

Return the [type, length] of the array at the address specified by ea.

Parameters:	ea (int or long) – an address within the database containing an array

type.array(bounds)

Return the [type, length] of the specified bounds as an array.

Parameters:	bounds (tuple) –

type.array(ea, size)

Return the [type, length] of the address ea if it was an array using the specified size (in bytes).

Parameters:	ea (int or long) – size –

type.array.element()¶

Return the type information for the member of the array defined at the current address.

Aliases: database.type.typeinfo, database.type.info

type.array.element(ea)

Return the type information for the member of the array defined at the address specified by ea.

Aliases: database.type.typeinfo, database.type.info

Parameters:	ea (int or long) – an address within the database containing an array

type.array.length()¶: Return the number of members in the array at the current address.

type.array.length(ea)

Return the number of members in the array at the address specified by ea.

Parameters:	ea (int or long) – an address within the database containing an array

type.array.member()¶: Return the type for the member of the array at the current address.

type.array.member(ea)

Return the type for the member of the array at the address specified by ea.

Parameters:	ea (int or long) – an address within the database containing an array

type.array.size()¶: Return the size of a member in the array at the current address.

type.array.size(ea)

Return the size of a member in the array at the address specified by ea.

Parameters:	ea (int or long) – an address within the database containing an array

3.1.1.2.13.2. database.type.structure¶

Aliases: database.type.struc

This namespace for returning type information about a structure that is defined within the database. By default this namespace will return the structure_t at the given address.

Some of the ways to use this namespace are:

> st = database.t.struct()
> print( database.t.struct.size() )
> st = structure.by(database.t.id(ea))

type.structure()¶: Return the structure type at the current address.

type.structure(ea)

Return the structure type at address ea.

Parameters:	ea (int or long) – an address within the database containing a structure

type.structure.id()¶

Return the identifier of the structure at the current address.

Aliases: database.get_structureid, database.get_strucid, database.getStructureId

type.structure.id(ea)

Return the identifier of the structure at address ea.

Aliases: database.get_structureid, database.get_strucid, database.getStructureId

Parameters:	ea (int or long) – an address within the database containing a structure

type.structure.size()¶: Return the total size of the structure at the current address.

type.structure.size(ea)

Return the total size of the structure at address ea.

Parameters:	ea (int or long) – an address within the database containing a structure

3.1.1.2.14. database.types¶

This namespace is for interacting with the local types that are defined within the database. The functions within this namespace can be used to create, query, or fetch the types that have been defined.

When listing the types that are matched, the following legend can be used to identify certain characteristics about them:

L - The type originated from a type library
I - The type originated from an inherited type library
T - The type is a type definition and references another type
P - The contents of the type is a pointer
F - The contents of the type is a floating-point value (float, double, long double)
E - The contents of the type is an enumeration
I - The contents of the type is an integral
A - The type represents an array
F - The type represents a function
S - The type represents a structure
V - The type represents a virtual function table
C - The type represents a structure containing a virtual function table
U - The type represents a union
? - The type is currently not defined

The available types that one can filter the local types with are as follows:

ordinal - Match according to the ordinal of the local type.
name - Match according to the name of the local type.
like - Filter the names of the local types according to a glob.
definition - Filter the local types by applying a glob to their definition.
regex - Filter the local types by applying a regular-expression to their definition.
typeref or typedef - Filter the local types for any that are an alias declared with typedef.
defined or present - Filter the local types for any that are defined.
size - Filter the local types according to their size.
greater or ge - Filter the local types for the ones that are larger or equal to a certain size.
gt - Filter the local types for the ones that are larger than a certain size.
less or le - Filter the local types for the ones that are less or equal to a certain size.
lt - Filter the local types for the ones that are less than a certain size.
integer - Filter the local types for any that are integers.
pointer - Filter the local types for any that are pointers.
function - Filter the local types for any that are functions.
float - Filter the local types for any that are floating-point.
array - Filter the local types for any that describe an array.
structure - Filter the local types for any that describe a structure.
union - Filter the local types for any that describe a union.
enumeration - Filter the local types for any that describe an enumeration.
predicate - Filter the types by passing their ordinal and idaapi.tinfo_t to a callable.

Some examples of using these keywords are as follows:

> database.types.list('*::*')
> iterable = database.types.iterate(definition='*Cookie*')
> result = database.types.search(regex='.*const.*')

types.add(name, **mangled)¶

Add an empty type with the provided name to the current type library.

Parameters:	name (str) – the name of the type to add **mangled – a boolean that specifies whether the name of the type is mangled

types.add(name, library, **mangled)

Add an empty type with the provided name to the specified type library.

Parameters:	name (str) – the name of the type to add library (idaapi.til_t) – the `idaapi.til_t` of the library to be added to **mangled – a boolean that specifies whether the name of the type is mangled

types.add(name, info, **mangled)

Add the type information in info to the current type library using the provided name.

Parameters:	name (str) – the name of the type to add info (str or idaapi.tinfo_t) – the string or `idaapi.tinfo_t` of the type to add **mangled – a boolean that specifies whether the name of the type is mangled

types.add(name, string, library, **mangled)

Add the type information in string to the specified type library using the provided name.

Parameters:	name (str) – the name of the type to add string (str) – a string describing the type to add library (idaapi.til_t) – the `idaapi.til_t` of the library to be added to **mangled – a boolean that specifies whether the name of the type is mangled

types.add(name, info, library, **mangled)

Add the type information in info to the specified type library using the provided name.

If the boolean mangled is specified, then the given name is mangled.

Parameters:	name (str) – the name of the type to add info (idaapi.tinfo_t) – the `idaapi.tinfo_t` to use when adding the type library (idaapi.til_t) – the `idaapi.til_t` of the library to be added to **mangled – a boolean that specifies whether the name of the type is mangled

types.by(ordinal)¶

Return the type information that is at the given ordinal.

Parameters:	ordinal (int or long) – the numerical index of the type to return

types.by(name)

Return the type information that has the specified name.

Parameters:	name (str) – the name of the type to return

types.by(ordinal, library)

Return the type information from the specified library that is at the given ordinal.

Parameters:	ordinal (int or long) – the numerical index of the type to return library (idaapi.til_t) – the `idaapi.til_t` of the library to return the type from

types.by(name, library)

Return the type information from the specified library that is using the given name.

Parameters:	name (str) – the name of the type to return library (idaapi.til_t) – the `idaapi.til_t` of the library to return the type from

types.by_index(ordinal)¶

Return the type information that is at the given ordinal.

Parameters:	ordinal (int or long) – the numerical index of the type to return

types.by_index(ordinal, library)

Return the type information from the specified library that is at the given ordinal.

Parameters:	ordinal (int or long) – the numerical index of the type to return library (idaapi.til_t) – the `idaapi.til_t` of the library to return the type from

types.by_name(name)¶

Return the type information that has the specified name.

Parameters:	name (str) – the name of the type to return

types.by_name(name, library)

Return the type information from the specified library that is using the given name.

Parameters:	name (str) – the name of the type to return library (idaapi.til_t) – the `idaapi.til_t` of the library to return the type from

types.count()¶: Return the number of types that are available in the current type library.

types.count(library)

Return the number of types that are available in the specified type library.

Parameters:	library (idaapi.til_t) – the `idaapi.til_t` of the library to return the number of types from

types.declare(string, **flags)¶

Parse the given string into an idaapi.tinfo_t using the current type library and return it.

Aliases: database.types.decl, database.types.parse

Parameters:	string (str) – the type as a string to parse *flags – any of the `idaapi.PT_\` flags to use when parsing the type

types.declare(string, library, **flags)

Parse the given string into an idaapi.tinfo_t using the specified type library and return it.

If the integer flags is provided, then use the specified flags (idaapi.PT_*) when parsing the string.

Aliases: database.types.decl, database.types.parse

Parameters:	string (str) – the type as a string to parse library (idaapi.til_t) – the `idaapi.til_t` describing the target type library *flags – any of the `idaapi.PT_\` flags to use when parsing the type

types.get(ordinal)¶

Get the type information at the given ordinal of the current type library and return it.

Parameters:	ordinal (int or long) – the numerical index of the type to get

types.get(name)

Get the type information with the given name from the current type library and return it.

Parameters:	name (str) – the name of the type to get

types.get(ordinal, library)

Get the type information at the given ordinal of the specified type library and return it.

Parameters:	ordinal (int or long) – the numerical index of the type to get library (idaapi.til_t) – the `idaapi.til_t` of the library to fetch the type from

types.get(name, library)

Get the type information with the given name from the specified type library and return it.

Parameters:	name (str) – the name of the type to get library (idaapi.til_t) – the `idaapi.til_t` of the library to fetch the type from

types.get(serialized)

Convert the serialized type information from the current type library and return it.

Parameters:	serialized (tuple) – the tuple containing the fields that describe the serialized type

types.get(serialized, library)

Convert the serialized type information from the specified type library and return it.

Parameters:	serialized (tuple) – the tuple containing the fields that describe the serialized type library (idaapi.til_t) – the `idaapi.til_t` of the library to serialize the type from

types.has(ordinal)¶

Return whether the current type library has a type at the given ordinal.

Parameters:	ordinal (int or long) – the ordinal of the type to check

types.has(name)

Return whether the current type library has a type with the specified name.

Parameters:	name (str) – the name of the type to check

types.has(ordinal, library)

Return whether the provided type library has a type at the given ordinal.

Parameters:	ordinal (int or long) – library (idaapi.til_t) – the `idaapi.til_t` of the library to check

types.has(name, library)

Return whether the provided type library has a type with the specified name.

Parameters:	name (str) – the name of the type to check library (idaapi.til_t) – the `idaapi.til_t` of the library to check

types.iterate(string)¶

Iterate through all of the types in current type library with a glob that matches string.

Parameters:	string (str) – the glob to filter the names of the types with

types.iterate(string, library)

Iterate through all of the types in the specified type library with a glob that matches string.

Parameters:	string (str) – the glob to filter the names of the types with library (idaapi.til_t) – the `idaapi.til_t` containing the types to iterate

types.iterate(**type)

Iterate through all of the types in the current type library that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter types with

types.iterate(library, **type)

Iterate through all of the types in the specified type library that match the keyword specified by type.

Parameters:	library (idaapi.til_t) – the `idaapi.til_t` of the library containing the types **type – any keyword that can be used to filter types with

types.list(string)¶

List all of the types in the current type library with a glob that matches string.

Parameters:	string (str) – the glob to filter the type names with

types.list(string, library)

List all of the types in the specified type library with a glob that matches string.

Parameters:	string (str) – the glob to filter the type names with library (idaapi.til_t) – the `idaapi.til_t` containing the types to list

types.list(**type)

List all of the types in the specified type library that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the types with

types.list(library, **type)

List all of the types in the specified type library that match the keyword specified by type.

Parameters:	library (idaapi.til_t) – the `idaapi.til_t` containing the types to list **type – any keyword that can be used to filter the types with

types.name(info)¶

Return the name of the type from the current type library that matches the given type info.

Parameters:	info (idaapi.tinfo_t) – the type information to return the name of

types.name(ordinal)

Return the name of the type from the current type library at the specified ordinal.

Parameters:	ordinal (int or long) – the numerical index of the type to get the name from

types.name(info, library)

Return the name of the type from the specified type library that matches the given type info.

Parameters:	info (idaapi.tinfo_t) – the type information to return the name of library (idaapi.til_t) – the `idaapi.til_t` of the library containing the type

types.name(ordinal, library)

Return the name of the type from the specified type library at the given ordinal.

Parameters:	ordinal (int or long) – the numerical index of the type to get the name from library (idaapi.til_t) – the `idaapi.til_t` of the library containing the type

types.name(ordinal, string, **mangled)

Set the name of the type at the specified ordinal from the current library to string.

Parameters:	ordinal (int or long) – the numerical index of the type to rename string (str) – the new name of the type **mangled – a boolean that specifies whether the name is mangled

types.name(ordinal, string, library, **mangled)

Set the name of the type at the specified ordinal of the given type library to string.

If the boolean mangled is specified, then the given name is mangled.

Parameters:	ordinal (int or long) – the numerical index of the type to rename string (str) – the new name of the type library (idaapi.til_t) – the `idaapi.til_t` of the library containing the type to rename **mangled – a boolean that specifies whether the name is mangled

types.remove(ordinal)¶

Remove the type information at the specified ordinal of the current type library.

Parameters:	ordinal (int or long) – the numerical index of the type to remove

types.remove(ordinal, library)

Remove the type information at the ordinal of the specified type library.

Parameters:	ordinal (int or long) – the numerical index of the type to remove library (idaapi.til_t) – the `idaapi.til_t` of the library to remove the type from

types.remove(name, **mangled)

Remove the type information with the specified name from the current type library.

Parameters:	name (str) – the name of the type to remove **mangled – a boolean that specifies whether the name of the type is mangled

types.remove(name, library, **mangled)

Remove the type information with the specified name from the specified type library.

If the boolean mangled is specified, then the given name is mangled.

Parameters:	name (str) – the name of the type to remove library (idaapi.til_t) – the `idaapi.til_t` of the library to remove the type from **mangled – a boolean that specifies whether the name of the type is mangled

types.search(string)¶

Search through all of the type names in the current type library matching the glob string and return the first result.

Parameters:	string (str) – the glob to filter the names of the types with

types.search(string, library)

Search through all of the type names in the specified type library matching the glob string and return the first result.

Parameters:	string (str) – the glob to filter the names of the types with library (idaapi.til_t) – the `idaapi.til_t` containing the types to search

types.search(**type)

Search through all of the types in the current type library that match the keyword specified by type.

Parameters:	**type – any keyword that can be used to filter the types with

types.search(library, **type)

Search through all of the types in the specified type library that match the keyword specified by type.

Parameters:	library (idaapi.til_t) – the `idaapi.til_t` containing the types to search **type – any keyword that can be used to filter the types with

types.set(ordinal, info)¶

Assign the type information info to the type at the specified ordinal of the current type library.

Parameters:	ordinal (int or long) – the numerical index of the type to set info (str or idaapi.tinfo_t) – the string or `idaapi.tinfo_t` of the type to assign

types.set(ordinal, name, info, **mangled)

Assign the type information info with the specified name to the given ordinal of the current type library.

Parameters:	ordinal (int or long) – the numerical index of the type to set name (str) – the name of the type to set info (str or idaapi.tinfo_t) – the string or `idaapi.tinfo_t` of the type to assign **mangled – a boolean that specifies whether the name of the type is mangled

types.set(ordinal, info, library)

Assign the type information info to the type at the ordinal of the specified type library.

Parameters:	ordinal (int or long) – the numerical index of the type to set info (str or idaapi.tinfo_t) – the string or `idaapi.tinfo_t` of the type to assign library (idaapi.til_t) – the `idaapi.til_t` of the library for the type

types.set(ordinal, name, string, library, **mangled)

Assign the type information in string with the specified name to the specified ordinal of the given type library.

Parameters:	ordinal (int or long) – the numerical index of the type to set name (str) – the name of the type to set string (str) – a string describing the type to assign library (idaapi.til_t) – the `idaapi.til_t` of the library for the type **mangled – a boolean that specifies whether the name of the type is mangled

types.set(ordinal, name, info, library, **mangled)

Assign the type information info with the specified name to the given ordinal of the type library.

If the boolean mangled is specified, then the given name is mangled.

Parameters:	ordinal (int or long) – the numerical index of the type to set name (str) – the name of the type to set info (idaapi.tinfo_t) – the `idaapi.tinfo_t` of the type to assign library (idaapi.til_t) – the `idaapi.til_t` of the library for the type **mangled – a boolean that specifies whether the name of the type is mangled

3.1.1.2.15. database.xref¶

Aliases: database.x

This namespace is for navigating the cross-references (xrefs) associated with an address in the database. This lets one identify code xrefs from data xrefs and even allows one to add or remove xrefs as they see fit.

This namespace is also aliased as database.x.

Some of the more common functions are used so often that they’re also aliased as globals. Some of these are:

database.up - Return all addresses that reference an address
database.down - Return all addresses that an address references
database.drefs - Return all the data references for an address
database.crefs - Return all the code references for an address
database.dxup - Return all the data references that reference an address
database.dxdown - Return all the data references that an address references
database.cxup - Return all the code references that reference an address
database.cxdown - Return all the code references that an address references

Some ways to utilize this namespace can be:

> print( database.x.up() )
> for ea in database.x.down(): ...
> for ea in database.x.cu(ea): ...
> ok = database.x.add_code(ea, target)
> ok = database.x.rm_data(ea)

xref.add_code(target, **reftype)¶

Add a code reference from the current address to target.

Aliases: database.xref.ac

Parameters:	target (int or long) – the target address to add a code reference to **reftype – if `call` is set to true, this specify that this reference is a function call

xref.add_code(ea, target, **reftype)

Add a code reference from address ea to target.

If the reftype call is true, then specify this ref as a function call.

Aliases: database.xref.ac

Parameters:	ea (int or long) – an address within the database target (int or long) – the target address to add a code reference to **reftype – if `call` is set to true, this specify that this reference is a function call

xref.add_data(target, **reftype)¶

Add a data reference from the current address to target.

Aliases: database.xref.ad

Parameters:	target (int or long) – the target address to add a data reference to **reftype – if `write` is set to true, then specify that this reference writes to its target

xref.add_data(ea, target, **reftype)

Add a data reference from the address ea to target.

If the reftype write is true, then specify that this ref is writing to the target.

Aliases: database.xref.ad

Parameters:	ea (int or long) – an address within the database target (int or long) – the target address to add a data reference to **reftype – if `write` is set to true, then specify that this reference writes to its target

xref.code()¶

Return all of the code xrefs that refer to the current address.

Aliases: database.crefs

xref.code(descend)

Aliases: database.crefs, database.xref.c

Parameters:	descend (bool) – a boolean that specifies to only return references that are referred by the current address

xref.code(ea)

Return all of the code xrefs that refer to the address ea.

Aliases: database.crefs, database.xref.c

Parameters:	ea (int or long) – an address within the database

xref.code(ea, descend)

Return all of the code xrefs that refer to the address ea.

If the bool descend is defined, then return only code refs that are referred by the specified address.

Aliases: database.crefs, database.xref.c

Parameters:	ea (int or long) – an address within the database descend (bool) – a boolean that specifies to only return references that are referred by the address

xref.code_down()¶

Return all of the code xrefs that are referenced by the current address.

Aliases: database.cxdown, database.xref.cd

xref.code_down(ea)

Return all of the code xrefs that are referenced by the address ea.

Aliases: database.cxdown, database.xref.cd

Parameters:	ea (int or long) – an address within the database

xref.code_up()¶

Return all of the code xrefs that are referenced by the current address.

Aliases: database.xref.cu, database.cxup

xref.code_up(ea)

Return all of the code xrefs that refer to the address ea.

Aliases: database.xref.cu, database.cxup

Parameters:	ea (int or long) – an address within the database

xref.data()¶

Return all of the data xrefs that refer to the current address.

Aliases: database.xref.d, database.drefs

xref.data(descend)

Aliases: database.xref.d, database.drefs

Parameters:	descend (bool) – a boolean that specifies to only return references that are referred by the current address

xref.data(ea)

Return all of the data xrefs that refer to the address ea.

Aliases: database.xref.d, database.drefs

Parameters:	ea (int or long) – an address within the database

xref.data(ea, descend)

Return all of the data xrefs that refer to the address ea.

If the bool descend is defined, then return only the data refs that are referred by the specified address.

Aliases: database.xref.d, database.drefs

Parameters:	ea (int or long) – an address within the database descend (bool) – a boolean that specifies to only return references that are referred by the current address

xref.data_down()¶

Return all of the data xrefs that are referenced by the current address.

Aliases: database.xref.dd, database.dxdown

xref.data_down(ea)

Return all of the data xrefs that are referenced by the address ea.

Aliases: database.xref.dd, database.dxdown

Parameters:	ea (int or long) – an address within the database

xref.data_up()¶

Return all of the data xrefs that refer to the current address.

Aliases: database.xref.du, database.dxup

xref.data_up(ea)

Return all of the data xrefs that refer to the address ea.

Aliases: database.xref.du, database.dxup

Parameters:	ea (int or long) – an address within the database

xref.down()¶

Return all of the references that are referred by the current address.

Aliases: database.down, database.xref.d

xref.down(ea)

Return all of the references that are referred by the address ea.

Aliases: database.down, database.xref.d

Parameters:	ea (int or long) – an address within the database

xref.erase()¶

Clear all references at the current address.

Aliases: database.xref.rx

xref.erase(ea)

Clear all references at the address ea.

Aliases: database.xref.rx

Parameters:	ea (int or long) – an address within the database containing a code or a data reference

xref.rm_code()¶

Delete _all_ the code references at the current address.

Aliases: database.xref.rc

xref.rm_code(ea)

Delete _all_ the code references at ea.

Aliases: database.xref.rc

Parameters:	ea (int or long) – an address within the database containing a code reference

xref.rm_code(ea, target)

Delete any code references at ea that point to address target.

Aliases: database.xref.rc

Parameters:	ea (int or long) – an address within the database containing a code reference target (int or long) – the target address that the reference points to

xref.rm_data()¶

Delete _all_ the data references at the current address.

Aliases: database.xref.rd

xref.rm_data(ea)

Delete _all_ the data references at ea.

Aliases: database.xref.rd

Parameters:	ea (int or long) – an address within the database containing a data reference

xref.rm_data(ea, target)

Delete any data references at ea that point to address target.

Aliases: database.xref.rd

Parameters:	ea (int or long) – an address within the database containing a data reference target (int or long) – the target address that the reference points to

xref.up()¶

Return all of the references that refer to the current address.

Aliases: database.xref.u, database.up

xref.up(ea)

Return all of the references that refer to the address ea.

Aliases: database.xref.u, database.up

Parameters:	ea (int or long) – an address within the database

3.1.1. database – Database module¶

3.1.1.1. Function list¶

3.1.1.2. Namespace list¶

3.1.1.2.1. database.address¶

3.1.1.2.2. database.config¶

3.1.1.2.2.1. database.config.register¶

3.1.1.2.3. database.entries¶

3.1.1.2.4. database.extra¶

3.1.1.2.5. database.functions¶

3.1.1.2.6. database.get¶

3.1.1.2.6.1. database.get.float¶

3.1.1.2.6.2. database.get.integer¶

3.1.1.2.6.3. database.get.switch¶

3.1.1.2.7. database.imports¶

3.1.1.2.8. database.marks¶

3.1.1.2.9. database.names¶

3.1.1.2.10. database.search¶

3.1.1.2.11. database.segments¶

3.1.1.2.12. database.set¶

3.1.1.2.12.1. database.set.float¶

3.1.1.2.12.2. database.set.integer¶

3.1.1.2.13. database.type¶

3.1.1.2.13.1. database.type.array¶

3.1.1.2.13.2. database.type.structure¶

3.1.1.2.14. database.types¶

3.1.1.2.15. database.xref¶

IDA-minsc

Navigation

Contents

Search

Indices

This Page