3.1.1. database – Database module

This module exposes a number of tools that can be used on a database and on addresses within the database. There are a number of namespaces that allow one to query information about the database as a whole, or to read/write to an address within the database.

The base argument type for many of the utilites within this module is the address. This can allow one to modify the colors or comments for an address, or to read/write from the different types of data that might exist at an address.

Some namespaces are also provided for querying the available symbolic information that IDA has discovered about a binary. This can be used to search and navigate the database. Some of the available namespaces that can be used for querying are functions, segments, names, imports, entries, and marks.

3.1.1.1. Function list

The functions that are available in this module use multicased functions and aliases. For more information on this, please see Aliases and Multicased functions.

database.bottom()

Return the very highest address within the database.

database.color()

Return the color (RGB) for the item at the current address.

database.color(none)

Remove the color from the item at the current address.

Parameters:none (None) – the python value None
database.color(ea)

Return the color (RGB) for the item at the address specified by ea.

Parameters:ea (int or long) – an address in the database
database.color(ea, none)

Remove the color from the item at the the address specified by ea.

Parameters:
  • ea (int or long) – an address in the database
  • none (None) – the python value None
database.color(ea, rgb)

Set the color for the item at address ea to rgb.

Parameters:
  • ea (int or long) – an address in the database
  • rgb (int or long) – the color as a red, green, and blue integer (0x00RRGGBB)
database.comment(**repeatable)

Return the comment at the current address.

Parameters:**repeatable – a boolean specifying that the repeatable comment should be returned
database.comment(ea, **repeatable)

Return the comment at the address ea.

If the bool repeatable is specified, then return the repeatable comment.

Parameters:
  • ea (int or long) – an address in the database
  • **repeatable – a boolean specifying that the repeatable comment should be returned
database.comment(string, **repeatable)

Set the comment at the current address to string.

Parameters:
  • string (str) – the comment to apply
  • **repeatable – a boolean specifying that the repeatable comment should be modified
database.comment(none, **repeatable)

Remove the comment at the current address.

Parameters:
  • none (None) – the python value None
  • **repeatable – a boolean specifying that the repeatable comment should be removed
database.comment(ea, string, **repeatable)

Set the comment at the address ea to string.

If the bool repeatable is specified, then modify the repeatable comment.

Parameters:
  • ea (int or long) – an address in the database
  • string (str) – the comment to apply
  • **repeatable – a boolean specifying that the repeatable comment should be modified
database.comment(ea, none, **repeatable)

Remove the comment at the address ea.

If the bool repeatable is specified, then remove the repeatable comment.

Parameters:
  • ea (int or long) – an address in the database
  • none (None) – the python value None
  • **repeatable – a boolean specifying that the repeatable comment should be removed
database.disassemble(**options)

Disassemble the instructions at the current address.

Parameters:**options – if count is specified as an integer, this will specify the number of instructions to disassemble. if comments is specified as a boolean, this will determine whether comments are included or not.
database.disassemble(ea, **options)

Disassemble the instructions at the address specified by ea.

If the integer count is specified, then return count number of instructions. If the bool comments is true, then return the comments for each instruction as well.

Aliases: database.disasm

Parameters:
  • ea (int or long) – an address within the database
  • **options – if count is specified as an integer, this will specify the number of instructions to disassemble. if comments is specified as a boolean, this will determine whether comments are included or not.
database.go(ea)

Jump to the specified address at ea.

Parameters:ea – an address in the database
database.go_offset(offset)

Jump to the specified offset within the database.

Aliases: database.goof, database.gotooffset, database.gooffset, database.goto_offset

Parameters:offset – an offset from the base address
database.here()

Return the current address.

database.instruction()

Return the instruction at the current address as a string.

database.instruction(ea)

Return the instruction at the address ea as a string.

Parameters:ea (int or long) – an address within the database
database.mangled()

Return the mangled name at the current address.

Aliases: database.mangle

database.mangled(ea)

Return the mangled name at the address specified by ea.

Aliases: database.mangle

Parameters:ea (int or long) – an address in the database containing a name
database.mangled(string, *suffix)

Rename the current address to the mangled version of string and return its previous mangled value.

Aliases: database.mangle

Parameters:
  • string (str) – a string to use as the name
  • *suffix – any other integers or strings to append to the name
database.mangled(none)

Remove the mangled name at the current address and return its previous mangled value.

Aliases: database.mangle

Parameters:none (None) – the python value None
database.mangled(ea, string, *suffix)

Rename the address specified by ea to the mangled version of string and return its previous mangled value.

Aliases: database.mangle

Parameters:
  • ea (int or long) – an address in the database
  • string (str) – a string to use as the name
  • *suffix – any other integers or strings to append to the name
database.mangled(ea, none)

Remove the name at the address specified by ea and return its previous mangled value.

Aliases: database.mangle

Parameters:
  • ea (int or long) – an address in the database containing a name
  • none (None) – the python value None
database.mark()

Return the mark at the current address.

database.mark(none)

Remove the mark at the current address.

Parameters:none (None) – the python value None
database.mark(ea)

Return the mark at the specified address ea.

Parameters:ea (int or long) – an address within the database containing a mark
database.mark(description)

Set the mark at the current address to the specified description.

Parameters:description (str) – the description to set the mark with
database.mark(ea, none)

Erase the mark at address ea.

Parameters:
  • ea (int or long) – the address of an existing mark within the database
  • none (None) – the python value None
database.mark(ea, description)

Sets the mark at address ea to the specified description.

Parameters:
  • ea (int or long) – the address within the database to set a mark at
  • description (str) – the address to set the mark with
database.name(**flags)

Return the name at the current address.

Parameters:**flags – any number of idaapi.GN_* flags to use when fetching the name
database.name(ea, **flags)

Return the name defined at the address specified by ea.

If flags is specified, then use the specified value as the flags.

Parameters:
  • ea (int or long) – an address in the database
  • **flags – any number of idaapi.GN_* flags to use when fetching the name
database.name(packed, **flags)

Renames the current address to the given packed name.

Parameters:
  • packed (tuple) – a tuple of integers or strings to use for the name
  • **flags – any number of idaapi.SN_* flags to use when setting the name
database.name(string, *suffix, **flags)

Renames the current address to string.

Parameters:
  • string (str) – a string to use as the name
  • *suffix – any other integers or strings to append to the name
  • **flags – any number of idaapi.SN_* flags to use when setting the name
database.name(none, **flags)

Removes the name at the current address.

Parameters:
  • none (None) – the python value None
  • **flags – any number of idaapi.SN_* flags to use when setting the name
database.name(ea, packed, **flags)

Renames the address specifed by ea to the given packed name.

Parameters:
  • ea – an address in the database
  • packed (tuple) – a tuple of integers or strings to use for the name
  • **flags – any number of idaapi.SN_* flags to use when setting the name
database.name(ea, string, *suffix, **flags)

Renames the address specified by ea to string.

If ea is pointing to a global and is not contained by a function, then by default the label will be added to the Names list. If flags is specified, then use the specified value as the flags. If the boolean listed is specified, then specify whether to add the label to the Names list or not.

Parameters:
  • ea (int or long) – an address in the database
  • string (str) – a string to use as the name
  • *suffix – any other integers or strings to append to the name
  • **flags – any number of idaapi.SN_* flags to use when setting the name
database.name(ea, none, **flags)

Removes the name defined at the address ea.

Parameters:
  • ea (int or long) – an address in the database
  • none (None) – the python value None
  • **flags – any number of idaapi.SN_* flags to use when removing the name
database.read()

Return the bytes defined at the current address.

database.read(ea)

Return the number of bytes associated with the address ea.

Parameters:ea (int or long) – the address to read bytes from
database.read(ea, size)

Return size number of bytes from address ea.

Parameters:
  • ea (int or long) – the address to read bytes from
  • size (int or long) – the number of bytes to read
database.read(bounds)

Return the bytes within the specified bounds.

Parameters:bounds (tuple) – a tuple containing the boundaries to return the bytes from
database.select(tag, *And, **boolean)

Query all of the global tags in the database for the specified tag and any others specified as And.

Parameters:
  • tag (str) – a required tag name to search for
  • *And – any other required tag names
  • **boolean – either And or Or which specifies required or optional tags (respectively)
database.select(**boolean)

Query all the global tags for any tags specified by boolean. Yields each address found along with the matching tags as a dictionary.

If And contains an iterable then require the returned address contains them. If Or contains an iterable then include any other tags that are specified.

Parameters:**boolean – either And or Or which specifies required or optional tags (respectively)
database.selectcontents(tag, *Or, **boolean)

Query all function contents for the specified tag or any others specified as Or.

Parameters:
  • tag (str) – a required tag name to search for
  • *Or – any other optional tag names
  • **boolean – either And or Or which specifies required or optional tags (respectively)
database.selectcontents(**boolean)

Query all function contents for any tags specified by boolean. Yields each function and the tags that match as a set.

If And contains an iterable then require the returned function contains them. If Or contains an iterable then include any other tags that are specified.

Parameters:**boolean – either And or Or which specifies required or optional tags (respectively)
database.tag()

Return all of the tags defined at the current address.

database.tag(ea)

Return all of the tags defined at address ea.

Parameters:ea (int or long) – an address in the database
database.tag(key)

Return the tag identified by key at the current address.

Parameters:key (str) – a string representing the tag name to return
database.tag(key, value)

Set the tag identified by key to value at the current address.

Parameters:
  • key (str) – a string representing the tag name to assign to
  • value – a python object to store at the tag
database.tag(ea, key)

Return the tag identified by key from the address ea.

Parameters:
  • ea (int or long) – an address in the database
  • key (str) – a string representing the tag name to return
database.tag(ea, key, value)

Set the tag identified by key to value at the address ea.

Parameters:
  • ea (int or long) – an address in the database
  • key (str) – a string representing the tag name to assign
  • value – a python object to store at the tag
database.tag(key, none)

Remove the tag identified by key from the current address.

Parameters:
  • key (str) – a string representing the tag name to remove
  • none (None) – the python value None
database.tag(ea, key, none)

Removes the tag identified by key at the address ea.

Parameters:
  • ea (int or long) – an address in the database
  • key (str) – a string representing the tag name to remove
  • none (None) – the python value None
database.tags()

Return all of the tag names used globally within the database.

database.top()

Return the very lowest address within the database.

database.unmangled()

Return the name at the current address in its unmangled form.

Aliases: database.unmangle, database.demangled, database.demangle

database.unmangled(ea)

Return the name at the address specified by ea in its unmangled form.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:ea (int or long) – an address in the database containing a name
database.unmangled(string, *suffix)

Rename the current address using the mangled version of string and return its previous unmangled value.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:
  • string (str) – a string to use as the name
  • *suffix – any other strings to append to the name
database.unmangled(none)

Remove the name at the current address and return its previous unmangled value.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:none (None) – the python value None
database.unmangled(ea, string, *suffix)

Rename the address specified by ea using the mangled version of string and return its previous unmangled value.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:
  • ea (int or long) – an address in the database
  • string (str) – a string to use as the name
  • *suffix – any other strings to append to the name
database.unmangled(ea, none)

Remove the name at the address specified by ea and return its previous unmangled value.

Aliases: database.unmangle, database.demangled, database.demangle

Parameters:
  • ea (int or long) – an address in the database containing a name
  • none (None) – the python value None
database.within()

Should always return true.

Aliases: database.contains

database.within(ea)

Return true if address ea is within the bounds of the database.

Aliases: database.contains

Parameters:ea (int or long) – an address within the database
database.write(data, **persist)

Modify the database at the current address with the bytes specified in data.

Parameters:
  • data (bytes) – the data to write
  • **persist – if persist is set to true, then write to the original bytes in the database
database.write(ea, data, **persist)

Modify the database at address ea with the bytes specified in data

If the bool persist is specified, then modify what IDA considers the original bytes.

Parameters:
  • ea (int or long) – the address to write to
  • data (bytes) – the data to write
  • **persist – if persist is set to true, then write to the original bytes in the database

3.1.1.2. Namespace list

These are the namespaces available within this module. Namespaces group similar functions that can be used typically for the same concept. Please see Classes as namespaces for more information on namespaces. For more information on multicase functions or aliases, please see Multicased functions or Aliases.

3.1.1.2.1. database.address

Aliases: database.a

This namespace is used for translating an address in the database to another address according to a number of constraints or types. Essentially these functions are used to assist with navigation. As an example, these functions allow one to navigate between the next and previous “call” instructions, addresses that contain data references, or even to navigate to unknown (undefined) addresses.

This namespace is also aliased as database.a.

Some of the more common functions are used so often that they’re also aliased as globals. Each of these can be used for navigation or for determining the next valid address. These are:

  • database.next - Return the “next” defined address
  • database.prev - Return the “previous” defined address
  • database.nextref - Return the “next” address with a reference.
  • database.prevref - Return the “previous” address with a reference
  • database.nextreg - Return the “next” address using a register
  • database.prevreg - Return the “previous” address using a register

Some examples of using this namespace can be:

> ea = database.a.next(ea)
> ea = database.a.prevreg(ea, 'edx', write=1)
> ea = database.a.nextref(ea)
> ea = database.a.prevcall(ea)
database.address()

Return the current address or a list of addresses for the current selection.

database.address(ea)

Return the address of the item containing the address ea.

Parameters:ea (int or long) – an address of an item in the database to return
database.address(start, end)

Return a list containing each of the addresses from start to end.

Parameters:
  • start (int or long) – the address to start at
  • end (int or long) – the address to stop at
database.address(start, end, step)

Return a list containing each of the addresses from start to end using the callable step to determine the next address.

Parameters:
  • start (int or long) – the address to start at
  • end (int or long) – the address to stop at
  • step (callable) – a callable that seeks to the next address such as address.next
database.address(bounds)

Return a list containing each of the addresses within bounds.

Parameters:bounds (tuple) – the address boundaries to return
database.address(bounds, step)

Return a list containing each of the addresses within bounds using the callable step to determine the next address.

Parameters:
  • bounds (tuple) – the address boundaries to return
  • step (callable) – a callable that seeks to the next address such as address.next
address.blocks()

Iterate through the currently selected blocks.

address.blocks(end)

Yields the boundaries of each block from the current address to end.

Parameters:end (int or long) – the address to stop at
address.blocks(bounds)

Yields the boundaries of each block within the specified bounds.

Parameters:bounds (tuple) – the boundaries of the blocks to return
address.blocks(start, end)

Yields the boundaries of each block between the addresses start and end.

Parameters:
  • start (int or long) – the address to start at
  • end (int or long) – the address to stop at
address.bounds()

Return the bounds of the current address or selection in a tuple formatted as (left, right).

address.bounds(ea)

Return the bounds of the specified address ea in a tuple formatted as (left, right).

Parameters:ea (int or long) – the address within the database to return an interface.bounds_t from
address.by_fileoffset(offset)

Return the address in the database for the specified file offset of the input file.

Aliases: database.address.byfileoffset

Parameters:offset (int or long) – the file offset to convert into a database address
address.by_offset(offset)

Return the specified offset translated to an address in the database.

Aliases: database.address.byoffset, database.by_offset, database.byoffset

Parameters:offset
address.fileoffset()

Return the file offset in the input file for the current address.

address.fileoffset(ea)

Return the file offset in the input file for the address ea.

Parameters:ea (int or long) – an address within the database to translate to the file offset
address.head()

Return the address of the byte at the beginning of the current address.

address.head(ea)

Return the address of the byte at the beginning of the address ea.

Parameters:ea (int or long) – an unaligned address within the database
address.iterate()

Iterate through the currently selected addresses.

address.iterate(end)

Iterate from the current address to end.

Parameters:end (int or long) – the address to stop iterating at
address.iterate(end, step)

Iterate from the current address to end using the callable step to determine the next address.

Parameters:
  • end (int or long) – the address to stop iterating at
  • step (callable) – a callable that seeks to the next address such as address.next
address.iterate(start, end)

Iterate from address start to end.

Parameters:
  • start (int or long) – the address to start iterating at
  • end (int or long) – the address to stop iterating at
address.iterate(start, end, step)

Iterate from address start to end using the callable step to determine the next address.

Parameters:
  • start (int or long) – the address to start iterating at
  • end (int or long) – the address to stop iterating at
  • step (callable) – a callable that seeks to the next address such as address.next
address.iterate(bounds)

Iterate through all of the addresses defined within bounds.

Parameters:bounds (tuple) – the address boundaries to iterate through
address.iterate(bounds, step)

Iterate through all of the addresses defined within bounds using the callable step to determine the next address.

Parameters:
  • bounds (tuple) – the address boundaries to iterate through
  • step (callable) – a callable that seeks to the next address such as address.next
address.next(**count)

Return the next address from the current address.

Aliases: database.next

Parameters:**count – the number of results to skip
address.next(predicate, **count)

Return the next address from the current address that satisfies the provided predicate.

Aliases: database.next

Parameters:
  • predicate (callable) – a callable to use when filtering instructions
  • **count – the number of results to skip
address.next(ea)

Return the next address from the address ea.

Aliases: database.next

Parameters:ea (int or long) – an address within the database
address.next(ea, predicate)

Return the next address from the address ea that satisfies the provided predicate.

Aliases: database.next

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions
address.next(ea, count)

Return the next count addresses from the address specified by ea.

Aliases: database.next

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of results to skip
address.next(ea, predicate, count)

Return the next count addresses from the address ea that satisfies the provided predicate.

Aliases: database.next

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions
  • count (int or long) – the number of results to skip
address.nextF(predicate, **count)

Return the next address from the current one that satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering instructions
  • **count – the number of results to skip
address.nextF(ea, predicate, **count)

Return the next address from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions
  • **count – the number of results to skip
address.nextF(ea, predicate, count)

Return the next count addresses from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions
  • count (int or long) – the number of results to skip
address.nextbranch(**count)

Return the next branch instruction from the current one.

Parameters:**count – the number of branch instructions to skip
address.nextbranch(predicate, **count)

Return the next branch instruction that satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering instructions by branch
  • **count – the number of branch instructions to skip
address.nextbranch(ea)

Return the next branch instruction from the address ea.

Parameters:ea (int or long) – an address within the database
address.nextbranch(ea, predicate, **count)

Return the next branch instruction from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions by branch
  • **count – the number of branch instructions to skip
address.nextbranch(ea, count)

Return the next count branch instructions from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of branch instructions to skip
address.nextcall(**count)

Return the next call instruction from the current address.

Parameters:**count – the number of call instructions to skip
address.nextcall(predicate, **count)

Return the next call instruction from the current address that satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering instructions by call
  • **count – the number of call instructions to skip
address.nextcall(ea)

Return the next call instruction from the address ea.

Parameters:ea (int or long) – an address within the database
address.nextcall(ea, predicate, **count)

Return the next call instruction from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions by call
  • **count – the number of call instructions to skip
address.nextcall(ea, count)

Return the next count call instructions from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of call instructions to skip
address.nextcomment(**repeatable)

Return the next address from the current one that has any type of comment.

Parameters:**repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.nextcomment(predicate, **repeatable)

Return the next address from the current one that has any type of comment and satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering addresses by comment
  • **repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.nextcomment(ea, **repeatable)

Return the next address from the address ea that has any type of comment.

Parameters:
  • ea (int or long) – an address within the database
  • **repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.nextcomment(ea, predicate, **repeatable)

Return the next address from the address ea that has any type of comment and satisfies the provided predicate.

If the bool repeatable is defined, then use it to determine whether to only track repeatable or non-repeatable comments.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering addresses by comment
  • **repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.nextcomment(ea, count, **repeatable)

Return the next count addresses from the address ea that has any type of comment.

If the bool repeatable is defined, then use it to determine whether to only track repeatable or non-repeatable comments.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of comments to skip
  • **repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.nextcref(**count)

Return the next address from the current one that has code referencing it.

Aliases: database.address.nextcode

Parameters:**count – the number of code references to skip
address.nextcref(predicate, **count)

Return the next address from the current one that has code referencing it and satisfies the provided predicate.

Aliases: database.address.nextcode

Parameters:
  • predicate (callable) – a callable to use when filtering code references
  • **count – the number of code references to skip
address.nextcref(ea)

Return the next address from the address ea that has code referencing it.

Aliases: database.address.nextcode

Parameters:ea (int or long) – an address within the database
address.nextcref(ea, predicate, **count)

Return the next address from the address ea that has code referencing it and satisfies the provided predicate.

Aliases: database.address.nextcode

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering code references
  • **count
address.nextcref(ea, count)

Return the next count addresses from the address ea that has code referencing it.

Aliases: database.address.nextcode

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of code references to skip
address.nextdref(**count)

Return the next address from the current one that has data referencing it.

Aliases: database.address.nextdata

Parameters:**count – the number of data references to skip
address.nextdref(predicate, **count)

Return the next address from the current one that has data referencing it and satisfies the provided predicate.

Aliases: database.address.nextdata

Parameters:
  • predicate (callable) – a callable to use when filtering data references
  • **count – the number of data references to skip
address.nextdref(ea)

Return the next address from the address ea that has data referencing it.

Aliases: database.address.nextdata

Parameters:ea (int or long) – an address within the database
address.nextdref(ea, predicate, **count)

Return the next address from the address ea that has data referencing it and satisfies the provided predicate.

Aliases: database.address.nextdata

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering data references
  • **count – the number of data references to skip
address.nextdref(ea, count)

Return the next count addresses from the address ea that has data referencing it.

Aliases: database.address.nextdata

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of data references to skip
address.nextfunction(**count)

Return the next address from the current address that is within a function.

Aliases: database.address.nextfunc

Parameters:**count – the number of function addresses to skip
address.nextfunction(ea)

Return the next address from the address ea that is within a function.

Aliases: database.address.nextfunc

Parameters:ea (int or long) – an address within the database
address.nextfunction(ea, predicate, **count)

Return the next address from the address ea that is within a function and satisfies the provided predicate.

Aliases: database.address.nextfunc

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering function addresses
  • **count – the number of function addresses to skip
address.nextfunction(ea, count)

Return the next count addresses from the address ea that is within a function.

Aliases: database.address.nextfunc

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of function addresses to skip
address.nextlabel(**count)

Return the address of the next label from the current address.

Parameters:**count – the number of labels to skip
address.nextlabel(predicate, **count)

Return the address of the next label from the current address that satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering instructions by label
  • **count – the number of labels to skip
address.nextlabel(ea)

Return the address of the next label from the address ea.

Parameters:ea (int or long) – an address within the database
address.nextlabel(ea, predicate, **count)

Return the address of the next label from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions by label
  • **count – the number of labels to skip
address.nextlabel(ea, count)

Return the address of the next count labels from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of labels to skip
address.nextmnemonic(mnemonics)

Return the address of the next instruction from the current address that uses any of the specified mnemonics.

Parameters:mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
address.nextmnemonic(mnemonics, predicate, **count)

Return the address of the next instruction from the current address that uses any of the specified mnemonics and satisfies the provided predicate.

Parameters:
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
  • predicate (callable) – a callable to use when filtering instructions by mnemonic
  • **count – the number of instructions to skip
address.nextmnemonic(mnemonics, count)

Return the address of the next count instructions from the current address that uses any of the specified mnemonics.

Parameters:
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
  • count (int or long) – the number of instructions to skip
address.nextmnemonic(ea, mnemonics)

Return the address of the next instruction from the address ea that uses any of the specified mnemonics.

Parameters:
  • ea (int or long) – an address within the database
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
address.nextmnemonic(ea, mnemonics, predicate, **count)

Return the address of the next instruction from the address ea that uses any of the specified mnemonics and satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
  • predicate (callable) – a callable to use when filtering instructions by mnemonic
  • **count – the number of instructions to skip
address.nextmnemonic(ea, mnemonics, count)

Return the address of the next count instructions from the address ea that uses any of the specified mnemonics.

Parameters:
  • ea (int or long) – an address within the database
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
  • count (int or long) – the number of instructions to skip
address.nextref(**count)

Return the next address from the current one that has anything referencing it.

Aliases: database.nextref

Parameters:**count – the number of references to skip
address.nextref(predicate, **count)

Return the next address from the current one that has anything referencing it and satisfies the provided predicate.

Aliases: database.nextref

Parameters:
  • predicate (callable) – a callable to use when filtering instruction references
  • **count – the number of references to skip
address.nextref(ea)

Return the next address from the address ea that has anything referencing it.

Aliases: database.nextref

Parameters:ea (int or long) – an address within the database
address.nextref(ea, predicate, **count)

Return the next address from the address ea that has anything referencing it and satisfies the provided predicate.

Aliases: database.nextref

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instruction references
  • **count – the number of references to skip
address.nextref(ea, count)

Return the next count addresses from the address ea that has anything referencing it.

Aliases: database.nextref

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of references to skip
address.nextreg(reg, *regs, **modifiers)

Return the next address containing an instruction that uses reg or any one of the specified regs.

Aliases: database.nextreg

Parameters:
  • reg (str or register_t) – a register of some kind
  • *regs – any other registers to match for
  • **modifiers – if write or read is true, then only return addresses where the specified registers are written to or read from (respectively)
address.nextreg(predicate, reg, *regs, **modifiers)

Return the next address containing an instruction uses reg or any one of the specified regs and satisfies the provided predicate.

Aliases: database.nextreg

Parameters:
  • predicate (callable) – a callable to use when filtering instructions by register
  • reg (str or register_t) – a register of some kind
  • *regs – any other registers to match for
  • **modifiers – if write or read is true, then only return addresses where the specified registers are written to or read from (respectively)
address.nextreg(ea, reg, *regs, **modifiers)

Return the next address from the address ea containing an instruction that uses reg or any one of the specified regs.

Aliases: database.nextreg

Parameters:
  • ea (int or long) – an address within the database
  • reg (str or register_t) – a register of some kind
  • *regs – any other registers to match for
  • **modifiers – if write or read is true, then only return addresses where the specified registers are written to or read from (respectively)
address.nextreg(ea, predicate, reg, *regs, **modifiers)

Return the next address from the address ea containing an instruction that uses reg or any one of the specified regs and satisfies the provided predicate.

Aliases: database.nextreg

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions by register
  • reg (str or register_t) – a register of some kind
  • *regs – any other registers to match for
  • **modifiers – if write or read is true, then only return addresses where the specified registers are written to or read from (respectively)
address.nextstack(delta)

Return the next instruction from the current one that is past the sp delta.

Aliases: database.address.nextdelta

Parameters:delta (int or long) – the stack delta to find the edge of
address.nextstack(ea, delta)

Return the next instruction from the address ea that is past the sp delta.

Aliases: database.address.nextdelta

Parameters:
  • ea (int or long) – an address within the database
  • delta (int or long) – the stack delta to find the edge of
address.nexttag(**tagname)

Return the next address that contains a tag using the specified tagname.

Parameters:**tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.nexttag(predicate, **tagname)

Return the next address that contains a tag using the specified tagname and satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering addresses by tag
  • **tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.nexttag(ea, **tagname)

Return the next address from ea that contains a tag using the specified tagname.

Aliases: database.address.nextcomment

Parameters:
  • ea (int or long) – an address within the database
  • **tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.nexttag(ea, predicate, **tagname)

Return the next address from ea that contains a tag using the specified tagname and satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering addresses by tag
  • **tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.nexttag(ea, count, **tagname)

Return the next count addresses from ea that contains a tag using the specified tagname.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of tags to skip
  • **tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.nextunknown(**count)

Return the next address from the current one that is undefined.

Parameters:**count – the number of unknown addresses to skip
address.nextunknown(predicate, **count)

Return the next address from the current one that is undefined and satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering unknown addresses
  • **count – the number of unknown addresses to skip
address.nextunknown(ea)

Return the next address from the address ea that is undefined.

Parameters:ea (int or long) – an address within the database
address.nextunknown(ea, predicate, **count)

Return the next address from the address ea that is undefined and satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering unknown addresses
  • **count – the number of unknown addresses to skip
address.nextunknown(ea, count)

Return the next count addresses from the address ea that is undefined.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of unknown addresses to skip
address.offset()

Return the current address translated to an offset relative to the base address of the database.

Aliases: database.get_offset, database.address.getoffset, database.getoffset, database.offset

address.offset(ea)

Return the address ea translated to an offset relative to the base address of the database.

Aliases: database.get_offset, database.address.getoffset, database.getoffset, database.offset

Parameters:ea (int or long) – an address within the database to translate to an offset from the beginning of the database
address.prev(**count)

Return the previous address from the current address.

Aliases: database.prev

Parameters:**count – the number of results to skip
address.prev(predicate, **count)

Return the previous address from the current address that satisfies the provided predicate.

Aliases: database.prev

Parameters:
  • predicate (callable) – a callable to use when filtering instructions
  • **count – the number of results to skip
address.prev(ea)

Return the previous address from the address specified by ea.

Aliases: database.prev

Parameters:ea (int or long) – an unaligned address within the database
address.prev(ea, predicate)

Return the previous address from the address ea that satisfies the provided predicate.

Aliases: database.prev

Parameters:
  • ea (int or long) – an unaligned address within the database
  • predicate (callable) – a callable to use when filtering instructions
address.prev(ea, count)

Return the previous count addresses from the address specified by ea.

Aliases: database.prev

Parameters:
  • ea (int or long) – an unaligned address within the database
  • count (int or long) – the number of results to skip
address.prev(ea, predicate, count)

Return the previous count addresses from the address ea that satisfies the provided predicate.

Aliases: database.prev

Parameters:
  • ea (int or long) – an unaligned address within the database
  • predicate (callable) – a callable to use when filtering instructions
  • count (int or long) – the number of results to skip
address.prevF(predicate, **count)

Return the previous address from the current one that satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering instructions
  • **count – the number of results to skip
address.prevF(ea, predicate, **count)

Return the previous address from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions
  • **count – the number of results to skip
address.prevF(ea, predicate, count)

Return the previous count addresses from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions
  • count (int or long) – the number of results to skip
address.prevbranch(**count)

Return the previous branch instruction from the current one.

Parameters:**count – the number of branch instructions to skip
address.prevbranch(predicate, **count)

Return the previous branch instruction from the current one that satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering instructions by branch
  • **count – the number of branch instructions to skip
address.prevbranch(ea)

Return the previous branch instruction from the address ea.

Parameters:ea (int or long) – an address within the database
address.prevbranch(ea, predicate, **count)

Return the previous branch instruction from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions by branch
  • **count – the number of branch instructions to skip
address.prevbranch(ea, count)

Return the previous count branch instructions from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of branch instructions to skip
address.prevcall(**count)

Return the previous call instruction from the current address.

Parameters:**count – the number of call instructions to skip
address.prevcall(predicate, **count)

Return the previous call instruction from the current address that satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering instructions by call
  • **count – the number of call instructions to skip
address.prevcall(ea)

Return the previous call instruction from the address ea.

Parameters:ea (int or long) – an address within the database
address.prevcall(ea, predicate, **count)

Return the previous call instruction from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions by call
  • **count – the number of call instructions to skip
address.prevcall(ea, count)

Return the previous count call instructions from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of call instructions to skip
address.prevcomment(**repeatable)

Return the previous address from the current one that has any type of comment.

Parameters:**repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.prevcomment(predicate, **repeatable)

Return the previous address from the current one that has any type of comment and satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering addresses by comment
  • **repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.prevcomment(ea, **repeatable)

Return the previous address from the address ea that has any type of comment.

Parameters:
  • ea (int or long) – an address within the database
  • **repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.prevcomment(ea, predicate, **repeatable)

Return the previous address from the address ea that has any type of comment and satisfies the provided predicate.

If the bool repeatable is defined, then use it to determine whether to only track repeatable or non-repeatable comments.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering addresses by comment
  • **repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.prevcomment(ea, count, **repeatable)

Return the previous count addresses from the address ea that has any type of comment.

If the bool repeatable is defined, then use it to determine whether to only track repeatable or non-repeatable comments.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of comments to skip
  • **repeatable – used to specify whether to filter by repeatable or non-repeatable comment
address.prevcref(**count)

Return the previous address from the current one that has code referencing it.

Aliases: database.address.prevcode

Parameters:**count – the number of code references to skip
address.prevcref(predicate, **count)

Return the previous address from the current one that has code referencing it and satisfies the provided predicate.

Aliases: database.address.prevcode

Parameters:
  • predicate (callable) – a callable to use when filtering data references
  • **count – the number of code references to skip
address.prevcref(ea)

Return the previous address from the address ea that has code referencing it.

Aliases: database.address.prevcode

Parameters:ea (int or long) – an address within the database
address.prevcref(ea, predicate, **count)

Return the previous address from the address ea that has code referencing it and satisfies the provided predicate.

Aliases: database.address.prevcode

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering code references
  • **count – the number of code references to skip
address.prevcref(ea, count)

Return the previous count addresses from the address ea that has code referencing it.

Aliases: database.address.prevcode

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of code references to skip
address.prevdref(**count)

Return the previous address from the current one that has data referencing it.

Aliases: database.address.prevdata

Parameters:**count – the number of data references to skip
address.prevdref(predicate, **count)

Return the previous address from the current one that has data referencing it and satisfies the provided predicate.

Aliases: database.address.prevdata

Parameters:
  • predicate (callable) – a callable to use when filtering data references
  • **count – the number of data references to skip
address.prevdref(ea)

Return the previous address from the address ea that has data referencing it.

Aliases: database.address.prevdata

Parameters:ea (int or long) – an address within the database
address.prevdref(ea, predicate, **count)

Return the previous address from the address ea that has data referencing it and satisfies the provided predicate.

Aliases: database.address.prevdata

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering data references
  • **count – the number of data references to skip
address.prevdref(ea, count)

Return the previous count addresses from the address ea that has data referencing it.

Aliases: database.address.prevdata

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of data references to skip
address.prevfunction(**count)

Return the previous address from the current address that is within a function.

Aliases: database.address.prevfunc

Parameters:**count – the number of function addresses to skip
address.prevfunction(ea)

Return the previous address from the address ea that is within a function.

Aliases: database.address.prevfunc

Parameters:ea (int or long) – an address within the database
address.prevfunction(ea, predicate, **count)

Return the previous address from the address ea that is within a function and satisfies the provided predicate.

Aliases: database.address.prevfunc

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering function addresses
  • **count – the number of function addresses to skip
address.prevfunction(ea, count)

Return the previous count addresses from the address ea that is within a function.

Aliases: database.address.prevfunc

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of function addresses to skip
address.prevlabel(**count)

Return the address of the previous label from the current address.

Parameters:**count – the number of labels to skip
address.prevlabel(predicate, **count)

Return the address of the previous label from the current address that satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering instructions by label
  • **count – the number of labels to skip
address.prevlabel(ea)

Return the address of the previous label from the address ea.

Parameters:ea (int or long) – an address within the database
address.prevlabel(ea, predicate, **count)

Return the address of the previous label from the address ea that satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions by label
  • **count – the number of labels to skip
address.prevlabel(ea, count)

Return the address of the previous count labels from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of labels to skip
address.prevmnemonic(mnemonics)

Return the address of the previous instruction from the current address that uses any of the specified mnemonics.

Parameters:mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
address.prevmnemonic(mnemonics, predicate, **count)

Return the address of the previous instruction from the current address that uses any of the specified mnemonics and satisfies the provided predicate.

Parameters:
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
  • predicate (callable) – a callable to use when filtering instructions by mnemonic
  • **count – the number of instructions to skip
address.prevmnemonic(mnemonics, count)

Return the address of the previous count instructions from the current address that uses any of the specified mnemonics.

Parameters:
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
  • count (int or long) – the number of instructions to skip
address.prevmnemonic(ea, mnemonics)

Return the address of the previous instruction from the address ea that uses any of the specified mnemonics.

Parameters:
  • ea (int or long) – an address within the database
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
address.prevmnemonic(ea, mnemonics, predicate, **count)

Return the address of the previous instruction from the address ea that uses any of the specified mnemonics and satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
  • predicate (callable) – a callable to use when filtering instructions by mnemonic
  • **count – the number of instructions to skip
address.prevmnemonic(ea, mnemonics, count)

Return the address of the previous count instructions from the address ea that uses any of the specified mnemonics.

Parameters:
  • ea (int or long) – an address within the database
  • mnemonics (str or list or set or tuple) – a string or iterable of strings containing a mnemonic to match an instruction against
  • count (int or long) – the number of instructions to skip
address.prevref(**count)

Return the previous address from the current one that has anything referencing it.

Aliases: database.prevref

Parameters:**count – the number of references to skip
address.prevref(predicate, **count)

Return the previous address from the current one that has anything referencing it and satisfies the provided predicate.

Aliases: database.prevref

Parameters:
  • predicate (callable) – a callable to use when filtering instruction references
  • **count – the number of references to skip
address.prevref(ea)

Return the previous address from the address ea that has anything referencing it.

Aliases: database.prevref

Parameters:ea (int or long) – an address within the database
address.prevref(ea, predicate, **count)

Return the previous address from the address ea that has anything referencing it and satisfies the provided predicate.

Aliases: database.prevref

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instruction references
  • **count – the number of references to skip
address.prevref(ea, count)

Return the previous count addresses from the address ea that has anything referencing it.

Aliases: database.prevref

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of references to skip
address.prevreg(reg, *regs, **modifiers)

Return the previous address containing an instruction that uses reg or any one of the specified regs.

Aliases: database.prevreg

Parameters:
  • reg (str or register_t) – a register of some kind
  • *regs – any other registers to match for
  • **modifiers – if write or read is true, then only return addresses where the specified registers are written to or read from (respectively)
address.prevreg(predicate, reg, *regs, **modifiers)

Return the previous address containing an instruction that uses reg or any one of the specified regs and satisfies the provided predicate.

Aliases: database.prevreg

Parameters:
  • predicate (callable) – a callable to use when filtering instructions by register
  • reg (str or register_t) – a register of some kind
  • *regs – any other registers to match for
  • **modifiers – if write or read is true, then only return addresses where the specified registers are written to or read from (respectively)
address.prevreg(ea, reg, *regs, **modifiers)

Return the previous address from the address ea containing an instruction that uses reg or any one of the specified regs.

Aliases: database.prevreg

Parameters:
  • ea (int or long) – an address within the database
  • reg (str or register_t) – a register of some kind
  • *regs – any other registers to match for
  • **modifiers – if write or read is true, then only return addresses where the specified registers are written to or read from (respectively)
address.prevreg(ea, predicate, reg, *regs, **modifiers)

Return the previous address from the address ea containing an instruction that uses reg or any one of the specified regs and satisfies the provided predicate.

Aliases: database.prevreg

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering instructions by register
  • reg (str or register_t) – a register of some kind
  • *regs – any other registers to match for
  • **modifiers – if write or read is true, then only return addresses where the specified registers are written to or read from (respectively)
address.prevstack(delta)

Return the previous instruction from the current one that is past the specified sp delta.

Aliases: database.address.prevdelta

Parameters:delta (int or long) – the stack delta to find the edge of
address.prevstack(ea, delta)

Return the previous instruction from the address ea that is past the specified sp delta.

Aliases: database.address.prevdelta

Parameters:
  • ea (int or long) – an address within the database
  • delta (int or long) – the stack delta to find the edge of
address.prevtag(**tagname)

Return the previous address that contains a tag using the specified tagname.

Parameters:**tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.prevtag(predicate, **tagname)

Return the previous address that contains a tag using the specified tagname and satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering addresses by tag
  • **tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.prevtag(ea, **tagname)

Return the previous address from ea that contains a tag using the specified tagname.

Parameters:
  • ea (int or long) – an address within the database
  • **tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.prevtag(ea, predicate, **tagname)

Return the previous address from ea that contains a tag using the specified tagname and satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering addresses by tag
  • **tagname – if tagname is assigned as a string, then only match against the specified tag otherwise look for any kind of comment
address.prevtag(ea, count, **tagname)

Return the previous count addresses from ea that contains a tag using the specified tagname.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of tags to skip
  • **tagname – if tagname is assigned a string, then only match against the specified tag otherwise look for any kind of comment
address.prevunknown(**count)

Return the previous address from the current one that is undefined.

Parameters:**count – the number of unknown addresses to skip
address.prevunknown(predicate, **count)

Return the previous address from the current one that is undefined and satisfies the provided predicate.

Parameters:
  • predicate (callable) – a callable to use when filtering unknown addresses
  • **count – the number of unknown addresses to skip
address.prevunknown(ea)

Return the previous address from the address ea that is undefined.

Parameters:ea (int or long) – an address within the database
address.prevunknown(ea, predicate, **count)

Return the previous address from the address ea that is undefined and satisfies the provided predicate.

Parameters:
  • ea (int or long) – an address within the database
  • predicate (callable) – a callable to use when filtering unknown addresses
  • **count – the number of unknown addresses to skip
address.prevunknown(ea, count)

Return the previous count addresses from the address ea that is undefined.

Parameters:
  • ea (int or long) – an address within the database
  • count (int or long) – the number of unknown addresses to skip
address.tail()

Return the last byte at the end of the current address.

address.tail(ea)

Return the address of the last byte at the end of the address at ea.

Parameters:ea (int or long) – an unaligned address within the database

3.1.1.2.2. database.config

This namespace contains various read-only properties about the database. This includes things such as the database boundaries, its filename, the path to the generated database, etc. Some tools for determining the type of the binary are also included.

config.apptype()

Return the application type identified by the loader when creating the database.

config.apptype(apptype_t)

Set the application type for the database to the specified apptype_t.

Parameters:apptype_t (int or long) – a string representing one of the idaapi.APPT_* types to apply
config.apptype(APPT_)

Set the application type for the database to the value for the string APPT_.

Parameters:APPT (str) – an enumeration containing one of the idaapi.APPT_* types to apply
config.baseaddress()

Return the baseaddress of the database.

Aliases: database.baseaddress, database.base

config.bits()

Return number of bits of the processor used by the database.

config.bitsize()

Return the number of bits used by the database.

config.bounds()

Return the bounds of the current database in a tuple formatted as (left, right).

Aliases: database.range

config.byteorder()

Return a string representing the byte-order used by integers in the database.

config.changes()

Return the number of changes within the database.

config.compiler()

Return the compiler that was configured for the database.

config.entry()

Return the first entry point for the database.

config.filename()

Return the filename that the database was built from.

config.filetype()

Return the file type identified by the loader when creating the database.

config.filetype(filetype_t)

Set the file type identified by the loader to the specified filetype_t.

Parameters:filetype_t (int or long) – a string representing one of the idaapi.FT_* types to apply
config.filetype(FT_)

Set the file type identified by the loader to the value for the string FT_.

Parameters:FT (str) – an enumeration containing one of the idaapi.FT_* types to apply
config.idb()

Return the full path to the database.

Aliases: database.config.database, database.idb

config.is_kernelspace()

Return whether the database is using a kernelmode address space or not.

Aliases: database.config.kernelQ, database.config.kernelspaceQ

config.is_readonly()

Return whether the database is read-only or not.

Aliases: database.config.readonlyQ

config.is_sharedobject()

Return whether the database is a shared-object or not.

Aliases: database.config.sharedQ, database.config.is_shared, database.config.sharedobject

config.lflags()

Return the value of the idainfo.lflags field from the database.

config.lflags(mask)

Return the value of the idainfo.lflags field from the database with the specified mask.

Parameters:mask (int or long) – the mask to apply to the lflags that are returned
config.lflags(mask, value)

Set the idainfo.lflags with the provided mask from the database to the specified value.

Parameters:
  • mask (int or long) – the mask to apply to the lflags before applying the value
  • value (int or long) – the value to apply to the lflags
config.main()
config.margin()

Return the current margin position for the current database.

config.module()

Return the module name as per the windows loader.

Aliases: database.module

config.ostype()

Return the operating system type identified by the loader when creating the database.

config.ostype(ostype_t)

Set the operating system type for the database to the specified ostype_t.

Parameters:ostype_t (int or long) – a string representing one of the idaapi.OSTYPE_* types to apply
config.ostype(OSTYPE_)

Set the operating system type for the database to the value for the string OSTYPE_.

Parameters:OSTYPE (str) –
config.path()

Return the absolute path to the directory containing the database.

Aliases: database.path

config.path(pathname, *components)

Return an absolute path composed of the provided pathname and any additional components relative to the directory containing the database.

Parameters:
  • pathname (str) –
  • *components
config.processor()

Return the name of the processor used by the database.

config.size()

Return the number of bytes used by the database which can be used to distinguish whether you’re running 32-bit or 64-bit.

config.type(typestr)

Evaluates a type string and returns its size according to the compiler used by the database.

Parameters:typestr – this is a c-like type specification
config.version()

Return the version of the database.

3.1.1.2.2.1. database.config.register

This namespace returns the available register names and their sizes for the database.

config.register.codesegment()

Return all of the code segment registers in the database.

config.register.datasegment()

Return all of the data segment registers in the database.

config.register.names()

Return all of the register names in the database.

config.register.segmentbits()

Return the segment register size for the database.

config.register.segments()

Return all of the segment registers in the database.

3.1.1.2.3. database.entries

Aliases: database.exports

This namespace can be used to enumerate all of the entry points and exports that are defined within the database By default the address of each entrypoint will be yielded.

This namespace is also aliased as database.exports.

When listing entry points that are matched, the following legend can be used to identify certain characteristics about them:

  • F - The entry point is referencing a function
  • C - The entry point is referencing code
  • A - The entry point is referencing data (address)
  • D - The entry point is referencing a decompiled function
  • T - The address of the entry point has a type applied to it
  • t - The address of the entry point has a guessable type
  • C - The address of the entry point is marked as code
  • D - The address of the entry point is marked as data
  • ^ - The address of the entry point is marked as unknown
  • + - The entry point has an implicit tag applied to it (named or typed)
  • \* - The entry point has an explicit tag applied to it

The different types that one can match entrypoints with are the following:

  • address or ea - Match according to the entrypoint’s address
  • name - Match according to the exact name
  • like - Filter the entrypoint names according to a glob
  • regex - Filter the entrypoint names according to a regular-expression
  • index - Match according to the entrypoint’s index
  • ordinal - Match according to the entrypoint’s ordinal
  • greater or ge - Filter the entrypoints for any after the specified address (inclusive)
  • gt - Filter the entrypoints for any after the specified address (exclusive)
  • less or le - Filter the entrypoints for any before the specified address (inclusive)
  • lt - Filter the entrypoints for any before the specified address (exclusive)
  • function - Filter the entrypoints for any that are referencing a function
  • typed - Filter the entrypoints for any that have type information applied to them
  • tagged - Filter the entrypoints for any that use the specified tag(s)
  • predicate - Filter the entrypoints by passing its index (ordinal) to a callable

Some examples of using these keywords are as follows:

> database.entries.list(greater=h())
> iterable = database.entries.iterate(like='Nt*')
> result = database.entries.search(index=0)
database.entries()

Yield the address of each entry point defined within the database.

entries.iterate(string)

Iterate through all of the entry points in the database with a glob that matches string.

Parameters:string (str) – the glob to use when filtering the available entry points
entries.iterate(**type)

Iterate through all of the entry points in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the available entry points
entries.list(string)

List all of the entry points matching the glob string against the name.

Parameters:string (str) – the glob to use when filtering the available entry points
entries.list(**type)

List all of the entry points in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the available entry points
entries.name()

Return the name of the entry point at the current address.

entries.name(ea)

Return the name of the entry point at the address ea.

Parameters:ea (int or long) – an address of an entry point in the database
entries.new()

Makes an entry point at the current address.

entries.new(ea)

Makes an entry point at the specified address ea.

Parameters:ea (int or long) – an address in the database
entries.new(name)

Adds the current address as an entry point using name and the next available index as the ordinal.

Parameters:name (str) – the name of the entry point
entries.new(ea, name)

Makes the specified address ea an entry point having the specified name.

Parameters:
  • ea (int or long) – an address in the database
  • name (str) – the name of the entry point
entries.new(name, ordinal)

Adds an entry point with the specified name to the database using ordinal as its index.

Parameters:
  • name (str) – the name of the entry point
  • ordinal (int or long) – the ordinal index for the entry point
entries.new(ea, name, ordinal)

Adds an entry point at ea with the specified name and ordinal.

Parameters:
  • ea (int or long) – an address in the database
  • name (str) – the name of the entry point
  • ordinal (int or long) – the ordinal index for the entry point
entries.ordinal()

Return the ordinal of the entry point at the current address.

entries.ordinal(ea)

Return the ordinal of the entry point at the address ea.

Parameters:ea (int or long) – an address of an entry point in the database
entries.search(string)

Search through all of the entry point names matching the glob string and return the first result.

Parameters:string (str) – the glob to use when filtering the available entry points
entries.search(**type)

Search through all of the entry points within the database and return the first result matching the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the available entry points

3.1.1.2.4. database.extra

Aliases: database.ex

This namespace is for interacting with IDA’s “extra” comments that can be associated with an address. This allows one to prefix or suffix an address with a large block of text simulating a multilined or paragraph comment.

To add extra comments, one can do this like:

> res = database.ex.prefix(ea, 'this\nis\na\nmultilined\ncomment')
> res = database.ex.suffix(ea, "whee\nok...i'm over it.")
> database.ex.insert(ea, 1)
> database.extra.append(ea, 2)
extra.has_prefix()

Return true if there are any extra comments that prefix the item at the current address.

Aliases: database.extra.prefixQ

extra.has_prefix(ea)

Return true if there are any extra comments that prefix the item at the address ea.

Aliases: database.extra.prefixQ

Parameters:ea (int or long) – the address to check for the existence of a prefix comment
extra.has_suffix()

Return true if there are any extra comments that suffix the item at the current address.

Aliases: database.extra.suffixQ

extra.has_suffix(ea)

Return true if there are any extra comments that suffix the item at the address ea.

Aliases: database.extra.suffixQ

Parameters:ea (int or long) – the address to check for the existence of a suffix comment
extra.postappend(ea, count)

Append count lines after the item at address ea.

Parameters:
  • ea (int or long) – the address of the suffix to append lines into
  • count (int or long) – the number of lines to append
extra.postappend(count)

Append count lines after the item at the current address.

Parameters:count (int or long) – the number of lines to append
extra.postinsert(ea, count)

Insert count lines after the item at address ea.

Parameters:
  • ea (int or long) – the address of the suffix to insert lines into
  • count (int or long) – the number of lines to insert
extra.postinsert(count)

Insert count lines after the item at the current address.

Parameters:count (int or long) – the number of lines to insert
extra.preappend(ea, count)

Append count lines in front of the item at address ea.

Aliases: database.extra.append

Parameters:
  • ea (int or long) – the address of the prefix to append newlines into
  • count (int or long) – the number of lines to append
extra.preappend(count)

Append count lines in front of the item at the current address.

Aliases: database.extra.append

Parameters:count (int or long) – the number of lines to append
extra.prefix()

Return the prefixed comment at the current address.

extra.prefix(string)

Set the prefixed comment at the current address to the specified string.

Parameters:string (str) – the comment to insert
extra.prefix(none)

Delete the prefixed comment at the current address.

Parameters:none (None) – the python value None
extra.prefix(ea)

Return the prefixed comment at address ea.

Parameters:ea (int or long) – the address containing the prefix comment to return
extra.prefix(ea, string)

Set the prefixed comment at address ea to the specified string.

Parameters:
  • ea (int or long) – the address to modify the prefix comment of
  • string (str) – the comment to insert
extra.prefix(ea, none)

Delete the prefixed comment at address ea.

Parameters:
  • ea (int or long) – the address containing the prefix comment to remove
  • none (None) – the python value None
extra.preinsert(ea, count)

Insert count lines in front of the item at address ea.

Aliases: database.extra.insert

Parameters:
  • ea (int or long) – the address of the prefix to insert lines into
  • count (int or long) – the number of lines to insert
extra.preinsert(count)

Insert count lines in front of the item at the current address.

Aliases: database.extra.insert

Parameters:count (int or long) – the number of lines to insert
extra.suffix()

Return the suffixed comment at the current address.

extra.suffix(string)

Set the suffixed comment at the current address to the specified string.

Parameters:string (str) – the comment to append
extra.suffix(none)

Delete the suffixed comment at the current address.

Parameters:none (None) – the python value None
extra.suffix(ea)

Return the suffixed comment at address ea.

Parameters:ea (int or long) – the address containing the suffix comment to return
extra.suffix(ea, string)

Set the suffixed comment at address ea to the specified string.

Parameters:
  • ea (int or long) – the address to modify the suffix comment of
  • string (str) – the comment to append
extra.suffix(ea, none)

Delete the suffixed comment at address ea.

Parameters:
  • ea (int or long) – the address containing the suffix comment to remove
  • none (None) – the python value None

3.1.1.2.5. database.functions

This namespace is used for listing all the functions inside the database. By default a list is returned containing the address of each function.

When listing functions that are matched, the following legend can be used to identify certain characteristics about them:

  • + - The function has an implicit tag (named or typed)
  • \* - The function has been explicitly tagged
  • J - The function is a wrapper or a thunk
  • L - The function was pattern matched as a library
  • S - The function is declared statically
  • ^ - The function does not contain a frame
  • ? - The function has its stack points calculated incorrectly and may be incorrect
  • T - The function has a prototype that was applied to it manually or via decompilation
  • t - The function has a prototype that was guessed
  • D - The function has been previously decompiled

The different types that one can match functions with are the following:

  • address or ea - Match according to the function’s address
  • name - Match according to the exact name
  • like - Filter the function names according to a glob
  • regex - Filter the function names according to a regular-expression
  • typed - Filter the functions for any that have type information applied to them
  • decompiled - Filter the functions for any that have been decompiled
  • frame - Filter the functions for any that contain a frame
  • problems - Filter the functions for any that contain problems with their stack
  • library - Filter the functions that any which were detected as a library function
  • wrapper - Filter the functions that are flagged as wrappers (thunks)
  • exceptions Filter the functions for any that either handles an exception or sets up a handler
  • tagged - Filter the functions for any that use the specified tag(s)
  • predicate - Filter the functions by passing their idaapi.func_t to a callable

Some examples of how to use these keywords are as follows:

> for ea in database.functions(): ...
> database.functions.list('*sub*')
> iterable = database.functions.iterate(regex='.*alloc')
> result = database.functions.search(like='*alloc*')
database.functions()

Return a list of all of the functions in the current database.

functions.iterate(string)

Iterate through all of the functions in the database with a glob that matches string.

Parameters:string (str) – the glob to filter the function names with
functions.iterate(**type)

Iterate through all of the functions in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter functions with
functions.list(string)

List all of the functions in the database with a glob that matches string.

Parameters:string (str) – the glob to filter the function names with
functions.list(**type)

List all of the functions in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the functions with
functions.search(string)

Search through all of the functions matching the glob string and return the first result.

Parameters:string (str) – the glob to filter the function names with
functions.search(**type)

Search through all of the functions within the database and return the first result matching the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the functions with

3.1.1.2.6. database.get

This namespace used to fetch and decode the data from the database at a given address. This allows one to interpret the semantics of parts of the database and then perform an action based on what was decoded. This includes standard functions for reading integers of different sizes, decoding structures, and even reading of arrays from the database.

In order to decode various things out of the database, some of the following examples can be used:

> res = database.get.signed()
> res = database.get.unsigned(ea, 8, byteorder='big')
> res = database.get.array(ea)
> res = database.get.array(length=42)
> res = database.get.structure(ea)
> res = database.get.structure(ea, structure=structure.by('mystructure'))
get.array(**length)

Return the values of the array at the current address.

Parameters:**length – if length is specified, then use it as the length of the array instead of determining it automatically
get.array(bounds)

Return the values within the provided bounds as an array.

Parameters:bounds (tuple) – a tuple containing the boundaries of the array to return
get.array(bounds, type)

Return the values within the provided bounds as an array of the pythonic element type.

Parameters:
  • bounds (tuple) – a tuple containing the boundaries of the array to return
  • type – the pythonic type to use for each element
get.array(ea, **length)

Return the values of the array at the address specified by ea.

If the integer length is defined, then use it as the number of elements for the array. If a pythonic type is passed to type, then use it for the element type of the array when decoding.

Parameters:
  • ea (int or long) – the address of an array within the database
  • **length – if length is specified, then use it as the length of the array instead of determining it automatically
get.info()

Return the type information for the current address as an idaapi.tinfo_t.

Aliases: database.get.typeinfo

get.info(ea)

Return the type information for the address ea as an idaapi.tinfo_t.

Aliases: database.get.typeinfo

Parameters:ea (int or long) – an address within the database
get.signed(**byteorder)

Read a signed integer from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.signed(ea, **byteorder)

Read a signed integer from the address ea using the size defined in the database.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.signed(ea, size, **byteorder)

Read a signed integer from the address ea with the specified size.

If byteorder is ‘big’ then read in big-endian form. If byteorder is ‘little’ then read in little-endian form.

The default value of byteorder is the same as specified by the database architecture.

Parameters:
  • ea (int or long) – an address within the database
  • size (int or long) – the size of the integer to return in bytes
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.string(**length)

Return the array at the current address as a string.

Parameters:**length – an integer specifying the length to use for the string or a strtype describing the type of the string
get.string(bounds, **length)

Return the array described by the specified bounds as a string.

Parameters:
  • bounds (tuple) – the boundaries of the string to return
  • **length – an integer specifying the length to use for the string or a strtype describing the type of the string
get.string(ea, **length)

Return the array at the address specified by ea as a string.

If an integer length is provided, then use it explicitly as the string’s length when reading. If an integer strtype is provided, then use it as the string’s character width when reading. If a tuple strtype is specified, then the first item is the character width and the second is the size of the length prefix when reading.

Parameters:
  • ea (int or long) – the address of the string to return
  • **length – an integer specifying the length to use for the string or a strtype describing the type of the string
get.structure()

Return a dictionary of ctypes for the structure_t that is applied to the current address.

Aliases: database.get.struct, database.get.struc

get.structure(ea)

Return a dictionary of ctypes for the structure_t that is applied to the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:ea (int or long) – the address of a structure within the database
get.structure(ea, sptr)

Return a dictionary of ctypes for the structure_t identified by sptr at the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:
  • ea (int or long) – the address within the database
  • sptr (idaapi.struc_t) – an idaapi.struc_t of the structure to decode from the specified address
get.structure(ea, name)

Return a dictionary of ctypes for the structure_t with the specified name at the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:
  • ea (int or long) – the address within the database
  • name (str) – the name of the structure to decode from the specified address
get.structure(ea, type)

Return a dictionary of ctypes for the structure_t specified by type at the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:
  • ea (int or long) – the address within the database
  • type (structure_t) – the structure_t to decode from the specified address
get.structure(ea, identifier)

Return a dictionary of ctypes for the structure_t with the specified identifier at the address ea.

Aliases: database.get.struct, database.get.struc

Parameters:
  • ea (int or long) – the address within the database
  • identifier (int or long) – the identifier of the structure to decode from the specified address
get.unsigned(**byteorder)

Read an unsigned integer from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.unsigned(ea, **byteorder)

Read an unsigned integer from the address ea using the size defined in the database.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.unsigned(ea, size, **byteorder)

Read an unsigned integer from the address ea with the specified size.

If byteorder is ‘big’ then read in big-endian form. If byteorder is ‘little’ then read in little-endian form.

The default value of byteorder is the same as specified by the database architecture.

Parameters:
  • ea (int or long) – an address within the database
  • size (int or long) – the size of the integer to return in bytes
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer

3.1.1.2.6.1. database.get.float

Aliases: database.get.f

This namespace contains a number of functions for fetching floating point numbers out of the database. These floating-point numbers are encoded according to the IEEE-754 specification.

This namespace is also aliased as database.get.f and can be used as in the following examples:

> res = database.get.f.half()
> res = database.get.f.single(ea)
> res = database.get.f.double(ea)

If one needs to describe a non-standard encoding for a floating-point number, one can use the database.float function. This function takes a tuple representing the number of bits for the different components of a floating-point number. This can be used as in the following for reading a floating-point “half” from the database:

> res = database.get.float(components=(10, 5, 1))

This specifies 10-bits for the mantissa, 5 for the exponent, and 1 bit for the signed flag. This allows one to specify arbitrary encodings for different floating-point numbers.

get.float(**byteorder)

Read a floating-number from the current address using the number type that matches its size.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float(ea, **byteorder)

Read a floating-number at the address ea using the number type that matches its size.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float(components, **byteorder)

Read a floating-point number at the current address encoded with the specified components.

Parameters:
  • components (tuple) – a tuple describing the component sizes for decoding the floating-point number
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float(ea, components, **byteorder)

Read a floating-point number at the address ea that is encoded with the specified components.

The components parameter is a tuple (mantissa, exponent, sign) representing the number of bits for each component of the floating-point number. If byteorder is ‘big’ then read in big-endian form. If byteorder is ‘little’ then read in little-endian form.

The default value of byteorder is the same as specified by the database architecture.

Parameters:
  • ea (int or long) – an address within the database
  • components (tuple) – a tuple describing the component sizes for decoding the floating-point number
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float.double(**byteorder)

Read a double from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float.double(ea, **byteorder)

Read a double from the address ea.

Parameters:
  • ea – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float.half(**byteorder)

Read a half from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float.half(ea, **byteorder)

Read a half from the address ea.

Parameters:
  • ea – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float.single(**byteorder)

Read a single from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number
get.float.single(ea, **byteorder)

Read a single from the address ea.

Parameters:
  • ea – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the floating-point number

3.1.1.2.6.2. database.get.integer

Aliases: database.get.i

This namespace contains the different ISO standard integer types that can be used to read integers out of the database.

This namespace is also aliased as database.get.i and can be used like in the following examples:

> res = database.get.i.uint32_t()
> res = database.get.i.sint64_t(ea)
> res = database.get.i.uint8_t(ea)
get.integer(**byteorder)

Read an integer from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer(ea, **byteorder)

Read an integer from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer(ea, size, **byteorder)

Read an integer of the specified size from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • size (int or long) – the size of the integer to return in bytes
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint128_t(**byteorder)

Read a sint128_t from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint128_t(ea, **byteorder)

Read a sint128_t from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint16_t(**byteorder)

Read a sint16_t from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint16_t(ea, **byteorder)

Read a sint16_t from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint32_t(**byteorder)

Read a sint32_t from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint32_t(ea, **byteorder)

Read a sint32_t from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint64_t(**byteorder)

Read a sint64_t from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint64_t(ea, **byteorder)

Read a sint64_t from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint8_t(**byteorder)

Read a sint8_t from the current address.

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.sint8_t(ea, **byteorder)

Read a sint8_t from the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint128_t(**byteorder)

Read a uint128_t from the current address.

Aliases: database.get.integer.oword

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint128_t(ea, **byteorder)

Read a uint128_t from the address ea.

Aliases: database.get.integer.oword

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint16_t(**byteorder)

Read a uint16_t from the current address.

Aliases: database.get.integer.word

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint16_t(ea, **byteorder)

Read a uint16_t from the address ea.

Aliases: database.get.integer.word

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint32_t(**byteorder)

Read a uint32_t from the current address.

Aliases: database.get.integer.dword

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint32_t(ea, **byteorder)

Read a uint32_t from the address ea.

Aliases: database.get.integer.dword

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint64_t(**byteorder)

Read a uint64_t from the current address.

Aliases: database.get.integer.qword

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint64_t(ea, **byteorder)

Read a uint64_t from the address ea.

Aliases: database.get.integer.qword

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint8_t(**byteorder)

Read a uint8_t from the current address.

Aliases: database.get.integer.byte

Parameters:**byteorder – if byteorder is provided, use it to determine the byteorder of the integer
get.integer.uint8_t(ea, **byteorder)

Read a uint8_t from the address ea.

Aliases: database.get.integer.byte

Parameters:
  • ea (int or long) – an address within the database
  • **byteorder – if byteorder is provided, use it to determine the byteorder of the integer

3.1.1.2.6.3. database.get.switch

Function for fetching an instance of a switch_t from a given address. Despite this being a namespace, by default it is intended to be used as a function against any known component of a switch. It will then return a class that allows one to query the different attributes of an idaapi.switch_info_t.

This namespace can be used as in the following example:

> sw = database.get.switch(ea)
> print( sw )
get.switch()

Return the switch that is referenced at the current address.

get.switch(ea)

Return the switch that is referenced by the address at ea.

Parameters:ea (int or long) – the address of a switch within the database

3.1.1.2.7. database.imports

This namespace is used for listing all of the imports within the database. Each import is represented by an address along with any naming information that is required to dynamically link external symbols with the binary.

By default a tuple is yielded for each import with the format (address, (shared-object, name, hint)). In this tuple, shared-object represents the name of the shared object the import is imported from. The name is the symbol name to link with, and hint is the import ordinal hint which is used to speed up the linking process.

When listing the imports that are matched, the following legend can be used to identify certain characteristics about them:

  • T - The import has a type that was explicitly applied
  • t - The import has a type that was guessted
  • H - The import contains an ordinal number as a hint
  • + - The import has an implicit tag applied to it (named or typed)
  • \* - The import has an explicit tag applied to it

The different types that one can match imports with are the following:

  • address or ea - Match according to the import’s address
  • name - Match according to the import’s symbol name
  • module - Filter the imports according to the specified module name
  • fullname - Match according to the full symbol name (module + symbol)
  • like - Filter the symbol names of all the imports according to a glob
  • regex - Filter the symbol names of all the imports according to a regular-expression
  • ordinal - Match according to the import’s hint (ordinal)
  • index - Match according index of the import
  • typed - Filter all of the imports based on whether they have a type applied to them
  • tagged - Filter the imports for any that use the specified tag(s)
  • predicate Filter the imports by passing the above (default) tuple to a callable

Some examples of using these keywords are as follows:

> database.imports.list(module='kernelbase.dll')
> iterable = database.imports.iterate(like='*alloc*')
> result = database.imports.search(index=42)
database.imports()
imports.at()

Return the import at the current address.

imports.at(ea)

Return the import at the address ea.

Parameters:ea (int or long) – the address of an import within the database
imports.fullname()

Return the full name of the import at the current address.

imports.fullname(ea)

Return the full name of the import at address ea.

Parameters:ea – the address of an import within the database
imports.iterate(string)

Iterate through all of the imports in the database with a glob that matches string.

Parameters:string (str) – the glob to use when filtering the available imports
imports.iterate(**type)

Iterate through all of the imports in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the available imports
imports.list(string)

List all of the imports matching the glob string against the fullname.

Parameters:string (str) – the glob to use when filtering the available imports
imports.list(**type)

List all of the imports in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the available imports
imports.module()

Return the import module at the current address.

imports.module(ea)

Return the import module at the specified address ea.

Parameters:ea (int or long) – the address of an import within the database
imports.modules()

Return all of the import modules defined in the database.

imports.name()

Return the name of the import at the current address.

imports.name(ea)

Return the name of the import at address ea.

Parameters:ea – the address of an import within the database
imports.ordinal()

Return the ordinal of the import at the current address.

imports.ordinal(ea)

Return the ordinal of the import at the address ea.

Parameters:ea – the address of an import within the database
imports.search(string)

Search through all of the imports matching the fullname glob string.

Parameters:string (str) – the glob to use when filtering the available imports
imports.search(**type)

Search through all of the imports within the database and return the first result matching the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the available imports

3.1.1.2.8. database.marks

This namespace is for interacting with the marks table within the database. By default, this namespace is capable of yielding the (address, description) of each mark within the database.

This allows one to manage the marks. Although it is suggested to utilize “tags” as they provide significantly more flexibility. Using marks allows for one to use IDA’s mark window for quick navigation to a mark.

The functions in this namespace can be used like:

> for ea, descr in database.marks(): ...
> database.marks.new('this is my description')
> database.marks.remove(ea)
> ea, descr = database.marks.by(ea)
database.marks()

Yields each of the marked positions within the database.

marks.by_address()

Return the mark at the current address.

Aliases: database.marks.by

marks.by_address(ea)

Return the (address, description) of the mark at the given address ea.

Aliases: database.marks.by

Parameters:ea (int or long) – the address of a mark within the database
marks.by_index(index)

Return the (address, description) of the mark at the specified index in the mark list.

Aliases: database.marks.byIndex

Parameters:index – the index of a mark
marks.iterate()

Iterate through all of the marks in the database.

marks.length()

Return the number of marks in the database.

marks.new(description)

Create a mark at the current address with the given description.

Parameters:description (str) – the description associated with the mark
marks.new(ea, description, **extra)

Create a mark at the address ea with the given description and return its index.

Parameters:
  • ea (int or long) – the address within the database to set the mark at
  • description (str) – the description associated with the mark
  • **extra – allows you to assign the x, y, or lnnum fields of the mark
marks.remove()

Remove the mark at the current address.

marks.remove(ea)

Remove the mark at the specified address ea returning the previous description.

Parameters:ea (int or long) – the address within the database containing a mark

3.1.1.2.9. database.names

This namespace is used for listing all of the names (symbols) within the database. By default the (address, name) is yielded in its mangled form.

When listing names that are matched, the following legend can be used to identify certain characteristics about the address of the returned name:

  • I - The symbol is residing in an import segment
  • C - The address of the symbol is marked as code
  • D - The address of the symbol is marked as data
  • ^ - The address of the symbol is is initialized
  • + - The symbol has an implicit tag applied to it (named or typed)
  • \* - The symbol has an explicit tag applied to it

The available types that one can filter the symbols with are as follows:

  • address - Match according to the address of the symbol
  • name - Match according to the name of the unmangled symbol
  • unmangled - Filter the unmangled symbol names according to a regular-expression
  • like - Filter the symbol names according to a glob
  • regex - Filter the symbol names according to a regular-expression
  • index - Match the symbol according to its index
  • function - Filter the symbol names for any that are referring to a function
  • imports - Filter the symbol names for any that are imports
  • typed - Filter the symbol names for any that have type information applied to them
  • tagged - Filter the symbol names for any that use the specified tag(s)
  • predicate - Filter the symbols by passing their address to a callable

Some examples of using these keywords are as follows:

> list(database.names())
> database.names.list(index=31)
> iterable = database.names.iterate(like='str.*')
> result = database.names.search(name='some_really_sick_symbol_name')
database.names()

Iterate through all of the names in the database yielding a tuple of the address and its name.

names.address(index)

Return the address of the symbol at index.

Parameters:index – the index of the symbol in the names list
names.at()

Return the index, symbol address, and name at the current address.

names.at(ea)

Return the index, symbol address, and name at the address ea.

Parameters:ea (int or long) – the address of a symbol
names.iterate(string)

Iterate through all of the names in the database with a glob that matches string.

Parameters:string (str) – the glob to filter the symbol names with
names.iterate(**type)

Iterate through all of the names in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter symbols with
names.list(string)

List all of the names in the database with a glob that matches string.

Parameters:string (str) – the glob to filter the symbol names with
names.list(**type)

List all of the names in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter symbols with
names.search(string)

Search through all of the names matching the glob string and return the first result.

Parameters:string (str) – the glob to filter the symbol names with
names.search(**type)

Search through all of the names within the database and return the first result matching the keyword specified by type.

Parameters:**type – any keyword that can be used to filter symbols with
names.symbol()

Return the symbol name of the current address.

Aliases: database.names.name

names.symbol(ea)

Return the symbol name of the address ea.

Aliases: database.names.name

Parameters:ea (int or long) – the address of a symbol

3.1.1.2.11. database.segments

This namespace is used for listing all the segments inside the database. By default each segment’s boundaries are yielded.

The different types that one can match segments with are the following:

  • name - Match according to the true segment name
  • like - Filter the segment names according to a glob
  • regex - Filter the segment names according to a regular-expression
  • index - Match the segment by its index
  • identifier - Match the segment by its identifier (idaapi.segment_t.name)
  • selector - Match the segment by its selector (idaapi.segment_t.sel)
  • greater or gt - Filter the segments for any after the specified address
  • less or lt - Filter the segments for any before the specified address
  • predicate - Filter the segments by passing its idaapi.segment_t to a callable

Some examples of using these keywords are as follows:

> for l, r in database.segments(): ...
> database.segments.list(regex=r'\.r?data')
> iterable = database.segments.iterate(like='*text*')
> result = database.segments.search(greater=0x401000)
database.segments()

Yield the bounds of each segment within the current database.

segments.iterate(name)

Iterate through all of the segments in the database with a glob that matches name.

Parameters:name (str) – the glob to filter the segment names with
segments.iterate(**type)

Iterate through all the segments defined in the database matching the keyword specified by type.

Parameters:**type – any keyword that can be used to filter segments with
segments.list(name)

List all of the segments defined in the database that match the glob name.

Parameters:name (str) – the glob to filter the segment names with
segments.list(**type)

List all of the segments in the database that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the segments with
segments.search(name)

Search through all of the segments matching the glob name and return the first result.

Parameters:name (str) – the glob to filter the segment names with
segments.search(**type)

Search through all of the segments within the database and return the first result matching the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the segments with

3.1.1.2.12. database.set

This namespace for setting the type of an address within the database. This allows one to apply a particular type to a given address. This allows one to specify whether a type is a string, undefined, code, data, an array, or even a structure.

This can be used as in the following examples:

> database.set.unknown(ea)
> database.set.aligned(ea, alignment=0x10)
> database.set.string(ea)
> database.set.structure(ea, structure.by('mystructure'))
database.set(info)

Set the type information at the current address to info.

Aliases: database.set.typeinfo, database.set.info

Parameters:info (str or idaapi.tinfo_t) – the type information to apply to the address
database.set(ea, info)

Set the type information at the address ea to info.

Aliases: database.set.typeinfo, database.set.info

Parameters:
  • ea (int or long) – an address within the database
  • info (str or idaapi.tinfo_t) – the type information to apply to the address
set.alignment(**alignment)

Set the data at the current address as aligned with the specified alignment.

Aliases: database.set.align, database.set.aligned

Parameters:**alignment – the number of bytes to align with
set.alignment(ea, **alignment)

Set the data at address ea as aligned.

If alignment is specified, then use it as the number of bytes to align the data to. If size is specified, then align that number of bytes.

Aliases: database.set.align, database.set.aligned

Parameters:
  • ea (int or long) – an address within the database
  • **alignment – the number of bytes to align with
set.array()

Set the data at the current selection to an array of the type at the current address.

set.array(length)

Set the data at the current selection to an array of the specified length using the type at the current address.

Parameters:length (int or long) – the number of elements to use when applying the array
set.array(type, **length)

Set the data at the current address to an array of the specified type using the length determined from the current selection if length is not specified.

Parameters:
  • type – a pythonic type to apply as an array element to the current address
  • **length – the number of elements to use when applying the array
set.array(ea, type)

Set the data at the address ea to an array of the given type.

Parameters:
  • ea (int or long) – an address within the database
  • type – a pythonic type to use as the array element for the specified address
set.array(bounds, type)

Set the data at the provided bounds to an array of the given type.

Parameters:
  • bounds (tuple) – a tuple containing the boundaries of the array to apply
  • type – a pythonic type to use as the array element for the specified address
set.array(ea, type, length)

Set the data at the address ea to an array with the given length and type.

Parameters:
  • ea (int or long) – an address within the database
  • type – a pythonic type to use as the array element for the specified address
  • length (int or long) – the number of elements to use for the array
set.code()

Set the data at the current address to code.

set.code(ea)

Set the data at address ea to code.

Parameters:ea (int or long) – an address within the database
set.data(size, **type)

Set the data at the current address to have the specified size and type.

Parameters:
  • size (int or long) – the number of bytes to set
  • **type – if type is specified as an IDA type (idaapi.FF_*) or a structure_t then apply it to the given address
set.data(ea, size, **type)

Set the data at address ea to have the specified size and type.

If type is not specified, then choose the correct type based on the size.

Parameters:
  • ea (int or long) – an address in the database
  • size (int or long) – the number of bytes to set
  • **type – if type is specified then as an IDA type (idaapi.FF_*) or a structure_t then apply it to the given address
set.string(**strtype)

Set the data at the current address to a string with the specified strtype.

Parameters:**strtype – if strtype is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix
set.string(bounds, **strtype)

Set the data within the provided bounds to a string with the specified strtype.

Parameters:
  • bounds (tuple) – the boundaries of the string to return
  • **strtype – if strtype is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix
set.string(ea, **strtype)

Set the data at address ea to a string with the specified strtype.

Parameters:
  • ea (int or long) – an address within the database
  • **strtype – if strtype is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix
set.string(ea, length, **strtype)

Set the data at address ea to a string with the specified length.

If the integer strtype is specified, then apply a string of the specified character width. If the tuple strtype is specified, the first item is the string’s character width and the second item is the size of the length prefix.

Parameters:
  • ea (int or long) – an address within the database
  • length (int or long) – the length of the string
  • **strtype – if strtype is specified as an integer, then use the integer as the character width of the string. if a tuple is specified, then the second item represents how many bytes to use for the length prefix
set.structure(type)

Set the data at the current address to the structure_t specified by type.

Aliases: database.set.struc, database.set.struct

Parameters:type (structure_t) – the structure_t to apply to the current address
set.structure(name)

Set the data at the current address to the structure_t with the given name.

Aliases: database.set.struc, database.set.struct

Parameters:name (str) – the name of the structure to apply to the current address
set.structure(sptr)

Set the data at the current address to the structure_t for the specified sptr.

Aliases: database.set.struc, database.set.struct

Parameters:sptr (idaapi.struc_t) – the idaapi.struc_t to apply to the current address
set.structure(ea, type)

Set the data at address ea to the structure_t specified by type.

Aliases: database.set.struc, database.set.struct

Parameters:
  • ea (int or long) – an address within the database
  • type (structure_t) – the structure_t to apply to the specified address
set.structure(ea, name)

Set the data at address ea to the structure_t with the given name.

Aliases: database.set.struc, database.set.struct

Parameters:
  • ea (int or long) – an address within the database
  • name (str) – the name of the structure to apply to the specified address
set.structure(ea, sptr)

Set the data at address ea to the structure_t for the specified sptr.

Aliases: database.set.struc, database.set.struct

Parameters:
  • ea (int or long) – an address within the database
  • sptr (idaapi.struc_t) – the idaapi.struc_t to apply to the specified address
set.structure(ea, identifier)

Set the data at address ea to the structure_t that has the specified identifier.

Aliases: database.set.struc, database.set.struct

Parameters:
  • ea (int or long) – an address within the database
  • identifier (int or long) – the identifier of the structure to apply to the specified address
set.unknown()

Set the data at the current address or selection to undefined.

Aliases: database.set.undef, database.set.undefined

set.unknown(ea)

Set the data at address ea to undefined.

Aliases: database.set.undef, database.set.undefined

Parameters:ea (int or long) – an address within the database
set.unknown(ea, size)

Set the data at address ea to undefined.

Aliases: database.set.undef, database.set.undefined

Parameters:
  • ea (int or long) – an address within the database
  • size (int or long) – the number of bytes to set

3.1.1.2.12.1. database.set.float

Aliases: database.set.f

This namespace used for applying various sized floating-point types to a particular address.

This namespace is aliased as database.set.f and can be used as follows:

> database.set.f.single(ea)
> database.set.f.double(ea)
set.float()

Sets the data at the current address to an IEEE-754 floating-point number based on its size.

set.float(ea)

Sets the data at address ea to an IEEE-754 floating-point number based on its size.

Parameters:ea – an address within the database
set.float.double()

Set the data at the current address to an IEEE-754 double

set.float.double(ea)

Set the data at address ea to an IEEE-754 double.

Parameters:ea – an address within the database
set.float.single()

Set the data at the current address to an IEEE-754 single

set.float.single(ea)

Set the data at address ea to an IEEE-754 single.

Parameters:ea – an address within the database

3.1.1.2.12.2. database.set.integer

Aliases: database.set.i

This namespace used for applying various sized integer types to a particular address.

This namespace is also aliased as database.set.i and can be used as follows:

> database.set.i.uint8_t(ea)
> database.set.i.uint64_t(ea)
set.integer()

Set the data at the current address to an integer.

set.integer(ea)

Set the data at address ea to an integer of a type determined by its size.

Parameters:ea (int or long) – an address within the database to set as an integer
set.integer(ea, size)

Set the data at the address ea to an integer of the specified size.

Parameters:
  • ea (int or long) – an address within the database to set as an integer
  • size (int or long) – the size of the integer
set.integer.sint128_t()

Set the data at the current address to a sint128_t.

set.integer.sint128_t(ea)

Set the data at address ea to an sint128_t.

Parameters:ea (int or long) – an address within the database
set.integer.sint16_t()

Set the data at the current address to a sint16_t.

set.integer.sint16_t(ea)

Set the data at address ea to a sint16_t.

Parameters:ea (int or long) – an address within the database
set.integer.sint32_t()

Set the data at the current address to a sint32_t.

set.integer.sint32_t(ea)

Set the data at address ea to a sint32_t.

Parameters:ea (int or long) – an address within the database
set.integer.sint64_t()

Set the data at the current address to a sint64_t.

set.integer.sint64_t(ea)

Set the data at address ea to a sint64_t.

Parameters:ea (int or long) – an address within the database
set.integer.sint8_t()

Set the data at the current address to a sint8_t.

set.integer.sint8_t(ea)

Set the data at address ea to a sint8_t.

Parameters:ea (int or long) – an address within the database
set.integer.uint128_t()

Set the data at the current address to an uint128_t.

Aliases: database.set.integer.oword

set.integer.uint128_t(ea)

Set the data at address ea to an uint128_t.

Aliases: database.set.integer.oword

Parameters:ea (int or long) – an address within the database
set.integer.uint16_t()

Set the data at the current address to a uint16_t.

Aliases: database.set.integer.word

set.integer.uint16_t(ea)

Set the data at address ea to a uint16_t.

Aliases: database.set.integer.word

Parameters:ea (int or long) – an address within the database
set.integer.uint32_t()

Set the data at the current address to a uint32_t.

Aliases: database.set.integer.dword

set.integer.uint32_t(ea)

Set the data at address ea to a uint32_t.

Aliases: database.set.integer.dword

Parameters:ea (int or long) – an address within the database
set.integer.uint64_t()

Set the data at the current address to a uint64_t.

Aliases: database.set.integer.qword

set.integer.uint64_t(ea)

Set the data at address ea to a uint64_t.

Aliases: database.set.integer.qword

Parameters:ea (int or long) – an address within the database
set.integer.uint8_t()

Set the data at the current address to a uint8_t.

Aliases: database.set.integer.byte

set.integer.uint8_t(ea)

Set the data at address ea to a uint8_t.

Aliases: database.set.integer.byte

Parameters:ea (int or long) – an address within the database

3.1.1.2.13. database.type

Aliases: database.t

This namespace is for fetching type information from the different addresses defined within the database. The functions within this namespace allow one to extract various type information from the different locations within the database.

This namespace is also aliased as database.t.

By default, this namespace will return the idaapi.DT_TYPE of the specified address.

Some examples of using this namespace can be:

> print( database.type.size(ea) )
> print( database.type.is_initialized(ea) )
> print( database.type.is_data(ea) )
> length = database.t.array.length(ea)
> st = database.t.structure(ea)
database.type()

Return the type information for the current address as an idaapi.tinfo_t.

database.type(ea)

Return the type information for the address ea as an idaapi.tinfo_t.

Parameters:ea (int or long) – an address within the database
database.type(none)

Remove the type information from the current address.

Parameters:none (None) – the python value None
database.type(info, **guessed)

Apply the type information in info to the current address.

Parameters:
  • info (str or idaapi.tinfo_t) – the type information to apply to the address
  • **guessed – if guessed is specified, the mark it as guessed by the disassembler of the user
database.type(ea, info, **guessed)

Apply the idaapi.tinfo_t in info to the address ea.

If guess is true, then apply the type information as a guess. If force is true, then apply the type as-is regardless of its location.

Parameters:
  • ea (int or long) – an address within the database
  • info (idaapi.tinfo_t) – the idaapi.tinfo_t to apply to the address
  • **guessed – if guessed is specified, the mark it as guessed by the disassembler of the user
database.type(ea, none)

Remove the type information from the address ea.

Parameters:
  • ea – an address within the database
  • none (None) – the python value None
database.type(ea, string, **guessed)

Parse the type information in string into an idaapi.tinfo_t and apply it to the address ea.

Parameters:
  • ea (int or long) – an address within the database
  • string (str) – a string describing the type information to apply to the address
  • **guessed – if guessed is specified, the mark it as guessed by the disassembler of the user
type.flags()

Return the flags of the item at the current address.

type.flags(ea)

Return the flags of the item at the address ea.

Parameters:ea (int or long) – an address within the database
type.flags(ea, mask)

Return the flags at the address ea masked with mask.

Parameters:
  • ea (int or long) – an address within the database
  • mask (int or long) – a bitmask used to select specific bits from the flags
type.flags(ea, mask, value)

Sets the flags at the address ea masked with mask set to value.

Parameters:
  • ea (int or long) – an address within the database
  • mask (int or long) – a bitmask used to select specific bits from the flags
  • value (int or long) – the bits to write
type.has_autoname()

Return if the current address was automatically named.

Aliases: database.type.autonameQ

type.has_autoname(ea)

Return if the address ea was automatically named.

Aliases: database.type.autonameQ

Parameters:ea (int or long) – an address within the database
type.has_comment()

Return if the current address is commented.

Aliases: database.type.commentQ

type.has_comment(ea)

Return if the address at ea is commented.

Aliases: database.type.commentQ

Parameters:ea (int or long) – an address within the database
type.has_customname()

Return if the current address has a custom name.

Aliases: database.type.customnameQ

type.has_customname(ea)

Return if the address at ea has a custom name.

Aliases: database.type.customnameQ

Parameters:ea (int or long) – an address within the database
type.has_dummyname()

Return if the current address has a dummy name.

Aliases: database.type.dummynameQ

type.has_dummyname(ea)

Return if the address at ea has a dummy name.

Aliases: database.type.dummynameQ

Parameters:ea (int or long) – an address within the database
type.has_label()

Return if the current address has a label.

Aliases: database.type.has_name, database.type.labelQ, database.type.nameQ

type.has_label(ea)

Return if the address at ea has a label.

Aliases: database.type.has_name, database.type.labelQ, database.type.nameQ

Parameters:ea (int or long) – an address within the database
type.has_listedname()

Return if the current address has a name that is listed.

Aliases: database.type.listednameQ

type.has_listedname(ea)

Return if the address at ea has a name that is listed.

Aliases: database.type.listednameQ

Parameters:ea (int or long) – an address within the database
type.has_publicname()

Return if the current address has a public name.

Aliases: database.type.publicnameQ

type.has_publicname(ea)

Return if the address at ea has a public name.

Aliases: database.type.publicnameQ

Parameters:ea (int or long) – an address within the database
type.has_reference()

Return if the current address is referencing another address.

Aliases: database.type.referenceQ

type.has_reference(ea)

Return if the address at ea is referencing another address.

Aliases: database.type.referenceQ

Parameters:ea (int or long) – an address within the database
type.has_typeinfo()

Return if the current address has any type information associated with it.

Aliases: database.type.infoQ, database.type.typeinfoQ

type.has_typeinfo(ea)

Return if the address at ea has any type information associated with it.

Aliases: database.type.infoQ, database.type.typeinfoQ

Parameters:ea (int or long) – an address within the database
type.has_weakname()

Return if the current address has a name with a weak type.

Aliases: database.type.weaknameQ

type.has_weakname(ea)

Return if the address at ea has a name with a weak type.

Aliases: database.type.weaknameQ

Parameters:ea (int or long) – an address within the database
type.is_align()

Return if the current address is defined as an alignment.

Aliases: database.type.alignQ, database.is_align

type.is_align(ea)

Return if the address at ea is defined as an alignment.

Aliases: database.type.alignQ, database.is_align

Parameters:ea (int or long) – an address within the database
type.is_code()

Return if the current address is marked as code.

Aliases: database.is_code, database.type.codeQ

type.is_code(ea)

Return if the address specified by ea is marked as code.

Aliases: database.is_code, database.type.codeQ

Parameters:ea (int or long) – an address within the database
type.is_code(ea, size)

Return if the address specified by ea up to size bytes is marked as code.

Aliases: database.is_code, database.type.codeQ

Parameters:
  • ea (int or long) – an address within the database
  • size (int or long) – the number of bytes to check
type.is_data()

Return if the current address is marked as data.

Aliases: database.is_data, database.type.dataQ

type.is_data(ea)

Return if the address specified by ea is marked as data.

Aliases: database.is_data, database.type.dataQ

Parameters:ea (int or long) – an address within the database
type.is_data(ea, size)

Return if the address specified by ea up to size bytes is marked as data.

Aliases: database.is_data, database.type.dataQ

Parameters:
  • ea (int or long) – an address within the database
  • size (int or long) – the number of bytes to check
type.is_exception(**flags)

Return if the current address or selection is guarded by an exception or part of an exception handler.

Aliases: database.type.hasexception, database.type.has_exception, database.type.isexception, database.type.exceptionQ

Parameters:**flags – any of the idaapi.TBEA_\* flags that are used to match the block type.
type.is_exception(ea, **flags)

Return if the address or boundaries in ea is guarded by an exception or part of an exception handler.

If seh or cpp is specified, then include or exclude that exception type. If guarded or try is true, then return if the address is guarded by an exception. If handler or catch is true, then return if the address is part of an exception handler. If fallthrough is true, then return if the address is part of the fall-through case for a handler. If filter or finally is true, then return if the address is part of an SEH filter or SEH finalizer (respectively).

Aliases: database.type.hasexception, database.type.has_exception, database.type.isexception, database.type.exceptionQ

Parameters:
  • ea (int or long or tuple) – an address within the database
  • **flags – any of the idaapi.TBEA_\* flags that are used to match the block type.
type.is_exception(ea, flags)

Return if the address in ea is referenced by an exception matching the specified flags (idaapi.TBEA_*).

Aliases: database.type.hasexception, database.type.has_exception, database.type.isexception, database.type.exceptionQ

Parameters:
  • ea (int or long) – an address within the database
  • flags (int or long) – any of the idaapi.TBEA_\* flags that are used to match the block type.
type.is_exception(bounds, flags)

Return if the given bounds is referenced by an exception matching the specified flags (idaapi.TBEA_*).

Aliases: database.type.hasexception, database.type.has_exception, database.type.isexception, database.type.exceptionQ

Parameters:
  • bounds (tuple) – the boundaries of the range to check
  • flags (int or long) – any of the idaapi.TBEA_\* flags that are used to match the block type.
type.is_globalref()

Return true if the instruction at the current address references a global.

Aliases: database.type.isglobalref, database.type.globalrefQ

type.is_globalref(ea)

Return true if the instruction at ea references a global.

Aliases: database.type.isglobalref, database.type.globalrefQ

Parameters:ea (int or long) – an address within the database
type.is_head()

Return if the current address is aligned to a definition in the database.

Aliases: database.is_head, database.type.headQ

type.is_head(ea)

Return if the address ea is aligned to a definition in the database.

Aliases: database.is_head, database.type.headQ

Parameters:ea (int or long) – an address within the database
type.is_importref()

Return true if the instruction at the current address references an import.

Aliases: database.type.isimportref, database.type.importrefQ

type.is_importref(ea)

Return true if the instruction at ea references an import.

Aliases: database.type.isimportref, database.type.importrefQ

Parameters:ea (int or long) – an address within the database
type.is_initialized()

Return if the current address is initialized.

Aliases: database.type.initializedQ

type.is_initialized(ea)

Return if the address specified by ea is initialized.

Aliases: database.type.initializedQ

Parameters:ea (int or long) – an address within the database
type.is_initialized(ea, size)

Return if the address specified by ea up to size bytes is initialized.

Aliases: database.type.initializedQ

Parameters:
  • ea (int or long) – an address within the database
  • size (int or long) – the number of bytes to check
type.is_reference()

Return if the data at the current address is referenced by another address.

Aliases: database.type.is_referenced, database.type.is_ref

type.is_reference(ea)

Return if the data at the address ea is referenced by another address.

Aliases: database.type.is_referenced, database.type.is_ref

Parameters:ea (int or long) – an address within the database
type.is_string()

Return if the current address is defined as a string.

Aliases: database.type.stringQ

type.is_string(ea)

Return if the address at ea is defined as a string.

Aliases: database.type.stringQ

Parameters:ea (int or long) – an address within the database
type.is_structure()

Return if the current address is defined as a structure.

Aliases: database.type.is_struct, database.type.structQ, database.type.is_struc

type.is_structure(ea)

Return if the address at ea is defined as a structure.

Aliases: database.type.is_struct, database.type.structQ, database.type.is_struc

Parameters:ea (int or long) – an address within the database
type.is_tail()

Return if the current address is not aligned to a definition in the database.

Aliases: database.is_tail, database.type.tailQ

type.is_tail(ea)

Return if the address ea is not aligned to a definition in the database.

Aliases: database.is_tail, database.type.tailQ

Parameters:ea (int or long) – an address within the database
type.is_unknown()

Return if the current address is marked as unknown.

Aliases: database.type.undefinedQ, database.is_unknown, database.type.is_undefined, database.type.unknownQ

type.is_unknown(ea)

Return if the address specified by ea is marked as unknown.

Aliases: database.type.undefinedQ, database.is_unknown, database.type.is_undefined, database.type.unknownQ

Parameters:ea (int or long) – an address within the database
type.is_unknown(ea, size)

Return if the address specified by ea up to size bytes is marked as unknown.

Aliases: database.type.undefinedQ, database.is_unknown, database.type.is_undefined, database.type.unknownQ

Parameters:
  • ea (int or long) – an address within the database
  • size (int or long) – the number of bytes to check
type.size()

Return the size of the item at the current address.

Aliases: database.size

type.size(ea)

Return the size of the item at the address ea.

Aliases: database.size

Parameters:ea (int or long) – an address within the database
type.switch()

Return the switch_t at the current address.

type.switch(ea)

Return the switch_t at the address ea.

Parameters:ea (int or long) – an address within the database containing a switch

3.1.1.2.13.1. database.type.array

This namespace is for returning type information about an array that is defined within the database. By default this namespace will return the array’s element type and its number of elements as a list [size, count].

Some examples of using this namespace can be:

> type, length = database.t.array()
> print( database.t.array.size(ea) )
> print( database.t.array.member(ea) )
> print( database.t.array.element(ea) )
> print( database.t.array.length(ea) )
type.array()

Return the [type, length] of the array at the current address.

type.array(ea)

Return the [type, length] of the array at the address specified by ea.

Parameters:ea (int or long) – an address within the database containing an array
type.array(bounds)

Return the [type, length] of the specified bounds as an array.

Parameters:bounds (tuple) –
type.array(ea, size)

Return the [type, length] of the address ea if it was an array using the specified size (in bytes).

Parameters:
  • ea (int or long) –
  • size
type.array.element()

Return the type information for the member of the array defined at the current address.

Aliases: database.type.typeinfo, database.type.info

type.array.element(ea)

Return the type information for the member of the array defined at the address specified by ea.

Aliases: database.type.typeinfo, database.type.info

Parameters:ea (int or long) – an address within the database containing an array
type.array.length()

Return the number of members in the array at the current address.

type.array.length(ea)

Return the number of members in the array at the address specified by ea.

Parameters:ea (int or long) – an address within the database containing an array
type.array.member()

Return the type for the member of the array at the current address.

type.array.member(ea)

Return the type for the member of the array at the address specified by ea.

Parameters:ea (int or long) – an address within the database containing an array
type.array.size()

Return the size of a member in the array at the current address.

type.array.size(ea)

Return the size of a member in the array at the address specified by ea.

Parameters:ea (int or long) – an address within the database containing an array

3.1.1.2.13.2. database.type.structure

Aliases: database.type.struc

This namespace for returning type information about a structure that is defined within the database. By default this namespace will return the structure_t at the given address.

Some of the ways to use this namespace are:

> st = database.t.struct()
> print( database.t.struct.size() )
> st = structure.by(database.t.id(ea))
type.structure()

Return the structure type at the current address.

type.structure(ea)

Return the structure type at address ea.

Parameters:ea (int or long) – an address within the database containing a structure
type.structure.id()

Return the identifier of the structure at the current address.

Aliases: database.get_structureid, database.get_strucid, database.getStructureId

type.structure.id(ea)

Return the identifier of the structure at address ea.

Aliases: database.get_structureid, database.get_strucid, database.getStructureId

Parameters:ea (int or long) – an address within the database containing a structure
type.structure.size()

Return the total size of the structure at the current address.

type.structure.size(ea)

Return the total size of the structure at address ea.

Parameters:ea (int or long) – an address within the database containing a structure

3.1.1.2.14. database.types

This namespace is for interacting with the local types that are defined within the database. The functions within this namespace can be used to create, query, or fetch the types that have been defined.

When listing the types that are matched, the following legend can be used to identify certain characteristics about them:

  • L - The type originated from a type library
  • I - The type originated from an inherited type library
  • T - The type is a type definition and references another type
  • P - The contents of the type is a pointer
  • F - The contents of the type is a floating-point value (float, double, long double)
  • E - The contents of the type is an enumeration
  • I - The contents of the type is an integral
  • A - The type represents an array
  • F - The type represents a function
  • S - The type represents a structure
  • V - The type represents a virtual function table
  • C - The type represents a structure containing a virtual function table
  • U - The type represents a union
  • ? - The type is currently not defined

The available types that one can filter the local types with are as follows:

  • ordinal - Match according to the ordinal of the local type.
  • name - Match according to the name of the local type.
  • like - Filter the names of the local types according to a glob.
  • definition - Filter the local types by applying a glob to their definition.
  • regex - Filter the local types by applying a regular-expression to their definition.
  • typeref or typedef - Filter the local types for any that are an alias declared with typedef.
  • defined or present - Filter the local types for any that are defined.
  • size - Filter the local types according to their size.
  • greater or ge - Filter the local types for the ones that are larger or equal to a certain size.
  • gt - Filter the local types for the ones that are larger than a certain size.
  • less or le - Filter the local types for the ones that are less or equal to a certain size.
  • lt - Filter the local types for the ones that are less than a certain size.
  • integer - Filter the local types for any that are integers.
  • pointer - Filter the local types for any that are pointers.
  • function - Filter the local types for any that are functions.
  • float - Filter the local types for any that are floating-point.
  • array - Filter the local types for any that describe an array.
  • structure - Filter the local types for any that describe a structure.
  • union - Filter the local types for any that describe a union.
  • enumeration - Filter the local types for any that describe an enumeration.
  • predicate - Filter the types by passing their ordinal and idaapi.tinfo_t to a callable.

Some examples of using these keywords are as follows:

> database.types.list('*::*')
> iterable = database.types.iterate(definition='*Cookie*')
> result = database.types.search(regex='.*const.*')
types.add(name, **mangled)

Add an empty type with the provided name to the current type library.

Parameters:
  • name (str) – the name of the type to add
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.add(name, library, **mangled)

Add an empty type with the provided name to the specified type library.

Parameters:
  • name (str) – the name of the type to add
  • library (idaapi.til_t) – the idaapi.til_t of the library to be added to
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.add(name, info, **mangled)

Add the type information in info to the current type library using the provided name.

Parameters:
  • name (str) – the name of the type to add
  • info (str or idaapi.tinfo_t) – the string or idaapi.tinfo_t of the type to add
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.add(name, string, library, **mangled)

Add the type information in string to the specified type library using the provided name.

Parameters:
  • name (str) – the name of the type to add
  • string (str) – a string describing the type to add
  • library (idaapi.til_t) – the idaapi.til_t of the library to be added to
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.add(name, info, library, **mangled)

Add the type information in info to the specified type library using the provided name.

If the boolean mangled is specified, then the given name is mangled.

Parameters:
  • name (str) – the name of the type to add
  • info (idaapi.tinfo_t) – the idaapi.tinfo_t to use when adding the type
  • library (idaapi.til_t) – the idaapi.til_t of the library to be added to
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.by(ordinal)

Return the type information that is at the given ordinal.

Parameters:ordinal (int or long) – the numerical index of the type to return
types.by(name)

Return the type information that has the specified name.

Parameters:name (str) – the name of the type to return
types.by(ordinal, library)

Return the type information from the specified library that is at the given ordinal.

Parameters:
  • ordinal (int or long) – the numerical index of the type to return
  • library (idaapi.til_t) – the idaapi.til_t of the library to return the type from
types.by(name, library)

Return the type information from the specified library that is using the given name.

Parameters:
  • name (str) – the name of the type to return
  • library (idaapi.til_t) – the idaapi.til_t of the library to return the type from
types.by_index(ordinal)

Return the type information that is at the given ordinal.

Parameters:ordinal (int or long) – the numerical index of the type to return
types.by_index(ordinal, library)

Return the type information from the specified library that is at the given ordinal.

Parameters:
  • ordinal (int or long) – the numerical index of the type to return
  • library (idaapi.til_t) – the idaapi.til_t of the library to return the type from
types.by_name(name)

Return the type information that has the specified name.

Parameters:name (str) – the name of the type to return
types.by_name(name, library)

Return the type information from the specified library that is using the given name.

Parameters:
  • name (str) – the name of the type to return
  • library (idaapi.til_t) – the idaapi.til_t of the library to return the type from
types.count()

Return the number of types that are available in the current type library.

types.count(library)

Return the number of types that are available in the specified type library.

Parameters:library (idaapi.til_t) – the idaapi.til_t of the library to return the number of types from
types.declare(string, **flags)

Parse the given string into an idaapi.tinfo_t using the current type library and return it.

Aliases: database.types.decl, database.types.parse

Parameters:
  • string (str) – the type as a string to parse
  • **flags – any of the idaapi.PT_\* flags to use when parsing the type
types.declare(string, library, **flags)

Parse the given string into an idaapi.tinfo_t using the specified type library and return it.

If the integer flags is provided, then use the specified flags (idaapi.PT_*) when parsing the string.

Aliases: database.types.decl, database.types.parse

Parameters:
  • string (str) – the type as a string to parse
  • library (idaapi.til_t) – the idaapi.til_t describing the target type library
  • **flags – any of the idaapi.PT_\* flags to use when parsing the type
types.get(ordinal)

Get the type information at the given ordinal of the current type library and return it.

Parameters:ordinal (int or long) – the numerical index of the type to get
types.get(name)

Get the type information with the given name from the current type library and return it.

Parameters:name (str) – the name of the type to get
types.get(ordinal, library)

Get the type information at the given ordinal of the specified type library and return it.

Parameters:
  • ordinal (int or long) – the numerical index of the type to get
  • library (idaapi.til_t) – the idaapi.til_t of the library to fetch the type from
types.get(name, library)

Get the type information with the given name from the specified type library and return it.

Parameters:
  • name (str) – the name of the type to get
  • library (idaapi.til_t) – the idaapi.til_t of the library to fetch the type from
types.get(serialized)

Convert the serialized type information from the current type library and return it.

Parameters:serialized (tuple) – the tuple containing the fields that describe the serialized type
types.get(serialized, library)

Convert the serialized type information from the specified type library and return it.

Parameters:
  • serialized (tuple) – the tuple containing the fields that describe the serialized type
  • library (idaapi.til_t) – the idaapi.til_t of the library to serialize the type from
types.has(ordinal)

Return whether the current type library has a type at the given ordinal.

Parameters:ordinal (int or long) – the ordinal of the type to check
types.has(name)

Return whether the current type library has a type with the specified name.

Parameters:name (str) – the name of the type to check
types.has(ordinal, library)

Return whether the provided type library has a type at the given ordinal.

Parameters:
  • ordinal (int or long) –
  • library (idaapi.til_t) – the idaapi.til_t of the library to check
types.has(name, library)

Return whether the provided type library has a type with the specified name.

Parameters:
  • name (str) – the name of the type to check
  • library (idaapi.til_t) – the idaapi.til_t of the library to check
types.iterate(string)

Iterate through all of the types in current type library with a glob that matches string.

Parameters:string (str) – the glob to filter the names of the types with
types.iterate(string, library)

Iterate through all of the types in the specified type library with a glob that matches string.

Parameters:
  • string (str) – the glob to filter the names of the types with
  • library (idaapi.til_t) – the idaapi.til_t containing the types to iterate
types.iterate(**type)

Iterate through all of the types in the current type library that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter types with
types.iterate(library, **type)

Iterate through all of the types in the specified type library that match the keyword specified by type.

Parameters:
  • library (idaapi.til_t) – the idaapi.til_t of the library containing the types
  • **type – any keyword that can be used to filter types with
types.list(string)

List all of the types in the current type library with a glob that matches string.

Parameters:string (str) – the glob to filter the type names with
types.list(string, library)

List all of the types in the specified type library with a glob that matches string.

Parameters:
  • string (str) – the glob to filter the type names with
  • library (idaapi.til_t) – the idaapi.til_t containing the types to list
types.list(**type)

List all of the types in the specified type library that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the types with
types.list(library, **type)

List all of the types in the specified type library that match the keyword specified by type.

Parameters:
  • library (idaapi.til_t) – the idaapi.til_t containing the types to list
  • **type – any keyword that can be used to filter the types with
types.name(info)

Return the name of the type from the current type library that matches the given type info.

Parameters:info (idaapi.tinfo_t) – the type information to return the name of
types.name(ordinal)

Return the name of the type from the current type library at the specified ordinal.

Parameters:ordinal (int or long) – the numerical index of the type to get the name from
types.name(info, library)

Return the name of the type from the specified type library that matches the given type info.

Parameters:
  • info (idaapi.tinfo_t) – the type information to return the name of
  • library (idaapi.til_t) – the idaapi.til_t of the library containing the type
types.name(ordinal, library)

Return the name of the type from the specified type library at the given ordinal.

Parameters:
  • ordinal (int or long) – the numerical index of the type to get the name from
  • library (idaapi.til_t) – the idaapi.til_t of the library containing the type
types.name(ordinal, string, **mangled)

Set the name of the type at the specified ordinal from the current library to string.

Parameters:
  • ordinal (int or long) – the numerical index of the type to rename
  • string (str) – the new name of the type
  • **mangled – a boolean that specifies whether the name is mangled
types.name(ordinal, string, library, **mangled)

Set the name of the type at the specified ordinal of the given type library to string.

If the boolean mangled is specified, then the given name is mangled.

Parameters:
  • ordinal (int or long) – the numerical index of the type to rename
  • string (str) – the new name of the type
  • library (idaapi.til_t) – the idaapi.til_t of the library containing the type to rename
  • **mangled – a boolean that specifies whether the name is mangled
types.remove(ordinal)

Remove the type information at the specified ordinal of the current type library.

Parameters:ordinal (int or long) – the numerical index of the type to remove
types.remove(ordinal, library)

Remove the type information at the ordinal of the specified type library.

Parameters:
  • ordinal (int or long) – the numerical index of the type to remove
  • library (idaapi.til_t) – the idaapi.til_t of the library to remove the type from
types.remove(name, **mangled)

Remove the type information with the specified name from the current type library.

Parameters:
  • name (str) – the name of the type to remove
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.remove(name, library, **mangled)

Remove the type information with the specified name from the specified type library.

If the boolean mangled is specified, then the given name is mangled.

Parameters:
  • name (str) – the name of the type to remove
  • library (idaapi.til_t) – the idaapi.til_t of the library to remove the type from
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.search(string)

Search through all of the type names in the current type library matching the glob string and return the first result.

Parameters:string (str) – the glob to filter the names of the types with
types.search(string, library)

Search through all of the type names in the specified type library matching the glob string and return the first result.

Parameters:
  • string (str) – the glob to filter the names of the types with
  • library (idaapi.til_t) – the idaapi.til_t containing the types to search
types.search(**type)

Search through all of the types in the current type library that match the keyword specified by type.

Parameters:**type – any keyword that can be used to filter the types with
types.search(library, **type)

Search through all of the types in the specified type library that match the keyword specified by type.

Parameters:
  • library (idaapi.til_t) – the idaapi.til_t containing the types to search
  • **type – any keyword that can be used to filter the types with
types.set(ordinal, info)

Assign the type information info to the type at the specified ordinal of the current type library.

Parameters:
  • ordinal (int or long) – the numerical index of the type to set
  • info (str or idaapi.tinfo_t) – the string or idaapi.tinfo_t of the type to assign
types.set(ordinal, name, info, **mangled)

Assign the type information info with the specified name to the given ordinal of the current type library.

Parameters:
  • ordinal (int or long) – the numerical index of the type to set
  • name (str) – the name of the type to set
  • info (str or idaapi.tinfo_t) – the string or idaapi.tinfo_t of the type to assign
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.set(ordinal, info, library)

Assign the type information info to the type at the ordinal of the specified type library.

Parameters:
  • ordinal (int or long) – the numerical index of the type to set
  • info (str or idaapi.tinfo_t) – the string or idaapi.tinfo_t of the type to assign
  • library (idaapi.til_t) – the idaapi.til_t of the library for the type
types.set(ordinal, name, string, library, **mangled)

Assign the type information in string with the specified name to the specified ordinal of the given type library.

Parameters:
  • ordinal (int or long) – the numerical index of the type to set
  • name (str) – the name of the type to set
  • string (str) – a string describing the type to assign
  • library (idaapi.til_t) – the idaapi.til_t of the library for the type
  • **mangled – a boolean that specifies whether the name of the type is mangled
types.set(ordinal, name, info, library, **mangled)

Assign the type information info with the specified name to the given ordinal of the type library.

If the boolean mangled is specified, then the given name is mangled.

Parameters:
  • ordinal (int or long) – the numerical index of the type to set
  • name (str) – the name of the type to set
  • info (idaapi.tinfo_t) – the idaapi.tinfo_t of the type to assign
  • library (idaapi.til_t) – the idaapi.til_t of the library for the type
  • **mangled – a boolean that specifies whether the name of the type is mangled

3.1.1.2.15. database.xref

Aliases: database.x

This namespace is for navigating the cross-references (xrefs) associated with an address in the database. This lets one identify code xrefs from data xrefs and even allows one to add or remove xrefs as they see fit.

This namespace is also aliased as database.x.

Some of the more common functions are used so often that they’re also aliased as globals. Some of these are:

  • database.up - Return all addresses that reference an address
  • database.down - Return all addresses that an address references
  • database.drefs - Return all the data references for an address
  • database.crefs - Return all the code references for an address
  • database.dxup - Return all the data references that reference an address
  • database.dxdown - Return all the data references that an address references
  • database.cxup - Return all the code references that reference an address
  • database.cxdown - Return all the code references that an address references

Some ways to utilize this namespace can be:

> print( database.x.up() )
> for ea in database.x.down(): ...
> for ea in database.x.cu(ea): ...
> ok = database.x.add_code(ea, target)
> ok = database.x.rm_data(ea)
xref.add_code(target, **reftype)

Add a code reference from the current address to target.

Aliases: database.xref.ac

Parameters:
  • target (int or long) – the target address to add a code reference to
  • **reftype – if call is set to true, this specify that this reference is a function call
xref.add_code(ea, target, **reftype)

Add a code reference from address ea to target.

If the reftype call is true, then specify this ref as a function call.

Aliases: database.xref.ac

Parameters:
  • ea (int or long) – an address within the database
  • target (int or long) – the target address to add a code reference to
  • **reftype – if call is set to true, this specify that this reference is a function call
xref.add_data(target, **reftype)

Add a data reference from the current address to target.

Aliases: database.xref.ad

Parameters:
  • target (int or long) – the target address to add a data reference to
  • **reftype – if write is set to true, then specify that this reference writes to its target
xref.add_data(ea, target, **reftype)

Add a data reference from the address ea to target.

If the reftype write is true, then specify that this ref is writing to the target.

Aliases: database.xref.ad

Parameters:
  • ea (int or long) – an address within the database
  • target (int or long) – the target address to add a data reference to
  • **reftype – if write is set to true, then specify that this reference writes to its target
xref.code()

Return all of the code xrefs that refer to the current address.

Aliases: database.crefs

xref.code(descend)

Aliases: database.crefs, database.xref.c

Parameters:descend (bool) – a boolean that specifies to only return references that are referred by the current address
xref.code(ea)

Return all of the code xrefs that refer to the address ea.

Aliases: database.crefs, database.xref.c

Parameters:ea (int or long) – an address within the database
xref.code(ea, descend)

Return all of the code xrefs that refer to the address ea.

If the bool descend is defined, then return only code refs that are referred by the specified address.

Aliases: database.crefs, database.xref.c

Parameters:
  • ea (int or long) – an address within the database
  • descend (bool) – a boolean that specifies to only return references that are referred by the address
xref.code_down()

Return all of the code xrefs that are referenced by the current address.

Aliases: database.cxdown, database.xref.cd

xref.code_down(ea)

Return all of the code xrefs that are referenced by the address ea.

Aliases: database.cxdown, database.xref.cd

Parameters:ea (int or long) – an address within the database
xref.code_up()

Return all of the code xrefs that are referenced by the current address.

Aliases: database.xref.cu, database.cxup

xref.code_up(ea)

Return all of the code xrefs that refer to the address ea.

Aliases: database.xref.cu, database.cxup

Parameters:ea (int or long) – an address within the database
xref.data()

Return all of the data xrefs that refer to the current address.

Aliases: database.xref.d, database.drefs

xref.data(descend)

Aliases: database.xref.d, database.drefs

Parameters:descend (bool) – a boolean that specifies to only return references that are referred by the current address
xref.data(ea)

Return all of the data xrefs that refer to the address ea.

Aliases: database.xref.d, database.drefs

Parameters:ea (int or long) – an address within the database
xref.data(ea, descend)

Return all of the data xrefs that refer to the address ea.

If the bool descend is defined, then return only the data refs that are referred by the specified address.

Aliases: database.xref.d, database.drefs

Parameters:
  • ea (int or long) – an address within the database
  • descend (bool) – a boolean that specifies to only return references that are referred by the current address
xref.data_down()

Return all of the data xrefs that are referenced by the current address.

Aliases: database.xref.dd, database.dxdown

xref.data_down(ea)

Return all of the data xrefs that are referenced by the address ea.

Aliases: database.xref.dd, database.dxdown

Parameters:ea (int or long) – an address within the database
xref.data_up()

Return all of the data xrefs that refer to the current address.

Aliases: database.xref.du, database.dxup

xref.data_up(ea)

Return all of the data xrefs that refer to the address ea.

Aliases: database.xref.du, database.dxup

Parameters:ea (int or long) – an address within the database
xref.down()

Return all of the references that are referred by the current address.

Aliases: database.down, database.xref.d

xref.down(ea)

Return all of the references that are referred by the address ea.

Aliases: database.down, database.xref.d

Parameters:ea (int or long) – an address within the database
xref.erase()

Clear all references at the current address.

Aliases: database.xref.rx

xref.erase(ea)

Clear all references at the address ea.

Aliases: database.xref.rx

Parameters:ea (int or long) – an address within the database containing a code or a data reference
xref.rm_code()

Delete _all_ the code references at the current address.

Aliases: database.xref.rc

xref.rm_code(ea)

Delete _all_ the code references at ea.

Aliases: database.xref.rc

Parameters:ea (int or long) – an address within the database containing a code reference
xref.rm_code(ea, target)

Delete any code references at ea that point to address target.

Aliases: database.xref.rc

Parameters:
  • ea (int or long) – an address within the database containing a code reference
  • target (int or long) – the target address that the reference points to
xref.rm_data()

Delete _all_ the data references at the current address.

Aliases: database.xref.rd

xref.rm_data(ea)

Delete _all_ the data references at ea.

Aliases: database.xref.rd

Parameters:ea (int or long) – an address within the database containing a data reference
xref.rm_data(ea, target)

Delete any data references at ea that point to address target.

Aliases: database.xref.rd

Parameters:
  • ea (int or long) – an address within the database containing a data reference
  • target (int or long) – the target address that the reference points to
xref.up()

Return all of the references that refer to the current address.

Aliases: database.xref.u, database.up

xref.up(ea)

Return all of the references that refer to the address ea.

Aliases: database.xref.u, database.up

Parameters:ea (int or long) – an address within the database