Module index

Module ida_auto

IDA Plugin SDK API wrapper: auto

Global variables

AU_CHLB = 90
AU_CODE = 20
AU_FINAL = 200
var AU_LBF2
AU_LBF2 = 70
var AU_LBF3
AU_LBF3 = 80
AU_LIBF = 60
AU_PROC = 30
AU_TAIL = 35
AU_TYPE = 50
var AU_UNK
AU_UNK = 10
AU_USED = 40
AU_WEAK = 25
var st_Ready
st_Ready = 0
var st_Think
st_Think = 1
var st_Waiting
st_Waiting = 2
var st_Work
st_Work = 3


def auto_apply_tail(*args) ‑> void
Plan to apply the tail_ea chunk to the parent
auto_apply_tail(tail_ea, parent_ea)
tail_ea: linear address of start of tail (C++: ea_t)
parent_ea: linear address within parent. If BADADDR,
automatically try to find parent via xrefs. (C++: ea_t)
def auto_apply_type(*args) ‑> void
Plan to apply the callee's type to the calling point.
auto_apply_type(caller, callee)
caller (C++: ea_t)
callee (C++: ea_t)
def auto_cancel(*args) ‑> void
Remove an address range (ea1..ea2) from queues 'AU_CODE' , 'AU_PROC' , 'AU_USED' . To remove an address range from other queues use 'auto_unmark()' function. 'ea1' may be higher than 'ea2', the kernel will swap them in this case. 'ea2' doesn't belong to the range.
auto_cancel(ea1, ea2)
ea1 (C++: ea_t)
ea2 (C++: ea_t)
def auto_get(*args) ‑> ea_t
Retrieve an address from queues regarding their priority. Returns 'BADADDR' if no addresses not lower than 'lowEA' and less than 'highEA' are found in the queues. Otherwise *type will have queue type.
auto_get(type, lowEA, highEA) -> ea_t
type (C++: atype_t *)
lowEA (C++: ea_t)
highEA (C++: ea_t)
def auto_is_ok(*args) ‑> bool
Are all queues empty? (i.e. has autoanalysis finished?).
def auto_make_code(*args) ‑> void
Plan to make code.
ea (C++: ea_t)
def auto_make_proc(*args) ‑> void
Plan to make code&function.
ea (C++: ea_t)
def auto_make_step(*args) ‑> bool
Analyze one address in the specified range and return true.
auto_make_step(ea1, ea2) -> bool
ea1 (C++: ea_t)
ea2 (C++: ea_t)
return: if processed anything. false means that there is nothing to
process in the specified range.
def auto_mark(*args) ‑> void
Put single address into a queue. Queues keep addresses sorted.
auto_mark(ea, type)
ea (C++: ea_t)
type (C++: atype_t)
def auto_mark_range(*args) ‑> void
Put range of addresses into a queue. 'start' may be higher than 'end', the kernel will swap them in this case. 'end' doesn't belong to the range.
auto_mark_range(start, end, type)
start (C++: ea_t)
end (C++: ea_t)
type (C++: atype_t)
def auto_recreate_insn(*args) ‑> int
Try to create instruction
auto_recreate_insn(ea) -> int
ea: linear address of callee (C++: ea_t)
return: the length of the instruction or 0
def auto_unmark(*args) ‑> void
Remove range of addresses from a queue. 'start' may be higher than 'end', the kernel will swap them in this case. 'end' doesn't belong to the range.
auto_unmark(start, end, type)
start (C++: ea_t)
end (C++: ea_t)
type (C++: atype_t)
def auto_wait(*args) ‑> bool
Process everything in the queues and return true.
def auto_wait_range(*args) ‑> ssize_t
Process everything in the specified range and return true.
auto_wait_range(ea1, ea2) -> ssize_t
ea1 (C++: ea_t)
ea2 (C++: ea_t)
return: number of autoanalysis steps made. -1 if the user clicked
cancel. (the wait box must be displayed by the caller if desired)
def enable_auto(*args) ‑> bool
Temporarily enable/disable autoanalyzer. Not user-facing, but rather because IDA sometimes need to turn AA on/off regardless of inf.s_genflags:INFFL_AUTO
enable_auto(enable) -> bool
enable (C++: bool)
return: old state
def get_auto_display(*args) ‑> bool
Get structure which holds the autoanalysis indicator contents.
get_auto_display(auto_display) -> bool
auto_display (C++: auto_display_t *)
def get_auto_state(*args) ‑> atype_t
Get current state of autoanalyzer. If auto_state == 'AU_NONE' , IDA is currently not running the analysis (it could be temporarily interrupted to perform the user's requests, for example).
def is_auto_enabled(*args) ‑> bool
Get autoanalyzer state.
def may_create_stkvars(*args) ‑> bool
Is it allowed to create stack variables automatically?. This function should be used by IDP modules before creating stack vars.
def may_trace_sp(*args) ‑> bool
Is it allowed to trace stack pointer automatically?. This function should be used by IDP modules before tracing sp.
def peek_auto_queue(*args) ‑> ea_t
Peek into a queue 'type' for an address not lower than 'low_ea'. Do not remove address from the queue.
peek_auto_queue(low_ea, type) -> ea_t
low_ea (C++: ea_t)
type (C++: atype_t)
return: the address or BADADDR
def plan_and_wait(*args) ‑> int
Analyze the specified range. Try to create instructions where possible. Make the final pass over the specified range if specified. This function doesn't return until the range is analyzed.
plan_and_wait(ea1, ea2, final_pass=True) -> int
ea1 (C++: ea_t)
ea2 (C++: ea_t)
final_pass (C++: bool)
retval: 1 - ok
retval: 0 - Ctrl-Break was pressed
def plan_ea(*args) ‑> void
Plan to perform reanalysis.
ea (C++: ea_t)
def plan_range(*args) ‑> void
Plan to perform reanalysis.
plan_range(sEA, eEA)
sEA (C++: ea_t)
eEA (C++: ea_t)
def reanalyze_callers(*args) ‑> void
Plan to reanalyze callers of the specified address. This function will add to 'AU_USED' queue all instructions that call (not jump to) the specified address.
reanalyze_callers(ea, noret)
ea: linear address of callee (C++: ea_t)
noret: !=0: the callee doesn't return, mark to undefine
subsequent instructions in the caller. 0: do nothing. (C++: bool)
def revert_ida_decisions(*args) ‑> void
Delete all analysis info that IDA generated for for the given range.
revert_ida_decisions(ea1, ea2)
ea1 (C++: ea_t)
ea2 (C++: ea_t)
def set_auto_state(*args) ‑> atype_t
Set current state of autoanalyzer.
set_auto_state(new_state) -> atype_t
new_state: new state of autoanalyzer (C++: atype_t)
return: previous state
def set_ida_state(*args) ‑> idastate_t
Change IDA status indicator value
set_ida_state(st) -> idastate_t
st: - new indicator status (C++: idastate_t)
return: old indicator status
def show_addr(*args) ‑> void
Show an address on the autoanalysis indicator. The address is displayed in the form " @:12345678".
ea: - linear address to display (C++: ea_t)
def show_auto(*args) ‑> void
Change autoanalysis indicator value.
show_auto(ea, type=AU_NONE)
ea: linear address being analyzed (C++: ea_t)
type: autoanalysis type (see Autoanalysis queues ) (C++:


class auto_display_t (*args)
Proxy of C++ auto_display_t class.
__init__(self) -> auto_display_t

Instance variables

var ea
auto_display_t_ea_get(self) -> ea_t
var state
auto_display_t_state_get(self) -> idastate_t
var type
auto_display_t_type_get(self) -> atype_t