IDA SDK

- Main Page
- Header Files
- Classes
- Modules

- File List
- File Members

Classes | Functions | Macros | Variables
funcs.hpp File Reference

## Detailed Description

Routines for working with functions within the disassembled program.

This file also contains routines for working with library signatures (e.g. FLIRT).

Each function consists of function chunks. At least one function chunk must be present in the function definition - the function entry chunk. Other chunks are called function tails. There may be several of them for a function.

A function tail is a continuous range of addresses. It can be used in the definition of one or more functions. One function using the tail is singled out and called the tail owner. This function is considered as 'possessing' the tail. get_func() on a tail address will return the function possessing the tail. You can enumerate the functions using the tail by using func_parent_iterator_t.

Each function chunk in the disassembly is represented as an "area" (a range of addresses, see area.hpp for details) with characteristics.

A function entry must start with an instruction (code) byte.

## Classes
struct | regarg_t
| Register argument description. More...
class | func_t
| A function is a set of continuous ranges of addresses with characteristics. More...
class | lock_func
| Helper class to lock a function pointer so it stays valid. More...
class | func_tail_iterator_t
| Class to enumerate all function tails sorted by addresses. More...
class | func_item_iterator_t
| Class to enumerate all function instructions and data sorted by addresses. More...
class | func_parent_iterator_t
| Class to enumerate all function parents sorted by addresses. More...

## Functions
bool | is_func_entry (const func_t *pfn)
| Does function describe a function entry chunk?
bool | is_func_tail (const func_t *pfn)
| Does function describe a function tail chunk?
bool | is_func_locked (const func_t *pfn)
| Is the function pointer locked?
idaman func_t *ida_export | get_func (ea_t ea)
| Get pointer to function structure by address. More...
idaman int ida_export | get_func_chunknum (func_t *pfn, ea_t ea)
| Get the containing tail chunk of 'ea'. More...
bool | func_contains (func_t *pfn, ea_t ea)
| Does the given function contain the given address?
idaman func_t *ida_export | getn_func (size_t n)
| Get pointer to function structure by number. More...
idaman size_t ida_export | get_func_qty (void)
| Get total number of functions in the program.
idaman int ida_export | get_func_num (ea_t ea)
| Get ordinal number of a function. More...
idaman func_t *ida_export | get_prev_func (ea_t ea)
| Get pointer to the previous function. More...
idaman func_t *ida_export | get_next_func (ea_t ea)
| Get pointer to the next function. More...
idaman bool ida_export | get_func_limits (func_t *pfn, area_t *limits)
| Get function limits. More...
char * | get_func_cmt (func_t *fn, bool repeatable)
| Get function comment. More...
bool | set_func_cmt (func_t *fn, const char *cmt, bool repeatable)
| Set function comment. More...
void | del_func_cmt (func_t *fn, bool repeatable)
| Delete function comment. More...
bool | update_func (func_t *fn)
| Update information about a function in the database (func_t). More...
idaman bool ida_export | add_func_ex (func_t *fn)
| Add a new function. More...
idaman bool ida_export | add_func (ea_t ea1, ea_t ea2)
| Add a new function. More...
idaman bool ida_export | del_func (ea_t ea)
| Delete a function. More...
idaman int ida_export | func_setstart (ea_t ea, ea_t newstart)
| Move function chunk start address. More...
idaman bool ida_export | func_setend (ea_t ea, ea_t newend)
| Move function chunk end address. More...
idaman void ida_export | reanalyze_function (func_t *pfn, ea_t ea1=0, ea_t ea2=BADADDR, bool analyze_parents=false)
| Reanalyze a function. More...
idaman void ida_export | clear_func_struct (func_t *fn)
| Initialize the function structure.
idaman int ida_export | find_func_bounds (ea_t ea, func_t *nfn, int flags)
| Determine the boundaries of a new function. More...
idaman ssize_t ida_export | get_func_name2 (qstring *out, ea_t ea)
| Get function name. More...
idaman int ida_export | get_func_bitness (const func_t *pfn)
| Get function bitness (which is equal to the function segment bitness). More...
int idaapi | get_func_bits (func_t *pfn)
| Get number of bits in the function addressing.
int idaapi | get_func_bytes (func_t *pfn)
| Get number of bytes in the function addressing.
bool | is_visible_func (func_t *pfn)
| Is the function visible (not hidden)?
bool | is_finally_visible_func (func_t *pfn)
| Is the function visible (event after considering SW_SHHID_FUNC)?
idaman void ida_export | set_visible_func (func_t *pfn, bool visible)
| Set visibility of function.
idaman int ida_export | set_func_name_if_jumpfunc (func_t *fn, const char *oldname)
| Give a meaningful name to function if it consists of only 'jump' instruction. More...
idaman ea_t ida_export | calc_thunk_func_target (func_t *fn, ea_t *fptr)
| Calculate target of a thunk function. More...
idaman char *ida_export | a2funcoff (ea_t ea, char *buf, size_t bufsize)
| Convert address to "funcname+offset" text form. More...
idaman void ida_export | std_gen_func_header (func_t *pfn)
| Generate standard function header lines using MakeLine() More...
idaman bool ida_export | func_does_return (ea_t callee)
| Does the function return?. More...
idaman bool ida_export | set_noret_insn (ea_t insn_ea, bool noret)
| Signal a non-returning instruction. More...
func_t * | get_fchunk (ea_t ea)
| Get pointer to function chunk structure by address. More...
func_t * | getn_fchunk (int n)
| Get pointer to function chunk structure by number. More...
size_t | get_fchunk_qty (void)
| Get total number of function chunks in the program.
int | get_fchunk_num (ea_t ea)
| Get ordinal number of a function chunk in the global list of function chunks. More...
func_t * | get_prev_fchunk (ea_t ea)
| Get pointer to the previous function chunk in the global list. More...
func_t * | get_next_fchunk (ea_t ea)
| Get pointer to the next function chunk in the global list. More...
idaman bool ida_export | append_func_tail (func_t *pfn, ea_t ea1, ea_t ea2)
| Append a new tail chunk to the function definition. More...
idaman bool ida_export | remove_func_tail (func_t *pfn, ea_t tail_ea)
| Remove a function tail. More...
idaman bool ida_export | set_tail_owner (func_t *fnt, ea_t func_start)
| Set a function as the possessing function of a function tail. More...
bool idaapi | f_any (flags_t, void *)
| Helper function to accept any address.
idaman void ida_export | iterate_func_chunks (func_t *pfn, void(idaapi *func)(ea_t ea1, ea_t ea2, void *ud), void *ud=NULL, bool include_parents=false)
| Function to iterate function chunks (all of them including the entry chunk) More...
idaman int ida_export | plan_to_apply_idasgn (const char *fname)
| Add a signature file to the list of planned signature files. More...
idaman bool ida_export | apply_idasgn (int advance)
| Start application of signature file. More...
idaman int ida_export | apply_idasgn_to (const char *signame, ea_t ea, bool is_startup)
| Apply a signature file to the specified address. More...
idaman int ida_export | get_idasgn_qty (void)
| Get number of signatures in the list of planned and applied signatures. More...
idaman int ida_export | get_current_idasgn (void)
| Get number of the the current signature. More...
idaman int ida_export | calc_idasgn_state (int n)
| Get state of a signature in the list of planned signatures. More...
idaman int ida_export | del_idasgn (int n)
| Remove signature from the list of planned signatures. More...
idaman int32 ida_export | get_idasgn_desc (int n, char *signame, size_t signamesize, char *optlibs, size_t optlibssize)
| Get information about a signature in the list. More...
idaman idasgn_t *ida_export | get_idasgn_header_by_short_name (const char *name)
| Get idasgn header by a short signature name. More...
idaman char *ida_export | get_idasgn_title (const char *name, char *buf, size_t bufsize)
| Get full description of the signature by its short name. More...
idaman void ida_export | determine_rtl (void)
| Determine compiler/vendor using the startup signatures. More...
idaman bool ida_export | apply_startup_sig (ea_t ea, const char *startup)
| Apply a startup signature file to the specified address. More...
idaman int ida_export | try_to_add_libfunc (ea_t ea)
| Apply the currently loaded signature file to the specified address. More...
Get prev/next address in function
Unlike func_item_iterator_t which always enumerates the main function chunk first, these functions respect linear address ordering.
idaman ea_t ida_export | get_prev_func_addr (func_t *pfn, ea_t ea)
idaman ea_t ida_export | get_next_func_addr (func_t *pfn, ea_t ea)
Functions to work with temporary register argument definitions
idaman void ida_export | read_regargs (func_t *pfn)
idaman void ida_export | add_regarg2 (func_t *pfn, int reg, const tinfo_t &tif, const char *name)

## Macros
#define | FUNC_NORET 0x00000001
| Function doesn't return.
#define | FUNC_FAR 0x00000002
| Far function.
#define | FUNC_LIB 0x00000004
| Library function.
#define | FUNC_STATICDEF 0x00000008
| Static function.
#define | FUNC_FRAME 0x00000010
| Function uses frame pointer (BP)
#define | FUNC_USERFAR 0x00000020
| User has specified far-ness. More...
#define | FUNC_HIDDEN 0x00000040
| A hidden function chunk.
#define | FUNC_THUNK 0x00000080
| Thunk (jump) function.
#define | FUNC_BOTTOMBP 0x00000100
| BP points to the bottom of the stack frame.
#define | FUNC_NORET_PENDING 0x00200
| Function 'non-return' analysis must be performed. More...
#define | FUNC_SP_READY 0x00000400
| SP-analysis has been performed. More...
#define | FUNC_PURGED_OK 0x00004000
| 'argsize' field has been validated. More...
#define | FUNC_TAIL 0x00008000
| This is a function tail. More...
#define | MOVE_FUNC_OK 0
| ok
#define | MOVE_FUNC_NOCODE 1
| no instruction at 'newstart'
#define | MOVE_FUNC_BADSTART 2
| bad new start address
#define | MOVE_FUNC_NOFUNC 3
| no function at 'ea'
#define | MOVE_FUNC_REFUSED 4
| a plugin refused the action
#define | FIND_FUNC_NORMAL 0x0000
| stop processing if undefined byte is encountered
#define | FIND_FUNC_DEFINE 0x0001
| create instruction if undefined byte is encountered
#define | FIND_FUNC_IGNOREFN 0x0002
| ignore existing function boundaries. More...
#define | FIND_FUNC_KEEPBD 0x0004
| do not modify incoming function boundaries, More...
#define | FIND_FUNC_UNDEF 0
| function has instructions that pass execution flow to unexplored bytes. More...
#define | FIND_FUNC_OK 1
| ok, 'nfn' is ready for add_func()
#define | FIND_FUNC_EXIST 2
| function exists already. More...
#define | DECLARE_FUNC_ITERATORS(prefix)
| Declare helper functions for func_item_iterator_t. More...
#define | IDASGN_OK 0
| ok
#define | IDASGN_BADARG 1
| bad number of signature
#define | IDASGN_APPLIED 2
| signature is already applied
#define | IDASGN_CURRENT 3
| signature is currently being applied
#define | IDASGN_PLANNED 4
| signature is planned to be applied
#define | LIBFUNC_FOUND 0
| ok, library function is found
#define | LIBFUNC_NONE 1
| no, this is not a library function
#define | LIBFUNC_DELAY 2
| no decision because of lack of information

## Variables
idaman areacb_t ida_export_data | funcs
| area control block for functions

## Macro Definition Documentation

#define DECLARE_FUNC_ITERATORS | ( |  | prefix | ) |

Value:
prefix bool ida_export func_tail_iterator_set(func_tail_iterator_t *fti, func_t *pfn, ea_t ea);\
prefix bool ida_export func_tail_iterator_set2(func_tail_iterator_t *fti, func_t *pfn, ea_t ea);\
prefix bool ida_export func_tail_iterator_set_ea(func_tail_iterator_t *fti, ea_t ea);\
prefix bool ida_export func_parent_iterator_set(func_parent_iterator_t *fpi, func_t *pfn);\
prefix bool ida_export func_parent_iterator_set2(func_parent_iterator_t *fpi, func_t *pfn);\
prefix bool ida_export func_item_iterator_next(func_item_iterator_t *fii, testf_t *testf, void *ud);\
prefix bool ida_export func_item_iterator_prev(func_item_iterator_t *fii, testf_t *testf, void *ud);\
prefix bool ida_export func_item_iterator_decode_prev_insn(func_item_iterator_t *fii);\
prefix bool ida_export func_item_iterator_decode_preceding_insn(func_item_iterator_t *fii, eavec_t *visited, bool *p_farref);
testf_t
bool idaapi testf_t(flags_t flags, void *ud)
Flag tester - see nextthat(), prevthat()
Definition: bytes.hpp:113
func_item_iterator_t
Class to enumerate all function instructions and data sorted by addresses.
Definition: funcs.hpp:722
ea_t
uint32 ea_t
effective address
Definition: pro.h:403
func_tail_iterator_t
Class to enumerate all function tails sorted by addresses.
Definition: funcs.hpp:650
ida_export
#define ida_export
functions marked with this keyword are available as part of the IDA SDK
Definition: pro.h:257
func_t
A function is a set of continuous ranges of addresses with characteristics.
Definition: funcs.hpp:56
func_parent_iterator_t
Class to enumerate all function parents sorted by addresses.
Definition: funcs.hpp:772
qvector
Reimplementation of vector class from STL.
Definition: pro.h:1610

Declare helper functions for func_item_iterator_t.

## Function Documentation

idaman func_t* ida_export get_func | ( | ea_t | ea | ) |

Get pointer to function structure by address.

Parameters

  ea | any address in a function

Returns
  ptr to a function or NULL. This function returns a function entry chunk.

idaman int ida_export get_func_chunknum | ( | func_t * | pfn,
|  | ea_t | ea
| ) |  |

Get the containing tail chunk of 'ea'.

Return values

  -1 | means 'does not contain ea'
  0 | means the 'pfn' itself contains ea
  >0 | the number of the containing function tail chunk

idaman func_t* ida_export getn_func | ( | size_t | n | ) |

Get pointer to function structure by number.

Parameters

  n | number of function, is in range 0..get_func_qty()-1

Returns
  ptr to a function or NULL. This function returns a function entry chunk.

idaman int ida_export get_func_num | ( | ea_t | ea | ) |

Get ordinal number of a function.

Parameters

  ea | any address in the function

Returns
  number of function (0..get_func_qty()-1). -1 means 'no function at the specified address'.

idaman func_t* ida_export get_prev_func | ( | ea_t | ea | ) |

Get pointer to the previous function.

Parameters

  ea | any address in the program

Returns
  ptr to function or NULL if previous function doesn't exist

idaman func_t* ida_export get_next_func | ( | ea_t | ea | ) |

Get pointer to the next function.

Parameters

  ea | any address in the program

Returns
  ptr to function or NULL if next function doesn't exist

idaman bool ida_export get_func_limits | ( | func_t * | pfn,
|  | area_t * | limits
| ) |  |

Get function limits.

The function limits is the minimal area containing all addresses belonging to the function

Return values

  true | ok
  false | wrong arguments

char* get_func_cmt | ( | func_t * | fn,
|  | bool | repeatable
| ) |  |
| inline

Get function comment.

Parameters

  fn | ptr to function structure
  repeatable | get repeatable comment?

Returns
  comment or NULL. The caller must qfree() the result. In fact this function works with function chunks too.

bool set_func_cmt | ( | func_t * | fn,
|  | const char * | cmt,
|  | bool | repeatable
| ) |  |
| inline

Set function comment.

This function works with function chunks too.

Parameters

  fn | ptr to function structure
  repeatable | set repeatable comment?

void del_func_cmt | ( | func_t * | fn,
|  | bool | repeatable
| ) |  |
| inline

Delete function comment.

This function works with function chunks too.

Parameters

  fn | ptr to function structure
  repeatable | delete repeatable comment?

bool update_func | ( | func_t * | fn | ) |
| inline

Update information about a function in the database (func_t).

You must not change the function start and end addresses using this function. Use ui_func_setstart() and ui_func_setend() for it.

Parameters

  fn | ptr to function structure with updated information

Returns
  success

idaman bool ida_export add_func_ex | ( | func_t * | fn | ) |

Add a new function.

If the fn->endEA is BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(..., FIND_FUNC_DEFINE). If ea1 is in the middle of an existing function, the kernel will try to shrink it to make room for the new function.

Parameters

  fn | ptr to filled function structure

Returns
  success

idaman bool ida_export add_func | ( | ea_t | ea1,
|  | ea_t | ea2
| ) |  |

Add a new function.

If the function end address is BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(..., FIND_FUNC_DEFINE);

If ea1 is in the middle of an existing function, the kernel will try to shrink it to make room for the new function.

Parameters

  ea1 | start address
  ea2 | end address

Returns
  success

idaman bool ida_export del_func | ( | ea_t | ea | ) |

Delete a function.

Parameters

  ea | any address in the function entry chunk

Returns
  success

idaman int ida_export func_setstart | ( | ea_t | ea,
|  | ea_t | newstart
| ) |  |

Move function chunk start address.

Parameters

  ea | any address in the function
  newstart | new end address of the function

Returns
  Function move result codes

idaman bool ida_export func_setend | ( | ea_t | ea,
|  | ea_t | newend
| ) |  |

Move function chunk end address.

Parameters

  ea | any address in the function
  newend | new end address of the function

Returns
  success

idaman void ida_export reanalyze_function | ( | func_t * | pfn,
|  | ea_t | ea1 = `0`,
|  | ea_t | ea2 = `BADADDR`,
|  | bool | analyze_parents = `false`
| ) |  |

Reanalyze a function.

This function analyzes all chunks of the given function. Optional parameters (ea1, ea2) may be used to narrow the analyzed area.

Parameters

  pfn | pointer to a function
  ea1 | start of the area to analyze
  ea2 | end of area to analyze
  analyze_parents | meaningful only if pfn points to a function tail. if true, all tail parents will be reanalyzed. if false, only the given tail will be reanalyzed.

idaman int ida_export find_func_bounds | ( | ea_t | ea,
|  | func_t * | nfn,
|  | int | flags
| ) |  |

Determine the boundaries of a new function.

This function tries to find the start and end addresses of a new function. It calls the module with processor_t::func_bounds in order to fine tune the function boundaries.

Parameters

  ea | starting address of a new function
  nfn | structure to fill with information
  flags | Find function bounds flags

Returns
  Find function bounds result codes

idaman ssize_t ida_export get_func_name2 | ( | qstring * | out,
|  | ea_t | ea
| ) |  |

Get function name.

Parameters

  out | buffer for the answer
  ea | any address in the function

Returns
  length of the function name

idaman int ida_export get_func_bitness | ( | const func_t * | pfn | ) |

Get function bitness (which is equal to the function segment bitness).

pfn==NULL => returns 0

Return values

  0 | 16
  1 | 32
  2 | 64

idaman int ida_export set_func_name_if_jumpfunc | ( | func_t * | fn,
|  | const char * | oldname
| ) |  |

Give a meaningful name to function if it consists of only 'jump' instruction.

Parameters

  fn | pointer to function (may be NULL)
  oldname | old name of function. if old name was in "j_..." form, then we may discard it and set a new name. if oldname is not known, you may pass NULL.

Returns
  success

idaman ea_t ida_export calc_thunk_func_target | ( | func_t * | fn,
|  | ea_t * | fptr
| ) |  |

Calculate target of a thunk function.

Parameters

  fn | pointer to function (may not be NULL)
  fptr | out: will hold address of a function pointer (if indirect jump)

Returns
  the target function or BADADDR

idaman char* ida_export a2funcoff | ( | ea_t | ea,
|  | char * | buf,
|  | size_t | bufsize
| ) |  |

Convert address to "funcname+offset" text form.

Parameters

  ea | linear address
  buf | output buffer
  bufsize | size of the output buffer

Returns
  NULL if no function is found at 'ea'. "funcname+offset" otherwise.

idaman void ida_export std_gen_func_header | ( | func_t * | pfn | ) |

Generate standard function header lines using MakeLine()

Parameters

  pfn | pointer to function structure

idaman bool ida_export func_does_return | ( | ea_t | callee | ) |

Does the function return?.

To calculate the answer, FUNC_NORET flag and is_noret() are consulted The latter is required for imported functions in the .idata section. Since in .idata we have only function pointers but not functions, we have to introduce a special flag for them.

idaman bool ida_export set_noret_insn | ( | ea_t | insn_ea,
|  | bool | noret
| ) |  |

Signal a non-returning instruction.

This function can be used by the processor module to tell the kernel about non-returning instructions (like call exit). The kernel will perform the global function analysis and find out if the function returns at all. This analysis will be done at the first call to func_does_return()

Returns
  true if the instruction 'noret' flag has been changed

func_t* get_fchunk | ( | ea_t | ea | ) |
| inline

Get pointer to function chunk structure by address.

Parameters

  ea | any address in a function chunk

Returns
  ptr to a function chunk or NULL. This function may return a function entry as well as a function tail.

func_t* getn_fchunk | ( | int | n | ) |
| inline

Get pointer to function chunk structure by number.

Parameters

  n | number of function chunk, is in range 0..get_fchunk_qty()-1

Returns
  ptr to a function chunk or NULL. This function may return a function entry as well as a function tail.

int get_fchunk_num | ( | ea_t | ea | ) |
| inline

Get ordinal number of a function chunk in the global list of function chunks.

Parameters

  ea | any address in the function chunk

Returns
  number of function chunk (0..get_fchunk_qty()-1). -1 means 'no function chunk at the specified address'.

func_t* get_prev_fchunk | ( | ea_t | ea | ) |
| inline

Get pointer to the previous function chunk in the global list.

Parameters

  ea | any address in the program

Returns
  ptr to function chunk or NULL if previous function chunk doesn't exist

func_t* get_next_fchunk | ( | ea_t | ea | ) |
| inline

Get pointer to the next function chunk in the global list.

Parameters

  ea | any address in the program

Returns
  ptr to function chunk or NULL if next function chunk doesn't exist

idaman bool ida_export append_func_tail | ( | func_t * | pfn,
|  | ea_t | ea1,
|  | ea_t | ea2
| ) |  |

Append a new tail chunk to the function definition.

If the tail already exists, then it will simply be added to the function tail list Otherwise a new tail will be created and its owner will be set to be our function If a new tail can not be created, then this function will fail.

Parameters

  ea1 | start of the tail. If a tail already exists at the specified address it must start at 'ea1'
  ea2 | end of the tail. If a tail already exists at the specified address it must end at 'ea2'. If specified as BADADDR, IDA will determine the end address itself.

idaman bool ida_export remove_func_tail | ( | func_t * | pfn,
|  | ea_t | tail_ea
| ) |  |

Remove a function tail.

If the tail belongs only to one function, it will be completely removed. Otherwise if the function was the tail owner, the first function using this tail becomes the owner of the tail.

idaman bool ida_export set_tail_owner | ( | func_t * | fnt,
|  | ea_t | func_start
| ) |  |

Set a function as the possessing function of a function tail.

The function should already refer to the tail (after append_func_tail).

idaman void ida_export iterate_func_chunks | ( | func_t * | pfn,
|  | void(idaapi *)(ea_t ea1, ea_t ea2, void *ud) | func,
|  | void * | ud = `NULL`,
|  | bool | include_parents = `false`
| ) |  |

Function to iterate function chunks (all of them including the entry chunk)

Parameters

  pfn | pointer to the function
  func | function to call for each chunk
  ud | user data for 'func'
  include_parents | meaningful only if pfn points to a function tail. if true, all tail parents will be iterated. if false, only the given tail will be iterated.

idaman int ida_export plan_to_apply_idasgn | ( | const char * | fname | ) |

Add a signature file to the list of planned signature files.

Parameters

  fname | file name. should not contain directory part.

Returns
  0 if failed, otherwise number of planned (and applied) signatures

idaman bool ida_export apply_idasgn | ( | int | advance | ) |

Start application of signature file.

Parameters

  advance | switch to current/next library 0: apply the current file from the list of planned signature files 1: apply the next file from the list of planned signature files

Return values

  1 | signature file is successfully loaded
  0 | failure, a warning was displayed

idaman int ida_export apply_idasgn_to | ( | const char * | signame,
|  | ea_t | ea,
|  | bool | is_startup
| ) |  |

Apply a signature file to the specified address.

Parameters

  signame | short name of signature file (the file name without path)
  ea | address to apply the signature
  is_startup | if set, then the signature is treated as a startup one for startup signature ida doesn't rename the first function of the applied module.

Returns
  Library function codes

idaman int ida_export get_idasgn_qty | ( | void |  | ) |

Get number of signatures in the list of planned and applied signatures.

Returns
  0..n

idaman int ida_export get_current_idasgn | ( | void |  | ) |

Get number of the the current signature.

Returns
  0..n-1

idaman int ida_export calc_idasgn_state | ( | int | n | ) |

Get state of a signature in the list of planned signatures.

Parameters

  n | number of signature in the list (0..get_idasgn_qty()-1)

Returns
  state of signature or IDASGN_BADARG

idaman int ida_export del_idasgn | ( | int | n | ) |

Remove signature from the list of planned signatures.

Parameters

  n | number of signature in the list (0..get_idasgn_qty()-1)

Returns
  IDASGN_OK, IDASGN_BADARG, IDASGN_APPLIED

idaman int32 ida_export get_idasgn_desc | ( | int | n,
|  | char * | signame,
|  | size_t | signamesize,
|  | char * | optlibs,
|  | size_t | optlibssize
| ) |  |

Get information about a signature in the list.

Parameters

  n | number of signature in the list (0..get_idasgn_qty()-1)
  signame | buffer for the name of the signature. (short form, only base name without the directory part will be stored). if signame == NULL, then the name won't be returned.
  signamesize | sizeof(signame)
  optlibs | buffer for the names of the optional libraries if optlibs == NULL, then the optional libraries are not returned
  optlibssize | sizeof(optlibs)

Returns
  number of successfully recognized modules using this signature. -1 means the 'n' is a bad argument, i.e. no signature with this number exists..

idaman idasgn_t* ida_export get_idasgn_header_by_short_name | ( | const char * | name | ) |

Get idasgn header by a short signature name.

Parameters

  name | short name of a signature

Returns
  NULL if can't find the signature

idaman char* ida_export get_idasgn_title | ( | const char * | name,
|  | char * | buf,
|  | size_t | bufsize
| ) |  |

Get full description of the signature by its short name.

Parameters

  name | short name of a signature
  buf | the output buffer
  bufsize | sizeof(buf)

Returns
  NULL if can't find the signature, otherwise returns the description of the signature

idaman void ida_export determine_rtl | ( | void |  | ) |

Determine compiler/vendor using the startup signatures.

If determined, then appropriate signature files are included into the list of planned signature files.

idaman bool ida_export apply_startup_sig | ( | ea_t | ea,
|  | const char * | startup
| ) |  |

Apply a startup signature file to the specified address.

Parameters

  ea | address to apply the signature to; usually idainfo::beginEA
  startup | the name of the signature file without path and extension

Returns
  true if successfully applied the signature

idaman int ida_export try_to_add_libfunc | ( | ea_t | ea | ) |

Apply the currently loaded signature file to the specified address.

If a library function is found, then create a function and name it accordingly.

Parameters

  ea | any address in the program

Returns
  Library function codes