IDA SDK

- Main Page
- Header Files
- Classes
- Modules

- File List
- File Members

Classes | Functions | Typedefs | Variables
auto.hpp File Reference

## Detailed Description

Functions that work with the autoanalyzer queue.

The autoanalyzer works when IDA is not busy processing the user keystrokes. It has several queues, each queue having its own priority. The analyzer stops when all queues are empty.

A queue contains addresses or address ranges. The addresses are kept sorted by their values. The analyzer will process all addresses from the first queue, then switch to the second queue and so on. There are no limitations on the size of the queues.

This file also contains functions that deal with the IDA status indicator and the autoanalysis indicator. You may use these functions to change the indicator value.

## Classes
struct | auto_display_t
| See auto_display. More...

## Functions
void | showAuto (ea_t ea, atype_t type=AU_NONE)
| Change autoanalysis indicator value. More...
void | showAddr (ea_t ea)
| Show an address on the autoanalysis indicator. More...
idastate_t | setStat (idastate_t st)
| Change IDA status indicator value. More...
bool | may_create_stkvars (void)
| Is it allowed to create stack variables automatically?. More...
bool | may_trace_sp (void)
| Is it allowed to trace stack pointer automatically?. More...
idaman void ida_export | auto_mark_range (ea_t start, ea_t end, atype_t type)
| Put range of addresses into a queue. More...
void | autoMark (ea_t ea, atype_t type)
| Put single address into a queue. Queues keep addresses sorted.
idaman void ida_export | autoUnmark (ea_t start, ea_t end, atype_t type)
| Remove range of addresses from a queue. More...
void | noUsed (ea_t ea)
| Plan to perform reanalysis.
void | noUsed (ea_t sEA, ea_t eEA)
| Plan to perform reanalysis.
void | auto_make_code (ea_t ea)
| Plan to make code.
void | auto_make_proc (ea_t ea)
| Plan to make code&function.
idaman void ida_export | reanalyze_callers (ea_t ea, bool noret)
| Plan to reanalyze callers of the specified address. More...
idaman void ida_export | revert_ida_decisions (ea_t ea1, ea_t ea2)
| Delete all analysis info that IDA generated for for the given range.
idaman void ida_export | auto_apply_type (ea_t caller, ea_t callee)
| Plan to apply the callee's type to the calling point.
idaman int ida_export | analyze_area (ea_t sEA, ea_t eEA)
| Analyze the specified area. More...
idaman bool ida_export | autoWait (void)
| Process everything in the queues and return true. More...
idaman void ida_export | autoCancel (ea_t ea1, ea_t ea2)
| Remove an address range (ea1..ea2) from queues AU_CODE, AU_PROC, AU_USED. More...
idaman bool ida_export | autoIsOk (void)
| Are all queues empty? (i.e. More...
idaman bool ida_export | autoStep (void)
| One step of autoanalyzer if 'autoEnabled' != 0. More...
idaman ea_t ida_export | peek_auto_queue (ea_t low_ea, atype_t type)
| Peek into a queue 'type' for an address not lower than 'low_ea'. More...
idaman ea_t ida_export | auto_get (ea_t lowEA, ea_t highEA, atype_t *type)
| Retrieve an address from queues regarding their priority. More...
idaman const char *ida_export | autoGetName (atype_t type)
| Get two-character queue name to display on the indicator.

## Typedefs
typedef int | atype_t
| identifies an autoanalysis queue - see Autoanalysis queues
typedef int | idastate_t
| IDA status indicator - see Status indicator states.

## Variables
const atype_t | AU_NONE = 00
| placeholder, not used
const atype_t | AU_UNK = 10
| 0: convert to unexplored
const atype_t | AU_CODE = 20
| 1: convert to instruction
const atype_t | AU_WEAK = 25
| 2: convert to instruction (ida decision)
const atype_t | AU_PROC = 30
| 3: convert to procedure start
const atype_t | AU_TAIL = 35
| 4: add a procedure tail
const atype_t | AU_TRSP = 38
| 5: trace stack pointer (not used yet)
const atype_t | AU_USED = 40
| 6: reanalyze
const atype_t | AU_TYPE = 50
| 7: apply type information
const atype_t | AU_LIBF = 60
| 8: apply signature to address
const atype_t | AU_LBF2 = 70
| 9: the same, second pass
const atype_t | AU_LBF3 = 80
| 10: the same, third pass
const atype_t | AU_CHLB = 90
| 11: load signature file (file name is kept separately)
const atype_t | AU_FINAL =200
| 12: final pass
const idastate_t | st_Ready = 0
| READY: IDA is doing nothing.
const idastate_t | st_Think = 1
| THINKING: Autoanalysis on, the user may press keys.
const idastate_t | st_Waiting = 2
| WAITING: Waiting for the user input.
const idastate_t | st_Work = 3
| BUSY: IDA is busy.
idaman atype_t ida_export_data | auto_state
| Current state of autoanalyzer. More...
idaman auto_display_t ida_export_data | auto_display
| Structure to hold the autoanalysis indicator contents.

## Function Documentation

void showAuto | ( | ea_t | ea,
|  | atype_t | type = `AU_NONE`
| ) |  |
| inline

Change autoanalysis indicator value.

Parameters

  ea | linear address being analyzed
  type | autoanalysis type (see Autoanalysis queues)

void showAddr | ( | ea_t | ea | ) |
| inline

Show an address on the autoanalysis indicator.

The address is displayed in the form " @:12345678".

Parameters

  ea | - linear address to display

idastate_t setStat | ( | idastate_t | st | ) |
| inline

Change IDA status indicator value.

Parameters

  st | - new indicator status

Returns
  old indicator status

bool may_create_stkvars | ( | void |  | ) |
| inline

Is it allowed to create stack variables automatically?.

This function should be used by IDP modules before creating stack vars.

bool may_trace_sp | ( | void |  | ) |
| inline

Is it allowed to trace stack pointer automatically?.

This function should be used by IDP modules before tracing sp.

idaman void ida_export auto_mark_range | ( | ea_t | start,
|  | ea_t | end,
|  | atype_t | type
| ) |  |

Put range of addresses into a queue.

'start' may be higher than 'end', the kernel will swap them in this case. 'end' doesn't belong to the range.

idaman void ida_export autoUnmark | ( | ea_t | start,
|  | ea_t | end,
|  | atype_t | type
| ) |  |

Remove range of addresses from a queue.

'start' may be higher than 'end', the kernel will swap them in this case. 'end' doesn't belong to the range.

idaman void ida_export reanalyze_callers | ( | ea_t | ea,
|  | bool | noret
| ) |  |

Plan to reanalyze callers of the specified address.

This function will add to AU_USED queue all instructions that call (not jump to) the specified address.

Parameters

  ea | linear address of callee
  noret | !=0: the callee doesn't return, mark to undefine subsequent instructions in the caller. 0: do nothing.

idaman int ida_export analyze_area | ( | ea_t | sEA,
|  | ea_t | eEA
| ) |  |

Analyze the specified area.

Try to create instructions where possible. Make the final pass over the specified area. This function doesn't return until the area is analyzed.

Return values

  1 | ok
  0 | Ctrl-Break was pressed

idaman bool ida_export autoWait | ( | void |  | ) |

Process everything in the queues and return true.

Return false if Ctrl-Break was pressed.

idaman void ida_export autoCancel | ( | ea_t | ea1,
|  | ea_t | ea2
| ) |  |

Remove an address range (ea1..ea2) from queues AU_CODE, AU_PROC, AU_USED.

To remove an address range from other queues use autoUnmark() function. 'ea1' may be higher than 'ea2', the kernel will swap them in this case. 'ea2' doesn't belong to the range.

idaman bool ida_export autoIsOk | ( | void |  | ) |

Are all queues empty? (i.e.

has autoanalysis finished?).

idaman bool ida_export autoStep | ( | void |  | ) |

One step of autoanalyzer if 'autoEnabled' != 0.

Returns
  true if some address was removed from queues and was processed.

idaman ea_t ida_export peek_auto_queue | ( | ea_t | low_ea,
|  | atype_t | type
| ) |  |

Peek into a queue 'type' for an address not lower than 'low_ea'.

Do not remove address from the queue.

Returns
  the address or BADADDR

idaman ea_t ida_export auto_get | ( | ea_t | lowEA,
|  | ea_t | highEA,
|  | atype_t * | type
| ) |  |

Retrieve an address from queues regarding their priority.

Returns BADADDR if no addresses not lower than 'lowEA' and less than 'highEA' are found in the queues. Otherwise *type will have queue type.

## Variable Documentation

idaman atype_t ida_export_data auto_state

Current state of autoanalyzer.

If auto_state == AU_NONE, IDA is currently not running the analysis (it could be temporarily interrupted to perform the user's requests, for example).