Routines for working with functions within the disassembled program. More...

Classes
class	func_t
	A function is a set of continuous ranges of addresses with characteristics. More...
class	lock_func_ea
	RAII helper to lock a function by address. More...
class	lock_func
	Helper class to lock a function pointer so it stays valid. More...
class	lock_func_with_tails_t
class	func_tail_iterator_t
	Class to enumerate all function tails sorted by addresses. More...
class	func_item_iterator_t
	Class to enumerate all function instructions and data sorted by addresses. More...
class	func_parent_iterator_t
	Class to enumerate all function parents sorted by addresses. More...
class	fchunk_info_t
	Describes a function chunk (entry or tail). More...
class	func_entry_info_t
	Describes a function entry chunk. More...
class	func_tail_info_t
	Describes a function tail chunk. More...
class	function_tail_iterator_t
	Class to enumerate all function tails sorted by addresses. More...
class	function_parent_iterator_t
	Class to enumerate all function parents sorted by addresses. More...
class	function_item_iterator_t
	Class to enumerate all function instructions and data sorted by addresses. More...

Typedefs
typedef qvector< regarg_t >	regargs_t

Functions
idaman void ida_export	free_regarg (struct regarg_t *v)
	DECLARE_REGARG_T_HELPERS (idaman) struct regarg_t
	Register argument description.
	DECLARE_TYPE_AS_MOVABLE (regarg_t)
	DECLARE_TYPE_AS_MOVABLE (func_t)
DEPRECATED bool	is_func_entry (const func_t *pfn)
	Does function describe a function entry chunk?
DEPRECATED bool	is_func_tail (const func_t *pfn)
	Does function describe a function tail chunk?
idaman DEPRECATED void ida_export	lock_func_range (const func_t *pfn, bool lock)
	Lock function pointer Locked pointers are guaranteed to remain valid until they are unlocked.
idaman DEPRECATED bool ida_export	is_func_locked (const func_t *pfn)
	Is the function pointer locked?
idaman DEPRECATED func_t *ida_export	get_func (ea_t ea)
	Get pointer to function structure by address.
idaman DEPRECATED int ida_export	get_func_chunknum (func_t *pfn, ea_t ea)
	Get the containing tail chunk of 'ea'.
idaman DEPRECATED func_t *ida_export	getn_func (size_t n)
	Get pointer to function structure by number.
idaman size_t ida_export	get_func_qty (void)
	Get total number of functions in the program.
idaman int ida_export	get_func_num (ea_t ea)
	Get ordinal number of a function.
idaman DEPRECATED func_t *ida_export	get_prev_func (ea_t ea)
	Get pointer to the previous function.
idaman DEPRECATED func_t *ida_export	get_next_func (ea_t ea)
	Get pointer to the next function.
idaman DEPRECATED ea_t ida_export	get_func_ranges (rangeset_t ranges, func_t pfn)
	Get function ranges.
idaman DEPRECATED ssize_t ida_export	get_func_cmt (qstring buf, const func_t pfn, bool repeatable)
	Get function comment.
idaman DEPRECATED bool ida_export	set_func_cmt (const func_t pfn, const char cmt, bool repeatable)
	Set function comment.
idaman DEPRECATED bool ida_export	update_func (func_t *pfn)
	Update information about a function in the database (func_t).
idaman DEPRECATED bool ida_export	add_func_ex (func_t *pfn)
	Add a new function.
idaman bool ida_export	del_func (ea_t ea)
	Delete a function.
idaman int ida_export	set_func_start (ea_t ea, ea_t newstart)
	Move function chunk start address.
idaman bool ida_export	set_func_end (ea_t ea, ea_t newend)
	Move function chunk end address.
idaman DEPRECATED void ida_export	reanalyze_function (func_t *pfn, ea_t ea1=0, ea_t ea2=BADADDR, bool analyze_parents=false)
	Reanalyze a function.
idaman DEPRECATED int ida_export	find_func_bounds (func_t *nfn, int flags)
	Determine the boundaries of a new function.
idaman ssize_t ida_export	get_func_name (qstring *out, ea_t ea)
	Get function name.
idaman DEPRECATED asize_t ida_export	calc_func_size (func_t *pfn)
	Calculate function size.
idaman DEPRECATED int ida_export	get_func_bitness (const func_t *pfn)
	Get function bitness (which is equal to the function segment bitness).
idaman DEPRECATED void ida_export	set_visible_func (func_t *pfn, bool visible)
	Set visibility of function.
idaman DEPRECATED int ida_export	set_func_name_if_jumpfunc (func_t pfn, const char oldname)
	Give a meaningful name to function if it consists of only 'jump' instruction.
idaman DEPRECATED ea_t ida_export	calc_thunk_func_target (func_t pfn, ea_t fptr)
	Calculate target of a thunk function.
idaman bool ida_export	func_does_return (ea_t callee)
	Does the function return?
idaman bool ida_export	reanalyze_noret_flag (ea_t ea)
	Plan to reanalyze noret flag.
idaman bool ida_export	set_noret_insn (ea_t insn_ea, bool noret)
	Signal a non-returning instruction.
idaman DEPRECATED func_t *ida_export	get_fchunk (ea_t ea)
	Get pointer to function chunk structure by address.
idaman DEPRECATED func_t *ida_export	getn_fchunk (int n)
	Get pointer to function chunk structure by number.
idaman size_t ida_export	get_fchunk_qty (void)
	Get total number of function chunks in the program.
idaman int ida_export	get_fchunk_num (ea_t ea)
	Get ordinal number of a function chunk in the global list of function chunks.
idaman DEPRECATED func_t *ida_export	get_prev_fchunk (ea_t ea)
	Get pointer to the previous function chunk in the global list.
idaman DEPRECATED func_t *ida_export	get_next_fchunk (ea_t ea)
	Get pointer to the next function chunk in the global list.
idaman DEPRECATED bool ida_export	append_func_tail (func_t *pfn, ea_t ea1, ea_t ea2)
	Append a new tail chunk to the function definition.
idaman DEPRECATED bool ida_export	remove_func_tail (func_t *pfn, ea_t tail_ea)
	Remove a function tail.
idaman DEPRECATED bool ida_export	set_tail_owner (func_t *fnt, ea_t new_owner)
	Set a new owner of a function tail.
idaman int ida_export	plan_to_apply_idasgn (const char *fname)
	Add a signature file to the list of planned signature files.
idaman int ida_export	apply_idasgn_to (const char *signame, ea_t ea, bool is_startup)
	Apply a signature file to the specified address.
idaman int ida_export	get_idasgn_qty (void)
	Get number of signatures in the list of planned and applied signatures.
idaman int ida_export	get_current_idasgn (void)
	Get number of the current signature.
idaman int ida_export	calc_idasgn_state (int n)
	Get state of a signature in the list of planned signatures.
idaman int ida_export	del_idasgn (int n)
	Remove signature from the list of planned signatures.
idaman int32 ida_export	get_idasgn_desc (qstring signame, qstring optlibs, int n)
	Get information about a signature in the list.
idaman ssize_t ida_export	get_idasgn_title (qstring buf, const char name)
	Get full description of the signature by its short name.
idaman void ida_export	determine_rtl (void)
	Determine compiler/vendor using the startup signatures.
idaman bool ida_export	apply_startup_sig (ea_t ea, const char *startup)
	Apply a startup signature file to the specified address.
idaman int ida_export	try_to_add_libfunc (ea_t ea)
	Apply the currently loaded signature file to the specified address.
	DECLARE_FUNC_ITERATORS (idaman) inline THREAD_SAFE bool idaapi f_any(flags64_t
	Helper function to accept any address.
idaman DEPRECATED void ida_export	iterate_func_chunks (func_t pfn, void(idaapi func)(ea_t ea1, ea_t ea2, void ud), void ud=nullptr, bool include_parents=false)
	Function to iterate function chunks (all of them including the entry chunk)
idaman bool ida_export	get_fchunk_info (fchunk_info_t *out, ea_t ea)
	Get the range of the function chunk (entry or tail) containing 'ea'.
idaman bool ida_export	get_prev_fchunk_info (fchunk_info_t *out, ea_t ea)
	Get the previous function chunk before the one containing 'ea'.
idaman bool ida_export	get_next_fchunk_info (fchunk_info_t *out, ea_t ea)
	Get the next function chunk after the one containing 'ea'.
idaman bool ida_export	get_func_entry_info (func_entry_info_t *out, ea_t ea, int flags=0)
	Get function entry info by address.
idaman bool ida_export	get_func_entry_info_by_num (func_entry_info_t *out, size_t n, int flags=0)
	Get function entry info by ordinal number.
idaman bool ida_export	set_func_entry_info (const func_entry_info_t *fi)
	Update function entry info in the database.
idaman bool ida_export	add_function_ex (func_entry_info_t *fi)
	Add a new function using func_entry_info_t.
bool	add_func (ea_t ea1, ea_t ea2=BADADDR)
	Add a new function.
idaman int ida_export	find_function_bounds (func_entry_info_t *fi, int flags)
	Determine the boundaries of a new function.
idaman ea_t ida_export	calc_thunk_function_target (func_entry_info_t fi, ea_t fptr)
	Calculate thunk function target.
idaman bool ida_export	get_func_tail_info (func_tail_info_t *out, ea_t ea)
	Get function tail info by address.
idaman size_t ida_export	get_tail_referer_qty (ea_t tail_ea)
	Get the number of referers (parent functions) for a tail chunk.
idaman ea_t ida_export	get_tail_referer (ea_t tail_ea, size_t n)
	Get a tail chunk referer by index.
idaman bool ida_export	get_tail_referers (eavec_t *out, ea_t tail_ea)
	Get all referers (parent functions) for a tail chunk.

Functions to work with temporary register argument definitions
idaman void ida_export	read_regargs (func_t *pfn)
idaman DEPRECATED void ida_export	add_regarg (func_t pfn, int reg, const tinfo_t &tif, const char name)
ea-based navigation
Get function/chunk addresses without using pointers.
idaman ea_t ida_export	get_func_start (ea_t ea)
	Get start address of the function containing 'ea'.
idaman ea_t ida_export	get_prev_func_ea (ea_t ea)
	Get start address of the previous function.
idaman ea_t ida_export	get_next_func_ea (ea_t ea)
	Get start address of the next function.
idaman ea_t ida_export	get_fchunk_start (ea_t ea)
	Get start address of the function chunk containing 'ea'.
idaman ea_t ida_export	get_prev_fchunk_ea (ea_t ea)
	Get start address of the previous function chunk.
idaman ea_t ida_export	get_next_fchunk_ea (ea_t ea)
	Get start address of the next function chunk.
idaman ea_t ida_export	get_func_ea_by_num (size_t n)
	Get function start address by ordinal number.
idaman ea_t ida_export	get_fchunk_ea_by_num (int n)
	Get function chunk start address by ordinal number.
ea-based property accessors
Read/write function properties by address.
idaman uint64 ida_export	get_func_flags (ea_t ea)
	Get function chunk flags.
bool	is_visible_func (ea_t ea)
	Is the function visible (not hidden)?
bool	is_finally_visible_func (ea_t ea)
	Is the function visible (event after considering #SCF_SHHID_FUNC)?
DEPRECATED bool	is_visible_func (func_t *pfn)
	Is the function visible (not hidden)?
DEPRECATED bool	is_finally_visible_func (func_t *pfn)
	Is the function visible (event after considering #SCF_SHHID_FUNC)?
idaman bool ida_export	set_func_flags (ea_t ea, uint64 flags)
	Set function chunk flags.
idaman bool ida_export	set_func_flag (ea_t ea, uint64 flag, bool on_off=true)
	Set or clear a single function chunk flag.
idaman bool ida_export	is_function_entry (ea_t ea)
	Is there a function entry chunk at 'ea'?
idaman bool ida_export	is_function_tail (ea_t ea)
	Is there a function tail chunk at 'ea'?
idaman ea_t ida_export	get_tail_owner (ea_t tail_ea)
	Get the owner function of a tail chunk.
ea-based wrappers
ea_t versions of functions that previously required func_t pointers.
idaman ssize_t ida_export	get_func_cmt_ea (qstring *buf, ea_t ea, bool repeatable)
	Get function comment by address.
idaman bool ida_export	set_func_cmt_ea (ea_t ea, const char *cmt, bool repeatable)
	Set function comment by address.
idaman int ida_export	get_func_bitness_ea (ea_t ea)
	Get function bitness by address.
int idaapi	get_func_bits_ea (ea_t ea)
	Get number of bits in the function addressing.
int idaapi	get_func_bytes_ea (ea_t ea)
	Get number of bytes in the function addressing.
DEPRECATED int idaapi	get_func_bits (const func_t *pfn)
	Get number of bits in the function addressing.
DEPRECATED int idaapi	get_func_bytes (const func_t *pfn)
	Get number of bytes in the function addressing.
idaman asize_t ida_export	calc_func_size_ea (ea_t ea)
	Calculate function size by address.
idaman ea_t ida_export	get_func_ranges_ea (rangeset_t *ranges, ea_t ea)
	Get function ranges by address.
idaman void ida_export	set_visible_func_ea (ea_t ea, bool visible)
	Set function visibility by address.
idaman bool ida_export	set_function_name_if_jumpfunc (ea_t func_ea, const char *oldname)
	Give a meaningful name to function if it consists of only 'jump' instruction.
idaman void ida_export	reanalyze_function_ea (ea_t func_ea, ea_t ea1=0, ea_t ea2=BADADDR, bool analyze_parents=false)
	Reanalyze function by address.
idaman void ida_export	add_func_regarg (ea_t func_ea, int reg, const tinfo_t &tif, const char *name)
	Add a temporary register argument definition.
idaman size_t ida_export	get_func_regarg_qty (ea_t func_ea)
	Get the number of register arguments for a function.
idaman bool ida_export	get_func_regarg (regarg_t *out, ea_t func_ea, size_t n)
	Get a register argument by index.
idaman bool ida_export	get_func_regargs (regargs_t *out, ea_t func_ea)
	Get all register arguments for a function.
ea-based locking
Lock function ranges by address to prevent invalidation.
idaman void ida_export	lock_func_range_ea (ea_t ea, bool lock)
	Lock function range by address.
idaman bool ida_export	is_func_locked_ea (ea_t ea)
	Is the function at ea locked?
Get prev/next address in function
Unlike func_item_iterator_t which always enumerates the main function chunk first, these functions respect linear address ordering.
idaman DEPRECATED ea_t ida_export	get_prev_func_addr (func_t *pfn, ea_t ea)
idaman DEPRECATED ea_t ida_export	get_next_func_addr (func_t *pfn, ea_t ea)

ea-based chunk manipulation
Manipulate function tail chunks using addresses instead of pointers.
typedef std::function< void(ea_t chunk_start, ea_t chunk_end)>	func_chunk_visitor_t
	Callback type for iterate_func_chunks_ea().
idaman bool ida_export	append_func_tail_ea (ea_t func_ea, ea_t ea1, ea_t ea2)
	Append a new tail chunk to the function at func_ea.
idaman bool ida_export	remove_func_tail_ea (ea_t func_ea, ea_t tail_ea)
	Remove a function tail.
idaman bool ida_export	set_tail_owner_ea (ea_t tail_ea, ea_t new_owner)
	Set a new owner of a function tail.
idaman int ida_export	get_func_chunknum_ea (ea_t func_ea, ea_t ea)
	Get the containing chunk number.
idaman size_t ida_export	get_func_tail_qty (ea_t func_ea)
	Get the number of function tail chunks.
idaman bool ida_export	get_func_tails (rangevec_t *out, ea_t func_ea)
	Get all function tail ranges.
bool	function_contains (ea_t func_ea, ea_t ea)
	Does the function at func_ea contain ea?
bool	is_same_func (ea_t ea1, ea_t ea2)
	Do two addresses belong to the same function?
idaman bool ida_export	is_same_fchunk (ea_t ea1, ea_t ea2)
	Do two addresses belong to the same function chunk?
DEPRECATED bool	func_contains (func_t *pfn, ea_t ea)
	Does the given function contain the given address?
idaman void ida_export	iterate_func_chunks_ea (ea_t fchunk_ea, const func_chunk_visitor_t &visitor, bool include_parents=false)
	Function to iterate function chunks (all of them including the entry chunk)
idaman ea_t ida_export	get_prev_function_addr (ea_t func_ea, ea_t ea)
	Get previous address belonging to the function, respecting linear ordering.
idaman ea_t ida_export	get_next_function_addr (ea_t func_ea, ea_t ea)
	Get next address belonging to the function, respecting linear ordering.

Detailed Description

Routines for working with functions within the disassembled program.

This file also contains routines for working with library signatures (e.g. FLIRT).

Each function consists of function chunks. At least one function chunk must be present in the function definition - the function entry chunk. Other chunks are called function tails. There may be several of them for a function.

A function tail is a continuous range of addresses. It can be used in the definition of one or more functions. One function using the tail is singled out and called the tail owner. This function is considered as 'possessing' the tail. get_func() on a tail address will return the function possessing the tail. You can enumerate the functions using the tail by using func_parent_iterator_t.

Each function chunk in the disassembly is represented as an "range" (a range of addresses, see range.hpp for details) with characteristics.

A function entry must start with an instruction (code) byte.

Typedef Documentation

◆ regargs_t

typedef qvector<regarg_t> regargs_t

Function Documentation

◆ free_regarg()

idaman void ida_export free_regarg ( struct regarg_t * v )

◆ DECLARE_REGARG_T_HELPERS()

DECLARE_REGARG_T_HELPERS ( idaman )

Register argument description.

regargs are destroyed when the full function type is determined.

◆ DECLARE_TYPE_AS_MOVABLE() [1/2]

DECLARE_TYPE_AS_MOVABLE ( regarg_t )

◆ DECLARE_TYPE_AS_MOVABLE() [2/2]

DECLARE_TYPE_AS_MOVABLE ( func_t )

◆ is_func_entry()

DEPRECATED bool is_func_entry ( const func_t * pfn )

inline

Does function describe a function entry chunk?

Deprecated: Use is_function_entry() for safer access.

◆ is_func_tail()

DEPRECATED bool is_func_tail ( const func_t * pfn )

inline

Does function describe a function tail chunk?

Deprecated: Use is_function_tail() for safer access.

◆ lock_func_range()

idaman DEPRECATED void ida_export lock_func_range	(	const func_t *	pfn,
		bool	lock )

Lock function pointer Locked pointers are guaranteed to remain valid until they are unlocked.

Ranges with locked pointers cannot be deleted or moved.

Deprecated: Use lock_func_range_ea() for safer access.

◆ is_func_locked()

idaman DEPRECATED bool ida_export is_func_locked ( const func_t * pfn )

Is the function pointer locked?

Deprecated: Use is_func_locked_ea() for safer access.

◆ get_func()

idaman DEPRECATED func_t *ida_export get_func ( ea_t ea )

Get pointer to function structure by address.

Parameters

ea	any address in a function

Returns: ptr to a function or nullptr. This function returns a function entry chunk.

Deprecated: Use get_func_start() or get_func_entry_info() for safer access.

◆ get_func_chunknum()

idaman DEPRECATED int ida_export get_func_chunknum	(	func_t *	pfn,
		ea_t	ea )

Get the containing tail chunk of 'ea'.

Return values

-1	means 'does not contain ea'
0	means the 'pfn' itself contains ea
>0	the number of the containing function tail chunk

Deprecated: Use get_func_chunknum_ea() for safer access.

◆ getn_func()

idaman DEPRECATED func_t *ida_export getn_func ( size_t n )

Get pointer to function structure by number.

Parameters

n	number of function, is in range 0..get_func_qty()-1

Returns: ptr to a function or nullptr. This function returns a function entry chunk.

Deprecated: Use get_func_ea_by_num() or get_func_entry_info_by_num() for safer access.

◆ get_func_qty()

idaman size_t ida_export get_func_qty ( void )

Get total number of functions in the program.

◆ get_func_num()

idaman int ida_export get_func_num ( ea_t ea )

Get ordinal number of a function.

Parameters

ea	any address in the function

Returns: number of function (0..get_func_qty()-1). -1 means 'no function at the specified address'.

◆ get_prev_func()

idaman DEPRECATED func_t *ida_export get_prev_func ( ea_t ea )

Get pointer to the previous function.

Parameters

ea	any address in the program

Returns: ptr to function or nullptr if previous function doesn't exist

Deprecated: Use get_prev_func_ea() for safer access.

◆ get_next_func()

idaman DEPRECATED func_t *ida_export get_next_func ( ea_t ea )

Get pointer to the next function.

Parameters

ea	any address in the program

Returns: ptr to function or nullptr if next function doesn't exist

Deprecated: Use get_next_func_ea() for safer access.

◆ get_func_ranges()

idaman DEPRECATED ea_t ida_export get_func_ranges	(	rangeset_t *	ranges,
		func_t *	pfn )

Get function ranges.

Parameters

ranges	buffer to receive the range info
pfn	ptr to function structure

Returns: end address of the last function range (BADADDR-error)

Deprecated: Use get_func_ranges_ea() for safer access.

◆ get_func_cmt()

idaman DEPRECATED ssize_t ida_export get_func_cmt	(	qstring *	buf,
		const func_t *	pfn,
		bool	repeatable )

Get function comment.

Parameters

buf	buffer for the comment
pfn	ptr to function structure
repeatable	get repeatable comment?

Returns: size of comment or -1 In fact this function works with function chunks too.

Deprecated: Use get_func_cmt_ea() for safer access.

◆ set_func_cmt()

idaman DEPRECATED bool ida_export set_func_cmt	(	const func_t *	pfn,
		const char *	cmt,
		bool	repeatable )

Set function comment.

This function works with function chunks too.

Parameters

pfn	ptr to function structure
cmt	comment string, may be multiline (with ' '). Use empty str ("") to delete comment
repeatable	set repeatable comment?

Deprecated: Use set_func_cmt_ea() for safer access.

◆ update_func()

idaman DEPRECATED bool ida_export update_func ( func_t * pfn )

Update information about a function in the database (func_t).

You must not change the function start and end addresses using this function. Use set_func_start() and set_func_end() for it.

Parameters

pfn	ptr to function structure

Returns: success

Deprecated: Use set_func_entry_info() for safer access.

◆ add_func_ex()

idaman DEPRECATED bool ida_export add_func_ex ( func_t * pfn )

Add a new function.

Deprecated: Use add_function_ex() for safer access. If the fn->end_ea is #BADADDR, then IDA will try to determine the function bounds by calling find_func_bounds(..., #FIND_FUNC_DEFINE).

Parameters

pfn	ptr to filled function structure

Returns: success

◆ del_func()

idaman bool ida_export del_func ( ea_t ea )

Delete a function.

Parameters

ea	any address in the function entry chunk

Returns: success

◆ set_func_start()

idaman int ida_export set_func_start	(	ea_t	ea,
		ea_t	newstart )

Move function chunk start address.

Parameters

ea	any address in the function
newstart	new end address of the function

Returns: Function move result codes

◆ set_func_end()

idaman bool ida_export set_func_end	(	ea_t	ea,
		ea_t	newend )

Move function chunk end address.

Parameters

ea	any address in the function
newend	new end address of the function

Returns: success

◆ reanalyze_function()

idaman DEPRECATED void ida_export reanalyze_function	(	func_t *	pfn,
		ea_t	ea1 = 0,
		ea_t	ea2 = BADADDR,
		bool	analyze_parents = false )

Reanalyze a function.

This function plans to analyzes all chunks of the given function. Optional parameters (ea1, ea2) may be used to narrow the analyzed range.

Parameters

pfn	pointer to a function
ea1	start of the range to analyze
ea2	end of range to analyze
analyze_parents	meaningful only if pfn points to a function tail. if true, all tail parents will be reanalyzed. if false, only the given tail will be reanalyzed.

Deprecated: Use reanalyze_function_ea() for safer access.

◆ find_func_bounds()

idaman DEPRECATED int ida_export find_func_bounds	(	func_t *	nfn,
		int	flags )

Determine the boundaries of a new function.

Deprecated: Use find_function_bounds() for safer access. This function tries to find the start and end addresses of a new function. It calls the module with processor_t::func_bounds in order to fine tune the function boundaries.

Parameters

nfn	structure to fill with information \ nfn->start_ea points to the start address of the new function.
flags	Find function bounds flags

Returns: Find function bounds result codes

◆ get_func_name()

idaman ssize_t ida_export get_func_name	(	qstring *	out,
		ea_t	ea )

Get function name.

Parameters

out	buffer for the answer
ea	any address in the function

Returns: length of the function name

◆ calc_func_size()

idaman DEPRECATED asize_t ida_export calc_func_size ( func_t * pfn )

Calculate function size.

This function takes into account all fragments of the function.

Parameters

pfn	ptr to function structure

Deprecated: Use calc_func_size_ea() for safer access.

◆ get_func_bitness()

idaman DEPRECATED int ida_export get_func_bitness ( const func_t * pfn )

Get function bitness (which is equal to the function segment bitness).

pfn==nullptr => returns 0

Return values

0	16
1	32
2	64

Deprecated: Use get_func_bitness_ea() for safer access.

◆ set_visible_func()

idaman DEPRECATED void ida_export set_visible_func	(	func_t *	pfn,
		bool	visible )

Set visibility of function.

Deprecated: Use set_visible_func_ea() for safer access.

◆ set_func_name_if_jumpfunc()

idaman DEPRECATED int ida_export set_func_name_if_jumpfunc	(	func_t *	pfn,
		const char *	oldname )

Give a meaningful name to function if it consists of only 'jump' instruction.

Parameters

pfn	pointer to function (may be nullptr)
oldname	old name of function. if old name was in "j_..." form, then we may discard it and set a new name. if oldname is not known, you may pass nullptr.

Returns: success

Deprecated: Use set_function_name_if_jumpfunc() for safer access.

◆ calc_thunk_func_target()

idaman DEPRECATED ea_t ida_export calc_thunk_func_target	(	func_t *	pfn,
		ea_t *	fptr )

Calculate target of a thunk function.

Parameters

pfn	pointer to function (may not be nullptr)
fptr	out: will hold address of a function pointer (if indirect jump)

Returns: the target function or #BADADDR

Deprecated: Use calc_thunk_function_target() for safer access.

◆ func_does_return()

idaman bool ida_export func_does_return ( ea_t callee )

Does the function return?

To calculate the answer, #FUNC_NORET flag and is_noret() are consulted The latter is required for imported functions in the .idata section. Since in .idata we have only function pointers but not functions, we have to introduce a special flag for them.

◆ reanalyze_noret_flag()

idaman bool ida_export reanalyze_noret_flag ( ea_t ea )

Plan to reanalyze noret flag.

This function does not remove FUNC_NORET if it is already present. It just plans to reanalysis.

◆ set_noret_insn()

idaman bool ida_export set_noret_insn	(	ea_t	insn_ea,
		bool	noret )

Signal a non-returning instruction.

This function can be used by the processor module to tell the kernel about non-returning instructions (like call exit). The kernel will perform the global function analysis and find out if the function returns at all. This analysis will be done at the first call to func_does_return()

Returns: true if the instruction 'noret' flag has been changed

◆ get_fchunk()

idaman DEPRECATED func_t *ida_export get_fchunk ( ea_t ea )

Get pointer to function chunk structure by address.

Parameters

ea	any address in a function chunk

Returns: ptr to a function chunk or nullptr. This function may return a function entry as well as a function tail.

Deprecated: Use get_fchunk_start() or get_fchunk_info() for safer access.

◆ getn_fchunk()

idaman DEPRECATED func_t *ida_export getn_fchunk ( int n )

Get pointer to function chunk structure by number.

Parameters

n	number of function chunk, is in range 0..get_fchunk_qty()-1

Returns: ptr to a function chunk or nullptr. This function may return a function entry as well as a function tail.

Deprecated: Use get_fchunk_ea_by_num() for safer access.

◆ get_fchunk_qty()

idaman size_t ida_export get_fchunk_qty ( void )

Get total number of function chunks in the program.

◆ get_fchunk_num()

idaman int ida_export get_fchunk_num ( ea_t ea )

Get ordinal number of a function chunk in the global list of function chunks.

Parameters

ea	any address in the function chunk

Returns: number of function chunk (0..get_fchunk_qty()-1). -1 means 'no function chunk at the specified address'.

◆ get_prev_fchunk()

idaman DEPRECATED func_t *ida_export get_prev_fchunk ( ea_t ea )

Get pointer to the previous function chunk in the global list.

Parameters

ea	any address in the program

Returns: ptr to function chunk or nullptr if previous function chunk doesn't exist

Deprecated: Use get_prev_fchunk_ea() for safer access.

◆ get_next_fchunk()

idaman DEPRECATED func_t *ida_export get_next_fchunk ( ea_t ea )

Get pointer to the next function chunk in the global list.

Parameters

ea	any address in the program

Returns: ptr to function chunk or nullptr if next function chunk doesn't exist

Deprecated: Use get_next_fchunk_ea() for safer access.

◆ append_func_tail()

idaman DEPRECATED bool ida_export append_func_tail	(	func_t *	pfn,
		ea_t	ea1,
		ea_t	ea2 )

Append a new tail chunk to the function definition.

If the tail already exists, then it will simply be added to the function tail list Otherwise a new tail will be created and its owner will be set to be our function If a new tail cannot be created, then this function will fail.

Parameters

pfn	pointer to the function
ea1	start of the tail. If a tail already exists at the specified address it must start at 'ea1'
ea2	end of the tail. If a tail already exists at the specified address it must end at 'ea2'. If specified as BADADDR, IDA will determine the end address itself.

Deprecated: Use append_func_tail_ea() for safer access.

◆ remove_func_tail()

idaman DEPRECATED bool ida_export remove_func_tail	(	func_t *	pfn,
		ea_t	tail_ea )

Remove a function tail.

If the tail belongs only to one function, it will be completely removed. Otherwise if the function was the tail owner, the first function using this tail becomes the owner of the tail.

Parameters

pfn	pointer to the function
tail_ea	any address inside the tail to remove

Deprecated: Use remove_func_tail_ea() for safer access.

◆ set_tail_owner()

idaman DEPRECATED bool ida_export set_tail_owner	(	func_t *	fnt,
		ea_t	new_owner )

Set a new owner of a function tail.

The new owner function must be already referring to the tail (after append_func_tail).

Parameters

fnt	pointer to the function tail
new_owner	the entry point of the new owner function

Deprecated: Use set_tail_owner_ea() for safer access.

◆ read_regargs()

idaman void ida_export read_regargs ( func_t * pfn )

◆ add_regarg()

idaman DEPRECATED void ida_export add_regarg	(	func_t *	pfn,
		int	reg,
		const tinfo_t &	tif,
		const char *	name )

Deprecated: Use add_func_regarg() for safer access.

◆ plan_to_apply_idasgn()

idaman int ida_export plan_to_apply_idasgn ( const char * fname )

Add a signature file to the list of planned signature files.

Parameters

fname file name. should not contain directory part.

Returns: 0 if failed, otherwise number of planned (and applied) signatures

◆ apply_idasgn_to()

idaman int ida_export apply_idasgn_to	(	const char *	signame,
		ea_t	ea,
		bool	is_startup )

Apply a signature file to the specified address.

Parameters

signame	short name of signature file (the file name without path)
ea	address to apply the signature
is_startup	if set, then the signature is treated as a startup one for startup signature ida doesn't rename the first function of the applied module.

Returns: Library function codes

◆ get_idasgn_qty()

idaman int ida_export get_idasgn_qty ( void )

Get number of signatures in the list of planned and applied signatures.

Returns: 0..n

◆ get_current_idasgn()

idaman int ida_export get_current_idasgn ( void )

Get number of the current signature.

Returns: 0..n-1

◆ calc_idasgn_state()

idaman int ida_export calc_idasgn_state ( int n )

Get state of a signature in the list of planned signatures.

Parameters

n	number of signature in the list (0..get_idasgn_qty()-1)

Returns: state of signature or #IDASGN_BADARG

◆ del_idasgn()

idaman int ida_export del_idasgn ( int n )

Remove signature from the list of planned signatures.

Parameters

n	number of signature in the list (0..get_idasgn_qty()-1)

Returns: #IDASGN_OK, #IDASGN_BADARG, #IDASGN_APPLIED

◆ get_idasgn_desc()

idaman int32 ida_export get_idasgn_desc	(	qstring *	signame,
		qstring *	optlibs,
		int	n )

Get information about a signature in the list.

Parameters

signame	buffer for the name of the signature. (short form, only base name without the directory part will be stored). if signame == nullptr, then the name won't be returned.
optlibs	buffer for the names of the optional libraries if optlibs == nullptr, then the optional libraries are not returned
n	number of signature in the list (0..get_idasgn_qty()-1)

Returns: number of successfully recognized modules using this signature. -1 means the 'n' is a bad argument, i.e. no signature with this number exists..

◆ get_idasgn_title()

idaman ssize_t ida_export get_idasgn_title	(	qstring *	buf,
		const char *	name )

Get full description of the signature by its short name.

Parameters

buf	the output buffer
name	short name of a signature

Returns: size of signature description or -1

◆ determine_rtl()

idaman void ida_export determine_rtl ( void )

Determine compiler/vendor using the startup signatures.

If determined, then appropriate signature files are included into the list of planned signature files.

◆ apply_startup_sig()

idaman bool ida_export apply_startup_sig	(	ea_t	ea,
		const char *	startup )

Apply a startup signature file to the specified address.

Parameters

ea	address to apply the signature to; usually idainfo::start_ea
startup	the name of the signature file without path and extension

Returns: true if successfully applied the signature

◆ try_to_add_libfunc()

idaman int ida_export try_to_add_libfunc ( ea_t ea )

Apply the currently loaded signature file to the specified address.

If a library function is found, then create a function and name it accordingly.

Parameters

ea	any address in the program

Returns: Library function codes

Classes

Typedefs

Functions

ea-based chunk manipulation

Detailed Description

Typedef Documentation

◆ regargs_t

Function Documentation

◆ free_regarg()

◆ DECLARE_REGARG_T_HELPERS()

◆ DECLARE_TYPE_AS_MOVABLE() [1/2]

◆ DECLARE_TYPE_AS_MOVABLE() [2/2]

◆ is_func_entry()

◆ is_func_tail()

◆ lock_func_range()

◆ is_func_locked()

◆ get_func()

◆ get_func_chunknum()

◆ getn_func()

◆ get_func_qty()

◆ get_func_num()

◆ get_prev_func()

◆ get_next_func()

◆ get_func_ranges()

◆ get_func_cmt()

◆ set_func_cmt()

◆ update_func()

◆ add_func_ex()

◆ del_func()

◆ set_func_start()

◆ set_func_end()

◆ reanalyze_function()

◆ find_func_bounds()

◆ get_func_name()

◆ calc_func_size()

◆ get_func_bitness()

◆ set_visible_func()

◆ set_func_name_if_jumpfunc()

◆ calc_thunk_func_target()

◆ func_does_return()

◆ reanalyze_noret_flag()

◆ set_noret_insn()

◆ get_fchunk()

◆ getn_fchunk()

◆ get_fchunk_qty()

◆ get_fchunk_num()

◆ get_prev_fchunk()

◆ get_next_fchunk()

◆ append_func_tail()

◆ remove_func_tail()

◆ set_tail_owner()

◆ read_regargs()

◆ add_regarg()

◆ plan_to_apply_idasgn()

◆ apply_idasgn_to()

◆ get_idasgn_qty()

◆ get_current_idasgn()

◆ calc_idasgn_state()

◆ del_idasgn()

◆ get_idasgn_desc()

◆ get_idasgn_title()

◆ determine_rtl()

◆ apply_startup_sig()

◆ try_to_add_libfunc()