http://www.cnblogs.com/fply/p/8506413.html
GetStrucQty():
"""
Get number of defined structure types
@return: number of structure types
"""
GetFirstStrucIdx():
"""
Get index of first structure type
@return: BADADDR if no structure type is defined
index of first structure type.
Each structure type has an index and ID.
INDEX determines position of structure definition
in the list of structure definitions. Index 1
is listed first, after index 2 and so on.
The index of a structure type can be changed any
time, leading to movement of the structure definition
in the list of structure definitions.
ID uniquely denotes a structure type. A structure
gets a unique ID at the creation time and this ID
can't be changed. Even when the structure type gets
deleted, its ID won't be resued in the future.
GetLastStrucIdx():
"""
Get index of last structure type
@return: BADADDR if no structure type is defined
index of last structure type.
See GetFirstStrucIdx() for the explanation of
structure indices and IDs.
"""
GetNextStrucIdx(index):
"""
Get index of next structure type
@param index: current structure index
@return: BADADDR if no (more) structure type is defined
index of the next structure type.
See GetFirstStrucIdx() for the explanation of
structure indices and IDs.
"""
GetPrevStrucIdx(index):
"""
Get index of previous structure type
@param index: current structure index
@return: BADADDR if no (more) structure type is defined
index of the presiouvs structure type.
See GetFirstStrucIdx() for the explanation of
structure indices and IDs.
"""
GetStrucIdx(sid):
"""
Get structure index by structure ID
@param sid: structure ID
@return: BADADDR if bad structure ID is passed
otherwise returns structure index.
See GetFirstStrucIdx() for the explanation of
structure indices and IDs.
"""
GetStrucId(index):
"""
Get structure ID by structure index
@param index: structure index
@return: BADADDR if bad structure index is passed otherwise returns structure ID.
@note: See GetFirstStrucIdx() for the explanation of structure indices and IDs.
"""
GetStrucIdByName(name):
"""
Get structure ID by structure name
@param name: structure type name
@return: BADADDR if bad structure type name is passed
otherwise returns structure ID.
"""
GetStrucName(sid):
"""
Get structure type name
@param sid: structure type ID
@return: None if bad structure type ID is passed
otherwise returns structure type name.
"""
GetStrucComment(sid, repeatable):
"""
Get structure type comment
@param sid: structure type ID
@param repeatable: 1: get repeatable comment
0: get regular comment
@return: None if bad structure type ID is passed
otherwise returns comment.
"""
GetStrucSize(sid):
"""
Get size of a structure
@param sid: structure type ID
@return: 0 if bad structure type ID is passed
otherwise returns size of structure in bytes.
"""
etMemberQty(sid):
"""
Get number of members of a structure
@param sid: structure type ID
@return: -1 if bad structure type ID is passed otherwise
returns number of members.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetMemberId(sid, member_offset):
"""
@param sid: structure type ID
@param member_offset:. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: -1 if bad structure type ID is passed or there is
no member at the specified offset.
otherwise returns the member id.
"""
GetStrucPrevOff(sid, offset):
"""
Get previous offset in a structure
@param sid: structure type ID
@param offset: current offset
@return: -1 if bad structure type ID is passed,
idaapi.BADADDR if no (more) offsets in the structure,
otherwise returns previous offset in a structure.
@note: IDA allows 'holes' between members of a
structure. It treats these 'holes'
as unnamed arrays of bytes.
This function returns a member offset or a hole offset.
It will return size of the structure if input
'offset' is bigger than the structure size.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetStrucNextOff(sid, offset):
"""
Get next offset in a structure
@param sid: structure type ID
@param offset: current offset
@return: -1 if bad structure type ID is passed,
idaapi.BADADDR if no (more) offsets in the structure,
otherwise returns next offset in a structure.
@note: IDA allows 'holes' between members of a
structure. It treats these 'holes'
as unnamed arrays of bytes.
This function returns a member offset or a hole offset.
It will return size of the structure if input
'offset' belongs to the last member of the structure.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetFirstMember(sid):
"""
Get offset of the first member of a structure
@param sid: structure type ID
@return: -1 if bad structure type ID is passed,
idaapi.BADADDR if structure has no members,
otherwise returns offset of the first member.
@note: IDA allows 'holes' between members of a
structure. It treats these 'holes'
as unnamed arrays of bytes.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetLastMember(sid):
"""
Get offset of the last member of a structure
@param sid: structure type ID
@return: -1 if bad structure type ID is passed,
idaapi.BADADDR if structure has no members,
otherwise returns offset of the last member.
@note: IDA allows 'holes' between members of a
structure. It treats these 'holes'
as unnamed arrays of bytes.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetMemberOffset(sid, member_name):
"""
Get offset of a member of a structure by the member name
@param sid: structure type ID
@param member_name: name of structure member
@return: -1 if bad structure type ID is passed
or no such member in the structure
otherwise returns offset of the specified member.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetMemberName(sid, member_offset):
"""
Get name of a member of a structure
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: None if bad structure type ID is passed
or no such member in the structure
otherwise returns name of the specified member.
"""
GetMemberComment(sid, member_offset, repeatable):
"""
Get comment of a member
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@param repeatable: 1: get repeatable comment
0: get regular comment
@return: None if bad structure type ID is passed
or no such member in the structure
otherwise returns comment of the specified member.
"""
GetMemberSize(sid, member_offset):
"""
Get size of a member
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: None if bad structure type ID is passed,
or no such member in the structure
otherwise returns size of the specified
member in bytes.
"""
GetMemberFlag(sid, member_offset):
"""
Get type of a member
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: -1 if bad structure type ID is passed
or no such member in the structure
otherwise returns type of the member, see bit
definitions above. If the member type is a structure
then function GetMemberStrid() should be used to
get the structure type id.
"""
GetMemberStrId(sid, member_offset):
"""
Get structure id of a member
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: -1 if bad structure type ID is passed
or no such member in the structure
otherwise returns structure id of the member.
If the current member is not a structure, returns -1.
"""
IsUnion(sid):
"""
Is a structure a union?
@param sid: structure type ID
@return: 1: yes, this is a union id
0: no
@note: Unions are a special kind of structures
"""
---恢复内容结束---
idc
GetStrucQty():
"""
Get number of defined structure types
@return: number of structure types
"""
GetFirstStrucIdx():
"""
Get index of first structure type
@return: BADADDR if no structure type is defined
index of first structure type.
Each structure type has an index and ID.
INDEX determines position of structure definition
in the list of structure definitions. Index 1
is listed first, after index 2 and so on.
The index of a structure type can be changed any
time, leading to movement of the structure definition
in the list of structure definitions.
ID uniquely denotes a structure type. A structure
gets a unique ID at the creation time and this ID
can't be changed. Even when the structure type gets
deleted, its ID won't be resued in the future.
GetLastStrucIdx():
"""
Get index of last structure type
@return: BADADDR if no structure type is defined
index of last structure type.
See GetFirstStrucIdx() for the explanation of
structure indices and IDs.
"""
GetNextStrucIdx(index):
"""
Get index of next structure type
@param index: current structure index
@return: BADADDR if no (more) structure type is defined
index of the next structure type.
See GetFirstStrucIdx() for the explanation of
structure indices and IDs.
"""
GetPrevStrucIdx(index):
"""
Get index of previous structure type
@param index: current structure index
@return: BADADDR if no (more) structure type is defined
index of the presiouvs structure type.
See GetFirstStrucIdx() for the explanation of
structure indices and IDs.
"""
GetStrucIdx(sid):
"""
Get structure index by structure ID
@param sid: structure ID
@return: BADADDR if bad structure ID is passed
otherwise returns structure index.
See GetFirstStrucIdx() for the explanation of
structure indices and IDs.
"""
GetStrucId(index):
"""
Get structure ID by structure index
@param index: structure index
@return: BADADDR if bad structure index is passed otherwise returns structure ID.
@note: See GetFirstStrucIdx() for the explanation of structure indices and IDs.
"""
GetStrucIdByName(name):
"""
Get structure ID by structure name
@param name: structure type name
@return: BADADDR if bad structure type name is passed
otherwise returns structure ID.
"""
GetStrucName(sid):
"""
Get structure type name
@param sid: structure type ID
@return: None if bad structure type ID is passed
otherwise returns structure type name.
"""
GetStrucComment(sid, repeatable):
"""
Get structure type comment
@param sid: structure type ID
@param repeatable: 1: get repeatable comment
0: get regular comment
@return: None if bad structure type ID is passed
otherwise returns comment.
"""
GetStrucSize(sid):
"""
Get size of a structure
@param sid: structure type ID
@return: 0 if bad structure type ID is passed
otherwise returns size of structure in bytes.
"""
etMemberQty(sid):
"""
Get number of members of a structure
@param sid: structure type ID
@return: -1 if bad structure type ID is passed otherwise
returns number of members.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetMemberId(sid, member_offset):
"""
@param sid: structure type ID
@param member_offset:. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: -1 if bad structure type ID is passed or there is
no member at the specified offset.
otherwise returns the member id.
"""
GetStrucPrevOff(sid, offset):
"""
Get previous offset in a structure
@param sid: structure type ID
@param offset: current offset
@return: -1 if bad structure type ID is passed,
idaapi.BADADDR if no (more) offsets in the structure,
otherwise returns previous offset in a structure.
@note: IDA allows 'holes' between members of a
structure. It treats these 'holes'
as unnamed arrays of bytes.
This function returns a member offset or a hole offset.
It will return size of the structure if input
'offset' is bigger than the structure size.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetStrucNextOff(sid, offset):
"""
Get next offset in a structure
@param sid: structure type ID
@param offset: current offset
@return: -1 if bad structure type ID is passed,
idaapi.BADADDR if no (more) offsets in the structure,
otherwise returns next offset in a structure.
@note: IDA allows 'holes' between members of a
structure. It treats these 'holes'
as unnamed arrays of bytes.
This function returns a member offset or a hole offset.
It will return size of the structure if input
'offset' belongs to the last member of the structure.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetFirstMember(sid):
"""
Get offset of the first member of a structure
@param sid: structure type ID
@return: -1 if bad structure type ID is passed,
idaapi.BADADDR if structure has no members,
otherwise returns offset of the first member.
@note: IDA allows 'holes' between members of a
structure. It treats these 'holes'
as unnamed arrays of bytes.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetLastMember(sid):
"""
Get offset of the last member of a structure
@param sid: structure type ID
@return: -1 if bad structure type ID is passed,
idaapi.BADADDR if structure has no members,
otherwise returns offset of the last member.
@note: IDA allows 'holes' between members of a
structure. It treats these 'holes'
as unnamed arrays of bytes.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetMemberOffset(sid, member_name):
"""
Get offset of a member of a structure by the member name
@param sid: structure type ID
@param member_name: name of structure member
@return: -1 if bad structure type ID is passed
or no such member in the structure
otherwise returns offset of the specified member.
@note: Union members are, in IDA's internals, located
at subsequent byte offsets: member 0 -> offset 0x0,
member 1 -> offset 0x1, etc...
"""
GetMemberName(sid, member_offset):
"""
Get name of a member of a structure
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: None if bad structure type ID is passed
or no such member in the structure
otherwise returns name of the specified member.
"""
GetMemberComment(sid, member_offset, repeatable):
"""
Get comment of a member
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@param repeatable: 1: get repeatable comment
0: get regular comment
@return: None if bad structure type ID is passed
or no such member in the structure
otherwise returns comment of the specified member.
"""
GetMemberSize(sid, member_offset):
"""
Get size of a member
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: None if bad structure type ID is passed,
or no such member in the structure
otherwise returns size of the specified
member in bytes.
"""
GetMemberFlag(sid, member_offset):
"""
Get type of a member
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: -1 if bad structure type ID is passed
or no such member in the structure
otherwise returns type of the member, see bit
definitions above. If the member type is a structure
then function GetMemberStrid() should be used to
get the structure type id.
"""
GetMemberStrId(sid, member_offset):
"""
Get structure id of a member
@param sid: structure type ID
@param member_offset: member offset. The offset can be
any offset in the member. For example,
is a member is 4 bytes long and starts
at offset 2, then 2,3,4,5 denote
the same structure member.
@return: -1 if bad structure type ID is passed
or no such member in the structure
otherwise returns structure id of the member.
If the current member is not a structure, returns -1.
"""
IsUnion(sid):
"""
Is a structure a union?
@param sid: structure type ID
@return: 1: yes, this is a union id
0: no
@note: Unions are a special kind of structures
"""
AddStrucEx(index, name, is_union): """ Define a new structure type @param index: index of new structure type If another structure has the specified index, then index of that structure and all other structures will be incremented, freeing the specifed index. If index is == -1, then the biggest index number will be used. See GetFirstStrucIdx() for the explanation of structure indices and IDs. @param name: name of the new structure type. @param is_union: 0: structure 1: union @return: -1 if can't define structure type because of bad structure name: the name is ill-formed or is already used in the program. otherwise returns ID of the new structure type """
DelStruc(sid): """ Delete a structure type @param sid: structure type ID @return: 0 if bad structure type ID is passed 1 otherwise the structure type is deleted. All data and other structure types referencing to the deleted structure type will be displayed as array of bytes. """
SetStrucIdx(sid, index): """ Change structure index @param sid: structure type ID @param index: new index of the structure @return: != 0 - ok @note: See GetFirstStrucIdx() for the explanation of structure indices and IDs. """
SetStrucName(sid, name): """ Change structure name @param sid: structure type ID @param name: new name of the structure @return: != 0 - ok
SetStrucComment(sid, comment, repeatable): """ Change structure comment @param sid: structure type ID @param comment: new comment of the structure @param repeatable: 1: change repeatable comment 0: change regular comment @return: != 0 - ok
AddStrucMember(sid, name, offset, flag, typeid, nbytes, target=-1, tdelta=0, reftype=REF_OFF32): """ Add structure member @param sid: structure type ID @param name: name of the new member @param offset: offset of the new member -1 means to add at the end of the structure @param flag: type of the new member. Should be one of FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA @param typeid: if isStruc(flag) then typeid specifies the structure id for the member if isOff0(flag) then typeid specifies the offset base. if isASCII(flag) then typeid specifies the string type (ASCSTR_...). if isStroff(flag) then typeid specifies the structure id if isEnum(flag) then typeid specifies the enum id if isCustom(flags) then typeid specifies the dtid and fid: dtid|(fid<<16) Otherwise typeid should be -1. @param nbytes: number of bytes in the new member @param target: target address of the offset expr. You may specify it as -1, ida will calculate it itself @param tdelta: offset target delta. usually 0 @param reftype: see REF_... definitions @note: The remaining arguments are allowed only if isOff0(flag) and you want to specify a complex offset expression @return: 0 - ok, otherwise error code (one of STRUC_ERROR_*)
DelStrucMember(sid, member_offset): """ Delete structure member @param sid: structure type ID @param member_offset: offset of the member @return: != 0 - ok. @note: IDA allows 'holes' between members of a structure. It treats these 'holes' as unnamed arrays of bytes.
SetMemberName(sid, member_offset, name): """ Change structure member name @param sid: structure type ID @param member_offset: offset of the member @param name: new name of the member @return: != 0 - ok.
SetMemberType(sid, member_offset, flag, typeid, nitems, target=-1, tdelta=0, reftype=REF_OFF32): """ Change structure member type @param sid: structure type ID @param member_offset: offset of the member @param flag: new type of the member. Should be one of FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA @param typeid: if isStruc(flag) then typeid specifies the structure id for the member if isOff0(flag) then typeid specifies the offset base. if isASCII(flag) then typeid specifies the string type (ASCSTR_...). if isStroff(flag) then typeid specifies the structure id if isEnum(flag) then typeid specifies the enum id if isCustom(flags) then typeid specifies the dtid and fid: dtid|(fid<<16) Otherwise typeid should be -1. @param nitems: number of items in the member @param target: target address of the offset expr. You may specify it as -1, ida will calculate it itself @param tdelta: offset target delta. usually 0 @param reftype: see REF_... definitions @note: The remaining arguments are allowed only if isOff0(flag) and you want to specify a complex offset expression @return: !=0 - ok.
SetMemberComment(sid, member_offset, comment, repeatable): """ Change structure member comment @param sid: structure type ID @param member_offset: offset of the member @param comment: new comment of the structure member @param repeatable: 1: change repeatable comment 0: change regular comment @return: != 0 - ok """
ExpandStruc(sid, offset, delta, recalc): """ Expand or shrink a structure type @param id: structure type ID @param offset: offset in the structure @param delta: how many bytes to add or remove @param recalc: recalculate the locations where the structure type is used @return: != 0 - ok
GetFchunkAttr(ea, attr): """ Get a function chunk attribute @param ea: any address in the chunk @param attr: one of: FUNCATTR_START, FUNCATTR_END, FUNCATTR_OWNER, FUNCATTR_REFQTY @return: desired attribute or -1
SetFchunkAttr(ea, attr, value): """ Set a function chunk attribute @param ea: any address in the chunk @param attr: only FUNCATTR_START, FUNCATTR_END, FUNCATTR_OWNER @param value: desired value @return: 0 if failed, 1 if success
GetFchunkReferer(ea, idx): """ Get a function chunk referer @param ea: any address in the chunk @param idx: referer index (0..GetFchunkAttr(FUNCATTR_REFQTY)) @return: referer address or BADADDR
NextFchunk(ea): """ Get next function chunk @param ea: any address @return: the starting address of the next function chunk or BADADDR @note: This function enumerates all chunks of all functions in the database """
PrevFchunk(ea): """ Get previous function chunk @param ea: any address @return: the starting address of the function chunk or BADADDR @note: This function enumerates all chunks of all functions in the database """
AppendFchunk(funcea, ea1, ea2): """ Append a function chunk to the function @param funcea: any address in the function @param ea1: start of function tail @param ea2: end of function tail @return: 0 if failed, 1 if success @note: If a chunk exists at the specified addresses, it must have exactly the specified boundaries """
RemoveFchunk(funcea, tailea): """ Remove a function chunk from the function @param funcea: any address in the function @param tailea: any address in the function chunk to remove @return: 0 if failed, 1 if success
SetFchunkOwner(tailea, funcea): """ Change the function chunk owner @param tailea: any address in the function chunk @param funcea: the starting address of the new owner @return: 0 if failed, 1 if success @note: The new owner must already have the chunk appended before the call """
FirstFuncFchunk(funcea): """ Get the first function chunk of the specified function @param funcea: any address in the function @return: the function entry point or BADADDR @note: This function returns the first (main) chunk of the specified function """
NextFuncFchunk(funcea, tailea): """ Get the next function chunk of the specified function @param funcea: any address in the function @param tailea: any address in the current chunk @return: the starting address of the next function chunk or BADADDR @note: This function returns the next chunk of the specified function """