idx - serial number of the new enum. If another enum with the same serial number exists, then all enums with serial numbers >= the specified idx get their serial numbers incremented (in other words, the new enum is put in the middle of the list of enums). If idx >= get_enum_qty() or idx == idaapi.BADNODE then the new enum is created at the end of the list of enums.
name - name of the enum.
flag - flags for representation of numeric constants in the definition of enum.
Returns:
id of new enum or BADADDR
交互相关
要求用户输入
You can use the ask_* functions from the ida_kernwin module.
For example:
ask_long: Display a dialog box and wait for the user to input an number ask_str: Display a dialog box and wait for the user to input a text string ask_file: Display a dialog box and wait for the user to input a file name ask_form: Display a dialog box and wait for the user There are also the choose_* functions if you want the user to choose something from the database (function, segment, structure). And fully customisable forms (see this example).
分析常用函数
在指定地址make code
create_insn(ea, out=None)
Create an instruction at the specified address. This function checks if an instruction is present at the specified address and will try to create one if there is none. It will fail if there is a data item or other items hindering the creation of the new instruction. This function will also fill the ‘out’ structure.
Returns: int
the length of the instruction or 0
获取指定地址的指令（助记符）
print_insn_mnem
例如，对于mov eax,1
返回“mov”
获取指定地址的n个立即数
get_printable_immvals(ea, n, F=0)
Get immediate ready-to-print values at the specified address
Parameters: ea - address to analyze (C++: ea_t) n - number of operand (0.. UA_MAXOP -1), -1 means all operands (C++: int) F - flags for the specified address (C++: flags_t) Returns: PyObject * number of immediate values (0..2* UA_MAXOP )
Get string contents ea - linear address len - string length. -1 means to calculate the max string length type - the string type (one of STRTYPE_… constants) Returns: string contents or empty string
string get_strlit_contents(long ea, long len, long type);
获取指定地址的数据（不使用调试时的数据）
ida_bytes.get_qword,ida_bytes.get_64bit
ida_bytes.get_dword, ida_bytes.get_32bit
ida_bytes.get_word,ida_bytes.get_16bit
获取指定地址的数据（使用调试时的数据）
read_dbg_qword
read_dbg_dword
read_dbg_word
创建结构体 create_struct(ea, length, tid, force=False)
Convert to struct.
Parameters:
ea, (C++ - ea_t)
length, (C++ - asize_t)
tid, (C++ - tid_t)
force, (C++ - bool)
Returns: bool
获取指定地址的操作 GetDisasm(ea)
Get disassembly line
@param ea: linear address of instruction
@return: "" - could not decode instruction at the specified location
@note: this function may not return exactly the same mnemonics
as you see on the screen.
获取一定长度的字节 get_bytes(ea, size, use_dbg=False)
Return the specified number of bytes of the program
1 2 3 4 5 6
Parameters: ea - linear address size - size of buffer in normal8-bit bytes use_dbg - if True, use debugger memory, otherwise just the database Returns: None on failure otherwise astring containing the read bytes
获取指定地址的名字 get_name(ea, gtn_flags=0)
Get name at the specified address
Parameters:
ea - linear address
gtn_flags - how exactly the name should be retrieved. combination of GN_ bits