idb_event Namespace Reference

Detailed Description

IDB event group.

Some events are still in the processor group, so you will need to hook to both groups. These events do not return anything.

The callback function should return 0 but the kernel won't check it. Use the hook_to_notification_point() function to install your callback.

Enumerations
enum	event_code_t {   closebase , savebase , upgraded , auto_empty ,   auto_empty_finally , determined_main , extlang_changed , idasgn_loaded ,   kernel_config_loaded , loader_finished , flow_chart_created , compiler_changed ,   changing_ti , ti_changed , changing_op_ti , op_ti_changed ,   changing_op_type , op_type_changed , segm_added , deleting_segm ,   segm_deleted , changing_segm_start , segm_start_changed , changing_segm_end ,   segm_end_changed , changing_segm_name , segm_name_changed , changing_segm_class ,   segm_class_changed , segm_attrs_updated , segm_moved , allsegs_moved ,   func_added , func_updated , set_func_start , set_func_end ,   deleting_func , frame_deleted , thunk_func_created , func_tail_appended ,   deleting_func_tail , func_tail_deleted , tail_owner_changed , func_noret_changed ,   stkpnts_changed , updating_tryblks , tryblks_updated , deleting_tryblks ,   sgr_changed , make_code , make_data , destroyed_items ,   renamed , byte_patched , changing_cmt , cmt_changed ,   changing_range_cmt , range_cmt_changed , extra_cmt_changed , item_color_changed ,   callee_addr_changed , bookmark_changed , sgr_deleted , adding_segm ,   func_deleted , dirtree_mkdir , dirtree_rmdir , dirtree_link ,   dirtree_move , dirtree_rank , dirtree_rminode , dirtree_segm_moved ,   local_types_changed , lt_udm_created , lt_udm_deleted , lt_udm_renamed ,   lt_udm_changed , lt_udt_expanded , frame_created , frame_udm_created ,   frame_udm_deleted , frame_udm_renamed , frame_udm_changed , frame_expanded ,   idasgn_matched_ea , lt_edm_created , lt_edm_deleted , lt_edm_renamed ,   lt_edm_changed }
	IDB event codes. More...

Enumeration Type Documentation

event_code_t

enum idb_event::event_code_t

IDB event codes.

Enumerator
closebase	The database will be closed now.
savebase	The database is being saved.
upgraded	The database has been upgraded and the receiver can upgrade its info as well. Parameters from (int) - old IDB version
auto_empty	Info: all analysis queues are empty. This callback is called once when the initial analysis is finished. If the queue is not empty upon the return from this callback, it will be called later again.
auto_empty_finally	Info: all analysis queues are empty definitively. This callback is called only once.
determined_main	The main() function has been determined. Parameters main (::ea_t) address of the main() function
extlang_changed	The list of extlangs or the default extlang was changed. Parameters kind (int) 0: extlang installed 1: extlang removed 2: default extlang changed el (extlang_t *) pointer to the extlang affected idx (int) extlang index
idasgn_loaded	FLIRT signature has been loaded for normal processing (not for recognition of startup sequences). Parameters short_sig_name (const char *)
kernel_config_loaded	This event is issued when ida.cfg is parsed. Parameters pass_number (int)
loader_finished	External file loader finished its work. Use this event to augment the existing loader functionality. Parameters li (linput_t *) neflags (uint16) Load file flags filetypename (const char *)
flow_chart_created	Gui has retrieved a function flow chart. Plugins may modify the flow chart in this callback. Parameters fc (qflow_chart_t *)
compiler_changed	The kernel has changed the compiler information. ( idainfo::cc structure; get_abi_name) Parameters adjust_inf_fields (::bool) may change inf fields?
changing_ti	An item typestring (c/c++ prototype) is to be changed. Parameters ea (::ea_t) new_type (const type_t *) new_fnames (const p_list *)
ti_changed	An item typestring (c/c++ prototype) has been changed. Parameters ea (::ea_t) type (const type_t *) fnames (const p_list *)
changing_op_ti	An operand typestring (c/c++ prototype) is to be changed. Parameters ea (::ea_t) n (int) new_type (const type_t *) new_fnames (const p_list *)
op_ti_changed	An operand typestring (c/c++ prototype) has been changed. Parameters ea (::ea_t) n (int) type (const type_t *) fnames (const p_list *)
changing_op_type	An operand type (offset, hex, etc...) is to be changed. Parameters ea (::ea_t) n (int) eventually or'ed with OPND_OUTER or OPND_ALL opinfo (const opinfo_t *) additional operand info
op_type_changed	An operand type (offset, hex, etc...) has been set or deleted. Parameters ea (::ea_t) n (int) eventually or'ed with OPND_OUTER or OPND_ALL
segm_added	A new segment has been created. Parameters s (segment_t *) See also adding_segm
deleting_segm	A segment is to be deleted. Parameters start_ea (::ea_t)
segm_deleted	A segment has been deleted. Parameters start_ea (::ea_t) end_ea (::ea_t) flags (int)
changing_segm_start	Segment start address is to be changed. Parameters s (segment_t *) new_start (::ea_t) segmod_flags (int)
segm_start_changed	Segment start address has been changed. Parameters s (segment_t *) oldstart (::ea_t)
changing_segm_end	Segment end address is to be changed. Parameters s (segment_t *) new_end (::ea_t) segmod_flags (int)
segm_end_changed	Segment end address has been changed. Parameters s (segment_t *) oldend (::ea_t)
changing_segm_name	Segment name is being changed. Parameters s (segment_t *) oldname (const char *)
segm_name_changed	Segment name has been changed. Parameters s (segment_t *) name (const char *)
changing_segm_class	Segment class is being changed. Parameters s (segment_t *)
segm_class_changed	Segment class has been changed. Parameters s (segment_t *) sclass (const char *)
segm_attrs_updated	Segment attributes has been changed. Parameters s (segment_t *) This event is generated for secondary segment attributes (examples: color, permissions, etc)
segm_moved	Segment has been moved. Parameters from (::ea_t) to (::ea_t) size (::asize_t) changed_netmap (bool) See also idb_event::allsegs_moved
allsegs_moved	Program rebasing is complete. This event is generated after series of segm_moved events Parameters info (::segm_move_infos_t *)
func_added	The kernel has added a function. Parameters pfn (func_t *)
func_updated	The kernel has updated a function. Parameters pfn (func_t *)
set_func_start	Function chunk start address will be changed. Parameters pfn (func_t *) new_start (::ea_t)
set_func_end	Function chunk end address will be changed. Parameters pfn (func_t *) new_end (::ea_t)
deleting_func	The kernel is about to delete a function. Parameters pfn (func_t *)
frame_deleted	The kernel has deleted a function frame. Parameters pfn (func_t *) idb_event::frame_created
thunk_func_created	A thunk bit has been set for a function. Parameters pfn (func_t *)
func_tail_appended	A function tail chunk has been appended. Parameters pfn (func_t *) tail (func_t *)
deleting_func_tail	A function tail chunk is to be removed. Parameters pfn (func_t *) tail (const range_t *)
func_tail_deleted	A function tail chunk has been removed. Parameters pfn (func_t *) tail_ea (::ea_t)
tail_owner_changed	A tail chunk owner has been changed. Parameters tail (func_t *) owner_func (::ea_t) old_owner (::ea_t)
func_noret_changed	FUNC_NORET bit has been changed. Parameters pfn (func_t *)
stkpnts_changed	Stack change points have been modified. Parameters pfn (func_t *)
updating_tryblks	About to update tryblk information. Parameters tbv (const ::tryblks_t *)
tryblks_updated	Updated tryblk information. Parameters tbv (const ::tryblks_t *)
deleting_tryblks	About to delete tryblk information in given range. Parameters range (const range_t *)
sgr_changed	The kernel has changed a segment register value. Parameters start_ea (::ea_t) end_ea (::ea_t) regnum (int) value (::sel_t) old_value (::sel_t) tag (uchar) Segment register range tags
make_code	An instruction is being created. Parameters insn (const insn_t*)
make_data	A data item is being created. Parameters ea (::ea_t) flags (flags64_t) tid (tid_t) len (::asize_t)
destroyed_items	Instructions/data have been destroyed in [ea1,ea2). Parameters ea1 (::ea_t) ea2 (::ea_t) will_disable_range (bool)
renamed	The kernel has renamed a byte. See also the rename event Parameters ea (::ea_t) new_name (const char *) can be nullptr local_name (bool) old_name (const char *) can be nullptr
byte_patched	A byte has been patched. Parameters ea (::ea_t) old_value (uint32)
changing_cmt	An item comment is to be changed. Parameters ea (::ea_t) repeatable_cmt (bool) newcmt (const char *)
cmt_changed	An item comment has been changed. Parameters ea (::ea_t) repeatable_cmt (bool)
changing_range_cmt	Range comment is to be changed. Parameters kind (range_kind_t) a (const range_t *) cmt (const char *) repeatable (bool)
range_cmt_changed	Range comment has been changed. Parameters kind (range_kind_t) a (const range_t *) cmt (const char *) repeatable (bool)
extra_cmt_changed	An extra comment has been changed. Parameters ea (::ea_t) line_idx (int) cmt (const char *)
item_color_changed	An item color has been changed. Parameters ea (::ea_t) color (bgcolor_t) if color==DEFCOLOR, the the color is deleted.
callee_addr_changed	Callee address has been updated by the user. Parameters ea (::ea_t) callee (::ea_t)
bookmark_changed	Boomarked position changed. Parameters index (uint32) pos (::const lochist_entry_t *) desc (::const char *) operation (int) 0-added, 1-updated, 2-deleted if desc==nullptr, then the bookmark was deleted.
sgr_deleted	The kernel has deleted a segment register value. Parameters start_ea (::ea_t) end_ea (::ea_t) regnum (int)
adding_segm	A segment is being created. Parameters s (segment_t *)
func_deleted	A function has been deleted. Parameters func_ea (::ea_t)
dirtree_mkdir	Dirtree: a directory has been created. Parameters dt (dirtree_t *) path (::const char *)
dirtree_rmdir	Dirtree: a directory has been deleted. Parameters dt (dirtree_t *) path (::const char *)
dirtree_link	Dirtree: an item has been linked/unlinked. Parameters dt (dirtree_t *) path (::const char *) link (::bool)
dirtree_move	Dirtree: a directory or item has been moved. Parameters dt (dirtree_t *) from (::const char *) to (::const char *)
dirtree_rank	Dirtree: a directory or item rank has been changed. Parameters dt (dirtree_t *) path (::const char *) rank (::size_t)
dirtree_rminode	Dirtree: an inode became unavailable. Parameters dt (dirtree_t *) inode (inode_t)
dirtree_segm_moved	Dirtree: inodes were changed due to a segment movement or a program rebasing. Parameters dt (dirtree_t *)
local_types_changed	Local types have been changed. Parameters ltc (local_type_change_t) ordinal (uint32) 0 means ordinal is unknown name (const char *) nullptr means name is unknown
lt_udm_created	local type udt member has been added Parameters udtname (::const char *) udm (::const udm_t *) Note udm_t::offset may not be calculated yet except of the fixed udt
lt_udm_deleted	local type udt member has been deleted Parameters udtname (::const char *) udm_tid (tid_t) udm (::const udm_t *)
lt_udm_renamed	local type udt member has been renamed Parameters udtname (::const char *) udm (::const udm_t *) oldname (::const char *)
lt_udm_changed	local type udt member has been changed Parameters udtname (::const char *) udm_tid (tid_t) udmold (::const udm_t *) udmnew (::const udm_t *) Note udm_t::offset may not be calculated yet except of the fixed udt
lt_udt_expanded	A structure type has been expanded/shrank. Parameters udtname (::const char *) udm_tid (tid_t) the gap was added/removed before this member delta (::adiff_t) number of added/removed bytes
frame_created	A function frame has been created. Parameters func_ea (::ea_t) idb_event::frame_deleted
frame_udm_created	Frame member has been added. Parameters func_ea (::ea_t) udm (::const udm_t *)
frame_udm_deleted	Frame member has been deleted. Parameters func_ea (::ea_t) udm_tid (tid_t) udm (::const udm_t *)
frame_udm_renamed	Frame member has been renamed. Parameters func_ea (::ea_t) udm (::const udm_t *) oldname (::const char *)
frame_udm_changed	Frame member has been changed. Parameters func_ea (::ea_t) udm_tid (tid_t) udmold (::const udm_t *) udmnew (::const udm_t *)
frame_expanded	A frame type has been expanded/shrank. Parameters func_ea (::ea_t) udm_tid (tid_t) the gap was added/removed before this member delta (::adiff_t) number of added/removed bytes
idasgn_matched_ea	A FLIRT match has been found. Parameters ea (::ea_t) the matching address name (::const char *) the matched name lib_name (::const char *) library name extracted from signature file
lt_edm_created	local type enum member has been added Parameters enumname (::const char *) edm (::const edm_t *)
lt_edm_deleted	local type enum member has been deleted Parameters enumname (::const char *) edm_tid (tid_t) edm (::const edm_t *)
lt_edm_renamed	local type enum member has been renamed Parameters enumname (::const char *) edm (::const edm_t *) oldname (::const char *)
lt_edm_changed	local type enum member has been changed Parameters enumname (::const char *) edm_tid (tid_t) edmold (::const edm_t *) edmnew (::const edm_t *)