LogoLogo
IDA 9.0
IDA 9.0
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Message Window
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step over
            • Run to cursor
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
        • List of all menu options
      • Desktops
      • Command line
      • How To Use List Viewers in IDA
      • Licenses
        • Apache License for Ghidra
        • Apache License for LLVM
        • Common Public License Version 1.0
        • APPLE PUBLIC SOURCE LICENSE
        • PCRE2 LICENCE
        • GNU Lesser General Public License v2.1 for libiberty
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Creating Type Libraries
      • IDAClang
      • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • IDA Teams Licenses
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
  • Developer Guide
    • C++ SDK
      • Getting Started with C++ SDK
      • C++ SDK Reference
      • Using the Decompiler SDK: Decompiler plugin
      • C++ SDK examples
      • How to create a plugin in C++?
      • C++ SDK Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting started with IDAPython
      • IDAPython API Reference
      • IDAPython examples
      • How to create a plugin in IDAPython?
      • IDAPython Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • IDC API Reference
        • Index of debugger related IDC functions
        • Alphabetical list of IDC functions
          • is_member_id
          • load_type
          • get_member_by_idx
          • get_ordinal_limit
          • set_selector
          • enable_tracing
          • get_prev_fixup_ea
          • del_segm
          • get_bmask_cmt
          • end_type_updating
          • Find
          • toggle_bnot
          • patch_byte
          • get_module_info
          • set_member_name
          • create_float
          • del_struc_member
          • read_dbg_memory
          • get_enum_width
          • getn_thread_name
          • del_struc
          • filelength
          • set_manual_insn
          • is_value...() functions
          • get_ip_val
          • del_extra_cmt
          • create_insn
          • op_offset_high16
          • get_cmt
          • expand_struc
          • get_idb_path
          • set_frame_size
          • get_file_ext
          • has_value
          • readshort
          • sanitize_file_name
          • get_member_flag
          • create_struct
          • ARM specific
          • set_enum_member_cmt
          • rename
          • set_ida_state
          • get_member_size
          • msg
          • qbasename
          • get_enum_member_enum
          • auto_mark_range
          • plan_to_apply_idasgn
          • set_named_type
          • op_offset
          • rename_entry
          • strlen
          • get_extra_cmt
          • get_enum_flag
          • fgetc
          • op_stkvar
          • get_last_index
          • get_field_ea
          • get_struc_id
          • select_thread
          • create_array
          • get_struc_cmt
          • set_array_string
          • set_func_attr
          • set_storage_type
          • get_struc_size
          • demangle_name
          • get_next_fixup_ea
          • get_next_bmask
          • delattr
          • gen_simple_call_chart
          • patch_qword
          • get_enum_name
          • loader_input_t.getc
          • get_debugger_event_cond
          • read_dbg_qword
          • define_local_var
          • generate_disasm_line
          • add_idc_hotkey
          • tolower
          • del_selector
          • set_debugger_event_cond
          • get_imagebase
          • gen_file
          • get_entry
          • find_custom_data_format
          • get_debug_name_ea
          • add_default_til
          • set_func_end
          • exit_process
          • delete_array
          • xtol
          • get_exception_code
          • detach_process
          • set_enum_cmt
          • get_wide_word
          • put_bookmark
          • is_loaded
          • add_enum_member
          • parse_decls
          • readstr
          • get_entry_qty
          • ord
          • sprintf
          • get_root_filename
          • get_enum_member_cmt
          • create_word
          • set_func_flags
          • loader_input_t.tell
          • create_align
          • read_dbg_dword
          • next_addr
          • get_bytes
          • batch
          • start_process
          • process_config_line
          • del_user_info
          • qmakefile
          • set_struc_name
          • print_decls
          • create_custom_data
          • del_enum_member
          • format_cdata
          • get_fixup_target_sel
          • get_item_size
          • loader_input_t.gets
          • get_last_bmask
          • Step Tracing Options
          • selector_by_name
          • get_enum_cmt
          • next_not_tail
          • prev_head
          • set_color
          • set_numbered_type
          • get_member_name
          • auto_wait
          • get_enum_member_bmask
          • fseek
          • get_segm_start
          • attach_process
          • Trace file functions
          • get_enum_member_value
          • op_stroff
          • get_next_offset
          • set_processor_type
          • get_bookmark_desc
          • create_data
          • lastattr
          • get_operand_value
          • collect_stack_trace
          • toupper
          • get_fixup_target_dis
          • set_cmt
          • add_entry
          • set_segm_addressing
          • qmake_full_path
          • get_source_linnum
          • fputc
          • resume_thread
          • get_func_attr
          • get_first_enum_member
          • add_sourcefile
          • get_first_bmask
          • read_selection_start
          • hasattr
          • get_member_cmt
          • gen_flow_graph
          • get_array_element
          • get_tinfo
          • loader_input_t
          • tinfo_errstr
          • TRUNC
          • add_segm_ex
          • Local types information and manipulation helpers
          • set_source_linnum
          • get_next_enum_member
          • loader_input_t.readbytes
          • set_array_params
          • jumpto
          • get_bookmark
          • set_enum_bf
          • prev_not_tail
          • toggle_sign
          • loader_input_t.size
          • Trace events functions
          • get_func_flags
          • get_gotea
          • set_segm_attr
          • get_item_head
          • set_default_sreg_value
          • print_insn_mnem
          • set_member_cmt
          • get_ordinal_qty
          • set_target_assembler
          • add_user_stkpnt
          • set_local_type
          • Hidden ranges
          • del_items
          • compile_idc_text
          • Dalvik debugger extension functions
          • byte_value
          • create_dword
          • is_code
          • del_func
          • get_enum
          • make_array
          • rotate_left
          • recalc_spd
          • search_path
          • CommonBits
          • get_processor_name
          • set_func_cmt
          • get_prev_bmask
          • Hashes
          • split_sreg_range
          • process_ui_action
          • set_fixup
          • get_fixup_target_type
          • create_oword
          • get_flags
          • get_func_name
          • create_strlit
          • add_struc
          • atol
          • load_debugger
          • mkdir
          • sizeof
          • get_enum_member_by_name
          • save_database
          • guess_type
          • get_segm_name
          • print_operand
          • qisabspath
          • get_member_qty
          • set_struc_cmt
          • get_fixup_target_flags
          • idadir
          • object.retrieve
          • add_auto_stkpnt
          • get_numbered_type_name
          • get_enum_member_name
          • get_next_index
          • prev_addr
          • get_name_ea
          • get_sp_delta
          • set_bmask_cmt
          • readlong
          • set_segm_name
          • get_prev_offset
          • set_segm_alignment
          • get_strlit_contents
          • forget_exception
          • get_item_end
          • add_func
          • get_name
          • Asks
          • get_spd
          • Debugger: control
          • get_wide_byte
          • plan_and_wait
          • set_enum_flag
          • RunPythonStatement
          • del_sourcefile
          • find_selector
          • get_frame_regs_size
          • op_num
          • define_exception
          • create_double
          • create_byte
          • read_selection_end
          • OpTypes
          • op_plain_offset
          • move_segm
          • get_member_id
          • set_segm_combination
          • get_current_thread
          • trim
          • Debugger: options
          • getn_thread
          • get_frame_id
          • typeinfo.print
          • to_ea
          • rebase_program
          • add_struc_member
          • get_exception_qty
          • get_first_index
          • import_type
          • set_segm_type
          • find_custom_data_type
          • get_next_seg
          • find_func_end
          • get_last_enum_member
          • getattr
          • get_frame_size
          • get_screen_ea
          • loader_input_t.read
          • set_reg_value
          • Debugger: modules
          • create_pack_real
          • writestr
          • exec_idc
          • get_enum_size
          • set_enum_name
          • create_tbyte
          • sel2para
          • atoa
          • loader_input_t.close
          • add_enum
          • ltoa
          • substr
          • del_idc_hotkey
          • Breakpoint handling functions
          • loader_input_t.seek
          • cleanup_appcall
          • object.store
          • get_type
          • qexit
          • get_debug_name
          • get_array_id
          • Can't Open File
          • suspend_process
          • process_config_directive
          • get_entry_name
          • get_last_member
          • get_struc_name
          • clear_selection
          • fclose
          • firstattr
          • create_yword
          • dbg_appcall
          • get_qword
          • patch_dword
          • begin_type_updating
          • read_dbg_byte
          • get_fpnum
          • qsleep
          • get_first_member
          • get_nsec_stamp
          • del_stkpnt
          • eval
          • savefile
          • eval_python
          • Xrefs
          • strstr
          • writeshort
          • get_sreg
          • get_segm_end
          • get_func_off_str
          • set_func_start
          • del_array_element
          • get_full_flags
          • set_exception_flags
          • rename_array
          • get_frame_args_size
          • op_flt
          • get_min_spd_ea
          • apply_type
          • get_prev_index
          • loadfile
          • retrieve_input_file_md5
          • get_wide_dword
          • patch_dbg_byte
          • Functions provided by the WinDbg debugger
          • get_original_byte
          • get_member_strid
          • call_system
          • writelong
          • get_thread_qty
          • nextattr
          • send_dbg_command
          • get_first_seg
          • get_processes
          • patch_word
          • get_manual_insn
          • ftell
          • get_entry_ordinal
          • set_array_long
          • delete_all_segments
          • TO_LONG
          • Function chunk related functions
          • Debugger: events
          • get_prev_func
          • op_seg
          • validate_idb_names
          • fprintf
          • fopen
          • strfill
          • del_fixup
          • get_bmask_name
          • inf_attr
          • is_bf
          • read_dbg_word
          • qdirname
          • get_segm_attr
          • func_contains
          • del_source_linnum
          • get_sourcefile
          • clr_database_flag
          • set_name
          • Refresh Screen
          • op_enum
          • getn_enum
          • get_db_byte
          • setattr
          • get_forced_operand
          • op_bin
          • Functions provided by the replayer debugger
          • prevattr
          • update_extra_cmt
          • get_str_type
          • op_man
          • choose_func
          • set_bmask_name
          • get_curline
          • decode_insn
          • set_segment_bounds
          • set_segm_class
          • write_dbg_memory
          • get_exception_name
          • get_enum_member
          • is_mapped
          • del_enum
          • get_frame_lvar_size
          • get_operand_type
          • set_root_filename
          • compile_idc_file
          • typeinfo.size
          • get_local_tinfo
          • get_fixup_target_off
          • is_union
          • unlink
          • get_segm_by_sel
          • set_enum_width
          • take_memory_snapshot
          • exec_python
          • get_next_func
          • get_member_offset
          • get_func_cmt
          • parse_decl
          • create_qword
          • next_head
          • suspend_thread
          • loader_input_t.getz
          • get_color
          • get_reg_value
          • load_and_run_plugin
          • set_database_flag
          • set_enum_member_name
          • set_member_type
          • get_prev_enum_member
      • IDC examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
  • Release Notes
    • IDA 9.0
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page

Was this helpful?

Export as PDF
  1. Developer Guide
  2. IDC
  3. IDC API Reference
  4. Alphabetical list of IDC functions

inf_attr

The following functions allow you to set/get common parameters.
Please note that not all parameters can be set directly.

long    get_inf_attr(long attr);
success set_inf_attr(long attr, long value);

// Set or clear bits in parameter
//      attr   - same as for get_inf_attr()/set_inf_attr() functions
//      bits   - bit mask
//      on     - boolean value, set or clear bits
// Convenience function
void set_flag(long attr, long bits, long on);

// 'attr' may be one of the following:

#define INF_VERSION      0              // ushort;  Version of database
#define INF_PROCNAME     1              // char[16];Name of current processor
#define INF_GENFLAGS     2              // ushort;  General flags:
#define         INFFL_AUTO       0x01   //              Autoanalysis is enabled?
#define         INFFL_ALLASM     0x02   //              May use constructs not supported by
                                        //              the target assembler
#define         INFFL_LOADIDC    0x04   //              Loading an idc file that contains database info
#define         INFFL_NOUSER     0x08   //              do not store user info in the database
#define         INFFL_READONLY   0x10   //              (internal) temporary interdiction to modify the database
#define         INFFL_CHKOPS     0x20   //              check manual operands? (unused)
#define         INFFL_NMOPS      0x40   //              allow non-matched operands? (unused)
#define         INFFL_GRAPH_VIEW 0x80   //              currently using graph options (\dto{graph})
#define INF_LFLAGS       3              // uint32   IDP-dependent flags
#define     LFLG_PC_FPP     0x00000001  //              decode floating point
                                        //              processor instructions?
#define     LFLG_PC_FLAT    0x00000002  //              Flat model?
#define     LFLG_64BIT      0x00000004  //              64-bit program?
#define     LFLG_IS_DLL     0x00000008  //              is dynamic library?
#define     LFLG_FLAT_OFF32 0x00000010  //              treat REF_OFF32 as 32-bit offset for 16bit segments (otherwise try SEG16:OFF16)
#define     LFLG_MSF        0x00000020  //              byte order: is MSB first?
#define     LFLG_WIDE_HBF   0x00000040  //              bit order of wide bytes: high byte first?
#define     LFLG_DBG_NOPATH 0x00000080  //              do not store input full path
#define     LFLG_SNAPSHOT   0x00000100  //              is memory snapshot?
#define     LFLG_PACK       0x00000200  //              pack the database?
#define     LFLG_COMPRESS   0x00000400  //              compress the database?
#define     LFLG_KERNMODE   0x00000800  //              is kernel mode binary?

#define INF_DATABASE_CHANGE_COUNT 4     // uint32; database change counter; keeps track of byte and segment modifications

#define INF_FILETYPE     5              // ushort;  type of input file (see ida.hpp)
#define         FT_EXE_OLD      0       //              MS DOS EXE File (obsolete)
#define         FT_COM_OLD      1       //              MS DOS COM File (obsolete)
#define         FT_BIN          2       //              Binary File
#define         FT_DRV          3       //              MS DOS Driver
#define         FT_WIN          4       //              New Executable (NE)
#define         FT_HEX          5       //              Intel Hex Object File
#define         FT_MEX          6       //              MOS Technology Hex Object File
#define         FT_LX           7       //              Linear Executable (LX)
#define         FT_LE           8       //              Linear Executable (LE)
#define         FT_NLM          9       //              Netware Loadable Module (NLM)
#define         FT_COFF         10      //              Common Object File Format (COFF)
#define         FT_PE           11      //              Portable Executable (PE)
#define         FT_OMF          12      //              Object Module Format
#define         FT_SREC         13      //              R-records
#define         FT_ZIP          14      //              ZIP file (this file is never loaded to IDA database)
#define         FT_OMFLIB       15      //              Library of OMF Modules
#define         FT_AR           16      //              ar library
#define         FT_LOADER       17      //              file is loaded using LOADER DLL
#define         FT_ELF          18      //              Executable and Linkable Format (ELF)
#define         FT_W32RUN       19      //              Watcom DOS32 Extender (W32RUN)
#define         FT_AOUT         20      //              Linux a.out (AOUT)
#define         FT_PRC          21      //              PalmPilot program file
#define         FT_EXE          22      //              MS DOS EXE File
#define         FT_COM          23      //              MS DOS COM File
#define         FT_AIXAR        24      //              AIX ar library
#define         FT_MACHO        25      //              Mac OS X Mach-O file
#define INF_OSTYPE       6              // ushort;  FLIRT: OS type the program is for
#define         OSTYPE_MSDOS 0x0001
#define         OSTYPE_WIN   0x0002
#define         OSTYPE_OS2   0x0004
#define         OSTYPE_NETW  0x0008
#define INF_APPTYPE      7              // ushort;  FLIRT: Application type
#define         APPT_CONSOLE 0x0001     //              console
#define         APPT_GRAPHIC 0x0002     //              graphics
#define         APPT_PROGRAM 0x0004     //              EXE
#define         APPT_LIBRARY 0x0008     //              DLL
#define         APPT_DRIVER  0x0010     //              DRIVER
#define         APPT_1THREAD 0x0020     //              Singlethread
#define         APPT_MTHREAD 0x0040     //              Multithread
#define         APPT_16BIT   0x0080     //              16 bit application
#define         APPT_32BIT   0x0100     //              32 bit application
#define INF_ASMTYPE      8              // uchar;   target assembler number (0..n)
#define INF_SPECSEGS     9              // uchar;   What format do special segments use? 0-unspecified, 4-entries are 4 bytes, 8- entries are 8 bytes
                                        //          program execution

#define INF_AF          10              // uint32;  Analysis flags:
#define AF_CODE         0x00000001      //              Trace execution flow
#define AF_MARKCODE     0x00000002      //              Mark typical code sequences as code
#define AF_JUMPTBL      0x00000004      //              Locate and create jump tables
#define AF_PURDAT       0x00000008      //              Control flow to data segment is ignored
#define AF_USED         0x00000010      //              Analyze and create all xrefs
#define AF_UNK          0x00000020      //              Delete instructions with no xrefs

#define AF_PROCPTR      0x00000040      //              Create function if data xref data->code32 exists
#define AF_PROC         0x00000080      //              Create functions if call is present
#define AF_FTAIL        0x00000100      //              Create function tails
#define AF_LVAR         0x00000200      //              Create stack variables
#define AF_STKARG       0x00000400      //              Propagate stack argument information
#define AF_REGARG       0x00000800      //              Propagate register argument information
#define AF_TRACE        0x00001000      //              Trace stack pointer
#define AF_VERSP        0x00002000      //              Perform full SP-analysis. (\ph{verify_sp})
#define AF_ANORET       0x00004000      //              Perform 'no-return' analysis
#define AF_MEMFUNC      0x00008000      //              Try to guess member function types
#define AF_TRFUNC       0x00010000      //              Truncate functions upon code deletion

#define AF_STRLIT       0x00020000      //              Create string literal if data xref exists
#define AF_CHKUNI       0x00040000      //              Check for unicode strings
#define AF_FIXUP        0x00080000      //              Create offsets and segments using fixup info
#define AF_DREFOFF      0x00100000      //              Create offset if data xref to seg32 exists
#define AF_IMMOFF       0x00200000      //              Convert 32bit instruction operand to offset
#define AF_DATOFF       0x00400000      //              Automatically convert data to offsets

#define AF_FLIRT        0x00800000      //              Use flirt signatures
#define AF_SIGCMT       0x01000000      //              Append a signature name comment for recognized anonymous library functions
#define AF_SIGMLT       0x02000000      //              Allow recognition of several copies of the same function
#define AF_HFLIRT       0x04000000      //              Automatically hide library functions

#define AF_JFUNC        0x08000000      //              Rename jump functions as j_...
#define AF_NULLSUB      0x10000000      //              Rename empty functions as nullsub_...

#define AF_DODATA       0x20000000      //              Coagulate data segs at the final pass
#define AF_DOCODE       0x40000000      //              Coagulate code segs at the final pass
#define AF_FINAL        0x80000000      //              Final pass of analysis

#define INF_AF2         11              // uint32;  Analysis flags 2

#define AF2_DOEH        0x00000001      //              Handle EH information
#define AF2_DORTTI      0x00000002      //              Handle RTTI information
#define AF2_MACRO       0x00000004      //              Try to combine several instructions into a macro instruction

#define INF_BASEADDR    12              // uval_t;  base paragraph of the program
#define INF_START_SS    13              // sel_t;   value of SS at the start
#define INF_START_CS    14              // sel_t;   value of CS at the start
#define INF_START_IP    15              // ea_t;    IP register value at the start of
#define INF_START_EA    16              // ea_t;    Linear address of program entry point
#define INF_START_SP    17              // ea_t;    SP register value at the start of
#define INF_MAIN        18              // ea_t;    address of main()
#define INF_MIN_EA      19              // ea_t;    The lowest address used
                                        //          in the program
#define INF_MAX_EA      20              // ea_t;    The highest address used
                                        //          in the program - 1
#define INF_OMIN_EA     21              // ea_t;
#define INF_OMAX_EA     22              // ea_t;
#define INF_LOWOFF      23              // ea_t;    low limit of voids
#define INF_HIGHOFF     24              // ea_t;    high limit of voids
#define INF_MAXREF      25              // uval_t;  max xref depth
#define INF_PRIVRANGE_START_EA 27       // ea_t;    Range of addresses reserved for internal use.
#define INF_PRIVRANGE_END_EA 28         // ea_t;    Initially specified by cfgvar PRIVRANGE

#define INF_NETDELTA    29              // sval_t; Delta value to be added to all addresses for mapping to netnodes.
                                        // Initially 0.
// CROSS REFERENCES
#define INF_XREFNUM     30              // uchar;   Number of references to generate
                                        //          0 - xrefs won't be generated at all
#define INF_TYPE_XREFNUM 31             // uchar;   Number of references to generate
                                        //          in the struct & enum windows
                                        //          0 - xrefs won't be generated at all
#define INF_REFCMTNUM   32              // uchar; number of comment lines to
                                        //        generate for refs to ASCII
                                        //        string or demangled name
                                        //        0 - such comments won't be
                                        //        generated at all
#define INF_XREFFLAG    33              // uchar;   xrefs representation:
#define         SW_SEGXRF       0x01    //              show segments in xrefs?
#define         SW_XRFMRK       0x02    //              show xref type marks?
#define         SW_XRFFNC       0x04    //              show function offsets?
#define         SW_XRFVAL       0x08    //              show xref values? (otherwise-"...")

// NAMES
#define INF_MAX_AUTONAME_LEN 34         // ushort;  max autogenerated name length (without zero byte)
#define INF_NAMETYPE    34              // char;    dummy names representation type
#define         NM_REL_OFF      0
#define         NM_PTR_OFF      1
#define         NM_NAM_OFF      2
#define         NM_REL_EA       3
#define         NM_PTR_EA       4
#define         NM_NAM_EA       5
#define         NM_EA           6
#define         NM_EA4          7
#define         NM_EA8          8
#define         NM_SHORT        9
#define         NM_SERIAL      10
#define INF_SHORT_DEMNAMES 36           // uint32;  short form of demangled names
#define INF_LONG_DEMNAMES 37            // uint32;  long form of demangled names
                                        //          see demangle.h for definitions
#define INF_DEMNAMES    38              // uchar;   display demangled names as:
#define         DEMNAM_CMNT  0          //              comments
#define         DEMNAM_NAME  1          //              regular names
#define         DEMNAM_NONE  2          //              don't display
#define         DEMNAM_GCC3  4          //          assume gcc3 names (valid for gnu compiler)
#define         DEMNAM_FIRST 8          //          override type info
#define INF_LISTNAMES   39              // uchar;   What names should be included in the list?
#define         LN_NORMAL       0x01    //              normal names
#define         LN_PUBLIC       0x02    //              public names
#define         LN_AUTO         0x04    //              autogenerated names
#define         LN_WEAK         0x08    //              weak names

// DISASSEMBLY LISTING DETAILS
#define INF_INDENT      40              // uchar;   Indention for instructions
#define INF_CMT_INDENT  41              // uchar;   Indention for comments
#define INF_MARGIN      42              // ushort;  max length of data lines
#define INF_LENXREF     43              // ushort;  max length of line with xrefs
#define INF_OUTFLAGS    44              // uint32;  output flags
#define         OFLG_SHOW_VOID  0x0002  //              Display void marks?
#define         OFLG_SHOW_AUTO  0x0004  //              Display autoanalysis indicator?
#define         OFLG_GEN_NULL   0x0010  //              Generate empty lines?
#define         OFLG_SHOW_PREF  0x0020  //              Show line prefixes?
#define         OFLG_PREF_SEG   0x0040  //              line prefixes with segment name?
#define         OFLG_LZERO      0x0080  //              generate leading zeroes in numbers
#define         OFLG_GEN_ORG    0x0100  //              Generate 'org' directives?
#define         OFLG_GEN_ASSUME 0x0200  //              Generate 'assume' directives?
#define         OFLG_GEN_TRYBLKS 0x0400 //              Generate try/catch directives?
#define INF_CMTFLG      45              // uchar;   comments:
#define         SCF_RPTCMT       0x01   //              show repeatable comments?
#define         SCF_ALLCMT       0x02   //              comment all lines?
#define         SCF_NOCMT        0x04   //              no comments at all
#define         SCF_LINNUM       0x08   //              show source line numbers
#define         SCF_TESTMODE     0x10   //              testida.idc is running
#define         SCF_SHHID_ITEM   0x20   //              show hidden instructions
#define         SCF_SHHID_FUNC   0x40   //              show hidden functions
#define         SCF_SHHID_SEGM   0x80   //              show hidden segments
#define INF_LIMITER     46              // uchar;   Generate borders?
#define INF_BIN_PREFIX_SIZE 47          // short;   # of instruction bytes to show
                                        //          in line prefix
#define INF_PREFFLAG    48              // uchar;   line prefix type:
#define         PREF_SEGADR     0x01    //              show segment addresses?
#define         PREF_FNCOFF     0x02    //              show function offsets?
#define         PREF_STACK      0x04    //              show stack pointer?
#define         PREF_PFXTRUNC   0x08    //              truncate instruction bytes if they would need more than 1 line

// STRING LITERALS
#define INF_STRLIT_FLAGS 49             // uchar;   string literal flags
#define         STRF_GEN        0x01    //              generate names?
#define         STRF_AUTO       0x02    //              names have 'autogenerated' bit?
#define         STRF_SERIAL     0x04    //              generate serial names?
#define         STRF_COMMENT    0x10    //              generate auto comment for string references?
#define         STRF_SAVECASE   0x20    //              preserve case of strings for identifiers
#define INF_STRLIT_BREAK 50             // uchar;   string literal line break symbol
#define INF_STRLIT_ZEROES 51            // char;    leading zeroes
#define INF_STRTYPE     52              // int32;   current ascii string type
                                        //          is considered as several bytes:
                                        //      low byte:
// Number of bytes per "units" in a string.
#define STRWIDTH_1B 0
#define STRWIDTH_2B 1
#define STRWIDTH_4B 2
#define STRWIDTH_MASK 0x03
// The string layout; how the string is laid out in data.
#define STRLYT_TERMCHR 0
#define STRLYT_PASCAL1 1
#define STRLYT_PASCAL2 2
#define STRLYT_PASCAL4 3
#define STRLYT_MASK 0xFC
#define STRLYT_SHIFT 2

#define INF_STRLIT_PREF 53              // char[16];ASCII names prefix
#define INF_STRLIT_SERNUM 54            // uval_t;  serial number

// DATA ITEMS
#define INF_DATATYPES   55              // uval_t;  data types allowed in data carousel

// COMPILER
#define INF_CC_ID       57              // uchar;   compiler
#define      COMP_MASK        0x0F      //              mask to apply to get the pure compiler id
#define         COMP_UNK      0x00      // Unknown
#define         COMP_MS       0x01      // Visual C++
#define         COMP_BC       0x02      // Borland C++
#define         COMP_WATCOM   0x03      // Watcom C++
#define         COMP_GNU      0x06      // GNU C++
#define         COMP_VISAGE   0x07      // Visual Age C++
#define         COMP_BP       0x08      // Delphi
#define         COMP_UNSURE   0x80      // uncertain compiler id
#define INF_CC_CM       58              // cm_t;  memory model & calling convention. see below
#define INF_CC_SIZE_I   59              // uchar;  sizeof(int)
#define INF_CC_SIZE_B   60              // uchar;  sizeof(bool)
#define INF_CC_SIZE_E   61              // uchar;  sizeof(enum)
#define INF_CC_DEFALIGN 62              // uchar;  default alignment
#define INF_CC_SIZE_S   63              // uchar;
#define INF_CC_SIZE_L   64              // uchar;
#define INF_CC_SIZE_LL  65              // uchar;
#define INF_CC_SIZE_LDBL 66             // uchar;  sizeof(long double)
#define INF_ABIBITS     67              // uint32; ABI features
#define   ABI_8ALIGN4       0x00000001  //   4 byte alignment for 8byte scalars (__int64/double) inside structures?
#define   ABI_PACK_STKARGS  0x00000002  //   do not align stack arguments to stack slots
#define   ABI_BIGARG_ALIGN  0x00000004  //   use natural type alignment for argument if the alignment exceeds native word size (e.g. __int64 argument should be 8byte aligned on some 32bit platforms)
#define   ABI_STACK_LDBL    0x00000008  //   long double areuments are passed on stack
#define   ABI_STACK_VARARGS 0x00000010  //   varargs are always passed on stack (even when there are free registers)
#define   ABI_HARD_FLOAT    0x00000020  //   use the floating-point register set
#define   ABI_SET_BY_USER   0x00000040  //   compiler/abi were set by user flag and require SETCOMP_BY_USER flag to be changed
#define   ABI_GCC_LAYOUT    0x00000080  //   use gcc layout for udts (used for mingw)
#define   ABI_MAP_STKARGS   0x00000100  //   register arguments are mapped to stack area (and consume stack slots)
#define   ABI_HUGEARG_ALIGN 0x00000200  //   use natural type alignment for an argument
                                        //   even if its alignment exceeds double native word size
                                        //   (the default is to use double word max).
                                        //   e.g. if this bit is set, __int128 has 16-byte alignment
#define INF_APPCALL_OPTIONS 68          // uint32; appcall options

// Pointer size, memory model, and calling convention are encoded using:
#define  CM_MASK   0x03         // Default pointer size:
#define   CM_UNKNOWN     0x00   //   unknown
#define   CM_N8_F16      0x01   //   if sizeof(int)<=2: near 1 byte, far 2 bytes
#define   CM_N64         0x01   //   if sizeof(int)>2: near 8 bytes, far 8 bytes
#define   CM_N16_F32     0x02   //   near 2 bytes, far 4 bytes
#define   CM_N32_F48     0x03   //   near 4 bytes, far 6 bytes
#define  CM_M_MASK   0x0C       // Memory model:
#define   CM_M_NN        0x00   //   small:   code=near, data=near (or unknown if CM_UNKNOWN)
#define   CM_M_FF        0x04   //   large:   code=far, data=far
#define   CM_M_NF        0x08   //   compact: code=near, data=far
#define   CM_M_FN        0x0C   //   medium:  code=far, data=near

#define is_code_far(cm) (((cm) & 4) != 0) // Does the given model specify far code?
#define is_data_far(cm) (((cm) &= CM_M_MASK) && (cm) != CM_M_FN) // Does the given model specify far data?

\defgroup CM_CC_
//@{
#define  CM_CC_MASK   0xF0      // Calling convention
#define   CM_CC_INVALID    0x00 // this value is invalid
#define   CM_CC_UNKNOWN    0x10 // unknown calling convention
#define   CM_CC_VOIDARG    0x20 // function without arguments
                                // if has other cc and argnum == 0,
                                // represent as f() - unknown list
#define   CM_CC_CDECL      0x30 // stack
#define   CM_CC_ELLIPSIS   0x40 // cdecl + ellipsis
#define   CM_CC_STDCALL    0x50 // stack, purged
#define   CM_CC_PASCAL     0x60 // stack, purged, reverse order of args
#define   CM_CC_FASTCALL   0x70 // stack, purged (x86), first args are in regs (compiler-dependent)
#define   CM_CC_THISCALL   0x80 // stack, purged (x86), first arg is in reg (compiler-dependent)
#define   CM_CC_GOLANG     0xB0 // GO: arguments and return value in stack
#define   CM_CC_SPECIALE   0xD0 // ::CM_CC_SPECIAL with ellipsis
#define   CM_CC_SPECIALP   0xE0 // Equal to ::CM_CC_SPECIAL, but with purged stack.
#define   CM_CC_SPECIAL    0xF0 // usercall: locations of all arguments
                                // and the return value are explicitly specified

// Convenience function to set a flag bit
static set_flag(off, bit, value)
{
  auto v = get_inf_attr(off);
  v = value ? (bit | v) : (~bit & v);
  return set_inf_attr(off, v);
}
// Set/get application bitness
#define inf_set_64bit()          set_flag(INF_LFLAGS, LFLG_64BIT, 1)
#define inf_set_32bit()          set_flag(INF_LFLAGS, LFLG_PC_FLAT, 1)
#define inf_is_64bit()           ((get_inf_attr(INF_LFLAGS) & LFLG_64BIT) != 0)
#define inf_is_32bit_or_higher() ((get_inf_attr(INF_LFLAGS) & LFLG_PC_FLAT) != 0)

Last updated 9 months ago

Was this helpful?