 交互式反汇编程序帮助索引

交互式反汇编程序帮助索引
有关附加信息和教程，请访问 https://www.hex-rays.com/products/ida
  主要理念

  菜单系统

  IDC 函数索引

  致谢
基本
  命令行开关
  配置文件
  环境变量
  键盘宏
  计算器
  段寄存器更改点
  问题列表
  定位器
  背景分析
  调试器
窗口
  反汇编窗口
  图表视图
  邻近视图
  箭头窗口
  消息窗口
  导出窗口
  导入窗口
  段窗口
  名称窗口
  函数窗口
  结构体窗口
  堆栈变量窗口
  枚举窗口
  问题窗口
  类型库窗口
  本地类型窗口
  签名窗口
  交叉引用窗口
  选择器窗口
  段寄存器窗口
  文件查看器
  文件编辑器
  字符串窗口
  函数调用窗口
如何...
  如何启动远程调试
  如何使用列表查看器
  如何使用记事本
  如何输入标识符
  如何输入段值
  如何输入地址
  如何输入数字
IDC 语言
  表达式
  语句
  变量
  函数
其他


 IDC 语言

IDC 语言
IDC 语言是一种类似于 C 的语言。它具有与 C 相同的词法标记：字符集、常量、标识符、关键字等。但是，由于它是一种脚本语言，因此没有指针，并且所有变量类型都可以由解释器处理。 任何变量都可以保存任何值; 声明变量时不指定其类型;

auto myvar;

IDC 的程序由函数的声明组成。默认情况下，执行从名为“main”的函数开始。选择要阅读的主题：


 按字母顺序列出的 IDC 函数

按字母顺序列出的 IDC 函数
函数描述使用下列约定：
  'ea' 是一个线性地址
  'success' 如果函数失败，则为 0，否则为 1
  'void' 意味着函数不会返回有意义的值(总是 0)
  'anyvalue' 意味着函数可以返回任何类型的值

 add_auto_stkpnt
 add_bpt
 add_cref
 add_default_til
 add_dref
 add_entry
 add_enum
 add_enum_member
 add_func
 add_hidden_range
 add_idc_hotkey
 add_segm_ex
 add_sourcefile
 add_struc
 add_struc_member
 add_user_stkpnt
 append_func_tail
 apply_type
 ask_addr
 ask_file
 ask_long
 ask_seg
 ask_str
 ask_yn
 atoa
 atol
 attach_process
 auto_mark
 auto_mark_range
 auto_unmark
 auto_wait
 batch
 begin_type_updating
 byte
 byte_value
 calc_gtn_flags
 call_system
 can_exc_continue
 check_bpt
 choose_func
 cleanup_appcall
 clear_selection
 clear_trace
 clr_database_flag
 collect_stack_trace
 compile_idc_file
 compile_idc_text
 create_align
 create_array
 create_byte
 create_custom_data
 create_data
 create_double
 create_dword
 create_float
 create_insn
 create_oword
 create_pack_real
 create_qword
 create_strlit
 create_struct
 create_tbyte
 create_word
 create_yword
 dalvik_get_array_elem
 dalvik_get_array_size
 dalvik_get_instance_fld
 dalvik_get_local
 dalvik_get_local_typed
 dbg_appcall
 decode_insn
 define_exception
 define_local_var
 del_array_element
 del_bpt
 del_cref
 del_dref
 del_enum
 del_enum_member
 del_extra_cmt
 del_fixup
 del_func
 del_hash_string
 del_hidden_range
 del_idc_hotkey
 del_items
 del_segm
 del_selector
 del_source_linnum
 del_sourcefile
 del_stkpnt
 del_struc
 del_struc_member
 del_user_info
 delattr
 delete_all_segments
 delete_array
 demangle_name
 detach_process
 diff_trace_file
 dword
 enable_bpt
 enable_tracing
 end_type_updating
 error
 eval
 EVAL_FAILURE
 eval_python
 exec_idc
 exec_python
 exit_process
 expand_struc
 fclose
 fgetc
 filelength
 find_binary
 find_code
 find_custom_data_format
 find_custom_data_type
 find_data
 find_defined
 find_func_end
 find_imm
 find_selector
 find_suspop
 find_text
 find_unknown
 first_func_chunk
 firstattr
 fopen
 force_bl_call
 force_bl_jump
 forget_exception
 format_cdata
 fprintf
 fputc
 fseek
 ftell
 func_contains
 gen_file
 gen_flow_graph
 gen_simple_call_chart
 generate_disasm_line
 get_appcall_options
 get_array_element
 get_array_id
 get_bmask_cmt
 get_bmask_name
 get_bookmark
 get_bookmark_desc
 get_bpt_attr
 get_bpt_ea
 get_bpt_qty
 get_bpt_tev_ea
 get_bytes
 get_call_tev_callee
 get_cmt
 get_color
 get_curline
 get_current_tev
 get_current_thread
 get_db_byte
 get_debug_name
 get_debug_name_ea
 get_debugger_event_cond
 get_double
 get_entry
 get_entry_name
 get_entry_ordinal
 get_entry_qty
 get_enum
 get_enum_cmt
 get_enum_flag
 get_enum_idx
 get_enum_member
 get_enum_member_bmask
 get_enum_member_by_name
 get_enum_member_cmt
 get_enum_member_enum
 get_enum_member_name
 get_enum_member_value
 get_enum_name
 get_enum_qty
 get_enum_size
 get_enum_width
 get_event_bpt_hea
 get_event_ea
 get_event_exc_code
 get_event_exc_ea
 get_event_exc_info
 get_event_exit_code
 get_event_id
 get_event_info
 get_event_module_base
 get_event_module_name
 get_event_module_size
 get_event_pid
 get_event_tid
 get_exception_code
 get_exception_flags
 get_exception_name
 get_exception_qty
 get_extra_cmt
 get_fchunk_attr
 get_fchunk_referer
 get_field_ea
 get_file_ext
 get_first_bmask
 get_first_cref_from
 get_first_cref_to
 get_first_dref_from
 get_first_dref_to
 get_first_enum_member
 get_first_fcref_from
 get_first_fcref_to
 get_first_hash_key
 get_first_index
 get_first_member
 get_first_module
 get_first_seg
 get_first_struc_idx
 get_fixup_target_dis
 get_fixup_target_flags
 get_fixup_target_off
 get_fixup_target_sel
 get_fixup_target_type
 get_flags
 get_float
 get_forced_operand
 get_fpnum
 get_frame_args_size
 get_frame_id
 get_frame_lvar_size
 get_frame_regs_size
 get_frame_size
 get_full_flags
 get_func_attr
 get_func_cmt
 get_func_flags
 get_func_name
 get_func_off_str
 get_gotea
 get_hash_long
 get_hash_string
 get_idb_path
 get_imagebase
 get_inf_attr
 get_input_file_path
 get_ip_val
 get_item_end
 get_item_head
 get_item_size
 get_last_bmask
 get_last_enum_member
 get_last_hash_key
 get_last_index
 get_last_member
 get_last_struc_idx
 get_local_tinfo
 get_manual_insn
 get_member_cmt
 get_member_flag
 get_member_id
 get_member_name
 get_member_offset
 get_member_qty
 get_member_size
 get_member_strid
 get_min_spd_ea
 get_module_info
 get_module_name
 get_module_size
 get_name
 get_name_ea
 get_name_ea_simple
 get_next_bmask
 get_next_cref_from
 get_next_cref_to
 get_next_dref_from
 get_next_dref_to
 get_next_enum_member
 get_next_fchunk
 get_next_fcref_from
 get_next_fcref_to
 get_next_fixup_ea
 get_next_func
 get_next_hash_key
 get_next_index
 get_next_module
 get_next_offset
 get_next_seg
 get_next_struc_idx
 get_nsec_stamp
 get_numbered_type_name
 get_operand_type
 get_operand_value
 get_ordinal_qty
 get_original_byte
 get_prev_bmask
 get_prev_enum_member
 get_prev_fchunk
 get_prev_fixup_ea
 get_prev_func
 get_prev_hash_key
 get_prev_index
 get_prev_offset
 get_prev_struc_idx
 get_process_state
 get_processes
 get_processor_name
 get_qword
 get_reg_value
 get_ret_tev_return
 get_root_filename
 get_screen_ea
 get_segm_attr
 get_segm_by_sel
 get_segm_end
 get_segm_name
 get_segm_start
 get_source_linnum
 get_sourcefile
 get_sp_delta
 get_spd
 get_sreg
 get_step_trace_options
 get_str_type
 get_strlit_contents
 get_struc_by_idx
 get_struc_cmt
 get_struc_id
 get_struc_idx
 get_struc_name
 get_struc_qty
 get_struc_size
 get_tev_ea
 get_tev_mem
 get_tev_mem_ea
 get_tev_mem_qty
 get_tev_qty
 get_tev_reg
 get_tev_tid
 get_tev_type
 get_thread_qty
 get_tinfo
 get_trace_file_desc
 get_type
 get_wide_byte
 get_wide_dword
 get_wide_word
 get_xref_type
 getattr
 getn_enum
 getn_thread
 getn_thread_name
 guess_type
 has_name
 has_user_name
 has_value
 has_xref
 hasattr
 idadir
 import_type
 inf_is_32bit_or_higher
 inf_is_64bit
 inf_set_32bit
 inf_set_64bit
 is_align
 is_bf
 is_bin0
 is_bin1
 is_byte
 is_char0
 is_char1
 is_code
 is_code_far
 is_custfmt0
 is_custfmt1
 is_custom
 is_data
 is_data_far
 is_dec0
 is_dec1
 is_defarg0
 is_defarg1
 is_double
 is_dword
 is_enum0
 is_enum1
 is_event_handled
 is_extra_cmts
 is_float
 is_float0
 is_float1
 is_flow
 is_head
 is_hex0
 is_hex1
 is_loaded
 is_manual0
 is_manual1
 is_mapped
 is_oct0
 is_oct1
 is_off0
 is_off1
 is_oword
 is_pack_real
 is_qword
 is_seg0
 is_seg1
 is_stkvar0
 is_stkvar1
 is_strlit
 is_stroff0
 is_stroff1
 is_struct
 is_tail
 is_tbyte
 is_union
 is_unknown
 is_valid_trace_file
 is_word
 is_yword
 jumpto
 lastattr
 load_and_run_plugin
 load_debugger
 load_trace_file
 loader_input_t.close
 loader_input_t.getc
 loader_input_t.gets
 loader_input_t.getz
 loader_input_t.read
 loader_input_t.readbytes
 loader_input_t.seek
 loader_input_t.size
 loader_input_t.tell
 loadfile
 ltoa
 make_array
 mkdir
 move_segm
 msg
 next_addr
 next_func_chunk
 next_head
 next_not_tail
 nextattr
 object.retrieve
 object.store
 op_bin
 op_chr
 op_dec
 op_enum
 op_flt
 op_hex
 op_man
 op_num
 op_oct
 op_offset
 op_offset_high16
 op_plain_offset
 op_seg
 op_stkvar
 op_stroff
 open_loader_input
 ord
 parse_decl
 parse_decls
 patch_byte
 patch_dbg_byte
 patch_dword
 patch_qword
 patch_word
 plan_and_wait
 plan_to_apply_idasgn
 prev_addr
 prev_head
 prev_not_tail
 prevattr
 print
 print_decls
 print_insn_mnem
 print_operand
 process_config_directive
 process_config_line
 process_ui_action
 put_bookmark
 qbasename
 qdirname
 qexit
 qisabspath
 qmake_full_path
 qmakefile
 qsleep
 qword
 read_dbg_byte
 read_dbg_dword
 read_dbg_memory
 read_dbg_qword
 read_dbg_word
 read_msr
 read_selection_end
 read_selection_start
 readlong
 readshort
 readstr
 rebase_program
 recalc_spd
 refresh_choosers
 refresh_debugger_memory
 refresh_idaview_anyway
 remove_fchunk
 rename
 rename_array
 rename_entry
 resume_process
 resume_thread
 retrieve_input_file_md5
 rotate_byte
 rotate_dword
 rotate_left
 rotate_word
 run_to
 RunPythonStatement
 sanitize_file_name
 save_database
 save_trace_file
 savefile
 search_path
 sel2para
 select_thread
 selector_by_name
 send_dbg_command
 set_appcall_options
 SET_APPCALL_TIMEOUT
 set_array_long
 set_array_params
 set_array_string
 set_bmask_cmt
 set_bmask_name
 set_bpt_attr
 set_bpt_cond
 set_cmt
 set_color
 set_current_tev
 set_database_flag
 set_debugger_event_cond
 set_debugger_options
 set_default_sreg_value
 set_enum_bf
 set_enum_cmt
 set_enum_flag
 set_enum_idx
 set_enum_member_cmt
 set_enum_member_name
 set_enum_name
 set_enum_width
 set_exception_flags
 set_fchunk_attr
 set_fixup
 set_flag
 set_frame_size
 set_func_attr
 set_func_cmt
 set_func_end
 set_func_flags
 set_func_start
 set_hash_long
 set_hash_string
 set_ida_state
 set_inf_attr
 set_local_type
 set_manual_insn
 set_member_cmt
 set_member_name
 set_member_type
 set_name
 set_processor_type
 set_reg_value
 set_remote_debugger
 set_root_filename
 set_segm_addressing
 set_segm_alignment
 set_segm_attr
 set_segm_class
 set_segm_combination
 set_segm_name
 set_segm_type
 set_segment_bounds
 set_selector
 set_source_linnum
 set_step_trace_options
 set_storage_type
 set_struc_cmt
 set_struc_idx
 set_struc_name
 set_tail_owner
 set_target_assembler
 set_trace_file_desc
 setattr
 sizeof
 split_sreg_range
 sprintf
 start_process
 step_back
 step_into
 step_over
 step_until_ret
 strfill
 stristr
 strlen
 strstr
 STRTERM1
 STRTERM2
 substr
 suspend_process
 suspend_thread
 take_memory_snapshot
 to_ea
 TO_LONG
 toggle_bnot
 toggle_sign
 tolower
 toupper
 trim
 TRUNC
 typeinfo.print
 typeinfo.size
 unlink
 update_extra_cmt
 update_hidden_range
 validate_idb_names
 value_is_float
 value_is_func
 value_is_int64
 value_is_long
 value_is_object
 value_is_pvoid
 value_is_string
 wait_for_next_event
 warning
 word
 write_dbg_memory
 write_msr
 writelong
 writeshort
 writestr
 xtol


 调试器相关 IDC 函数索引

调试器相关 IDC 函数索引

 add_bpt
 AddBpt
 attach_process
 can_exc_continue
 cleanup_appcall
 dbg_appcall
 define_exception
 del_bpt
 detach_process
 enable_bpt
 enable_tracing
 exit_process
 forget_exception
 get_bpt_attr
 get_bpt_ea
 get_bpt_qty
 get_current_thread
 get_debugger_event_cond
 get_event_bpt_hea
 get_event_ea
 get_event_exc_code
 get_event_exc_ea
 get_event_exc_info
 get_event_exit_code
 get_event_id
 get_event_info
 get_event_module_base
 get_event_module_name
 get_event_module_size
 get_event_pid
 get_event_tid
 get_exception_code
 get_exception_flags
 get_exception_name
 get_exception_qty
 get_first_module
 get_module_name
 get_module_size
 get_next_module
 get_processes
 get_process_state
 get_reg_value
 get_step_trace_options
 get_thread_qty
 getn_thread
 is_event_handled
 load_debugger
 read_msr
 refresh_debugger_memory
 resume_thread
 run_to
 select_thread
 send_dbg_command
 set_bpt_attr
 set_bpt_cond
 set_debugger_event_cond
 set_debugger_options
 set_exception_flags
 set_reg_value
 set_remote_debugger
 set_step_trace_options
 SetBptCnd
 start_process
 step_into
 step_over
 step_until_ret
 suspend_process
 suspend_thread
 wait_for_next_event
 read_msr


 终止 IDA

终止 IDA

 操作名称: Abort
此命令终止当前 IDA 会话。如果数据库未打包，则 Abort 命令不可用。

IDA 不会保存对磁盘的更改。

另参见

         其他文件...子菜单命令。
         退出命令。


 添加断点

添加断点

 操作名称: BreakpointAdd
该命令在当前地址添加一个断点。如果指令存在于该地址，则创建一个指令断点。否则，IDA 提供创建一个硬件断点，并允许用户 编辑断点 设置。硬件断点可以是真实的硬件断点或 页断点。
另参见:
   断点列表
   添加断点
   删除断点
   编辑断点
   断点子菜单
   页断点


 添加执行跟踪

添加执行跟踪

 操作名称: ExecTraceAdd
该命令向当前地址添加一个执行跟踪。

每次运行给定地址的指令时，调试器都会在跟踪窗口中添加一个跟踪事件。

事实上，执行跟踪只不过是具有特殊属性的断点：

在内部，调试器将在给定地址处添加断点指令。

另参见 跟踪窗口
          跟踪管理
          清除跟踪
          指令跟踪
          函数跟踪
          基本块跟踪
          添加写入跟踪
          添加读取/写入跟踪
          跟踪选项
          跟踪子菜单。


 添加读取/写入跟踪

添加读取/写入跟踪

 操作名称: ReadWriteTraceAdd
该命令向当前地址添加读取/写入跟踪。

每次以读取或写入模式访问给定地址时，调试器都会在跟踪窗口中添加一个跟踪事件。

事实上，读取/写入跟踪只不过是具有特殊属性的断点：

在内部，调试器将在给定的地址上添加一个硬件断点，所以硬件断点的所有限制也对读取/写入跟踪有效。

另参见 跟踪窗口
          跟踪管理
          清除跟踪
          指令跟踪
          函数跟踪
          基本块跟踪
          添加写入跟踪
          添加执行跟踪
          跟踪选项
          跟踪子菜单。


 添加监视

添加监视

 操作名称: AddWatch
该命令在当前地址添加一个监视。该监视在 监视列表窗口可见。
另参见:
   监视列表
   删除监视
   监视子菜单


 添加写入跟踪

添加写入跟踪

 操作名称: WriteTraceAdd
该命令向当前地址添加一个写入跟踪。

每次在写模式下访问给定地址时，调试器都会向跟踪窗口添加一个跟踪事件。

事实上，写入跟踪只不过是具有特殊属性的断点：

在内部，调试器将在给定的地址上添加一个硬件断点，所以 硬件断点的所有限制对于写入跟踪也是有效的。

另参见 跟踪窗口
          跟踪管理
          清除跟踪
          指令跟踪
          函数跟踪
          基本块跟踪
          添加读取/写入跟踪
          添加执行跟踪
          跟踪选项
          跟踪子菜单。


 添加/编辑枚举

添加/编辑枚举

 操作名称: AddEnum

 操作名称: EditEnum
这些命令允许你定义和编辑枚举类型。你需要指定：
        - 枚举的名称
        - 序列号 (1,2...)
        - 枚举成员的表达
每个枚举都有其 ID 和序列号。ID 是用于引用枚举的数字，而序列号用于在输出过程中对枚举进行排序。更改序列号会将枚举移动到另一个位置。

枚举的序列号显示在窗口的左下角。

你可以将任何数字指定为序列号，IDA 会将枚举移动到指定位置。

        1 - 当前枚举成为第一个枚举
        2 - 当前枚举成为第二个枚举
        ...
你还需要指定枚举常量的表达形式。你可以从各种数字基数(十六进制、十进制、八进制、二进制)和字符常量中进行选择。

你可以指定元素宽度或将其保留为零。零表达未指定元素宽度。允许的宽度是 2 的幂，范围为 1..64。

请注意，你可以通过选中“位域”复选框在此处创建 位域 定义。

当你打开枚举 窗口时，这些命令可用。

另参见

         编辑|枚举子菜单。
         如何输入数字。


 add_auto_stkpnt

add_auto_stkpnt

添加自动 SP 寄存器更改点
     func_ea  - 函数开始
     ea       - 其中 SP 更改的线性地址，
                通常这是修改堆栈指针指令的结尾(cmd.ea+cmd.size)
     delta    - SP 的新旧值之间的差异
返回：1-正常，0-失败

success add_auto_stkpnt(func_ea, ea, sval_t delta);


 add_default_til

add_default_til

加载类型库
     name - 库类型的名称。
返回: 1-正常，0-失败。

success add_default_til(string name);


 add_entry

add_entry

添加入口点
     ordinal - 入口点编号
                如果入口点没有序号
                number，'ordinal' 应等于 'ea'
     ea       - 入口点的地址
     name   - 入口点的名称。 如果 null 字符串，则入口点不会重命名。
makecode - 如果为 1，则此入口点是函数的起点。否则，它表达数据字节。
返回值： 0- 具有指定序号的入口点已存在
         1- 正常
success add_entry(long ordinal, long ea, string name, long makecode);


 add_enum

add_enum

add a new enum type
     idx - serial number of the new enum.
           If another enum with the same serial number
           exists, then all enums with serial
           numbers >= the specified idx get their
           serial numbers incremented (in other words,
           the new enum is put in the middle of the list
           of enums).
           If idx >= get_enum_qty() or idx == -1
           then the new enum is created at the end of
           the list of enums.
     name - name of the enum.
     flag - flags for representation of numeric constants
            in the definition of enum.
返回: id of new enum or -1.

long add_enum(long idx, string name, long flag);


 add_enum_member

add_enum_member

添加枚举的成员 - 一个符号常量
     enum_id - 枚举的 ID
     name - 符号常量的名称。 Must be unique
               in the program.
     value   - value of symbolic constant.
     bmask   - bitmask of the constant
               ordinary enums accept only -1 as a bitmask
               all bits set in value should be set in bmask too
返回: 0-ok, otherwise error code CONST_ERROR_...

long add_enum_member(long enum_id, string name, long value, long bmask);

#define CONST_ERROR_NAME  1     // already have member with this name (bad name)
#define CONST_ERROR_VALUE 2     // already have member with this value
#define CONST_ERROR_ENUM  3     // bad enum id
#define CONST_ERROR_MASK  4     // bad bmask
#define CONST_ERROR_ILLV  5     // bad bmask and value combination (~bmask & value != 0)


 add_func

add_func

create a function
     start, end - function bounds
                  If the function end address is BADADDR, then
                  IDA will try to determine the function bounds
                  automatically. IDA will define all necessary
                  instructions to determine the function bounds.
返回: !=0 - ok
note: an instruction should be present at the start address

success add_func(long start, long end=BADADDR);


 add_idc_hotkey

add_idc_hotkey

Add hotkey for IDC function
     hotkey  - hotkey name ('a', "Alt-A", etc)
     idcfunc - IDC function name
returns:
#define IDCHK_OK        0       // ok
#define IDCHK_ARG       -1      // bad argument(s)
#define IDCHK_KEY       -2      // bad hotkey name
#define IDCHK_MAX       -3      // too many IDC hotkeys

long add_idc_hotkey(string hotkey, string idcfunc);


 add_segm_ex

add_segm_ex

Create a new segment
     startea  - linear address of the start of the segment
     endea    - linear address of the end of the segment
                this address will not belong to the segment
                'endea' should be higher than 'startea'
     base     - base paragraph or selector of the segment.
                a paragraph is 16byte memory chunk.
                If a selector value is specified, the selector should be
                already defined.
     use32    - 0: 16bit segment, 1: 32bit segment, 2: 64bit segment
     align    - segment alignment. see below for alignment values
     comb     - segment combination. see below for combination values.
     flags    - combination of ADDSEG_... bits
返回: 0-failed, 1-ok

success add_segm_ex(long startea, long endea, long sel, long use32, long align, long comb, long flags);

#define ADDSEG_NOSREG   0x0001  // set all default segment register values to BADSELs
                     // (undefine all default segment registers)
#define ADDSEG_OR_DIE   0x0002  // qexit() if can't add a segment
#define ADDSEG_NOTRUNC  0x0004  // don't truncate the new segment at the beginning
                    // of the next segment if they overlap.
                    // destroy/truncate old segments instead.
#define ADDSEG_QUIET    0x0008  // silent mode, no "Adding segment..." in the messages window
#define ADDSEG_FILLGAP  0x0010  // If there is a gap between the new segment
                    // and the previous one, and this gap is less
                    // than 64K, then fill the gap by extending the
                    // previous segment and adding .align directive
                    // to it. This way we avoid gaps between segments.
                    // Too many gaps lead to a virtual array failure.
                    // It cannot hold more than ~1000 gaps.
#define ADDSEG_SPARSE   0x0020  // Use sparse storage method for the new segment


 add_sourcefile

add_sourcefile

Mark a range of address as belonging to a source file
   An address range may belong only to one source file.
   A source file may be represented by several address ranges.
        ea1     - linear address of start of the address range
        ea2     - linear address of end of the address range
        filename- name of source file.
   返回: 1-正常，0-失败。

success add_sourcefile(long ea1, ulong ea2, string filename);


 add_struc

add_struc

define a new structure type
     index    - index of new structure type
                If another structure has the specified index,
                then index of that structure and all other
                structures will be increentedfreeing the specifed
                index. If index is == -1, then the biggest index
                number will be used.
                See get_first_struc_idx() for the explanation of
                structure indices and IDs.

     name     - name of the new structure type.

     is_union - 0: structure
                1: union

返回: -1 if can't define structure type because of bad structure name:
            the name is ill-formed or is already used in the program.
         otherwise returns ID of the new structure type

long add_struc(long index, string name, long is_union);


 add_struc_member

add_struc_member

添加结构体成员。

此函数可以以两种形式使用。
First form:
long add_struc_member(long id, string name, long offset, long flag,
            long typeid, long nbytes);
Second form:
long add_struc_member(long id, string name, long offset, long flag,
            long typeid, long nbytes,
            long target, long tdelta, long reftype);

arguments:
  id      - structure type ID
  name    - name of the new member
  offset  - offset of the new member
         -1 means to add at the end of the structure
  flag    - type of the new member. Should be one of
        FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA
  typeid  - if is_struct(flag) then typeid specifies the structure id for the member
        if is_off0(flag) then typeid specifies the offset base.
        if is_strlit(flag) then typeid specifies the string type (STRTYPE_...).
        if is_stroff(flag) then typeid specifies the structure id
        if is_enum(flag) then typeid specifies the enum id
        Otherwise typeid should be -1
   nbytes  - number of bytes in the new member the remaining arguments are allowed only if isOff0(flag)
and you want to specify a complex offset expression
   target  - target address of the offset expr. 你可以将其指定为 -1，ida 会自行计算 tdelta - 偏移目标增量。usually 0 reftype - see REF_... definitions 返回: 0 - ok, otherwise error code STRUC_ERROR_...

long add_struc_member(long id, string name, long offset, long flag, long typeid,
              long nbytes, long target, long tdelta, long reftype);

// Constants used with begin_type_updating() and end_type_updating()
#define UTP_ENUM      0
#define UTP_STRUCT    1

#define STRUC_ERROR_MEMBER_NAME    (-1) // already has member with this name (bad name)
#define STRUC_ERROR_MEMBER_OFFSET  (-2) // already has member at this offset
#define STRUC_ERROR_MEMBER_SIZE    (-3) // bad number of bytes or bad sizeof(type)
#define STRUC_ERROR_MEMBER_TINFO   (-4) // bad typeid parameter
#define STRUC_ERROR_MEMBER_STRUCT  (-5) // bad struct id (the 1st argument)
#define STRUC_ERROR_MEMBER_UNIVAR  (-6) // unions can't have variable sized members
#define STRUC_ERROR_MEMBER_VARLAST (-7) // variable sized member should be the last member in the structure
#define STRUC_ERROR_MEMBER_NESTED  (-8) // recursive structure nesting is forbidden


 add_user_stkpnt

add_user_stkpnt

添加用户定义的 SP 寄存器更改点
     ea -SP 更改的线性地址
     delta -SP 的新旧值之间的差异
返回：1-ok，0-失败

success add_user_stkpnt(ea, sval_t delta);


 文件末尾的其他信息

文件末尾的其他信息
操作系统未将正在加载的文件完全加载到内存中。这可能是因为： - 文件被覆盖; IDA 不知道这种类型的叠加 - 文件末尾附加了调试信息 - 文件末尾有其他类型的信息。

无论如何，IDA 不会加载附加信息。


 已经录制了宏...

已经录制了宏...
不可能同时定义两个宏。 请完成第一个宏的定义(按 Alt-=)，然后再定义另一个。


 分析选项

分析选项

 操作名称: SetAuto
此命令允许你禁用和启用自动分析及其指示器。

通常，自动分析是启用的。如果你确定它会对你有所帮助，请禁用它。

在这里，你可以更改各种内核分析 选项 1 、选项 2 和 选项 3，更改处理器类型 (如果处理器模块支持多种类型) 或汇编程序样式。如果当前处理器有选项，则还会有一个按钮用于更改特定于处理器的选项。如果当前处理器支持内存映射，则还会有一个按钮用于更改内存映射范围。

分析指标位于 IDA 主窗口的左下角(文本版本的右上角)。该指标的可能值：

 "          "  空指示器表示指示器关闭。
 AU:  idle    自动分析完成。
 AU:disabled 自动分析已禁用。
 FL:<address> 正在跟踪执行流
 PR:<address> 正在创建函数
 TL:<address> 正在创建一个函数尾部
 SP:<address> 正在跟踪堆栈指针
 AC:<address> 正在分析地址
 LL:<number>  正在加载签名文件
 L1:<address> FLIRT 的第一遍
 L2:<address> FLIRT 的第二遍
 L3:<address> FLIRT 的第三遍
 TP:<address> 正在应用类型信息
 FI:<address> 自动分析最后通过
 WF:<address> 弱执行流正在被跟踪
 ??:<address> 地址变为未知
  @:<number> 各种活动的示值
提示：你可以右键单击分析指示器以快速禁用或启用它，或重新分析程序。

另参见 选项子菜单。自动分析说明。


 定位器

定位器
某些 IDA 命令(例如选择要输出的文件的一部分或指定要移动的段)需要定位点。

要放下定位器，你可以使用 Alt-L 键或 Shift-<arrow> 组合，这样更方便。你也可以用鼠标通过简单地单击并拖动它来放置定位器。

放下定位器后，你可以使用箭头等自由导航。任何使用定位器的命令都会引发它。

定位范围以另一种颜色显示。

退出 IDA 时，定位器值将丢失。


 Android 调试器

Android 调试器
Android 调试器具有以下特殊性和局限性：

- 支持 ARM 上的 Android(而不是 x86)

- 支持 ARM 和 Thumb 模式代码

- 可以调试多线程应用程序。然而，由于操作系统不报告线程死机，所以只有当调试器注意到线程丢失时(例如，因为出错当我们尝试挂起它时)，才被报告。

- 显然，在系统调用之前，Android 会将正在执行系统调用的应用程序报告为执行 "LDMFD SP!, {R4,R7}"。一旦系统调用完成，就到达下一个指令。

- 不支持硬件断点.

另参见:
   启动进程
   调试器子菜单
   如何启动远程调试


 Ghidra 的 Apache 许可证

Ghidra 的 Apache 许可证

                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. 你可以添加自己的归属
          你分发的衍生作品中的通知，以及
          或作为作品中通知文本的附录，提供
          此类附加归属通知不能被解释为
          修改许可证。

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. 你全权负责确定
      使用或重新分发作品的适当性，并承担任何
      与你行使本许可项下的权限相关的风险。

   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

   END OF TERMS AND CONDITIONS

   APPENDIX: How to apply the Apache License to your work.

      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information.(不要包含括号！)文本应该用文件格式的适当注释语法括起来。我们还建议
      文件或类名和用途描述应包含在
      与版权声明相同的“打印页面”，以便于使用
      在第三方档案中进行识别。

   Copyright [yyyy] [name of copyright owner]

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.


 LLVM 的 Apache 许可证

LLVM 的 Apache 许可证

==============================================================================
LLVM 项目采用带有 LLVM 例外的 Apache License v2.0：
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

    1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

    2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

    3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

    4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. 你可以添加自己的归属
          你分发的衍生作品中的通知，以及
          或作为作品中通知文本的附录，提供
          此类附加归属通知不能被解释为
          修改许可证。

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

    5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

    6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

    7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. 你全权负责确定
      使用或重新分发作品的适当性，并承担任何
      与你行使本许可项下的权限相关的风险。

    8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

    9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

    END OF TERMS AND CONDITIONS

    APPENDIX: How to apply the Apache License to your work.

      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information.(不要包含括号！)文本应该用文件格式的适当注释语法括起来。我们还建议
      文件或类名和用途描述应包含在
      与版权声明相同的“打印页面”，以便于使用
      在第三方档案中进行识别。

    Copyright [yyyy] [name of copyright owner]

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.

---- LLVM Exceptions to the Apache 2.0 License ----

As an exception, if, as a result of your compiling your source code, portions of this Software are embedded into an Object form of such source code, you may redistribute such embedded portions in such Object form without complying with the conditions of Sections 4(a), 4(b) and 4(d) of the License.
In addition, if you combine or link compiled forms of this Software with software that is licensed under the GPLv2 ("Combined Software") and if a court of competent jurisdiction determines that the patent provision (Section 3), the indemnity provision (Section 9) or other Section of the License conflicts with the conditions of the GPLv2, you may retroactively and prospectively choose to deem waived or otherwise exclude such Section(s) of the License, but only in their entirety and only with respect to the Combined Software.
============================================================================== Software from third parties included in the LLVM Project: ============================================================================== The LLVM Project contains third party software which is under different license terms. All such code will be identified clearly using at least one of two mechanisms: 1) It will be in a separate directory tree with its own `LICENSE.txt` or `LICENSE` file at the top containing the specific license and restrictions which apply to that software, or 2) It will contain specific license and restriction terms at the top of every file.
============================================================================== Legacy LLVM License (https://llvm.org/docs/DeveloperPolicy.html#legacy):
Copyright (c) 2007-2019 University of Illinois at Urbana-Champaign. All rights reserved.
Developed by:
    LLVM Team

    University of Illinois at Urbana-Champaign

    http://llvm.org

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal with the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    * Redistributions of source code must retain the above copyright notice,
      this list of conditions and the following disclaimers.

    * Redistributions in binary form must reproduce the above copyright notice,
      this list of conditions and the following disclaimers in the
      documentation and/or other materials provided with the distribution.

    * Neither the names of the LLVM Team, University of Illinois at
      Urbana-Champaign, nor the names of its contributors may be used to
      endorse or promote products derived from this Software without specific
      prior written permission.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE SOFTWARE.


 追加函数尾部

追加函数尾部

 操作名称: AppendFunctionTail
此命令将程序的任意范围追加到函数定义中。在应用此命令之前，必须选择一个范围。此范围不得与其他函数块相交(但是，可以将现有尾部添加到多个函数中)。

IDA 将要求选择用于选择的父函数，并将范围附加到函数定义中。

另参见

         编辑|函数子菜单。
         移除函数尾部


 苹果开放的源代码授权

苹果开放的源代码授权
下载本软件前，请仔细阅读本授权。在下载或使用本软件时，你应同意接受本授权条款的约束。如果你不接受或不同意本授权条款，请不要下载或使用该软件。

1. General; Definitions. This License applies to any program or other work which Apple Computer, Inc. ("Apple") makes publicly available and which contains a notice placed by Apple identifying such program or work as "Original Code" and stating that it is subject to the terms of this Apple Public Source License version 2.0 ("License"). As used in this License:

1.1 "Applicable Patent Rights" mean: (a) in the case where Apple is the grantor of rights, (i) claims of patents that are now 或 hereafter acquired, owned by 或 assigned to Apple and (ii) that cover subject matter contained in the Original Code, but only to the extent necessary to use, reproduce and/or distribute the Original Code without infringement; and (b) in the case where You are the grantor of rights, (i) claims of patents that are now 或 hereafter acquired, owned by 或 assigned to You and (ii) that cover subject matter in Your Modifications, taken alone 或 in combination with Original Code.

1.2 "Contributor" means any person 或 entity that creates or contributes to the creation of Modifications.

1.3 "Covered Code" means the Original Code, Modifications, the combination of Original Code and any Modifications, and/or any respective portions thereof.

1.4 "Externally Deploy" means: (a) to sublicense, distribute or otherwise make Covered Code available, directly or indirectly, to anyone other than You; and/or (b) to use Covered Code, alone or as part of a Larger Work, in any way to provide a service, including but not limited to delivery of content, through electronic communication with a client other than You.

1.5 "Larger Work" means a work which combines Covered Code or portions thereof with code not governed by the terms of this License.

1.6 "Modifications" mean any addition to, deletion from, and/or change to, the substance and/or structure of the Original Code, any previous Modifications, the combination of Original Code and any previous Modifications, and/or any respective portions thereof. When code is released as a series of files, a Modification is: (a) any addition to or deletion from the contents of a file containing Covered Code; and/or (b) any new file or other representation of computer program statements that contains any part of Covered Code.

1.7 "Original Code" means (a) the Source Code of a program 或 other work as originally made available by Apple under this License, including the Source Code of any updates 或 upgrades to such programs or works made available by Apple under this License, and that has been expressly identified by Apple as such in the header 文件(s) of such work; and (b) the object code compiled from such Source Code and originally made available by Apple under this License.

1.8 "Source Code" means the human readable form of a program or other work that is suitable for making modifications to it, including all modules it contains, plus any associated interface definition files, scripts used to control compilation and installation of an executable (object code).

1.9 "You" or "Your" means an individual or a legal entity exercising rights under this License. For legal entities, "You" or "Your" includes any entity which controls, is controlled by, or is under common control with, You, where "control" means (a) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (b) ownership of fifty percent (50%) or more of the outstanding shares or beneficial ownership of such entity.

2. Permitted Uses; Conditions & Restrictions. Subject to the terms and conditions of this License, Apple hereby grants You, effective on the date You accept this License and download the Original Code, a world-wide, royalty-free, non-exclusive license, to the extent of Apple's Applicable Patent Rights and copyrights covering the Original Code, to do the following:

2.1 Unmodified Code. You may use, reproduce, display, perform, internally distribute within Your organization, and Externally Deploy verbatim, unmodified copies of the Original Code, for commercial or non-commercial purposes, provided that in each instance:

(a) You must retain and reproduce in all copies of Original Code the copyright and other proprietary notices and disclaimers of Apple as they appear in the Original Code, and keep intact all notices in the Original Code that refer to this License; and

(b) You must include a copy of this License with every copy of Source Code of Covered Code and documentation You distribute or Externally Deploy, and You may not offer or impose any terms on such Source Code that alter or restrict this License or the recipients' rights hereunder, except as permitted under Section 6.

2.2 Modified Code. You may modify Covered Code and use, reproduce, display, perform, internally distribute within Your organization, and Externally Deploy Your Modifications and Covered Code, for commercial or non-commercial purposes, provided that in each instance You also meet all of these conditions:

(a) You must satisfy all the conditions of Section 2.1 with respect to the Source Code of the Covered Code;

(b) You must duplicate, to the extent it does not already exist, the notice in Exhibit A in each file of the Source Code of all Your Modifications, and cause the modified files to carry prominent notices stating that You changed the files and the date of any change; and

(c) If You Externally Deploy Your Modifications, You must make Source Code of all Your Externally Deployed Modifications either available to those to whom You have Externally Deployed Your Modifications, or publicly available. Source Code of Your Externally Deployed Modifications must be released under the terms set forth in this License, including the license grants set forth in Section 3 below, for as long as you Externally Deploy the Covered Code or twelve (12) months from the date of initial External Deployment, whichever is longer. You should preferably distribute the Source Code of Your Externally Deployed Modifications electronically (e.g. download from a web site).

2.3 Distribution of Executable Versions. In addition, if You Externally Deploy Covered Code (Original Code and/or Modifications) in object code, executable form only, You must include a prominent notice, in the code itself as well as in related documentation, stating that Source Code of the Covered Code is available under the terms of this License with information on how and where to obtain such Source Code.

2.4 Third Party Rights. You expressly acknowledge and agree that although Apple and each Contributor grants the licenses to their respective portions of the Covered Code set forth herein, no assurances are provided by Apple or any Contributor that the Covered Code does not infringe the patent or other intellectual property rights of any other entity. Apple and each Contributor disclaim any liability to You for claims brought by any other entity based on infringement of intellectual property rights or otherwise. As a condition to exercising the rights and licenses granted hereunder, You hereby assume sole responsibility to secure any other intellectual property rights needed, if any. For example, if a third party patent license is required to allow You to distribute the Covered Code, it is Your responsibility to acquire that license before distributing the Covered Code.

3. Your Grants. In consideration of, and as a condition to, the licenses granted to You under this License, You hereby grant to any person or entity receiving or distributing Covered Code under this License a non-exclusive, royalty-free, perpetual, irrevocable license, under Your Applicable Patent Rights and other intellectual property rights (other than patent) owned or controlled by You, to use, reproduce, display, perform, modify, sublicense, distribute and Externally Deploy Your Modifications of the same scope and extent as Apple's licenses under Sections 2.1 and 2.2 above.

4. Larger Works. You may create a Larger Work by combining Covered Code with other code not governed by the terms of this License and distribute the Larger Work as a single product. In each such instance, You must make sure the requirements of this License are fulfilled for the Covered Code or any portion thereof.

5. Limitations on Patent License. Except as expressly stated in Section 2, no other patent rights, express or implied, are granted by Apple herein. Modifications and/or Larger Works may require additional patent licenses from Apple which Apple may grant in its sole discretion.

6. Additional Terms. You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations and/or other rights consistent with the scope of the license granted herein ("Additional Terms") to one or more recipients of Covered Code. However, You may do so only on Your own behalf and as Your sole responsibility, and not on behalf of Apple or any Contributor. You must obtain the recipient's agreement that any such Additional Terms are offered by You alone, and You hereby agree to indemnify, defend and hold Apple and every Contributor harmless for any liability incurred by or claims asserted against Apple or such Contributor by reason of any such Additional Terms.

7. Versions of the License. Apple may publish revised and/or new versions of this License from time to time. Each version will be given a distinguishing version number. Once Original Code has been published under a particular version of this License, You may continue to use it under the terms of that version. You may also choose to use such Original Code under the terms of any subsequent version of this License published by Apple. No one other than Apple has the right to modify the terms applicable to Covered Code created under this License.

8. NO WARRANTY OR SUPPORT. The Covered Code may contain in whole or in part pre-release, untested, or not fully tested works. The Covered Code may contain errors that could cause failures or loss of data, and may be incomplete or contain inaccuracies. You expressly acknowledge and agree that use of the Covered Code, or any portion thereof, is at Your sole and entire risk. THE COVERED CODE IS PROVIDED "AS IS" AND WITHOUT WARRANTY, UPGRADES OR SUPPORT OF ANY KIND AND APPLE AND APPLE'S LICENSOR(S) (COLLECTIVELY REFERRED TO AS "APPLE" FOR THE PURPOSES OF SECTIONS 8 AND 9) AND ALL CONTRIBUTORS EXPRESSLY DISCLAIM ALL WARRANTIES AND/OR CONDITIONS, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES AND/OR CONDITIONS OF MERCHANTABILITY, OF SATISFACTORY QUALITY, OF FITNESS FOR A PARTICULAR PURPOSE, OF ACCURACY, OF QUIET ENJOYMENT, AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. APPLE AND EACH CONTRIBUTOR DOES NOT WARRANT AGAINST INTERFERENCE WITH YOUR ENJOYMENT OF THE COVERED CODE, THAT THE FUNCTIONS CONTAINED IN THE COVERED CODE WILL MEET YOUR REQUIREMENTS, THAT THE OPERATION OF THE COVERED CODE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT DEFECTS IN THE COVERED CODE WILL BE CORRECTED. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY APPLE, AN APPLE AUTHORIZED REPRESENTATIVE OR ANY CONTRIBUTOR SHALL CREATE A WARRANTY. You acknowledge that the Covered Code is not intended for use in the operation of nuclear facilities, aircraft navigation, communication systems, or air traffic control machines in which case the failure of the Covered Code could lead to death, personal injury, or severe physical or environmental damage.

9. LIMITATION OF LIABILITY. TO THE EXTENT NOT PROHIBITED BY LAW, IN NO EVENT SHALL APPLE OR ANY CONTRIBUTOR BE LIABLE FOR ANY INCIDENTAL, SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING TO THIS LICENSE OR YOUR USE OR INABILITY TO USE THE COVERED CODE, OR ANY PORTION THEREOF, WHETHER UNDER A THEORY OF CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCTS LIABILITY OR OTHERWISE, EVEN IF APPLE OR SUCH CONTRIBUTOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY REMEDY. SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OF LIABILITY OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION MAY NOT APPLY TO YOU. In no event shall Apple's total liability to You for all damages (other than as may be required by applicable law) under this License exceed the amount of fifty dollars ($50.00).

10. Trademarks. This License does not grant any rights to use the trademarks or trade names "Apple", "Apple Computer", "Mac", "Mac OS", "QuickTime", "QuickTime Streaming Server" or any other trademarks, service marks, logos or trade names belonging to Apple (collectively "Apple Marks") or to any trademark, service mark, logo or trade name belonging to any Contributor. You agree not to use any Apple Marks in or as part of the name of products derived from the Original Code or to endorse or promote products derived from the Original Code other than as expressly permitted by and in strict compliance at all times with Apple's third party trademark usage guidelines which are posted at http://www.apple.com/legal/guidelinesfor3rdparties.html.

11. Ownership. Subject to the licenses granted under this License, each Contributor retains all rights, title and interest in and to any Modifications made by such Contributor. Apple retains all rights, title and interest in and to the Original Code and any Modifications made by or on behalf of Apple ("Apple Modifications"), and such Apple Modifications will not be automatically subject to this License. Apple may, at its sole discretion, choose to license such Apple Modifications under this License, or on different terms from those contained in this License or may choose not to license them at all.

12. Termination.

12.1 Termination. This License and the rights granted hereunder will terminate:

(a) automatically without notice from Apple if You fail to comply with any term(s) of this License and fail to cure such breach within 30 days of becoming aware of such breach;

(b) immediately in the event of the circumstances described in Section 13.5(b); or

(c) automatically without notice from Apple if You, at any time during the term of this License, commence an action for patent infringement against Apple; provided that Apple did not first commence an action for patent infringement against You in that instance.

12.2 Effect of Termination. Upon termination, You agree to immediately stop any further use, reproduction, modification, sublicensing and distribution of the Covered Code. All sublicenses to the Covered Code which have been properly granted prior to termination shall survive any termination of this License. Provisions which, by their nature, should remain in effect beyond the termination of this License shall survive, including but not limited to Sections 3, 5, 8, 9, 10, 11, 12.2 and 13. No party will be liable to any other for compensation, indemnity or damages of any sort solely as a result of terminating this License in accordance with its terms, and termination of this License will be without prejudice to any other right or remedy of any party.

13. Miscellaneous.

13.1 Government End Users. The Covered Code is a "commercial item" as defined in FAR 2.101. Government software and technical data rights in the Covered Code include only those rights customarily provided to the public as defined in this License. This customary commercial license in technical data and software is provided in accordance with FAR 12.211 (Technical Data) and 12.212 (Computer Software) and, for Department of Defense purchases, DFAR 252.227-7015 (Technical Data -- Commercial Items) and 227.7202-3 (Rights in Commercial Computer Software or Computer Software Documentation). Accordingly, all U.S. Government End Users acquire Covered Code with only those rights set forth herein.

13.2 Relationship of Parties. This License will not be construed as creating an agency, partnership, joint venture or any other form of legal association between or among You, Apple or any Contributor, and You will not represent to the contrary, whether expressly, by implication, appearance or otherwise.

13.3 Independent Development. Nothing in this License will impair Apple's right to acquire, license, develop, have others develop for it, market and/or distribute technology or products that perform the same or similar functions as, or otherwise compete with, Modifications, Larger Works, technology or products that You may develop, produce, market or distribute.

13.4 Waiver; Construction. Failure by Apple or any Contributor to enforce any provision of this License will not be deemed a waiver of future enforcement of that or any other provision. Any law or regulation which provides that the language of a contract shall be construed against the drafter will not apply to this License.

13.5 Severability. (a) If for any reason a court of competent jurisdiction finds any provision of this License, or portion thereof, to be unenforceable, that provision of the License will be enforced to the maximum extent permissible so as to effect the economic benefits and intent of the parties, and the remainder of this License will continue in full force and effect. (b) Notwithstanding the foregoing, if applicable law prohibits or restricts You from fully and/or specifically complying with Sections 2 and/or 3 or prevents the enforceability of either of those Sections, this License will immediately terminate and You must immediately discontinue any use of the Covered Code and destroy all copies of it that are in your possession or control.

13.6 Dispute Resolution. Any litigation or other dispute resolution between You and Apple relating to this License shall take place in the Northern District of California, and You and Apple hereby consent to the personal jurisdiction of, and venue in, the state and federal courts within that District with respect to this License. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded.

13.7 Entire Agreement; Governing Law. This License constitutes the entire agreement between the parties with respect to the subject matter hereof. This License shall be governed by the laws of the United States and the State of California, except that body of California law concerning conflicts of law.

Where You are located in the province of Quebec, Canada, the following clause applies: The parties hereby confirm that they have requested that this License and all related documents be drafted in English. Les parties ont exige que le present contrat et tous les documents connexes soient rediges en anglais.

EXHIBIT A.

"Portions Copyright (c) 1999-2003 Apple Computer, Inc. All Rights Reserved.

This file contains Original Code and/or Modifications of Original Code as defined in and that are subject to the Apple Public Source License Version 2.0 (the 'License'). You may not use this file except in compliance with the License. Please obtain a copy of the License at http://www.opensource.apple.com/apsl/

The Original Code and all software distributed under the License are distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the specific language governing rights and limitations under the License."


 将补丁应用到输入文件

将补丁应用到输入文件

 操作名称: ApplyPatches
将以前 修补字节应用到输入文件。如果选择“恢复”选项，则原始字节将应用于输入文件。

另参见

         编辑|补丁核心子菜单。
         生成 DIF 文件


 apply_type

apply_type

Apply the specified type to the address
     ea    - the address of the object
     type  - typeinfo object or a C declaration string with ';'
             if specified as zero or an empty string, then the type
             assciated with 'ea' will be deleted
     flags - combination of TINFO_... constants or 0
返回: 1-正常，0-失败。
Note: this function accepts member ids and change struct member types too

success apply_type(long ea, typeinfo type, long flags = TINFO_DEFINITE);
#define TINFO_GUESSED    0x0000 // this is a guessed type #define TINFO_DEFINITE   0x0001 // this is a definite type #define TINFO_DELAYFUNC  0x0002 // if type is a function and no function exists at ea, // schedule its creation and argument renaming to auto-analysis // otherwise try to create it immediately


 ARM 处理器详情

ARM 处理器详情
由于架构版本 v4 (在 ARM7 内核中引入)，ARM 处理器具有一个名为 Thumb 的新的16位指令集 (原来32位集称为“ARM”)。由于这两个集合具有不同的指令编码，并且可以在一个段中混合，所以我们需要一种方法来指定如何反汇编指令。为此，IDA 使用名为“T”的虚拟段寄存器。如果其值为 0，则使用 ARM 模式。否则，将使用 Thumb 模式。ARM 是默认模式。请注意，如果你更改区域 T 寄存器的值，IDA 会破坏该区域中的所有指令，因为它们的反汇编不再正确。

IDA 默认使用 UAL(统一汇编语言)语法，该语法对 ARM 和 Thumb 模式使用相同的语法。如有必要，可以在 分析选项中选择旧版汇编程序语法。

要解码 Aarch64 (ARM64) 指令，必须将包含指令的段 设置为 64 位。

ARM 处理器选项

简化指令

      如果打开该选项，IDA 将简化指令，并用更清晰的伪指令取代它们
      例如,

              MOV     PC, LR

      被替换为

              RET
禁用指针解除引用
      如果此选项处于打开状态，IDA 将不会使用 =label 语法
      从文本池加载。
      例如，

                    LDR     R1, =dst
                    ...
      off_0_1003C   DCD dst

      将被替换为

                    LDR     R1, off_0_1003C
没有自动 ARM-Thumb 开关
      如果打开该选项，IDA 在跟随跳转和调用时将不会自动传送
      ARM-Thumb 模式。
禁用 BL 跳转检测
      某些 Thumb 模式的 ARM 编译器在长跳转时使用 BL (分支链接) 而不是 B (分支)，
     因为 BL 的范围更大。
      默认情况下，IDA 会尝试确定 BL 是跳转还是调用。

      你可以使用 "编辑/其他" 菜单中的命令覆盖 IDA 的决定
      (强制 BL 调用/强制 BL 跳转)。
      如果你的目标不使用此技巧，则可以设置此选项
      IDA 将始终将 BL 视为调用。
分散的 MOVT/MOVW 对分析 一对 MOVT 和 MOVW 指令可用于将任何 32 位常量加载到寄存器中，而无需使用文本池。例如：MOVW R1#0xABA2MOVT R1, #0x32AA 被 IDA 简化为 MOV R1, 0x32AAABA2(除非 关闭宏创建)
      但是，如果它们之间存在不相关的指令，则此类
      简化是不可能的。 如果你启用转换，则 IDA 将尝试
      转换偶数分散指令的操作数。上面的例子可以表示为：

      MOVW  R1, #:lower16:0x32AAABA2
      [other instructions]
      MOVT  R1, #:upper16:0x32AAABA2

      可以选择 IDA 应如何积极处理此类配对：
      让它们保持原样，只在结果是有效地址时才转换，或者即使结果看起来不像有效地址，也尝试转换所有地址对。
编辑 ARM 架构选项
      此按钮允许你编辑 ARM 体系结构体的各种功能。
      这会影响部分指令的反汇编，具体取决于是否
      所选的体系结构体支持它们。有关详细信息，请参阅 ARM 架构参考手册。

命令行选项

      你可以从命令行配置架构选项。
      为此，请使用 -parm:<option1[;option2...]> 开关。
      接受以下选项：

      ARMv  - 基本架构版本 (如 ARMv4, ARMv4T,ARMv5TE, ..., ARMv7-M, ARMv7-A)

       或

         - ARM 核心名称(如 ARM7TDMI, ARM926EJ-S, PXA270, Cortex-M3, Cortex-A8)

      此外，可以使用特殊名称“ armmeta ”“来解码所有已知指令。

      上述选项将设置一些可以进一步调整的默认值：
      NoVFP/VFPv<N>           - 禁用或启用对 VFP 指令的支持(例如 VFPv3)。
      NoNEON/NEON/NEON-FMA    - 禁用或启用对 NEON (又名高级 SIMD) 指令的支持。
      NoThumb/Thumb/Thumb-2   - 禁用或启用对 Thumb (16-位) 或 Thumb-2 (16/32-位) 指令的支持。
      NoARM/ARM               - 禁用或启用对 ARM 指令的支持。
      XScale                  - 对 XScale 特定指令的支持。
                             隐含 ARMv5TE。
      NoWMMX/WMMXv1/WMMXv2    - 支持 Intel Wireless MMX 扩展 (v1 或 v2)。隐含 XScale。
参见命令了解如何指定段寄存器值。


 ARM 详情

ARM 详情

某些 Thumb 模式下的 ARM 编译器使用 BL(分支和链接)
跳远而不是 B(分支)，因为 BL 的范围更大。
默认情况下，IDA 会尝试确定 BL 是跳转还是调用。
你可以使用“编辑/其他”菜单中的命令覆盖 IDA 的决定
(强制 BL 调用/强制 BL 跳转)或以下两个功能。

//  强制 BL 指令为跳转 //       ea - BL 指令的地址 //  返回: 1-正常，0-失败
success force_bl_jump(long ea);
//  强制 BL 指令为调用//       ea - BL 指令的地址 //  返回: 1-正常，0-失败
success force_bl_call(long ea);


 箭头窗口

箭头窗口
在图表版本中，反汇编的左侧有一个带有箭头的小窗口。这些箭头表达执行流程，即分支和跳转指令。箭头颜色可以是：
        - 红色：表达箭头源和目标不属于同一函数。 通常情况下，分支位于函数内部，
          红色将明显代表来自或通往不同函数的分支。

        - 黑色：当前选择的箭头。通过使用向上或向下键移动到箭头的开头或结尾，
          或者左键单击箭头的开始或箭头结束，可以进行选择。按 PageUp、PageDown、Home、End 键
           或使用滚动条不会更改选择。这允许将所选箭头追踪到很远的地方。
        - 灰色：所有其他箭头
箭头粗细可以是：
        - 粗的：向后箭头。向后箭头通常表示循环。粗箭头表示清晰和值得注意的方式。
        - 细的：向前箭头。
最后，箭头可以是实心或虚线。虚线箭头表示条件分支，而实心箭头表示无条件分支。

你可以使用垂直拆分器调整箭头窗口的大小，甚至可以完全隐藏它。如果它被隐藏，箭头窗口在屏幕上将不可见，但你可以通过向右拖动拆分器来显示它。当你关闭反汇编窗口时，IDA 会记住注册表中的当前箭头窗口大小。


 Asks

Asks

// Ask the user to enter a string
//      defval - the default string value. This value
//               will appear in the dialog box.
//      hist   - history id. One of HIST_... constants
//      prompt - the prompt to display in the dialog box
// Returns: the entered string.

string ask_str(string defval, long hist, string prompt);

#define HIST_SEG    1           ///< segment names
#define HIST_CMT    2           ///< comments
#define HIST_SRCH   3           ///< search substrings
#define HIST_IDENT  4           ///< names
#define HIST_FILE   5           ///< file names
#define HIST_TYPE   6           ///< type declarations
#define HIST_CMD    7           ///< commands
#define HIST_DIR    8           ///< directory names (text version only)

// Ask the user to choose a file
//      for_saving- 0: "Open" dialog box, 1: "Save" dialog box
//      mask   - the input file mask as "*.*" or the default file name.
//      prompt - the prompt to display in the dialog box
// Returns: the selected file.

string ask_file(bool for_saving, string mask, string prompt);

// 要求用户输入地址
//      defval - 默认地址值。此值将出现在对话框中。
//      prompt - the prompt to display in the dialog box
// Returns: the entered address or BADADDR.

long ask_addr(long defval, string prompt);

// 要求用户输入一个数字
//      defval - 默认值。 此值将出现在对话框中。
//      prompt - the prompt to display in the dialog box
// Returns: the entered number or -1.

long ask_long(long defval, string prompt);

// Ask the user to enter a segment value
//      defval - 默认值。 此值将出现在对话框中。
//      prompt - the prompt to display in the dialog box
// Returns: the entered segment selector or BADSEL.

long ask_seg(long defval, string prompt);

// Ask the user a question and let him answer Yes/No/Cancel
//      defval - the default answer. This answer will be selected if the user
//               presses Enter.
//      prompt - the prompt to display in the dialog box
// Returns: -1:cancel, 0-no, 1-ok

long ask_yn(long defval, string prompt);


 汇编一个指令

汇编一个指令

 操作名称: Assemble
此命令允许你组合指令。目前，只有 IBM PC 处理器提供汇编程序，尽管如此，插件编写器可以通过编写自己的汇编程序来扩展或完全替换内置汇编程序。

汇编程序要求将所有内存引用括在方括号中。例如：

        mov ax, [counter]
此外，不得使用关键字“offset”。代替
        mov eax, offset name
你必须写为
        mov eax, name
另参见
         编辑|补丁核心子菜单。
         如何输入数字。


 汇编程序指令对话框

汇编程序指令对话框
此命令启用/禁用某些汇编程序指令的生成，即：
        assume 指令
        origin 指令
有时(当你不打算汇编输出文件时)，你可能希望禁用它们的生成。

另参见 选项子菜单。


 汇编程序级别和 C 级别类型

汇编程序级别和 C 级别类型
为了提供直观而强大的接口类型，IDA 引入了两种类型：
  - 汇编程序级别类型
  - C 级别类型
汇编程序级别类型是用户使用结构体 或 枚举 视图。

由于用户必须手动指定杆件偏移量和其他属性，因此 IDA 认为杆件偏移量是固定的，并且从不移动此类类型的杆件。如果结构体的成员变得太大并且不再适合该结构体，IDA 将删除它。

在本地类型窗口中定义的类型被视为 C 级别类型。对于它们，IDA 会自动计算成员偏移量，如有必要，可能会移动成员并更改总结构体大小。

用户只需在相应的窗口中编辑类型即可更改类型级别。例如，如果从结构体视图编辑 C 级别类型，则 IDA 将会将此类类型视为汇编程序级别类型。

 在结构体/枚举视图中：
  汇编程序级别类型使用常规颜色显示。
  C 级别类型以灰色显示，就好像它们被禁用一样(但事实并非如此)。

 在本地类型视图中：
  C 级别类型使用常规颜色显示。
  汇编程序级别类型以灰色显示，就好像它们被禁用一样(但事实并非如此)。


 atoa

atoa

Convert address value to a string
Returns address in the form 'seg000:1234'
(the same as in line prefixes)

string atoa(long ea);


 atol

atol

Convert ascii string to a number
     str - a decimal representation of a number
返回: a binary number
另参见 ord() function
Thread-safe function.

long atol(string str);


 附加到进程

附加到进程

 操作名称: ProcessAttach
该命令显示与数据库中的反汇编文件相对应的运行进程，并允许用户选择要附加的进程。
另参见:
   启动进程
   进程选项
   暂停进程
   终止进程
   从进程分离
   调试器子菜单


 attach_process

attach_process

Attach the debugger to a running process
     pid - PID of the process to attach to. If NO_PROCESS, a dialog box
           will interactively ask the user for the process to attach to.
     event_id - reserved, must be -1
returns:
        -2 - impossible to find a compatible process
        -1 - impossible to attach to the given process (process died, privilege
             needed, not supported by the debugger plugin, ...)
         0 - the user cancelled the attaching to the process
         1 - the debugger properly attached to the process
See the important note to the step_into() function

long attach_process(long pid, long event_id);


 自动分析未完成

自动分析未完成
只要没有完成自动分析，IDA 数据库就不一致：
  - 并非所有交叉引用都能找到
  - 并非所有指令都已反汇编
  - 并非所有数据项都会被探查
另参见：自动分析 设置自动分析


 auto_mark_range

auto_mark_range

计划在将来执行操作。
此函数会将你的请求放入一个特殊的自动分析队列。
稍后，IDA 将从队列中检索请求并进行处理
它。有几种自动分析队列类型。IDA 将处理所有
从第一个队列查询，然后切换到第二个队列，等等。

// plan/unplan range of addresses
void auto_mark_range(long start, long end, long queuetype);
void auto_unmark(long start, long end, long queuetype);

// plan to analyze an address
#define auto_mark(ea, qtype)      auto_mark_range(ea, (ea)+1, qtype)

#define AU_UNK  10      // make unknown
#define AU_CODE 20      // convert to instruction
#define AU_PROC 30      // make function
#define AU_USED 40      // reanalyze
#define AU_LIBF 60      // apply a flirt signature (the current signature!)
#define AU_FINAL 200    // coagulate unexplored items


 auto_wait

auto_wait

Wait for the end of autoanalysis
This function will suspend execution of IDC program
till the autoanalysis queue is empty.

void auto_wait();


 背景分析

背景分析
IDA 可以在程序未被占用时分析程序，执行你提示的操作。你与 IDA 一起反汇编程序，但你的请求具有优先权。

背景分析的状态显示在屏幕的右上角。

你可以 禁用 自动分析，但在这种情况下，IDA 的某些功能会产生奇怪的结果 (例如，如果你尝试将数据转换为指令，IDA 将不会跟踪控制流的所有线程，并且数据将仅在屏幕上转换为指令...)

另参见 分析选项。


 错误的 BIOS 和 DOS 注释库

错误的 BIOS 和 DOS 注释库
IDA 无法使用该数据库 (ida.int)，因为
        - 不存在或
        - 有错误
在这种情况下，IDA 不会在 DOS 和 BIOS 上生成新的自动注释。


 错误的宏

错误的宏
无法重新定义 Alt-- 和 Alt-= 键，因为它们用于定义其他宏。

请为宏选择另一个键。


 错误的重定位表

错误的重定位表
重定位表的引用超出了程序限制。


 基本块跟踪

基本块跟踪

 操作名称: ToggleTraceBasicBlocks
该命令启动基本块跟踪。然后, 你可以照常使用所有调试器命令: 调试器将保存到达临时基本块断点的所有地址。

在内部，调试器正常运行当前线程，在从当前函数引用的每个函数的每个基本块的最后指令中，设置临时断点，并且在跟踪的基本块中间的任何调用指令中也设置临时断点。

基本块跟踪比正常执行慢，但比指令或函数跟踪快。

另参见 跟踪窗口
          跟踪管理
          清除跟踪
          指令跟踪
          函数跟踪
          添加写入跟踪
          添加读取/写入跟踪
          添加执行跟踪
          跟踪选项
          跟踪子菜单。


 batch

batch

Enable/disable batch mode of operation
     batch:  0 - ida will display dialog boxes and wait for the user input
             1 - ida will not display dialog boxes, warnings, etc.
返回: old balue of batch flag

long batch(long batch);


 begin_type_updating

begin_type_updating

Begin type updating. Use this function if you
plan to call AddEnumConst or similar type modification functions
many times or from inside a loop

     utp - (one of UTP_... consts)
returns: none

success begin_type_updating(long utp);


 二进制字符串格式

二进制字符串格式

可以输入以下项的序列：

  - 所选基数中的数字(十六进制、十进制或八进制)
  - 字符串常量："string"
  - Unicode 字符串常量： L"unicode string"
  - 问号 '?' 忽略变量字节

序列必须用空格或逗号分隔。

输入的数字将占用它适合的最小字节数，但字节数是 2 的幂(1、2 或 4 字节)的限制。
两个问号之间没有空格，与一个问号相同。一个问号对应一个 CPU 字节。对于宽字节 CPU，一个 CPU 字节可能由多个八位字节组成，例如 TMS320C28。
示例:
  CD 21          - 字节 0xCD, 0x21
  21CD           - 字节 0xCD, 0x21(顺序取决于字节序)
  "Hello", 0     - 以 null 结尾的字符串 "Hello"
  L"Hello"       - 'H', 0, 'e', 0, 'l', 0, 'l', 0, 'o', 0
  B8 ? ? ? ? 90  - 字节 0xB8, 4 字节，任意值，字节 0x90


 位域

位域
有一种特殊的 枚举：位域。位域是划分为位组的枚举。在位字段中定义新的符号常量时，需要指定该常量所属的组。默认情况下，IDA 建议每个组包含一个位。如果尚未定义组，则在定义组中的第一个常量时会自动创建该组。例如:
        name   CONST1
        value    0x1
        mask    0x1
将定义一个名为 CONST1 且值为 1 的常量，并将创建一个仅包含一位的组。另一个例子。让我们考虑以下定义：
 #define  OOF_SIGNMASK    0x0003
 #define  OOFS_IFSIGN   0x0000
 #define  OOFS_NOSIGN   0x0001
 #define  OOFS_NEEDSIGN 0x0002
 #define  OOF_SIGNED      0x0004
 #define  OOF_NUMBER      0x0008
 #define  OOF_WIDTHMASK   0x0030
 #define  OOFW_IMM      0x0000
 #define  OOFW_16       0x0010
 #define  OOFW_32       0x0020
 #define  OOFW_8        0x0030
 #define  OOF_ADDR        0x0040
 #define  OOF_OUTER       0x0080
 #define  OOF_ZSTROFF     0x0100
我们如何描述这一点？
    名称                值           掩码         掩码名称

 OOFS_IFSIGN   0x0000   0x0003 OOF_SIGNMASK
 OOFS_NOSIGN   0x0001   0x0003 OOF_SIGNMASK
 OOFS_NEEDSIGN 0x0002   0x0003 OOF_SIGNMASK
 OOF_SIGNED      0x0004   0x0004
 OOF_NUMBER      0x0008   0x0008
 OOFW_IMM      0x0000   0x0030 OOF_WIDTHMASK
 OOFW_16       0x0010   0x0030 OOF_WIDTHMASK
 OOFW_32       0x0020   0x0030 OOF_WIDTHMASK
 OOFW_8        0x0030   0x0030 OOF_WIDTHMASK
 OOF_ADDR        0x0040   0x0040
 OOF_OUTER       0x0080   0x0080
 OOF_ZSTROFF     0x0100   0x0100
如果掩码由多个位组成，则它可以具有名称和注释。在定义带有掩码的常量时，可以设置掩码名称。IDA 将以不同的颜色显示掩码名称。

为了在程序中使用位域，只需将指令操作数转换为 枚举即可。IDA 将显示操作数，如下所示：

        mov     ax, 70h
将替换为
        mov     ax, OOFS_IFSIGN or OOFW_8 or OOF_ADDR
另参见 枚举窗口


 按位取反操作数

按位取反操作数

 操作名称: BitwiseNegate
此命令按位取反当前操作数。请注意，并非所有类型的操作数都可以取反。不可能同时取反和更改操作数的符号。

仅当当前汇编程序支持按位取反操作时，此命令才有效。

另参见：

          编辑|操作数类型子菜单。
          手动输入 #th 操作数 命令。
          设置操作数类型


 Bochs 调试器

Bochs 调试器
Bochs 调试器插件使用 Bochs 内部命令行调试器。 有关内部调试器的详细信息：http://bochs.sourceforge.net/doc/docbook/user/internal-debugger.html

要使用 Bochs 调试器插件，必须执行以下步骤:

  - Download and install Bochs v2.6.x from:
        http://bochs.sourceforge.net/getcurrent.html

    For Mac OS or Linux, please refer to the following guide:
        https://www.hex-rays.com//products/ida/support/tutorials/debugging_bochs_linux.pdf

  - Open or create an IDB file in IDA and select the Bochs debugger

  - 在“调试器选项”、“设置特定选项”中配置调试器特定选项。
    One of three possible modes of operation can be selected: image, idb, or pe.
Because the debugger plugin uses the Bochs command line debugger, it has the following limitations:
  - Breakpoints: the Bochs debugger has the limit of 10 physical, 10
    virtual, and 10 linear breakpoints. Since IDA uses some breakpoints
    for its own purposes, only 20 breakpoints can be set by the user

  - Watchpoints: the Bochs debugger has the limit of 16 read and 16 write
    watchpoints

  - FPU registers, MMX, XMM, control, task and segment registers cannot be modified
There are ways to overcome some of the limitations mentioned above by downloading Bochs source code and modifying it. For example, the number of allowed breakpoints can be increased.

The Bochs debugger configuration dialog box has the following entries:

  BOCHSRC
    This is the path to the Bochs configuration file template. It contains
    special variables prefixed with "$". These variables should not be
    modified or changed by the user, as they are automatically filled by the
    plugin. Other entries can be modified as needed.

操作模式用户可以在磁盘映像、IDB 和 PE 操作模式之间进行选择。

  删除image 文件 upon session end
    If enabled, IDA will 自动 delete the Bochs disk images used for
    the debugging session (this option only applies to IDB and PE operation modes).
    If the plugin (in IDB operation mode) finds a previously created image, it verifies that it
    corresponds to the database and uses it as is. Unchecking this option
    for the IDB operation mode will speed up launching the 调试器.

  64-bit emulation
    This options enables 64bit emulation. It is only present in the 64-bit version of IDA.
    By default, the Bochs plugin will try to detect whether to choose 32 或 64-bit emulation.
默认配置参数取自 ida\cfg\dbg_bochs.cfg。

The Bochs 调试器模块 adds a new menu item: 调试器, Bochs 命令。 It can be used to send arbitrary commands to Bochs. The 命令 output is displayed in the 消息窗口 (there is also an IDC counterpart of this 函数, please refer to "startup.idc" 文件). 该命令 is very useful but may interfere with IDA, especially if the user modifies breakpoints 或 resume execution outside IDA.

 另请参阅:
        磁盘映像操作模式
        Bochs IDB 操作模式
        Bochs PE 操作模式
        Bochs 插件操作模式常见问题


 Bochs 调试器常见问题解答

Bochs 调试器常见问题解答
General:

- How are breakpoints treated by IDA Bochs Plugin: Bochs 调试器 does not use breakpoints by inserting 0xCC at the given address. Instead, since it is an emulator, it constantly compares the current 指令 pointer against the 断点列表. Data breakpoints are supported by Bochs and are known as "watchpoints". If the user creates 硬件断点, IDA will 自动 创建Bochs watchpoints.

- 如何 select the Bochs operation mode programmatically: using IDC: it is possible to use ChangeConfig() 函数 to pass a key=value. For example, process_config_line("DEFAULT_MODE=1") will select the disk image operation mode. (Please refer to cfg\dbg_bochs.cfg for list of configurable options).

- When debugging, IDA undefines instructions: if the "Debugger options / Reconstruct stack" is checked and the stack pointer is in the same segment as the currently executing code, then IDA might undefine instructions. To solve this program, uncheck the reconstruct stack option.

- How to convert from physical to linear addresses and vice versa: Bochs internal debugger provides two useful commands for this: "info tab" and "page".

Disk image operation mode:

- Data/Software breakpoints are not always triggered: During a debugging session, when a breakpoint is created while the protected mode/paging is enabled, the page table信息 is used to translate addresses and correctly 创建the breakpoint. When debugging session is started again, IDA cannot access translation tables to re-创建the same breakpoint, thus the breakpoint will be created without any translation信息 (it will be treated as physical addresses) This is why those breakpoints are not triggered. As a workaround, we suggest disabling those breakpoints and re-enable them when paging is enabled. This problem can also arise when the "use virtual breakpoints" option is enabled.

IDB/PE operation mode:

- Cannot map VA: Sometimes, IDA may display a message stating that a given VA could not be mapped. This mainly happens because both IDB/PE operation modes use virtual addresses from 0x0 to 0x9000 and from 0xE0000000 to 0xFFFFFFFF internally. To solve the problem, please rebase the program to another area:

  - IDB operation mode: use 编辑, 段, Rebase 程序
  - PE operation mode: rebase the input 文件 using a third party utility
PE operation mode:

- Dynamic DLL loading: sometimes, when running a program, the plugin may attempt to load a DLL that is not declared in the stub 或 load section of the startup script. In this case, please write down the name of the DLL, then add it to the startup script, and restart the debug session. It is possible to 创建a local copy, next to your database, of startup scripts so that these scripts will be used with this database only.

- Disk image loading slow: The disk image produced in the PE operation mode can be as big as 20MB. The reason for this slow loading is most probably because the plugin tries to load all referenced DLLs instead of stubbing them. To fix this, when the process starts, please take note of the loaded DLLs list (using IDA / Modules List) then add the desired module names in the startup.* / "stub" section.

另参见:
Bochs 调试器


 Bochs 磁盘映像操作模式

Bochs 磁盘映像操作模式
磁盘映像操作模式用于使用任何 Bochs 磁盘映像运行 Bochs。

一个简单的入门方法是启动 IDA 并反汇编与你的磁盘映像关联的 bochsrc 文件。IDA will recognize bochsrc 文件, parse the contents, determine the associated disk image and 创建a new database containing the first sector of the disk image (usually the boot sector).

The database does not have to correspond to the disk image: it could in fact start as an empty database, then user could convert the needed 段 to loader 段 for later analysis. The following script can be used for that purpose:

        attrs = get_segm_attr(desired__segment__start, SEGATTR_FLAGS);
        attrs = (attrs & ~SFL_DEBUG) | SFL_LOADER;
        set_segm_attr(desired__segment__start, SEGATTR_FLAGS, attrs);
If the disk image switches to protected mode with memory paging enabled, IDA will use the page table mapping to display 段. For 16-bit applications, IDA 自动 creates a default DOS memory map (Interrupt vector table, Bios Data Area, User Memory and BIOS ROM). Also, the Bochs 调试器 plugin will try to guess the 调试器 段 bitness, nonetheless the user can 编辑 the bitness manually.

Moreover, the Bochs internal 调试器 provides the ability to add hardware like breakpoints, known as watchpoints, but the addresses must be physical addresses. In order to use the disk image operation mode in a more convenient way, the plugin will convert the virtual addresses to physical adresses (if page table信息 is present) before adding the 硬件断点. This mechanism will not always work, please check the 常见问题解答 for more信息. For 硬件断点 on execute, the plugin will use the selected address as-is and 创建a physical breakpoint.

磁盘映像操作模式可以指定以下参数:

  - The bochsrc 文件 which contains the configuration for the Bochs virtual machine in question.
    bochsrc 文件应输入到:
    调试器 -> 进程选项 -> 应用程序(忽略其他字段)

  - Use virtual breakpoints when protected mode is enabled:
    This parameter is set in the 调试器 Specific options.
    It will allow the plugin to use "vb" command to create
    virtual breakpoints (using cs:eip), instead of using the "lb" which
    creates linear breakpoints (using only "eip"). It is useful when
    debugging code where the "cs" segment selector base is not zero.
This is a small example on 如何 debug a given disk image:

1. Prepare the needed bochs virtual machine 文件 (bochsrc, disk image, floppy image if needed, etc...)

2. 加载 the bochsrc 文件 into IDA. IDA will 自动 创建a database.

(Step 2, is optional. It is possible to use a database of your choice, but remember to point its "调试器->Process 选项->Input 文件" to the bochsrc 文件)

3. Make sure the "Disk image" operation mode is selected (If Step 2 was used, then Disk image operation mode will be selected 自动)

4. Enable "调试器选项->Suspend on debugging start", and start debugging!

In the disk image operation mode, the Bochs 调试器 plugin does not handle 或 report exceptions, if they must be caught and handled, please put breakpoints in the IDT 或 IVT entries.

 另参见：
        Bochs 调试器
        Bochs 插件操作模式常见问题


 Bochs IDB 操作模式

Bochs IDB 操作模式
The IDB operation mode, as its name implies, takes the current database as the input and runs it under the Bochs 调试器. This mode can be used to debug any x86 32 或 64-bit code. Please note that the code executes with privilege ring 3.

The following parameters can be specified in the IDB operation mode:

  - Entry address: the address where the execution starts.
    This parameter can be specified in three ways (listed in order of
    precedence):
      - by renaming the desired location as "ENTRY" (global name)
      - by selecting an address range with the mouse 或 keyboard.
        The selection start address is used as the 入口点
      - by positioning the cursor at a given position and running the
        调试器

  - 退出 address (optional): the address where the execution ends.
    This parameter can be specified in two ways:
      - by renaming the desired location as "EXIT" (global name). Please note that
        the emulation will stop at the item following the exit label.
      - by selecting an address range with the mouse 或 keyboard
        The selection end address is used as the exit point
    If the exit address is not specified, the execution will continue until
    an exception occurs. However, if the exit address is reached, the 调试器
    will ask the user if emulation should be continued 或 not.

  - Startup stack size: 数字 of KBs to allocate for the stack 段.
    The stack 段 is 自动 created and named as "STACK".
启用“调试器设置/调试启动时挂起”也可能很有用，以便 IDA 在执行第一条指令之前自动挂起进程。

While debugging, exceptions may occur and are caught by IDA. Please note that these exceptions are raw machine exceptions. For example, instead of an access violation exception, a page fault exception is generated.

 另参见：
        Bochs 调试器
        Bochs 插件操作模式常见问题


 Bochs PE 操作模式

Bochs PE 操作模式
The PE operation mode can be used to load PE 文件 and debug them in a MS Windows like environment.

The current limitations include:

  - Thread 或 process manipulation are not supported

  - Limited support for PE+

  - We provide implementations of a limited 数字 of system calls. Feel
    free to implement missing functions using IDC scripts 或 DLLs.

  - LoadLibrary() will fail on unknown DLLs: the list of desired DLLs must
    be specified before running the 调试器 in the startup.idc 文件

  - Limited emulation environment: IDA does not emulate the complete MS Windows
    operating system: it just provides the basic environment for a
    32bit PE 文件 to run (please check the features below). There are many
    ways how the debugged program can detect that it runs in an emulated
    environment.
PE executables feature list:

- SEH support: we try to mimic MS Windows as much as possible. For example, the ICEBP 指令 is a privileged 指令, but Windows reports back a single step exception. Similarly, MS Windows does not distinguish between 0xCC and 0xCD 0x03, so when an exception occurs, it reports that the exception address is always one byte before the trap. So if it was an INT 0x3 (CD03), the exception address will point to the 0x03 (in the middle of the 指令).

- TLS callbacks: TLS callbacks are normally parsed by IDA and presented as 入口点s. They will be called by the 调试器 before jumping to the main 入口点 of the application. Turning on the "调试器 Setup/Suspend on debugging start" may be a good idea since it will make all this logic clearly visible.

- Emulation of NT 结构体: Some malware do not use GetProcAddress() or GetModuleHandle(). Instead, they try to parse the system 结构体 and deduce these values. For this we also provide and build the basic structure of TIB, PEB, PEB_LDR_DATA, LDR_MODULE(s) and RTL_USER_PROCESS_PARAMETERS. Other structures can be built in the bochs_startup() function of the startup.idc file.

PE/PE+ executables feature list:

- Extensible API emulation: The user may provide an implementation of a any API function using scripts. The plugin supports IDC language by default, but if there are any other registered and active external languages, then external language will be used. Currently, the plugin ships with preconfigured IDC and Python scripts (please refer to startup.idc/startup.py).

It is also possible to take a copy of all the API and startup scripts and place them next to the database in question. This will tell the Bochs 调试器 plugin that these scripts are to be used with the current database directory. Such mechanism makes it possible to customize API/startup scripts for different databases.

In the following example, kernel32!GlobalAlloc is implemented via IDC like this:

 (file name: api_kernel32.idc)
 ///func=GlobalAlloc entry=k32_GlobalAlloc purge=8
 static k32_GlobalAlloc()
 {
   eax = BochsVirtAlloc(0, BochsGetParam(2), 1);
   return 0;
 }
 ///func=GlobalFree entry=k32_GlobalFree purge=4
 static k32_GlobalFree()
 {
   eax = BochsVirtFree(BochsGetParam(1), 0);
   return 0;
 }
A simple MessageBoxA replacement can be:
 (file name: api_user32.idc)
 ///func=MessageBoxA entry=messagebox purge=0x10
 static messagebox()
 {
   auto param2; param2 = BochsGetParam(2);
   msg("MessageBoxA has been called: %s\n",
        get_strlit_contents(param2, -1, STRTYPE_C));

   // Supply the return value
   eax = 1;

   // Continue execution
   return 0;
 }
To access the stack arguments passed to a given IDC 函数, please use the BochsGetParam() IDC 函数.

For a full reference on using IDC to implement API calls, please refer to ida\plugins\bochs\api_kernel32.idc 文件.

- Remap a DLL path (from the startup.idc script):

    /// map /home/johndoe/sys_dlls/user32.dll=d:\winnt\system32\user32.dll
    /// map /home/johndoe/sys_dlls/kernel32.dll=d:\winnt\system32\kernel32.dll
- 指定additional DLL search path (and optionally change the mapping):
    /// map /home/johndoe/sys_dlls/=d:\winnt\system32
  Or:

    /// map c:\projects\windows_xpsp2_dlls\=c:\windows\system32
  或 just as a search path without mapping:

    /// map c:\program 文件\my program
  You need to add the appropriate terminating slashes
- Redefine the 环境变量: the 环境变量 can be redefined in startup.idc
    /// env PATH=c:\windows\system32\;c:\programs    /// env USERPROFILE=c:\Users\Guest

  In Linux, if no environment 变量 is defined in the startup 文件 then no environment strings will be present.
  In Windows, we take the 环境变量 from the system if none were defined.
- Use native code: it is possible to write a custom Win32/64 DLL and map it into the process space.

Existing APIs can then be redirected to custom written functions. 例如:

  ///func=GetProcAddress entry=bochsys.BxGetProcAddress
  ///func=ExitProcess entry=bochsys.BxExitProcess
  ///func=GetModuleFileNameA entry=bochsys.BxGetModuleFileNameA
  ///func=GetModuleHandleA entry=bochsys.BxGetModuleHandleA
Here we redirect some functions to bochsys.dll that modify the memory space of the application. Please note that bochsys.dll is a special module, IDA is aware of it. Custom functions are declared like this:
  (file name: api_kernel32.idc)
  ///func=GetCommandLineA entry=mydll.GetCommandLineA purge=0
Then in startup.idc 文件, the following line must be added:
   /// load mydll.dll
Custom DLLs are normal DLLs that can import functions from any other DLL. However, it is advisable that the custom DLL is kept small in size and simple, by not linking it to the runtime libraries.

- Helper IDC functions: a set of helper IDC functions are available when the 调试器 is active. For more信息, please refer to "startup.idc".

- Less demanding PE loader: Most PE 文件 can be loaded and run, including system drivers, DLL and some PE 文件 that cannot be run by the operating system.

- Dependency resolution: In the PE operation mode, the plugin will recursively load all DLLs referenced by the program. All DLLs that are not explicitly marked with "stub" in startup.idc will be loaded as is. It is important to "stub" all system DLLs for faster loading. The PE loader creates empty stubs for 未定义 functions in stubbed DLLs. For example, the following line defines a stub that will always return 0 for CreateFileA:

  /// func=CreateFileA retval=0
Since CreateFileA is mentioned in the IDS files and IDA knows how many bytes it purges from the stack, there is no need to specify the "purge" value. For other functions that are not known to IDA, a full definition line would look like:
  /// func=FuncName purge=N_bytes retval=VALUE
- Startup and 退出 scripts: It is possible to assign IDC functions that run when the debugging session starts 或 is about to terminate (before the application continues from the PROCESS_EXIT event). In addition to running code at startup, the startup script serves a role in telling the PE loader which DLLs are to be mapped for the current debugging session. 例如:
  /// stub ntdll.dll
  /// stub kernel32.dll
  /// stub user32.dll
  /// stub shell32.dll
  /// stub shlwapi.dll
  /// stub wininet.dll
These lines list the DLLs that will be used during the debugging session. IDA creates empty stubs for all functions from these DLLs. Non-trivial implementations of selected functions can be speficied in api_xxxx.idc 文件, where xxxx is the module name.

API and startup scripts are searched first in the current directory and then in the ida/plugins/bochs directory.

- Memory allocation limit: The PE loader has a simple memory manager. It is used for the intial memory allocation at the loading stage and for dynamic memory allocation during the debugging session. No memory limits are applied at the loading stage: the loader will load all modules regardless of their size. However, when the debugging session starts, a limit applies on how much memory can be dynamically allocated. This limit is specfied in the 调试器 specific options as "Max allocatable memory". Memory allocation will fail once this limit is reached.

Some notes on bochsys.dll:

- BxIDACall: This exported 函数 is used as a trap to suspend the code execution in Bochs and perform some actions in IDA. For example, when the target calls kernel32.VirtualAlloc, it is redirected to bochsys.BxVirtualAlloc, which calls BxIDACall, which triggers IDA:

  kernel32.VirtualAlloc -> bochsys.BxVirtualAlloc -> BxIDACall -> IDA bochs plugin
A breakpoint can be set on this 函数 to monitor all API calls that are handled by IDA.

- Bx未定义ApiCall: This exported 函数 is executed when the application calls an unimplemented 函数. Setting a breakpoint on it will allow discovering unimplemented functions and eventually implementing them as IDC or DLL functions. It can also be used to determine when unpacking/decryption finishes (provided that all functions used by the unpacker have been defined).

 另参见：
        Bochs 调试器
        Bochs 插件操作模式常见问题


 书签窗口

书签窗口

 操作名称: OpenBookmarks
此命令将打开书签窗口。该窗口允许用户跳转到列表中的特定位置。


 断点条件

断点条件
可以使用断点属性的“条件”字段输入一个表达式，该表达式在命中断点时计算。它可以是实际条件，也可以是 IDC 或其他支持的脚本语言语法中的任何有效代码。通过使用 "..." 按钮，你可以打开条件的多行编辑器，并切换用于评估它的脚本语言。

表达式

  如果输入表达式，结果将用于确定是否
  所选操作将被执行。 IDC 表达式的一些示例：

  检查 EAX 是否等于 5：

    EAX==5

  检查函数的第一个参数是否为 1：

    get_wide_dword(ESP)==1

  将函数的第二个参数解释为指向 Unicode 字符串的指针，打印它，
  并返回 0(以便立即继续执行)：

    msg("Filename: %s\n", get_strlit_contents(get_wide_dword(ESP+4), -1, STRTYPE_UNICODE)), 0

  将 EAX 设置为 0 并继续：

    EAX=0,0
语句
  你可以在多行编辑器中输入多个语句。如果最后一个是“return”语句，则将其用作条件的结果。否则，假定条件返回 0。

另参见:
         断点列表
         编辑断点
         断点子菜单
         IDC 函数索引


 断点处理函数

断点处理函数

// 获取断点的数字。
// 返回: 断点的数字

long get_bpt_qty();

// Get breakpoint address
//      n - number of breakpoint, is in range 0..get_bpt_qty()-1
// returns: address of the breakpoint or BADADDR

long get_bpt_ea(long n);

// Get the characteristics of a breakpoint
//      address - any address in the breakpoint range
//      bptattr - the desired attribute code, one of BPTATTR_... constants
// Returns: the desired attribute value or -1

long get_bpt_attr(long ea, number bptattr);

#define NO_PROCESS    -1  // invalid process
#define NO_THREAD      0  // invalid thread
#define BPTATTR_EA     1  // starting address of the breakpoint
#define BPTATTR_SIZE   2  // size of the breakpoint (undefined for software breakpoint)
#define BPTATTR_TYPE   3                     // type of the breakpoint
// Breakpoint types:
#define  BPT_WRITE   1                       // Hardware: Write access
#define  BPT_READ    2                       // Hardware: Read access
#define  BPT_RDWR    3                       // Hardware: Read/write access
#define  BPT_SOFT    4                       // Software breakpoint
#define  BPT_EXEC    8                       // Hardware: Execute instruction
#define  BPT_DEFAULT (BPT_SOFT|BPT_EXEC)     // Choose bpt type automaticaly

#define BPTATTR_COUNT  4  // number of times the breakpoint is hit before stopping

#define BPTATTR_FLAGS  5  // Breakpoint attributes:
#define BPT_BRK        0x001 // the debugger stops on this breakpoint
#define BPT_TRACE      0x002 // the debugger adds trace information when // this breakpoint is reached
#define BPT_UPDMEM     0x004 // refresh the memory layout and contents before evaluating bpt condition
#define BPT_ENABLED    0x008 // enabled? #define BPT_LOWCND     0x010 // condition is calculated at low level (on the server side)
#define BPT_TRACEON    0x020 // enable tracing when the breakpoint is reached
#define BPT_TRACE_INSN 0x040 //   instruction tracing
#define BPT_TRACE_FUNC 0x080 //   function tracing
#define BPT_TRACE_BBLK 0x100 //   basic block tracing

#define BPTATTR_COND   6  // Breakpoint condition
         // NOTE: the return value is a string in this case
#define BPTATTR_PID    7  // Breakpoint process id
#define BPTATTR_TID    8  // Breakpoint thread id

// Breakpoint location type:
#define BPLT_ABS     0    // Absolute address. Attributes:
               // - locinfo: absolute address

#define BPLT_REL     1    // Module relative address. Attributes:
               // - locpath: the module path
               // - locinfo: offset from the module base address

#define BPLT_SYM     2    // Symbolic name. The name will be resolved on DLL load/unload
               // events and on naming an address. Attributes:
               // - locpath: symbol name
               // - locinfo: offset from the symbol base address

// Breakpoint properties:
#define BKPT_BADBPT   0x01 // failed to write the bpt to the process memory (at least one location)
#define BKPT_LISTBPT  0x02 // include in bpt list (user-defined bpt)
#define BKPT_TRACE    0x04 // trace bpt; should not be deleted when the process gets suspended
#define BKPT_ACTIVE   0x08 // active?
#define BKPT_PARTIAL  0x10 // partially active? (some locations were not written yet)
#define BKPT_CNDREADY 0x20 // condition has been compiled
// ***********************************************
class Breakpoint
{
  // Breakpoint type. One of BPT_... constants attribute type;
  // Breakpoint size (for hardware breakpoint)
  attribute size;

  // Breakpoint condition (string)
  attribute condition;

  // Scripting language of the condition string
  // "IDC" for IDC, "Python" for Python etc. ('name' field of extlang_t)
  // if empty, default extlang is assumed
  attribute elang;

  // Breakpoint flags. Refer to BPTATTR_FLAGS
  attribute flags;

  // Breakpoint properties. Refer to BKPT_... constants
  attribute props;

  // Breakpoint pass count
  attribute pass_count;

  // Attribute location type. Refer to BPLT_... constants.
  // Readonly attribute.
  attribute loctype;

  // Breakpoint path (depending on the loctype)
  // Readonly attribute.
  attribute locpath;

  // Breakpoint address info (depending on the loctype)
  // Readonly attribute.
  attribute locinfo;

  // Set absolute breakpoint
  success set_abs_bpt(address);

  // Set symbolic breakpoint
  success set_sym_bpt(symbol_name, offset);

  // Set relative breakpoint
  success set_rel_bpt(path, offset);
};

// Set modifiable characteristics of a breakpoint
//       address - any address in the breakpoint range
//       bptattr - the attribute code, one of BPTATTR_... constants.
//                 BPTATTR_COND is not allowed, see Bpts
//       value   - the attibute value
// Returns: success

success set_bpt_attr(long ea, number bptattr, long value);

// Set breakpoint condition
//       address  - any address in the breakpoint range
//       cnd      - breakpoint condition
//       is_lowcnd- 0:regular condition, 1:low level condition
// Returns: success

success set_bpt_cond(long ea, string cnd, long is_lowcnd=0);

// Add a new breakpoint
//       ea   - any address in the process memory space:
//       size - size of the breakpoint (irrelevant for software breakpoints):
//       type - type of the breakpoint (one of BPT_... constants)
// Only one breakpoint can exist at a given address.
// Returns: success

success add_bpt(long ea, long size=0, long bpttype=BPT_DEFAULT);

// Delete breakpoint
//       ea   - any address in the process memory space:
// Returns: success

success del_bpt(long ea);

// Enable/disable breakpoint
//       ea   - any address in the process memory space
// Disabled breakpoints are not written to the process memory
// To check the state of a breakpoint, use check_bpt()
// Returns: success

success enable_bpt(long ea, long enable);

// Check a breakpoint
//       ea   - any address in the process memory space
// Returns: one of BPTCK_... constants

long check_bpt(long ea);

#define BPTCK_NONE -1  // breakpoint does not exist
#define BPTCK_NO    0   // breakpoint is disabled
#define BPTCK_YES   1   // breakpoint is enabled
#define BPTCK_ACT   2   // breakpoint is active (written to the process)


 断点列表

断点列表

 操作名称: Breakpoints
打开断点窗口。

在此窗口中，你可以查看与现有断点相关的信息。断点保存在数据库中，并尽快恢复(一旦内存变为可写)。

“通过计数”列表示程序在挂起之前需要命中断点的次数(0 表示“始终挂起”)。

另参见:
   添加断点
   删除断点
   编辑断点
   断点子菜单


 断点子菜单

断点子菜单
下面是使用调试器断点的命令。
  断点列表
  添加断点
  编辑断点
  删除断点
另参见 调试器子菜单。


 浏览器选项

浏览器选项
“IDA 选项”对话框的此选项卡允许编辑提示和标识符加亮显示相关设置。有两组设置。

第一组用于将鼠标悬停在某个文本上时显示的提示。

第二组用于加亮显示。

标识符提示的行数

        指定提示窗口的初始高度。
        如果提示较小，IDA 可能会决定显示的行数少于指定的行数。用户可以使用鼠标滚轮调整提示窗口的大小。
标识符提示的延迟
        当用户将鼠标指针悬停在标识符上时，提示出现前的毫秒数
鼠标滚轮调整提示窗口大小
        允许使用鼠标滚轮调整提示窗口的大小。
        如果用户不想调整提示的大小，则可以关闭。
如果调试器处于活动状态，则没有提示
        当调试器处于活动状态时，提示将被禁用。 这可能对调试速度很有用：
计算零填充范围的提示可能代价很高
自动加亮显示当前标识符
        加亮显示屏幕上所有位置的当前标识符。
        IDA 尝试确定当前标识符是否表示寄存器。
        在这种情况下，它将加亮显示对寄存器其他部分的引用。例如，如果加亮显示 "AL" ，则 IDA 也会加亮显示
        "AH", "AX" 和 "EAX" (如果当前处理器是 x86)。
跳转到折叠的项目时自动取消隐藏折叠的项目(仅限 gui)
        如果启用此选项，则 IDA 将在用户决定跳转到隐藏函数时
        自动展开它们。 一旦用户退出该功能，请按
        Esc，函数将再次自动折叠。
惰性跳转(仅限 gui)
        如果设置了此选项，如果跳转目标已在屏幕上，
        则 IDA 将不会重新绘制反汇编窗口。
        在该情况下，它只会将光标移动到指定的地址。此选项可减少屏幕重绘和跳跃行为。
导航堆栈下拉菜单中的项数
        指定“跳转”工具栏下拉菜单中的条目数
自动滚动的行数
        指定强制反汇编视图自动滚动的行数
插入符号闪烁间隔
        指定输入插入符号闪烁的速度(以千秒为单位)。
        必须大于或等于 500 或零。
        零表示禁用闪烁


 bTree 错误

bTree 错误
通常不会发生此错误，如发生请告知我们的技术支持。


 构建 PIN 工具

构建 PIN 工具
在使用 PIN 跟踪器之前，必须构建 PIN 工具模块(仅以源代码形式分发)，因为 Intel PIN 许可证不允许以二进制形式重新分发 PIN 工具。

请参阅

https://www.hex-rays.com/products/ida/support/tutorials/pin/pin_tutorial.pdf

来了解如何构建我们的 PIN 工具。


 byte_value

byte_value

Get byte value from flags
Get value of byte provided that the byte is initialized.
This macro works ok only for 8-bit byte machines.

#define byte_value(F)  (F & MS_VAL)    // quick replacement for get_wide_byte()


 C++ 类型详情

C++ 类型详情
IDA 可以解析和处理简单的 C 类声明。 它不能解析模板和其他复杂的结构体，但可以解析简单的标准案例。

如果 C++ 类包含虚拟函数，IDA 将尝试为该类重建虚拟函数数表 (VFT)。 VFT 将按名称链接到类：如果类名为 "A"，则 VFT 类型将为 "A_vtbl"。

让我们考虑以下类层次结构:

  class A { virtual int f(); int data; };
  class B : public A { virtual int g(); };
IDA 将建立以下结构体:
  struct __cppobj A {A_vtbl *__vftable;int data;}
  struct A_vtbl {int (*f)(A *__hidden this);}
  struct __cppobj B : A {}
  struct B_vtbl {int (*f)(A *__hidden this);
                 int (*g)(B *__hidden this);}
Please note that the VFT pointer in the class A has a special name: "__vftable". This name allows IDA to recognize the pointer as a VFT pointer and treat it accordingly.

Another example of more complex class hierarchy:

  class base1 { virtual int b1(); int data; };
  class base2 { virtual int b2(); int data; };
  class der2 : public base2 { virtual int b2(); int data; };
  class derived : public base1, public der2 { virtual int d(); };
Compiling in 32-bit Visual Studio mode yields the following layout:
  class derived size(20):
        +---
   0    | +--- (base class base1)
   0    | | {vfptr}
   4    | | data
        | +---
   8    | +--- (base class der2)
   8    | | +--- (base class base2)
   8    | | | {vfptr}
  12    | | | data
        | | +---
  16    | | data
        | +---
        +---
IDA will generate the following types:
  struct __cppobj base1 {base1_vtbl *__vftable /*VFT*/;int data;};
  struct /*VFT*/ base1_vtbl {int (*b1)(base1 *__hidden this);};
  struct __cppobj base2 {base2_vtbl *__vftable /*VFT*/;int data;};
  struct /*VFT*/ base2_vtbl {int (*b2)(base2 *__hidden this);};
  struct __cppobj der2 : base2 {int data;};
  struct /*VFT*/ der2_vtbl {int (*b2)(der2 *__hidden this);};
  struct __cppobj derived : base1, der2 {};
  struct /*VFT*/ derived_vtbl {int (*b1)(base1 *__hidden this);
                               int (*d)(derived *__hidden this);};
The 'derived' class will use 2 VFTs:
  offset 0: derived_vtbl
  offset 8: der2_vtbl
IDA and Decompiler can use both VFTs and produce nice code for virtual calls.

Please note that the VFT layout will be different in g++ mode and IDA can handle it too. Therefore it is important to have the target compiler set correctly.

It is possible to build the class hierarchy manually. Just abide by the following rules:

  - VFT pointer must have the "__vftable" name
  - VFT type must follow the "CLASSNAME_vtbl" pattern
C++ classes are marked with "__cppobj" keyword, it influences the class layout. However, this keyword is not required for VFT types.

In the case of a multiple inheritance it is possible to override a virtual table for a secondary base class by declaring a type with the following name: "CLASSNAME_XXXX_vtbl" where XXXX is the offset to the virtual table inside the derived (CLASSNAME) class.

示例: if in the above example we add one more function

        virtual int derived::b2();
然后我们还需要一个虚拟表。Its name must be "derived_0008_vtbl". Please note that our parser does not create such vtables, you have to do it manually.
 See also 本地类型窗口


 计算器

计算器

 操作名称: Calculate
提供了一个简单的计算器。你可以输入常量 C 样式表达式。表达式的语法与 IDC 表达式的语法相同。结果以三种形式显示在消息窗口中：十六进制、十进制和字符。

在这些表达式中可以使用在反汇编过程中创建的所有名称。IDA 还可以在光标下拾取名称或编号，并将其存储到输入行中。

另参见

         视图子菜单。
         如何输入数字。


 call_system

call_system

Execute an OS command.
IDA 将等待启动的程序完成。
In order to start the command in parallel, use OS methods.
For example, you may start another program in parallel using "start" command.
     command - command line to execute
返回: error code from OS
Thread-safe function.

long call_system(string command);


 无法打开文件

无法打开文件
该文件可能不存在或设置为只读。


 无法将选择添加到函数定义

无法将选择添加到函数定义
此错误消息表示无法将所选内容添加到函数中。这可能是因为以下原因：
  - 指定的函数不存在或不是函数条目块

  - 选择跨越了现有函数块的边界。
  所选内容不得与现有函数块相交
  或必须等于函数尾部块。

  - 选择跨越段边界

  - 选择在一个特殊的部分(进口、出口等)

  - 选择跨越了指令或数据的边界
更正你的选择，然后重试。


 不能分配到段寄存器

不能分配到段寄存器
发生此错误的原因是数据库损坏。尝试尽快完成工作并生成文本源文件。

最好的选择是从备份还原，因为数据库已损坏。


 不能创建数据库

不能创建数据库
很可能你的磁盘已满或发生了某些磁盘 I/O 错误。


 无法创建文件

无法创建文件
该文件可能存在，但为只读文件。


 无法创建段寄存器范围

无法创建段寄存器范围
发生此错误的原因是数据库损坏。尝试尽快完成工作并生成文本源文件。

最好的选择是从备份还原，因为数据库已损坏。


 找不到文件分段

找不到文件分段
数据库为空或已损坏。不幸的是，所有信息都丢失了。

如果有，请使用数据库的备份副本。

如果以前已将数据库保存到文本文件中，则可以加载它。有关说明，请参阅转储数据库命令。


 未找到输入的文件

未找到输入的文件
IDA 已尝试查找具有 IDA 中提及的扩展名的文件 。CFG 文件，但找不到任何内容。

默认扩展表如下所示：

 扩展名       处理器

  "com" :       ""
  "exe" :       ""
  "dll" :       ""
  "drv" :       ""
  "sys" :       ""
  "bin" :       ""
  "ovl" :       ""
  "ovr" :       ""
  "ov?" :       ""
  "nlm" :       ""
  "lan" :       ""
  "dsk" :       ""
  "obj" :       ""
  "prc" :       "68000"
  "axf" :       "arm710a"
  "h68" :       "68000"
  "i51" :       "8051"
  "sav" :       "pdp11"
  "rom" :       "z80"
  "cla*":       "java"
  "s19":        "6811"
  "epoc":       "arm"
  "o":          ""
另参见 IDA 使用帮助


 不能生成可执行文件

不能生成可执行文件
IDA 仅为以下项生成可执行文件： -MS DOS .exe -MS DOS .com -MS DOS .drv -MS DOS .sys - 通用二进制文件 - 英特尔十六进制对象格式 -MOS 技术十六进制对象格式

此外，外部加载器可能支持也可能不支持创建用户定义的输入文件格式。


 不能移动段起始地址

不能移动段起始地址
IDA 无法更改分段起始地址，因为具有新起始地址的此分段将与另一个相邻分段重叠。例如，以下情况：
  seg_a  开始在 0x0000 结束在 0x1000
  seg_b  开始在 0x1000 结束在 0x2000
  seg_c  开始在 0x2000 结束在 0x3000
如果你要求更改 seg_c，使其从 0x500 开始，你将看到此错误消息，因为新的 seg_c 将 seg_b 重叠。

请注意，结束地址从不属于 IDA 中的段。


 不能移动段起始地址

不能移动段起始地址
如果某些指令/数据发生在段之外，则 IDA 无法更改段起始地址。首先取消定义此指令/数据。


 无法重命名位置

无法重命名位置
这可能是由于以下原因之一：

1. 名称格式不正确：

        - 这是一个保留词
          注意：IDA 不允许将寄存器名称用作字节名。
        - 它包含坏字符。
          允许的字符列表在 IDA.CFG 中指定
        - 它以保留的前缀开头。使用了一些前缀
          由 IDA 生成名称。请参阅 名称表达方式
          前缀列表的对话框。
2. 该名称已在程序中使用。尝试使用其他 名称。为了知道名称的使用位置，你可以尝试使用跳转到名称位置来跳转到它

3. 地址不能有名称：

     - IDA 拒绝重命名尾部字节(即第二个、第三个...
       指令/数据的字节)。
     - 该地址不属于程序


 在窗口中将当前行居中

在窗口中将当前行居中

 操作名称: CenterInWindow


 更改操作数符号

更改操作数符号

 操作名称: ChangeSign
此命令更改当前操作数的符号。请注意，并非所有操作数都可以更改其符号。

另参见：

          编辑|操作数类型子菜单。
          手动输入 #th 操作数 命令。
          设置操作数类型


 更改段寻址

更改段寻址
你可以在 16 位和 32 位段寻址之间进行选择。

如果段地址发生变更，IDA 将删除该段中的所有指令和数据。

如果你不确定，千万不要这样做。它可能会产生不可逆转的后果，所有指令/数据都将转换为未定义的字节。

另请参见其他 SegEdit 表单字段。


 更改段对齐

更改段对齐
对齐方式：在 abs，byte，word，dword，para，page 之间进行选择

你可以指定所选段的段对齐方式。默认情况下，IDA 假定“字节”对齐。

更改对齐方式只会更改屏幕上的段定义。不会发生其他任何事情。

另请参见其他 SegEdit 表单字段。


 更改段属性

更改段属性

 操作名称: EditSegment
此命令允许你更改段属性。你可以更改除段基础之外的所有属性。要更改段基础，你必须删除该段并重新创建它。

请使用以下链接了解段属性：

      如何更改段名称
      如何更改段类
      如何更改段寻址模式 (16/32)
      如何更改段对齐方式
      如何更改段组合
更改段类可能会更改段类型。

移动相邻段：表示上一个和下一个段将被缩小或扩展，以填补段之间的间隙。单击 此处 了解更多信息。

禁用地址：如果设置，则当一个段被缩小时，所有关于从该段传出的字节的信息将被完全删除。否则，IDA 将丢弃有关指令/数据、注释等的信息，但会保留字节值，以便以后可以创建另一个段，并使用现有的字节值。

如果 IDA 创建了 2 个段，其中只有一个段必须存在，你可以尝试以下顺序：

        - 删除 一个段。 选择一个
          错误的段基值。不要禁用被删除的段占用的地址。
        - 更改另一个段的边界。
请注意， 创建段命令会自动更改重叠段的边界。

具有“debugger”属性的段是其内存内容未保存在数据库中的段。通常，这些段由调试器创建，以反映程序的当前内存状态。

但是，用户可以修改此属性。

如果清除该段，则在关闭调试器会话后，该段将永久保留在数据库中。数据库将反映状态更改时段的状态。

如果设置了该段，则该段将成为临时段，并将在调试会话结束时删除。

“调试器段”复选框仅在调试会话期间可用。

“加载程序”段是由文件加载程序创建的段。具有此属性的段被视为输入文件的一部分。

设置了“debugger”属性但未设置“loader”属性的段被视为临时段。IDA 不会自动分析此类细分市场。

“Segment permissions”组框可用于修改 Segment 访问权限(读/写/执行)

另参见 编辑|段子菜单。


 更改段组合

更改段组合
Combination

描述链接器如何将段与其他段组合在一起的字段。在 MS-DOS 下，具有相同名称和类的段可以通过两种方式组合：它们可以连接起来形成一个逻辑段，也可以重叠。在后一种情况下，它们具有相同的起始地址或相同的结束地址，并且它们描述了内存中的公共范围。该字段的值为：

  Private.  不要与任何其他程序段合并。
  Public.  通过追加符合对齐要求的偏移量进行合并。

  Stack.   合并为 Public。
           此组合类型强制字节对齐。

  Common. 使用最大尺寸进行叠加组合。
更改段组合仅更改屏幕上的段定义。不会发生其他任何事情。

另请参见其他 SegEdit 表单字段。


 更改段名称

更改段名称
输入段的新名称。段名称的长度最多为 8 个字符。IDA 会检查长度是否正常。尝试为句段提供助记符名称。

另请参见其他 SegEdit 表单字段。


 更改段寄存器值

更改段寄存器值

 操作名称: SetSegmentRegister
仅与具有段寄存器的处理器相关。 目前，此命令适用于 IBM PC、TMS320C2、Intel80196 和 PowerPC 处理器。

此命令创建或更新段寄存器 更改点。

有关详细信息，请参阅 跳转到段寄存器更改点。

ALPHA DISASSEMBLY

对于 Alpha 处理器，用户必须输入实际 GP 值与 GOT(全局偏移表)的开始之间的差值。 例如:

         .got
         ....
         ; gp points here
 label:
If you want to specify that a register points to "label", you must calculate and enter the difference "label-.got" as the register value.

ARM DISASSEMBLY

The ARM processor module has a virtual segment register T which reflects the state of the T bit of the processor state register (PSR). Therefore, the value of this register controls THUMB/ARM mode. If its value is not zero, then the disassembly will be in the thumb mode.

POWER PC DISASSEMBLY

For PowerPC processors, the user must enter an offset from the beginning of the TOC to the TOC entry which contains the address of the target. 一个示例：

 TOC:    .toc
         ....
 sometc: .tc sometc[tc], datachunk
If you want to specify that a register points to "datachunk", you must calculate and enter the difference "sometc-TOC" as the register value. You can change the TOC value in the processor specific options (which is accessible from the analysis options).

INTEL 80196 DISASSEMBLY

For Intel 80196NP/NU processors, the user must enter the value of WSR or WSR1 register. IDA will automatically take the new value into account.

 另参见 编辑|段子菜单。
 另参见 如何输入段值。
 另参见 如何输入数字。


 更改段翻译

更改段翻译

 操作名称: SegmentTranslation
段转换是解析对当前段指令的引用时要使用的其他段的序列。Only code references are affected by the segment translation. Data references can be redirected to the desired addresses by modifying the data segment register.

This feature is available only for selected processors (it is not available for IBM PC processors).

We hope it is easier to give an example than to give a formal definition. Suppose we have 3 segments:

                start   end
        A       0000    1000
        B       1000    2000
        C       3000    4000
The instruction
        call    1000
in the segment C obviously refers to the segment B while the instruction
        call    500
refers to the segment A.

However, IDA does not try to link these references unless you tell it to do so: include the segments A and B into a translation list of the segment C. 这意味着你必须创建一个翻译列表

        A B
for the segment C.

Below is a more complicated example:

                start   end
        A       0000    1000
        B       1000    2000
        C       1000    2000
        D       3000    4000
        E       3000    4000
translations
        B:      A
        C:      A
        D:      A B
        E:      A C
allow you to emulate overlays (the first set is A B D, the second A C E)

IMPORTANT NOTE1: If you use the segment translations, make sure that all segments have unique segment bases. If two segments are placed in the linear address space so that they must have the same segment base, you may assign different selectors with equal values to them.

IMPORTANT NOTE2: IDA supports only one translation list per segment. This translation is applied by default to all instruction in the segment. If the segment uses other mappings, then these individual mappings can be specified for each instruction separately by using the make offset commands.

IMPORTANT NOTE3: Since only code references are affected by the segment translations, try to create the RAM segment at its usual place (i.e. its linear address in IDA corresponds to its address in the processor memory). This will make all data references to it to be correct without any segment translation. For the data references to other segments you'll need to use the make offset command for each such reference.

另参见

         解决空间概念问题
         编辑|段子菜单。


 更改堆栈指针

更改堆栈指针

 操作名称: ChangeStackPointer
This command allows you to specify how the stack pointer (SP) is modified by the current instruction.

如果当前指令不属于任何 函数，则不能使用此命令。

You will need to use this command only if IDA was not able to trace the value of the SP register. Usually IDA can handle it but in some special cases it fails. An example of such a situation is an indirect call of a function that purges its parameters from the stack. In this case, IDA has no information about the function and cannot properly trace the value of SP.

Please note that you need to specify the difference between the old and new values of SP.

The value of SP is used if the current function accesses local variables by [ESP+xxx] notation.

另参见

         编辑|函数子菜单。
         转换为堆栈变量


 选择标记数字

选择标记数字
此命令允许你标记位置，以便之后可以立即跳转到标记的位置。从列表中选择任意一行。所选行将用于标记描述。之后，你将能够使用 <Alt-J> 键跳转到标记的位置。

你可以使用 <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> 键。如果选择列表的第一行，则不会选择任何内容。

按 <Enter> 选择行，按 <Esc> 取消。

另参见: 如何跳转到标记的位置


 选择标记位置

选择标记位置
此命令允许你跳转到以前标记的位置。选择任意行。你将跳转到所选位置。

你可以使用 <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> 键。如果选择列表的第一行，则不会选择任何内容。

按 <Enter> 选择行，按 <Esc> 取消。

另参见: 如何标记位置


 选择段

选择段
IDA can display a list of the program segments. Each segment is represented by a line in the list. Please note that the end address of the segment never belongs to the segment in IDA.

The following segment attributes are visible:

  Name          Segment name
  Start         Virtual start address
  End           Virtual end address (address past the end of the segment)
  R             'R': readable,      '.': not readable,   '?':unknown
  W             'W': writable,      '.': not writable,   '?':unknown
  X             'X': executable,    '.': not executable, '?':unknown
  D             'D': debugger only, '.': regular
  L             'L': created by loader, '.': no
  Align         Segment alignment
  Base          Segment base selector or address
  Type          Segment type
  Class         Segment class
  AD            Segment addressing width
The rest of the columns display the default values of the segment registers for the segment.

By default, the cursor is located on the current segment.

You can use normal cursor movement keys and the mouse. You can also search for the segment by pressing Alt-T, ordirectly jump to the desired line by typing in its number.

Press <Enter> to select line, <Esc> to cancel the selection.

另参见 other segment related commands


 choose_func

choose_func

ask the user to select a function
     title - title of the dialog box
返回: -1 - user refused to select a function
         otherwise returns the selected function start address

long choose_func(string title);


 cleanup_appcall

cleanup_appcall

Cleanup the current appcall This function can be used to terminate the current   dbg_appcall that was started with APPCALL_MANUAL
success cleanup_appcall();


 清除跟踪

清除跟踪

 操作名称: ClearTrace
此命令从跟踪窗口中移除所有跟踪事件。 它还会移除任何加载的跟踪文件，这些文件用于对当前加载的跟踪进行比较。
另参见 跟踪窗口
          二进制跟踪的比较
          跟踪管理
          指令跟踪
          函数跟踪
          基本块跟踪
          添加写入跟踪
          添加读取/写入跟踪
          添加执行跟踪
          跟踪选项
          跟踪子菜单。


 清除撤消历史记录

清除撤消历史记录

 操作名称: ResetUndo
此命令清除撤消历史记录。在此之后，“撤消”和“重做”命令将不可用。但是，一旦用户执行新操作，IDA 将再次开始记录所有数据库修改。

此命令的副作用是快速自动分析：由于尚无要还原的用户操作，因此 IDA 不会维护撤消缓冲区，从而加快了分析速度。

另参见 撤消 重做 禁用撤消 打开撤消历史记录


 clear_selection

clear_selection

Clear selection

void clear_selection();


 clr_database_flag

clr_database_flag

Clear database flag
     flags - DBFL_... bits
see also save_database() (definition of the DBFL_... bits)

void clr_database_flag(long flags);


 collect_stack_trace

collect_stack_trace

Unwind the stack for the given thread
     tid - thread id
返回: a call stack object with the attributes:
"size" - number of frames
array subscript "[0]", "[1]", ... up to the number of frames - 1
each frame object has the attributes:
  "callea" - the address of the call instruction.
             for the 0th frame this is usually just the current value of EIP.
  "funcea" - the address of the called function
  "fp"     - the value of the frame pointer of the called function
  "funcok" - is there a function created in the database for the current frame?

object collect_stack_trace(long tid);


 颜色配置

颜色配置
This dialog allows you to customize the color settings.
 GUI version:
 ------------
IDA keeps the color configuration in the registry. 有 3 种预定义方案。The user can modify the existing schemes or add his own schemes. New schemes should be added to the "themes" subdirectory in IDA.
 Text version:
 -------------
IDA keeps colors in file IDACOLOR.CF. This file may reside in the IDA directory or in the current directory. It is a binary file. IDA automatically saves all your changes into this file.

If the current item line prefix has "black on black" color, then the current item will not be highlighted. The same is with current line color - if it is "black on black", the current line will not be highlighted.

You can change the colors using the Customize button. You may have up to 4 different color palettes and switch between them on fly. The color palette is saved in IDACOLOR.CF file.

Each line prefix has its own color code depending on the current item: (the fourth color palette values are shown)

 Line prefixes
   Library function             BRIGHT CYAN ON BLUE
   Regular function             WHITE ON BLUE
   Instruction                  BROWN ON BLUE
   Data                         WHITE ON BLUE
   Unexplored                   WHITE ON BLACK
   Externs                      BRIGHT MAGENTA ON BLUE
   Current item                 BRIGHT BLUE ON BLUE
   Current line                 YELLOW ON BLUE
   Default                      BLACK ON BLACK (not used)
If the "current item" or "current line" are BLACK ON BLACK, then they will not be highlighted.

The rest of the line is colored with the following codes:

 Keywords
   Instruction                  WHITE ON BLUE
   Directive                    YELLOW ON BLUE
   Macro name                   MAGENTA ON BLUE
   Register name                WHITE ON BLUE
   Other                        WHITE ON BLUE

 Names
   Dummy data                   WHITE ON BLUE
   Dummy code                   WHITE ON BLUE
   Dummy unexplored             MAGENTA ON BLUE
   Hidden                       GREY ON BLUE
   Library function             BRIGHT CYAN ON BLUE
   Local variable               GREEN ON BLUE
   Regular data                 YELLOW ON BLUE
   Regular code                 YELLOW ON BLUE
   Regular unexplored           RED ON BLUE
   Demangled                    BRIGHT GREEN ON BRIGHT BLUE
   Segment name                 YELLOW ON BLUE
   Imported name                LIGHT MAGENTA ON BLUE

 Constants
   Suspicious                   BRIGHT RED ON BLUE
   Char in instruction          BRIGHT CYAN ON BLUE
   String in instruction        BRIGHT CYAN ON BLUE
   Number in instruction        BRIGHT GREEN ON BLUE
   Char in data                 BRIGHT GREEN ON BLUE
   String in data               BRIGHT GREEN ON BLUE
   Number in data               WHITE ON BLUE

 Xrefs
   Code                         GREEN ON BLUE
   Data                         CYAN ON BLUE
   Code to tail                 BRIGHT RED ON BLUE
   Data to tail                 MAGENTA ON BLUE

 Comments
   Automatic                    BROWN ON BLUE
   Regular                      BRIGHT WHITE ON BLUE
   Repeatable                   BROWN ON BLUE
   Extra line                   YELLOW ON BLUE

 Other
   Punctuation                  WHITE ON BLUE
   Opcode bytes                 BRIGHT GREEN ON BLUE
   Manual operand               BRIGHT WHITE ON BLUE
   Errors                       RED ON BLACK
   Selected                     BLACK ON WHITE
   Default                      YELLOW ON BLUE
(Other,Default) color code is used if a token has no color attached to it.

另参见 选项子菜单。


 命令行

命令行
在 IDA 主窗口的底部，状态栏的正上方有一个输入栏。 它可用于输入各种命令。 默认情况下，它接受 IDC 命令，但插件可能会将自己注册为它的命令语言提供程序。

目前，存在以下命令行提供程序:

  - idc
  - python 插件
  - bochs 调试器
  - windbg 调试器
  - GDB 调试器
当这些插件处于活动状态时，它们将处理输入的命令。 可以通过单击输入字段左侧的按钮来更改当前命令语言。 可以通过从命令行的上下文菜单中选择“默认 CLI”，将当前语言设置为默认语言。

命令行输入字段可以通过按“.”来激活。 Esc 切换回上一个窗口。


 命令行开关

命令行开关
可以使用以下命令行之一启动 IDA：
        ida input-file  （启动图形界面）
        idat input-file （启动文本界面）
将 '64' 后缀添加到命令名称中，以启动 64 位版本的 IDA。例如:
        ida64 input-file
将启动 64 位图形界面。

可识别以下命令行开关：

 -a     禁用 自动分析。 (-a- 启用它)
 -A     自主模式。IDA 不会显示对话框。
        设计用于与 -S 开关一起使用。
 -b#### loading address, a hexadecimal number, in paragraphs
        (a paragraph is 16 bytes)
 -B     batch mode. IDA will generate .IDB and .ASM files automatically
 -c     disassemble a new file (delete the old database)
 -C#### set compiler in format name:abi
 -ddirective
        A configuration directive which must be processed at the first
        pass. 示例: -dVPAGESIZE=8192
 -Ddirective
        A configuration directive which must be processed at the second
        pass.
 -f     disable FPP instructions (IBM PC only)
 -h     help screen
 -i#### program entry point (hex)
 -I#    set IDA as just-in-time debugger (0 to disable and 1 to enable)
 -L#### name of the log file
 -M     disable mouse (text only)
 -O#### options to pass to plugins.
        This switch is not available in the IDA Home edition.
 -o#### specify the output database (implies -c)
 -p#### processor type
 -P+    compress database (create zipped idb)
 -P     pack database (create unzipped idb)
 -P-    do not pack database (not recommended, see Abort command)
 -r###  immediately run the built-in debugger
        format of this switch is explained here
 -R     load MS Windows exe file resources
 -S###  Execute a script file when the database is opened.
        The script file extension is used to determine which extlang
        will run the script.
        It is possible to pass command line arguments after the script name.
        例如: -S"myscript.idc argument1 \"argument 2\" argument3"

        The passed parameters are stored in the "ARGV" global IDC variable.
        Use "ARGV.count" to determine the number of arguments.
        The first argument "ARGV[0]" contains the script name.

        This switch is not available in the IDA Home edition.

 -T###  interpret the input file as the specified file type
        The file type is specified as a prefix of a file type
        visible in the 'load file' dialog box
        To specify archive member put it after the colon char,
        for example: -TZIP:classes.dex
        You can specify any nested paths:
        -T<ftype>[:<member>{:<ftype>:<member>}[:<ftype>]]
        IDA does not display the 'load file' dialog in this case
 -t     create an empty database.
 -W###  specify MS Windows directory
 -x     do not create segmentation
        (used in pair with Dump database command)
        this switch affects EXE and COM format files only.
 -z     debug:
                00000001 drefs
                00000002 offsets
                00000004 flirt
                00000008 idp module
                00000010 ldr module
                00000020 plugin module
                00000040 ids files
                00000080 config file
                00000100 check heap
                00000200 licensing
                00000400 demangler
                00000800 queue
                00001000 rollback
                00002000 already data or code
                00004000 type system
                00008000 show all notifications
                00010000 debugger
                00020000 dbg_appcall
                00040000 source-level debugger
                00080000 accessibility
                00100000 network
                00200000 full stack analysis (simplex method)
                00400000 handling of debug info (e.g. pdb, dwarf)
                00800000 lumina
 -?     this screen (works for the text version)
 ?      this screen (works for the text version)
 -h     this screen (works for the text version)
 -H     this screen (works for the text version)
 --help this screen (works for the text version)
For batch mode, IDA must be invoked with the following command line:
        ida -B input-file
which is equivalent to:
        ida -c -A -Sanalysis.idc input-file
The text interface (idat.exe/idat) is better for batch mode because it uses less system resources. However, please note that regular plugins are not automatically loaded in batch mode because the analysis.idc file quits and the kernel has no chance to load them.

For more information, please see the analysis.idc file in the IDC subdirectory.


 注释对话框

注释对话框
该命令 changes the look of the disassembly 注释. 你可以在此处更改以下复选框/输入字段的值：

Comment indention

        You can change indention of 注释:

                mov ax, bx                      ; this is a comment
        <-------------------------------------->
                       indention

        IDA.CFG 参数: COMMENTS_INDENTION
Display of 'suspicious' marks
        This option enables or disables suspicious marks display.
        Usually the suspicious marks are disabled because IDA displays the suspicious
        operands in red/orange anyway.

        IDA.CFG 参数: SHOW_SUSPICOUS
Display of empty lines
        This option enables or disables the presence of the autogenerated
        empty lines in the disassembly. It could be useful to decrease
        the number of the blank lines on the screen increasing amount
        of information on it.

        IDA.CFG 参数: SHOW_EMPTYLINES
Display of basic blocks
        This option enables or disables the presence of the autogenerated
        empty lines at the end of basic blocks in the disassembly.

        IDA.CFG 参数: SHOW_BASIC_BLOCKS
Display borders between data/code
        This command enables or disables the presence of the autogenerated
        border lines in the disassembly. It could be useful to decrease
        the number of the blank lines on the screen increasing amount
        of information on it. 边界线如下所示：

         ;---------------------------------------------------------

        Note that you can hide a particular border by using hide border command.

        IDA.CFG 参数: SHOW_BORDERS
显示注释
        If this option is disabled, IDA will not show any comments.
Display repeatable comments
        This command enables or disables the repeatable comments display.

        IDA.CFG 参数: SHOW_REPEATABLE_COMMENTS
Display auto comments
        Autocomments are predefined comments for all instructions.
        If you forgot the meaning of a certain instruction, you can use
        this command to get comments to all lines of the screen.

        IDA does not give comments to very simple instructions such as
        'mov' instruction and does not override existing comments.

        IDA.CFG 参数: SHOW_AUTOCOMMENTS
Display source lines
        This options controls the presence of the source line number
        information in the disassembly. Some object files have this
        information.

        IDA.CFG 参数: SHOW_SOURCE_LINNUM
Display try block lines
       This option controls the display of the try block information
       in the disassembly.

       IDA.CFG 参数: SHOW_TRYBLOCKS
另参见 选项子菜单。


 Common Public License 版本 1.0

Common Public License 版本 1.0
THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS COMMON PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.

1. DEFINITIONS

"Contribution" means:

    a) in the case of the initial Contributor, the initial code and
documentation distributed under this Agreement, and

    b) in the case of each subsequent Contributor:

    i) changes to the Program, and

    ii) additions to the Program;

    where such changes and/or additions to the Program originate from and are
distributed by that particular Contributor. A Contribution 'originates' from a
Contributor if it was added to the Program by such Contributor itself 或 anyone
acting on such Contributor's behalf. Contributions do not include additions to
the Program which: (i) are separate modules of software distributed in
conjunction with the Program under their own license agreement, and (ii) are not
derivative works of the Program.
"Contributor" means any person 或 entity that distributes the Program.

"Licensed Patents " mean patent claims licensable by a Contributor which are necessarily infringed by the use 或 sale of its Contribution alone 或 when combined with the Program.

"Program" means the Contributions distributed in accordance with this Agreement.

"Recipient" means anyone who receives the Program under this Agreement, including all Contributors.

2. GRANT OF RIGHTS

    a) Subject to the terms of this Agreement, each Contributor hereby grants
Recipient a non-exclusive, worldwide, royalty-free copyright license to
reproduce, prepare derivative works of, publicly display, publicly perform,
distribute and sublicense the Contribution of such Contributor, if any, and such
derivative works, in source code and object code form.

    b) Subject to the terms of this Agreement, each Contributor hereby grants
Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed
Patents to make, use, sell, offer to sell, import and otherwise transfer the
Contribution of such Contributor, if any, in source code and object code form.
This patent license shall apply to the combination of the Contribution and the
Program if, at the time the Contribution is added by the Contributor, such
addition of the Contribution causes such combination to be covered by the
Licensed Patents. The patent license shall not apply to any other combinations
which include the Contribution. No hardware per se is licensed hereunder.

    c) Recipient understands that although each Contributor grants the licenses
to its Contributions set forth herein, no assurances are provided by any
Contributor that the Program does not infringe the patent 或 other intellectual
property rights of any other entity. Each Contributor disclaims any liability to
Recipient for claims brought by any other entity based on infringement of
intellectual property rights 或 otherwise. As a condition to exercising the
rights and licenses granted hereunder, each Recipient hereby assumes sole
responsibility to secure any other intellectual property rights needed, if any.
For example, if a third party patent license is required to allow Recipient to
distribute the Program, it is Recipient's responsibility to acquire that license
before distributing the Program.

    d) Each Contributor represents that to its knowledge it has sufficient
copyright rights in its Contribution, if any, to grant the copyright license set
forth in this Agreement.
3. REQUIREMENTS

贡献者可以选择根据自己的许可协议以目标代码形式分发程序，前提是：

    a) it complies with the terms and conditions of this Agreement; and

    b) its license agreement:

    i) effectively disclaims on behalf of all Contributors all warranties and
conditions, express and implied, including warranties 或 conditions of title and
non-infringement, and implied warranties 或 conditions of merchantability and
fitness for a particular purpose;

    ii) effectively excludes on behalf of all Contributors all liability for
damages, including direct, indirect, special, incidental and consequential
damages, such as lost profits;

    iii) states that any provisions which differ from this Agreement are offered
by that Contributor alone and not by any other party; and

    iv) states that source code for the Program is available from such
Contributor, and informs licensees how to obtain it in a reasonable manner on or
through a medium customarily used for software exchange.
When the Program is made available in source code form:
    a) it must be made available under this Agreement; and

    b) a copy of this Agreement must be included with each copy of the Program.
Contributors may not remove 或 alter any copyright notices contained within the Program.

Each Contributor must identify itself as the originator of its Contribution, if any, in a manner that reasonably allows subsequent Recipients to identify the originator of the Contribution.

4. COMMERCIAL DISTRIBUTION

Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like. While this license is intended to facilitate the commercial use of the Program, the Contributor who includes the Program in a commercial product offering should do so in a manner which does not create potential liability for other Contributors. Therefore, if a Contributor includes the Program in a commercial product offering, such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify every other Contributor ("Indemnified Contributor") against any losses, damages and costs (collectively "Losses") arising from claims, lawsuits and other legal actions brought by a third party against the Indemnified Contributor to the extent caused by the acts or omissions of such Commercial Contributor in connection with its distribution of the Program in a commercial product offering. The obligations in this section do not apply to any claims or Losses relating to any actual or alleged intellectual property infringement. In order to qualify, an Indemnified Contributor must: a) promptly notify the Commercial Contributor in writing of such claim, and b) allow the Commercial Contributor to control, and cooperate with the Commercial Contributor in, the defense and any related settlement negotiations. The Indemnified Contributor may participate in any such claim at its own expense.

For example, a Contributor might include the Program in a commercial product offering, Product X. That Contributor is then a Commercial Contributor. If that Commercial Contributor then makes performance claims, 或 offers warranties related to Product X, those performance claims and warranties are such Commercial Contributor's responsibility alone. Under this section, the Commercial Contributor would have to defend claims against the other Contributors related to those performance claims and warranties, and if a court requires any other Contributor to pay any damages as a result, the Commercial Contributor must pay those damages.

5. NO WARRANTY

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely responsible for determining the appropriateness of using and distributing the Program and assumes all risks associated with its exercise of rights under this Agreement, including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and unavailability or interruption of operations.

6. DISCLAIMER OF LIABILITY

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

7. GENERAL

If any provision of this Agreement is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this Agreement, and without further action by the parties hereto, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable.

If Recipient institutes patent litigation against a Contributor with respect to a patent applicable to software (including a cross-claim or counterclaim in a lawsuit), then any patent licenses granted by that Contributor to such Recipient under this Agreement shall terminate as of the date such litigation is filed. In addition, if Recipient institutes patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Program itself (excluding combinations of the Program with other software or hardware) infringes such Recipient's patent(s), then such Recipient's rights granted under Section 2(b) shall terminate as of the date such litigation is filed.

All Recipient's rights under this Agreement shall terminate if it fails to comply with any of the material terms or conditions of this Agreement and does not cure such failure in a reasonable period of time after becoming aware of such noncompliance. If all Recipient's rights under this Agreement terminate, Recipient agrees to cease use and distribution of the Program as soon as reasonably practicable. However, Recipient's obligations under this Agreement and any licenses granted by Recipient relating to the Program shall continue and survive.

Everyone is permitted to copy and distribute copies of this Agreement, but in order to avoid inconsistency the Agreement is copyrighted and may only be modified in the following manner. The Agreement Steward reserves the right to publish new versions (including revisions) of this Agreement from time to time. No one other than the Agreement Steward has the right to modify this Agreement. IBM is the initial Agreement Steward. IBM may assign the responsibility to serve as the Agreement Steward to a suitable separate entity. Each new version of the Agreement will be given a distinguishing version number. The Program (including Contributions) may always be distributed subject to the version of the Agreement under which it was received. In addition, after a new version of the Agreement is published, Contributor may elect to distribute the Program (including its Contributions) under the new version. Except as expressly stated in Sections 2(a) and 2(b) above, Recipient receives no rights or licenses to the intellectual property of any Contributor under this Agreement, whether expressly, by implication, estoppel or otherwise. All rights in the Program not expressly granted under this Agreement are reserved.

This Agreement is governed by the laws of the State of New York and the intellectual property laws of the United States of America. No party to this Agreement will bring a legal action under this Agreement more than one year after the cause of action arose. Each party waives its rights to a jury trial in any resulting litigation.


 CommonBits

CommonBits

//
//      Common bits
//

#define MS_COMM 0x000FF800             // Mask of common bits #define FF_COMM 0x00000800             // Has comment? #define FF_REF  0x00001000             // has references? #define FF_LINE 0x00002000             // Has next or prev cmt lines ? #define FF_NAME 0x00004000             // Has user-defined name ? #define FF_LABL 0x00008000             // Has dummy name? #define FF_FLOW 0x00010000             // Exec flow from prev instruction? #define FF_SIGN 0x00020000             // Inverted sign of operands #define FF_BNOT 0x00040000             // Bitwise negation of operands #define FF_ANYNAME      (FF_LABL|FF_NAME)
#define is_flow(F)       ((F & FF_FLOW) != 0) #define is_extra_cmts(F) ((F & FF_LINE) != 0) #define has_xref(F)      ((F & FF_REF)  != 0) #define has_name(F)      ((F & FF_NAME) != 0) #define has_user_name(F) ((F & FF_ANYNAME) == FF_NAME)


 compile_idc_file

compile_idc_file

Compile an IDC script file.
输入不应包含当前正在执行的函数
 - 否则，被替换函数的行为将无法定义。
     path - path to compile
返回: 0 - 正常，否则返回错误消息。
线程安全函数。

string compile_idc_file(string path);


 compile_idc_text

compile_idc_text

编译 IDC 脚本文本。
输入不应包含当前正在执行的函数
 - 否则，被替换函数的行为将无法定义。
     idc_text - text to compile
返回: 0 - 正常，否则返回错误消息。
线程安全函数。

string compile_idc_text(string idc_text);


 编译器

编译器

 操作名称: SetupCompiler
此对话框允许用户指定用于创建程序的编译器以及内存模型、默认调用约定、ABI 和其他参数。

请注意，虽然某些参数组合毫无意义，但 IDA 不会检查它们的有效性。由用户指定正确的组合。

IDA 尝试自动确定正确的值。

包含目录是查找标准 C 标头的目录列表。此参数在解析 C 头文件期间使用。在 MS Windows 中，目录必须用 ';' 分隔，在 Linux 中必须用 ':' 分隔。预定义的宏字段具有相同的格式，并且使用方式类似。请注意，默认情况下，IDA 不会定义任何特定于编译器的宏。

另参见 选项子菜单


 复合偏移表达式

复合偏移表达式
复杂偏移表达式如下所示
        offset target + delta - offset base
It is specified by:
        - type (OFF16, OFF32, LOW16, etc.)
        - base
        - optional target
        - optional delta from target
The relationship between these parameters is (the formula is given for full offsets):
        operand_value = target + delta - base

  or (the same relationship in a different form):

        target = operand_value - delta + base
You always have to specify the offset type and base. Usually, the delta is equal to zero. For the full offset type you may omit the offset target, which is recommended. In this case, IDA will calculate it automatically. However, if you specify the offset target, make sure that the relationship between the parameters still holds. For the half offset types, you have to specify the target because there is no way to calculate it.

The offset types:

  8-bit full offset            :
  16-bit full offset           :
  32-bit full offset           :

    The full offsets are regular offset expressions like

        offset label

    They can occupy 8, 16, or 32 bits.
    You have to specify the offset base for these offsets.

  low 8 bits of 16-bit offset  :

    Only the low 8 bits of the offset. IDA 将把他们代表为

        (offset label) & 0xFF

  low 16 bits of 32-bit offset :

    Only the low 16 bits of the offset. IDA 将把他们代表为
        (offset label) & 0xFFFF

  high 8 bits of 16-bit offset :

    Only the high 8 bits of the offset. IDA 将把他们代表为
        offset label >> 8

  high 16 bits of 32-bit offset:

    Only the high 17 bits of the offset. IDA 将把他们代表为
        offset label >> 16
另参见 offset by any user-specified base


 配置文件

配置文件
首先在 %IDADIR%\cfg 中搜索配置文件，然后在 %IDAUSR%\cfg 中搜索配置文件。

请参阅有关 IDAUSR 环境变量的文档。

在配置文件中，可以使用 C,C++ 样式注释和包含文件。 如果未找到文件，则 IDA 使用默认值。 IDA 使用以下配置文件:

 IDA.CFG      - 通用配置文件
 IDATUI.CFG - 文本模式接口配置文件
 IDAGUI.CFG - 图形模式接口配置文件
在 IDATUI.CFG 中，你可以为 IDA 的文本版本定义热键和键盘宏。 语法:
        "ActionName" = Value
其中 value 可能是:
        字符串:       "Ctrl-F5"
        字符:          'F'
        扫描代码:     0x4900
        零:              0
零扫描代码禁用热键。

要定义键盘宏:

     MACRO key { key1 key2 key3 ... keyN }
其中 key 是字符串(键名)、字符或扫描代码。 示例:
        MACRO   "Alt-W" // this sample macro jumps to "start" label
        {
                "Ctrl-G"
                's' 't' 'a' 'r', 't'
                "Enter"
        }


 从 IDA 连接远程 PIN 工具实例

从 IDA 连接远程 PIN 工具实例
For local debugging the PIN tool can be automatically launched by IDA. For remote debugging it must be launched manually, as in the following example:
  $ /path/to/pin -t /path/to/idadbg/lib -p PORT -- APPLICATION [ARGUMENTS]
Where PORT is the port that the PIN tool will listen for incoming connections from IDA. APPLICATION is the target application to be traced and the optional parameter ARGUMENTS are the arguments to be passed to the target application. Please note that on Win64 it may be required to specify the path to specific x64 binary instead to the pin.bat batch file.

To attach to an already running process instead of starting a new one a command like the following one must be executed:

  $ /path/to/pin -pid PID -t /full/path/to/idadbg/lib/with.extension -p PORT
Where PID is the pid of the running process to attach and PORT the port that the PIN tool will listen for incoming connections.

The hostname and port where the PIN tool is listening for incoming connections should be specified in IDA. See the Debugger, Process options dialog.

After successfully launching the PIN tool the IDA debugger can be launched by pressing F9 or selecting Debugger, Start Process.

PIN accepts the following optional environment variables and command line arguments:

  - Environment variables:
    IDAPIN_DEBUG: Set this environment variable to 1 or higher to print
    debugging information.

  - Command line arguments:
    -p number: Port where the PIN tool will listen for incoming connections from IDA
    -idadbg [0|1|2]: Same as the IDAPIN_DEBUG environment variable


 将操作数转换为二进制数

将操作数转换为二进制数

 操作名称: OpBinary
此命令使当前指令或数据操作数类型为二进制。IDA 始终对二进制数使用 123b 表示法，即使当前汇编程序不支持二进制数也是如此。

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

另参见 编辑|操作符类型|数字子菜单。


 将操作数转换为字符

将操作数转换为字符

 操作名称: OpChar
此命令将当前指令/数据的即时操作数类型转换为字符。

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

另参见 编辑|操作数类型子菜单。


 将操作数转换为十进制数

将操作数转换为十进制数

 操作名称: OpDecimal
This command converts the immediate operand(s) type of the current instruction/data to decimal. Therefore, it becomes a 'number'.

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

另参见 编辑|操作符类型|数字子菜单。


 将操作数转换为浮点数

将操作数转换为浮点数

 操作名称: OpFloat
该命令 makes the current operand type floating point.

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

另参见 编辑|操作符类型|数字子菜单。


 将操作数转换为十六进制数

将操作数转换为十六进制数

 操作名称: OpHex
This command converts immediate operand(s) type of the current instruction/data to hex number. So you can delete suspicious mark of the item.

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

另参见 编辑|操作符类型|数字子菜单。


 将操作数转换为数字

将操作数转换为数字

 操作名称: OpNumber
This command converts immediate operand(s) type of the current instruction/data to a number. That way, you can delete suspicious mark of the item.

The number is represented in the default radix for the current processor (usually hex, but octal for PDP-11, for example).

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

另参见 编辑|操作符类型|数字子菜单。


 将操作数转换为八进制数

将操作数转换为八进制数

 操作名称: OpOctal
此命令使当前指令或数据操作数类型为八进制。IDA 始终对八进制数使用 123o 表示法，即使当前汇编程序不支持八进制数。

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

另参见 编辑|操作符类型|数字子菜单。


 将操作数转换为偏移量(任意段)

将操作数转换为偏移量(任意段)

 操作名称: OpAnyOffset
This command converts the immediate operand of the current instruction/data to an offset from any segment.

IDA will ask to choose a base segment for the offset.

如果使用定位器选择范围，IDA 将执行 'en masse' 转换。它将所选范围内所有指令的即时操作数转换为偏移量。但是，IDA 会首先询问你即时操作数值的下限和上限。If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

To create offsets to structure members use Convert to struct offset command.

另参见：

          按数据段偏移量/否
          按当前段偏移
          编辑|操作数类型|偏移子菜单。
          手动输入 #th 操作数 命令。
          设置操作数类型


 将操作数转换为偏移量(代码段)

将操作数转换为偏移量(代码段)

 操作名称: OpOffsetCs
此命令将当前指令/数据的直接操作数转换为当前段 (CS) 的偏移量。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

如果使用定位器选择范围，IDA 将执行 'en masse' 转换。它将所选范围内所有指令的即时操作数转换为偏移量。但是，IDA 会首先询问你即时操作数值的下限和上限。If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise, it will be left unmodified.

If this command is applied to a structure member in the structure window, then IDA will create an "automatic offset". An automatic offset is an offset with the base equal to 0xFFFFFFFF. This base value means that the actual value of the base will be calculated by IDA when a structure instance is created.

To create offsets to structure members, use Convert to struct offset command.

另参见：

          按数据段偏移/无偏移
          按任何段偏移
          按任何用户指定的基数偏移
          编辑|操作数类型|偏移子菜单。
          手动输入 #th 操作数 命令。
          设置操作数类型


 将操作数转换为偏移量(数据段)

将操作数转换为偏移量(数据段)

 操作名称: OpOffset
This command converts the immediate operand of the current instruction/data to an offset from the current data segment (DS).

If current DS value is unknown (or equal 0xFFFF) IDA will warn you -- it will beep. In this case, you have to define DS register value for the current byte. The best way to do it is:

  - jump to segment register change point
  - change value of DS
  - return
or you can change default value of DS for the current segment.

If you want to delete offset definition, you can use this command again - it works as trigger.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwis, all other operands will be affected.

如果使用定位器选择范围，IDA 将执行 'en masse' 转换。它将所选范围内所有指令的即时操作数转换为偏移量。但是，IDA 会首先询问你即时操作数值的下限和上限。If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

To create offsets to structure members use Convert to struct offset command.

另参见：

          按数据段偏移/无偏移
          按任何段偏移
          按任何用户指定的基数偏移
          编辑|操作数类型|偏移子菜单。
          手动输入操作数 命令。
          设置操作数类型


 将操作数转换为偏移量(自定义基数)

将操作数转换为偏移量(自定义基数)

 操作名称: OpUserOffset
This command converts the immediate operand of the current instruction/data to a complex offset expression.

Please click here to learn more about complex offsets.

如果使用定位器选择范围，IDA 将执行 'en masse' 转换。它将所选范围内所有指令的即时操作数转换为偏移量。但是，IDA 会首先询问你即时操作数值的下限和上限。如果操作数的值 >= 下限且 <= 上限，则操作数将转换为偏移量，否则将保持不变。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

If the offset base is specified as 0xFFFFFFFF, then IDA will create "an automatic offset". Automatic offsets mean that the actual value of the base will be calculated by IDA.

The following offset attributes are available:

  Treat the base address as a plain number

        if checked, IDA will treat the base address as a number.
        In this case, IDA will not create a cross-reference to it
        and the base address will be printed as a number,
        not as an offset expression.

  Offset points past the main object

        Offsets of this type point past an object end.
        They do not cause an object created/deletion.

  Use image base as offset base

        These offsets are based on the image base.
        There is no need to explicitly specify the offset base.
        These offsets are displayed in a concise form:
          rva func
        instead of
          offset func - imagebase
        If you intend to reassemble the output file, execute the
        following IDC statement:
        set_inf_attr(INF_GENFLAGS, get_inf_attr(INF_GENFLAGS) & ~INFFL_ALLASM);

  Subtract operand value

        Use this option when the operand value should be substracted
        from the base to get the target address. In this case the displayed
        expression will be displayed as
          offset base - target
        instead of the usual
          offset target - base

  Signed operand

        Use this option if the operand should be interpreted
        as a signed value. This option is only available for OFF_REF8,
        OFF_REF16, OFF_REF32 and OFF_REF64 offset types.

  Operand value of 0 is invalid

        If the operand value is 0, the value will be highlighted in red.

  Operand value of NOT 0 is invalid

        If the operand value is zero's complement (i.e. all bits are set),
        the value will be highlighted in red.
        For example a OFF_REF16 with an operand value of 0xFFFF would be invalid.

  Use the current address as the offset base

        The offset base is dynamically calculated and is equal to the address of
        the current element:
          - for standalone items: their start address
          - for arrays: the start of the array element
          - for structures: the start of the structure field
        The offset expression is displayed in the following concise form:
          offset target - $
        where "$" denotes the start of the element (and is assembler-dependent).
To create offsets to structure members use Convert to struct offset command.

另参见：

          按数据段偏移量/否
          按当前段偏移
          编辑|操作数类型|偏移子菜单。
          手动输入 #th 操作数 命令。
          设置操作数类型


 将操作数转换为段

将操作数转换为段

 操作名称: OpSegment
此命令将当前指令/数据的直接操作数类型转换为段基数。段基础通常显示如下：
        mov     ax, seg dseg
使用此命令时，IDA 将删除 手动 输入的操作数。

如果 IDA 找不到基数等于操作数值的段，则仅将其显示为十六进制数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

另参见 编辑|操作数类型子菜单。


 将操作数转换为堆栈变量

将操作数转换为堆栈变量

 操作名称: OpStackVariable
This command converts immediate operand(s) type of the current instruction to an offset to stack variables, i.e. a local variable or function argument in the stack.

You need to define stack variables before using this command.

If the current operand is based on the value of the stack pointer ([ESP+xxx]) and the SP value is traced incorrectly, then you need to correct SP value using change stack pointer command.

如果使用定位器选择范围，IDA 将执行 'en masse' 转换。It will convert immediate operands of all instructions in the selected range to stack variables. 但是，IDA 会首先询问你即时操作数值的下限和上限。If the operand value is >= lower limit and <= upper limit then the operand will be converted to stack variable, otherwise it will be left unmodified.

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响; 否则，所有其他操作数都将受到影响。

另参见：

          编辑|操作数类型子菜单。
          手动输入 #th 操作数 命令。
          Define stack variables...


 将操作数转换为结构体偏移量

将操作数转换为结构体偏移量

 操作名称: OpStructOffset

 GUI version:
 ------------
This command pertmits to convert all immediate operands of instructions in a range selection to a path of offsets through a structure and its possible sub unions. If no selection is active, IDA will simply permit to convert the current operand. In this case, it will display a simple dialog box the same way as the text version (see below).

You can select the desired register in the drop-down list: all operands relative to this register will be added to the 'Offsets' list. 下拉列表中的特殊空行用于直接处理即时值。Checkboxes in the 'Offsets' list allow you to select which operand you indeed want to modify. By default, IDA will select only undefined operands, to avoid overwriting previous type definitions. This list is sorted by operand value, by instruction address and finally by operand number. You can easily see the instructions related to the operand by moving the mouse over it, and wait for a hint to be displayed.

The 'Structures and Unions' tree will contain all selectable structures, and sub unions. Once you select or move over a structure, the 'Offsets' list updates itself for each checked offset: the computed name of the operand is displayed, according to the selected structure in the tree. An icon is also drawn, to easily know if a specific structure matchs the offset or not, or if the offset is too big for the selected structure. The structures who match the most offsets will be near the top of the tree. You can also move your mouse over structures in the tree to obtain an interesting hint.

如果可以通过选择联合成员来专用偏移量，则也可以显示“？”图标。In this case, if you expand the structure in the tree, you can select the adequate union member simply by checking the desired radio button. IDA automatically corrects the related name in the 'Offsets' list.

The 'Offset delta' value represents the difference between the structure start and the pointer value. 例如，如果你有一个操作数 4，并且想要转换为类似 "mystruct.field_6-2" 的表达式，则必须输入 2 作为增量。通常增量为零，即指针指向结构体的起点。

The 'Hide sub structures without sub unions' option (checked by default) avoids to add unnecessary sub structures to the tree, to keep it as small as possible. If you uncheck this option, all sub structures will be added to the tree.

By default, IDA displays the structure member at offset 0. To change this behaviour, you can directly disable the 'Force zero offset field' in the 'Options' frame. Later zero offsets can be forced using Edit, Structs, Force zero offset menu item.

 Text version:
 -------------
This command converts immediate operand(s) type of the current instruction/data to an offset within the specified structure. Before using this command, you have to define a structure type.

First of all, IDA will ask a so-called "struct offset delta". This value represents the difference between the structure start and the pointer value. 例如，如果你有一个操作数 4，并且想要转换为类似 "mystruct.field_6-2" 的表达式，则必须输入 2 作为增量。通常增量为零，即指针指向结构体的起点。

如果使用定位器选择范围，IDA 将执行 'en masse' 转换。它将所选范围内所有指令的即时操作数转换为偏移量。但是，IDA 会首先询问你即时操作数值的下限和上限。如果操作数的值 >= 下限且 <= 上限，则操作数将转换为偏移量，否则将保持不变。

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响;否则，所有其他操作数都将受到影响。

By default IDA doesn't display the structure member at offset 0. To change this behaviour, use Force zero field offset command.

Moreover, if there are several possible representations (this can happen if unions are used), select the desired representation using the Select union member... command.

另参见：

          按数据段/否偏移
          按当前段偏移
          按任意段偏移
          由任何用户指定的基数偏移
          编辑|操作数类型|偏移子菜单。
          Enter #th operand manually command.
          设置操作数类型


 将操作数转换为符号常量(枚举)

将操作数转换为符号常量(枚举)

 操作名称: OpEnum
This command converts immediate operand(s) type of the current instruction/data to an enum member. Before using this command, you have to define an enumeration type.

If the selected enum is a bitfield, IDA will try to build a bitfield expression to represent the constant. Please note that for bitfields having multiple constants with the same value some expressions won't be possible.

如果使用定位器选择范围，IDA 将执行 'en masse' 转换。It will convert immediate operands of all instructions in the selected range to symbolic constants. 但是，IDA 会首先询问你即时操作数值的下限和上限。If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

使用此命令时，IDA 将删除 手动 输入的操作数。

如果光标位于第一个操作数上(光标位于 ',' 之前)，则第一个操作数将受到影响; 否则，所有其他操作数都将受到影响。

另参见：

          编辑|操作数类型子菜单。
          手动输入 #th 操作数 命令。
          设置操作数类型


 转换为数组

转换为数组

 操作名称: MakeArray
This command allows you to create arrays and change their sizes.

The arrays are created in 2 simple steps:

  1. Create the first element of array using the data
     definition commands (data, string, structs)
  2. Apply the array command to the created data item.
Enter array size in current array elements (not bytes). The suggested array size is the minimum of the following values:
        - the address of the next item with a cross reference
        - the address of the next user-defined name
For string literals, you can use this command to change the length of the string.

The dialog box contains the following fields:

Items on a line (meaningless for string literals):

        0               place maximal number of items on a line
        other value     number of items on a line
Please note that the margin parameter affects the number of items on a line too.

Alignment (meaningless for string literals):

        -1              do not align items
        0               align automatically
        other value     width of each item

 Signed elements:       if checked, IDA treats all elements as signed numbers.
                        only meaningful for numbers (not for offsets and
                        segments and strings)

 Display indexes:       if checked, IDA will display the indexes of array
                        elements in the form of comments (0,1,2...)

 Create as array:       if not checked, IDA will create a separate item for
                        each array element. Useful for creating huge arrays.
                        If the box is unchecked when this command is
                        applied to string literals, IDA will create many
                        string literals instead of one big string.
If applied to a variable-sized structure, this command is used to specify the overall size of the structure. You cannot create arrays of variable-sized structures.

另参见

 Edit submenu
 如何输入数字。


 转换为数据

转换为数据

 操作名称: MakeData
This command converts the current unexplored bytes to data. If it is not possible, IDA will warn you.

Multiple using of this command will change the data type:

 db -> dw -> dd -> float -> dq -> double -> dt -> packreal -> octa \;
 ^                                                                 |;
 \---------<----------------<--------------<-----------------------/;
You may remove some items from this list using setup data command.

If the target assembler does not support double words or another data type, it will be skipped.

 To create a structure variable, use Declare struct var command.
 To create an array, use Array command.
 To convert back, use Undefine command.
另参见 编辑子菜单


 转换为指令

转换为指令

 操作名称: MakeCode
This command converts the current unexplored bytes to instruction(s). IDA will warn you if it is not possible.

If you have selected a range using the anchor, all the bytes from this range will be converted to instructions.

If you apply this command to an instruction, it will be reanalyzed.

另参见 编辑子菜单


 转换为字符串文字

转换为字符串文字

 操作名称: MakeStrlit
此命令将当前未探查的字节转换为字符串。

允许的字符集在 配置文件 参数 StrlitChars 中指定。在任何情况下都不允许使用字符 '\0'。If the current assembler does not allow characters above 0x7F, characters with high bit set are not allowed.

If the anchor has been dropped, IDA will take for the string all characters between the current cursor position and the anchor.

Use the anchor if the string starts a disallowed character.

This command also generates a name for the string. In the configuration file, you can specify the characters allowed in names (NameChars).

You can change the literal string length using Array command.

The GUI version allows you to assign a special hotkey to create Unicode strings. To do so, change the value of the StringUnicode parameter in the IDAGUI.CFG file.

Pascal Strings

To create Pascal style strings (with first byte indicating string length) use Set String Style command.

另参见 编辑子菜单


 复制结构体类型

复制结构体类型

 操作名称: CopyStruct
This command makes a copy of the current structure type. The new structure type will have the same members as the current one but its name will be autogenerated (something like struc_333)

By default the new 结构体类型 will be placed after the current 结构体类型.

另参见 编辑|结构体子菜单。


 将字段信息复制到指针

将字段信息复制到指针

 操作名称: CopyFieldsToPointers
This command scans the current struct variable and renames the locations pointed by offset expressions unless they already have a non-dummy name.

It also copies the type info from the struct members to pointed locations.

另参见 编辑|结构体子菜单。


 创建新段

创建新段

 操作名称: CreateSegment
此命令允许你创建新区段。

If you select a range using the anchor, IDA will propose the start address and the end address of the selection as defaults for the segment bounds.

You need to specify at least:

    - the segment start address
    - the segment end address (excluded from the range)
    - the segment base
Click here to learn about addressing model used in IDA.

If "sparse storage" is set, IDA will use special sparse storage method for the segment. This method is recommended for huge segments. Later, it is possible to change the storage method of any region using set_storage_type IDC function.

If another segment already exists at the specified address, the existing segment is truncated and the new segment lasts from the specified start address to the next segment (or specified end address, whichever is lower). If the old and the new segments have the same base address, instructions/data will not be discarded by IDA. Otherwise, IDA will discard all instructions/data of the new segment.

IDA 可以创建一个额外的细分市场，以覆盖新细分市场结束后的范围。

另参见 编辑|段子菜单。


 从当前数据创建新的结构体

从当前数据创建新的结构体

 操作名称: CreateStructFromData
该命令 defines a new structure from 数据 already defined. The new structure is created with adequate 数据 types, and each member uses the current 数据 name if it is available.

此命令仅在 IDA 的图表版本中可用。

另参见 编辑|结构体子菜单。


 创建常规注释

创建常规注释

 操作名称: MakeComment
If you stand at the function start and your cursor is on a function name, IDA will ask you to enter a function comment.

If you stand at the segment start and your cursor is on a segment name, IDA will ask you to enter a segment comment.

If this command is issued in the structures window, it allows you to change the comment of a structure, or structure member. If the cursor is on the structure name, it will be changed, otherwise the member name will be changed. Otherwise, this command allows you to enter a normal indented comment for the current item.

You can show/hide all comments in Comments Dialog.

另参见

        "How to use the notepad"
         Edit|Comments submenu
         Repeatable comments
         How to use the notepad


 创建可重复的注释

创建可重复的注释

 操作名称: MakeRptCmt
This command allows you to enter a repeatable comment. 可重复的注释将附加到当前项目和引用它的所有其他项目。

If you stand at the function start, IDA will ask you to enter a function comment.

If this command is issued in the structures window, it allows you to change the comment of a structure or structure member. If the cursor is on the structure name, the structure comment will be changed, otherwise the member comment will be changed.

Otherwise, this command allows you to enter a repeatable comment for the current item.

You cannot enter repeatable segment comments.

All items that refer to the current item will have this comment by default.

Note that if you have defined both comment types (regular and repeatable), the regular comment will be displayed for the current item and the repeatable comment will be displayed for all items that refer to the current item, if they do not have their own comments.

The repeatable comments may be used to describe subroutines, data items etc., because all calls to the subroutine will have the repeatable comment.

You can show/hide all comments in the Comments Dialog.

You can show and hide repeatable comments in the Comments Dialog.

另参见

        "How to use the notepad"
         Edit|Comments submenu
         Regular comments


 创建其他注释行

创建其他注释行

 Action                 Name
 ------                 ----
 edit anterior lines    MakeExtraLineA
 edit posterior lines   MakeExtraLineB
If you want to enter multi-line comments or additional instructions, you can use this feature of IDA.

There are two kinds of extra lines: the ones generated before the instruction line and the ones generated after the instruction line.

Do not forget that the maximal number of lines for an item is 500.

IDA does not insert a comment symbol at the beginning of the lines.

另参见

        "How to use the notepad"
        Edit|Text|Comments submenu.
        如何使用记事本


 创建对齐指令

创建对齐指令

 操作名称: MakeAlignment
此命令允许你创建对齐指令。alignment 指令将替换链接器插入的一些无用字节，以将代码和数据与段落边界或任何其他等于 2 的幂的地址对齐。

你可以选择要转换为对齐指令的范围。如果你选择了一个范围，IDA 将尝试自动确定正确的对齐方式。

要使此命令正常工作，至少需要满足两个要求： - 当前地址上必须有足够的未探查字节。- 对齐指令必须始终以可被一两次幂整除的地址结束。

另参见

         编辑|其他子菜单
         如何输入地址。


 创建 ASM 文件

创建 ASM 文件

 操作名称: ProduceAsm
请输入汇编程序文本文件的文件名。IDA 会将反汇编的文本写入此文件。

如果使用 Drop Anchor 命令在屏幕上选择了范围，则 IDA 将仅写入所选范围(从当前地址到定位点)。

如果在写入文件期间出现某些 I/O 问题(例如磁盘已满)，IDA 将停止并创建部分文件。

请注意， 演示 版无法生成汇编文件。

另参见其他 生成输出文件命令。


 创建 C 头文件

创建 C 头文件

 操作名称: ProduceHeader
此命令将本地类型窗口中的所有定义保存到 C 头文件中

请注意，除非在结构体窗口中创建的类型与本地类型同步，否则不会保存这些类型

另参见其他生成输出文件命令。


 创建差异文件

创建差异文件

 操作名称: ProduceDiff
This command will prompt you for a filename and then will create a plain text difference file of the following format:
 comment

 filename
 offset: oldval  newval
另参见
         文件|生成输出文件子菜单,
         编辑|补丁核心子菜单。


 创建可执行文件

创建可执行文件

 操作名称: ProduceExe
Enter a file name for the new executable file. Usually this command is used after patching (see commands Patch byte and Patch word) to obtain a patched version of the file.

IDA produces executable files only for:

  - MS DOS .exe
  - MS DOS .com
  - MS DOS .drv
  - MS DOS .sys
  - general binary
  - Intel Hex Object Format
  - MOS Technology Hex Object Format
For other file formats please create a difference file.

NOTE: only Patch byte/word commands affect the executable file contents, other commands (including User-Specified String for the #th Operand) will not affect the content of the disassembled file.

EXE files: Output files will have the same EXE-header and relocation table as the input file. IDA will fill unused ranges of the EXE file (e.g. between relocation table and loadable pages) with zeroes.

另参见

         文件|生成输出文件子菜单,
         编辑|补丁核心子菜单。


 创建函数

创建函数

 操作名称: MakeFunction
此命令在反汇编文本中定义一个新函数。

你可以使用 定位器指定函数边界。如果未指定任何边界，IDA 将尝试自动查找边界：

   - 函数起点等于当前光标位置;
   - 函数终点由 IDA 计算。
函数不能包含对未定义指令的引用。如果已在指定地址定义函数，则 IDA 将跳转到其起始地址，并显示一条警告消息。

函数必须以指令开头。

另参见

         编辑|函数子菜单。
         编辑函数
         删除函数


 创建 HTML 文件

创建 HTML 文件

 操作名称: ProduceHtml
Please enter a 文件 name for the HTML 文件. IDA 会将反汇编的文本写入此文件。

If you've selected an area on the screen using Drop 定位器 命令, IDA will write only the selected area (from the current address to the 定位器).

如果在写入文件期间出现某些 I/O 问题(例如磁盘已满)，IDA 将停止并创建部分文件。

Please note that demo version cannot produce HTML files. 此命令仅在 IDA 的图表版本中可用。

另参见其他生成输出文件命令。


 创建 INC 文件

创建 INC 文件

 操作名称: ProduceInc
Please enter a 文件 name for the assembler include 文件. IDA will write the信息 about the defined types (结构体 and 枚举) to this 文件.

如果在写入文件期间出现某些 I/O 问题(例如磁盘已满)，IDA 将停止并创建部分文件。

Please note that demo version cannot produce assembler include 文件.

另参见其他生成输出文件命令。


 创建 LST 文件

创建 LST 文件

 操作名称: ProduceLst
Enter a file name for the assembler listing file. IDA 会将反汇编的文本写入此文件。

If you've selected a range on the screen using Drop Anchor command, IDA will write only the selected range (from the current address to the anchor).

如果在写入文件期间出现某些 I/O 问题(例如磁盘已满)，IDA 将停止并创建部分文件。

Please note that demo version cannot produce assembler listing files.

另参见其他 生成输出文件命令。


 创建 MAP 文件

创建 MAP 文件

 操作名称: ProduceMap
请输入映射的文件名。IDA 将写入有关此文件的以下信息:
  - 当前分段
  - 按值排序的名称列表
你可以禁用分段信息的生成。你还可以在输出文件中启用或禁用 虚拟 名称。

你可以使用此映射文件作为你的信息，也可以用于调试(例如，Periscope Company 的 Periscope 或 Borland 的 Turbo Debugger 可以读取此文件)。

另参见其他 生成输出文件命令。


 创建段 - 自动选取选择器案列

创建段 - 自动选取选择器案列
Suppose we need to create a segment occupying linear addresses 200000-200C00 and the virtual addresses must have be 0000..0C00. If we simply enter
        segment start address:  0x200000
        segment end address:    0x200C00
        segment base:           0x20000
然后 IDA 会注意到段基数太大，不适合 16 位。Because of this IDA will find a free selector (let's say it has found selector number 5), define it to point at paragraph 0x20000 and create a segment. After all this we will have:
        - a new selector is defined (5 -> 0x20000)
        - a new segment is created. Its attributes:
                start = 0x200000
                end   = 0x200C00
                base  = 5
The first virtual address in the segment will be 0:
        VirtualAddress = LinearAddress - (SelectorValue(SegmentBase) << 4)
                       = 0x200000      - (SelectorValue(5) << 4)
                       = 0x200000      - (0x20000 << 4)
                       = 0x200000      - 0x200000
                       = 0
请注意，结束地址从不属于 IDA 中的段。

返回到寻址空间概念


 创建段 - 简单案例 (PC)

创建段 - 简单案例 (PC)
IBM PC case -----------

Suppose we need to create a segment occupying addresses F000:1000..F000:2000 Let's calculate linear addresses:

        start = (0xF000 << 4) + 0x1000 = 0xF1000
        end   = (0xF000 << 4) + 0x2000 = 0xF2000
The segment base must be selected so that the first offset in our segment will be 0x1000. 让我们使用以下等式找到它：
        VirtualAddress = LinearAddress - (SegmentBase << 4);
        0x1000         = 0xF1000 - (base << 4);
After solving this equation, we see that the segment base is equal to 0xF000. (you see, this is really a very simple case :) )

Now, we can create a segment entering:

        segment start address:  0xF1000
        segment end address:    0xF2000
        segment base:           0xF000
请注意，结束地址从不属于 IDA 中的段。

返回到寻址空间概念


 创建段 - 简单案例 (Z80)

创建段 - 简单案例 (Z80)

 Z80 case
 --------
Suppose we need to create a segment occuping virtual addresses 8000-C000. Since we are free to place our segment anywhere in the linear address space, we choose the linear addresses at our convenience. Let's say we choose a linear address 0x20000:
        start = 0x20000
        end   = start + 0x4000 = 0x24000
The segment base must be selected so that the virtual address in our segment will be 0x8000. 让我们使用以下等式找到它：
        VirtualAddress = LinearAddress - (SegmentBase << 4);
        0x8000         = 0x20000 - (base << 4);
        base << 4      = 0x20000 - 0x8000
        base << 4      = 0x18000
        base           = 0x1800
After solving this equation, we see that the segment base is equal to 0x1800.

Now we can create a segment entering:

        segment start address:  0x20000
        segment end address:    0x24000
        segment base:           0x1800
请注意，结束地址从不属于 IDA 中的段。

返回到寻址空间概念


 创建段 - 自定义选择器案例

创建段 - 自定义选择器案例
If the previous example we saw how IDA allocates a selector automaticlly. You could make it yourself:

1. Create a selector. For this, open the selectors window and press Ins. Enter a selector number and its value.

2. Create a segment. Specify the selector number as the segment base.

返回到寻址空间概念


 create_align

create_align

Convert the current item to an alignment directive
     ea      - linear address
     count   - number of bytes to convert
     align   - 0 or 1..32
               if it is 0, the correct alignment will be calculated
               by the kernel
返回: 1-ok, 0-failure

success create_align(long ea, long count, long align);


 create_array

create_array

create array
     name - name of array. There are no restrictions
            on the name (its length should be less than
            120 characters, though)
返回: -1 - can't create array (it already exists)
         otherwise returns id of the array

long create_array(string name);


 create_byte

create_byte

Convert the current item to a byte
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_byte(ea)     create_data(ea, FF_BYTE, 1, BADADDR)


 create_custom_data

create_custom_data

Convert the current item to a custom data type
     ea   - linear address
     size - size of the item
     dtid - custom data type id (see find_custom_data_type)
     fid  - custom data format id (see find_custom_data_format)
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_custom_data(ea, size, dtid, fid) create_data(ea, FF_CUSTOM, size, dtid|((fid)<<16))


 create_data

create_data

Create a data item at the specified address
     ea - linear address
     flags - FF_BYTE..FF_PACKREAL
     size - size of item in bytes
     tid - for FF_STRUCT the structure id
returns: 1-ok, 0-failure

success create_data(long ea, long flags, long size, long tid);


 create_double

create_double

Convert the current item to a double floating point (8 bytes)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_double(ea)   create_data(ea, FF_DOUBLE, 8, BADADDR)


 create_dword

create_dword

Convert the current item to a double word (4 bytes)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_dword(ea)    create_data(ea, FF_DWORD, 4, BADADDR)


 create_float

create_float

Convert the current item to a floating point (4 bytes)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_float(ea)    create_data(ea, FF_FLOAT, 4, BADADDR)


 create_insn

create_insn

Create an instruction at the specified address
     ea - linear address
返回: 0 - can't create an instruction (no such opcode, the instruction would
             overlap with existing items, etc)
         otherwise returns length of the instruction in bytes

long create_insn(long ea);


 create_oword

create_oword

Convert the current item to a octa word (16 bytes/128 bits)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_oword(ea)    create_data(ea, FF_OWORD, 16, BADADDR)


 create_pack_real

create_pack_real

Convert the current item to a packed real (10 or 12 bytes)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_pack_real(ea) create_data(ea, FF_PACKREAL, 10, BADADDR)


 create_qword

create_qword

Convert the current item to a quadro word (8 bytes)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_qword(ea)    create_data(ea, FF_QWORD, 8, BADADDR)


 create_strlit

create_strlit

Create a string.
This function creates a string (the string type is determined by the value
of get_inf_attr(INF_STRTYPE))
  ea      - linear address
  len     - length of the string in bytes
返回: 1-ok, 0-failure
note: the type of an existing string is returned by get_str_type()

success create_strlit(long ea, long len=0);


 create_struct

create_struct

Create a structure data item at the specified address
     ea      - linear address
     size    - structure size in bytes. -1 means that the size
               will be calculated automatically
     strname - name of a structure type
返回: 1-ok, 0-failure

success create_struct(long ea, long size, string strname);


 create_tbyte

create_tbyte

Convert the current item to a tbyte (10 or 12 bytes)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_tbyte(ea)    create_data(ea, FF_TBYTE, 10, BADADDR)


 create_word

create_word

Convert the current item to a word (2 bytes)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_word(ea)     create_data(ea, FF_WORD, 2, BADADDR)


 create_yword

create_yword

Convert the current item to a ymm word (32 bytes/256 bits)
     ea - linear address
返回: 1-ok, 0-failure
This is a convenience macro, see also create_data() function

#define create_yword(ea)    create_data(ea, FF_YWORD, 32, BADADDR)


 致谢

致谢

IDA 是一个复杂的多功能软件。
在文档中它包含一些第三方代码需要提及的授权。
下面将其列出：
------------------------------------------------------------------------------- XML patterns from Ghidra Software Reverse Engineering Framework
适用于 Ghidra XML 模式的 Apache 许可证 v2.0
------------------------------------------------------------------------------- The LLVM Project is under the Apache License v2.0 with LLVM Exceptions:
带有 LLVM 例外的 Apache 许可证 v2.0
------------------------------------------------------------------------------- LZFSE decompressor
Copyright (c) 2015-2016, Apple Inc. All rights reserved.
如果满足以下条件，则允许以源代码和二进制形式重新分发和使用，无论是否进行修改：
1.  Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2.  Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
3.  Neither the name of the copyright holder(s) nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------- Minimal LZMA Project (minlzma)
MIT License
Copyright (c) 2020 Alex Ionescu
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
上述版权声明和本许可声明应包含在本软件的所有副本或大部分内容中。
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Portions of NDK by Alex Ionescu
The NDK is Copyright Â©2005-2012 Alex Ionescu. GNU LESSER GENERAL PUBLIC LICENSE Version 2.1, February 1999
IDAPython plugin by Gergely Erdelyi
Copyright (c) 2004-2008 Gergely Erdelyi . All rights reserved.
如果满足以下条件，则允许以源代码和二进制形式重新分发和使用，无论是否进行修改：
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
3. The name of the author may not be used to endorse 或 promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
InfoZIP libraries
  Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler

  This software is provided 'as-is', without any express 或 implied
  warranty.  In no event will the authors be held liable for any damages
  arising from the use of this software.

  Permission is granted to anyone to use this software for any purpose,
  including commercial applications, and to alter it and redistribute it
  freely, subject to the following restrictions:

  1. The origin of this software must not be misrepresented; you must not
     claim that you wrote the original software. If you use this software
     in a product, an acknowledgment in the product documentation would be
     appreciated but is not required.
  2. Altered source versions must be plainly marked as such, and must not be
     misrepresented as being the original software.
  3. This notice may not be removed 或 altered from any source distribution.

  Jean-loup Gailly        Mark Adler
  jloup@gzip.org          madler@alumni.caltech.edu

PCRE2 library:   BSD License------------------------
DSP56K analyzer part of DSP56K module
  Copyright (c) 1998 Miloslaw Smyk
  All rights reserved.
  Support for DSP 563xx added by Ivan Litvin

  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions
  are met:
  1. Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
  3. All advertising materials mentioning features or use of this software
     must display the following acknowledgement:
       This product includes software developed by Miloslaw Smyk
  4. The name of the author may not be used to endorse or promote products
     derived from this software without specific prior written permission

  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

TVision port to Linux is partially based on modifications made by Sergio Sigala
  All changes copyright (c) 1997 Sergio Sigala, Brescia, Italy.
  All rights reserved.

  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions
  are met:
  1. Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.

  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

COIN/Clp library
  Copyright (C) 2002, International Business Machines
  Corporation and others.

  Common Public License v1.0

CCTOOLS package from Apple
 APPLE PUBLIC SOURCE LICENSE
  Version 2.0 - August 6, 2003

------------------------------------------------------------------------------- DEX loader and Dalvik processor module use portions of code from the Android project "libdex":
  Copyright (C) 2008 The Android Open Source Project

  Licensed under the Apache License, Version 2.0 (the "License");
  you may not use this file except in compliance with the License.
  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.

Libdwarf library:
  Copyright (C) 2000,2002,2003,2004,2005 Silicon Graphics, Inc. All Rights Reserved.
  Portions Copyright (C) 2008-2010 Arxan Technologies, Inc. All Rights Reserved.
  Portions Copyright (C) 2009-2011 David Anderson. All Rights Reserved.
  Portions Copyright (C) 2010 SN Systems Ltd. All Rights Reserved.

  This program is free software; you can redistribute it and/or modify it
  under the terms of version 2.1 of the GNU Lesser General Public License
  as published by the Free Software Foundation.

Qt libraries:
  http://doc.qt.io/qt-5/licensing.html

  The source code of Qt used in IDA is available upon request at support@hex-rays.com

SHA256 checksum: Copyright (c) 2002, Dr Brian Gladman, Worcester, UK.   All rights reserved. This code was * written by Colin Plumb in 1993, no copyright is claimed. * This code is in the public domain; do with it what you wish.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:  All rights reserved.
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.

 The free distribution and use of this software in both source and binary
 form is allowed (with or without changes) provided that:

 LICENSE TERMS

 The free distribution and use of this software in both source and binary
 form is allowed (with or without changes) provided that:

   1. distributions of this source code include the above copyright
      notice, this list of conditions and the following disclaimer;

   2. distributions in binary form include the above copyright
      notice, this list of conditions and the following disclaimer
      in the documentation and/or other associated materials;

   3. the copyright holder's name is not used to endorse products
      built using this software without specific written permission.

 ALTERNATIVELY, provided that this notice is retained in full, this product
 may be distributed under the terms of the GNU General Public License (GPL),
 in which case the provisions of the GPL apply INSTEAD OF those given above.

 DISCLAIMER
*  You may obtain a copy of the License at * *  http://www.apache.org/licenses/LICENSE-2.0

 This software is provided 'as is' with no explicit or implied warranties
 in respect of its properties, including, but not limited to, correctness
 and/or fitness for purpose.*  You may obtain a copy of the License at * *  http://www.apache.org/licenses/LICENSE-2.0
------------------------------------------------------------------------------- MinHook - The Minimalistic API Hooking Library for x64/x86 Copyright (C) 2009-2017 Tsuda Kageyu. All rights reserved.
如果满足以下条件，则允许以源代码和二进制形式重新分发和使用，无论是否进行修改：
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
================================================================================ Portions of this software are Copyright (c) 2008-2009, Vyacheslav Patkov. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.All rights reserved.
如果满足以下条件，则允许以源代码和二进制形式重新分发和使用，无论是否进行修改：
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
------------------------------------------------------------------------------- Hacker Disassembler Engine 64 C Copyright (c) 2008-2009, Vyacheslav Patkov. All rights reserved.
如果满足以下条件，则允许以源代码和二进制形式重新分发和使用，无论是否进行修改：
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------- Hacker Disassembler Engine 64 C Copyright (c) 2008-2009, Vyacheslav Patkov. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
MIT License
Copyright (c) 2018-2021 Berscheid
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Copyright (c) 2018-2021 Berscheid
Licensed under the MIT License <http://opensource.org/licenses/MIT.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
------------------------------------------------------------------------------- __|  |   __|     |   | |  JSON for Modern C++ |  |  |__   |  |  | | | |  version 3.10.5 |_____|_____|_____|_|___|  https://github.com/nlohmann/jsonIN NO EVENT  SHALL THE AUTHORS  OR COPYRIGHT  HOLDERS  BE  LIABLE FOR  ANY  CLAIM,  DAMAGES OR  OTHER LIABILITY, WHETHER IN AN ACTION OF  CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE  OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.


 交叉引用属性

交叉引用属性
交叉引用对话框显示对各种项的引用列表。每行都具有以下属性:

Direction Up or Down. Meainingful for program address; denotes where the reference comes from, from the lower addresses than the reference target (down) or from higher addresses (up).

Type

        The following types exist:

          o - offset, the address of the item is taken
          r - read access
          w - write access
          t - textual referenced (used for manually specified operands)
          i - informational (e.g. a derived class refers to its base class)
          J - far (intersegment) jump
          j - near (intrasegment) jump
          P - far (intersegment) call
          p - near (intrasegment) call
          ^ - ordinary flow
          s - xref from a structure
          m - xref from a structure member
          k - xref from a stack variable
Address
        For 'xrefs to' dialogs: where the reference comes from (source)
        For 'xrefs from' dialogs: where the reference goes to (destination)
Text
        Additional info about the cross reference


 交叉引用对话框

交叉引用对话框
IDA 自动维护交叉引用。 当然，当 IDA 开始反汇编新文件时，交叉引用不会立即出现; 它们将在背景 分析期间收集。

此命令更改交叉引用的表示形式。

在交叉引用中显示段

        此复选框启用或禁用交叉引用中的句段:

           启用：     ; CODE XREF: 3000:1025
           禁用：     ; CODE XREF: 1025
显示交叉引用类型标记
        If this option is disabled, IDA will not display "CODE"
        or "DATA" in the cross-references.

        IDA.CFG 参数: SHOW_XREF_TYPES
显示功能偏移量
        此选项控制交叉引用地址的外观。
        如果启用，地址将显示为偏移量
        从函数开始。示例：

           启用：     somefunc+0x44
           禁用：    cseg:0x4544

        IDA.CFG 参数: SHOW_XREF_FUNC
Display xref values
        If this option is disabled, IDA will just display the presence
        of cross-references, like this:

                ; CODE XREF: ...

        IDA.CFG 参数: SHOW_XREF_VALUES
右边距
        Determines the maximal length of a line with the cross references.

        IDA.CFG 参数: MAX_XREF_LENGTH
Cross reference depth
        This value "how many bytes of an object to look at to collect
        cross references". For example we have an array:

                A       db 100 dup(0)

        If some instruction refers to the 5-th element of the array:

                mov     al,A+5

         with TD=3      we'll have no xrefs displayed
         with TD=10     we'll have this xref

        IDA.CFG 参数: MAX_TAIL
Number of xrefs to display
        Determines the maximal number of the cross references to display.
        You may keep this value low because you can access all xrefs by
        using the Jump to cross reference command.

        IDA.CFG 参数: SHOW_XREFS
另参见 选项子菜单。


 交叉引用窗口

交叉引用窗口

 操作名称: OpenXrefs
此命令将打开交叉引用窗口。 此窗口包含对当前位置的所有引用。

你可以在此窗口中使用 列表查看器 命令。

您也可以通过按 Ins 或 Del 在此处添加和删除交叉引用。 右键单击鼠标也可以。

添加交叉引用：应指定 from 和 to 地址以及交叉引用类型。

交叉引用：如果选中“如果没有更多交叉引用，则未定义”，则在删除最后一个交叉引用时，目标地址的指令将未定义。 仅当指令不启动函数时，IDA 才会取消定义指令。

另参见 视图|打开子视图子菜单。


 自定义分解名称

自定义分解名称
All your changes will be saved in the current database. If you want to change the form of demangled names for all new databases, then you need to edit the configuration file, variables 'ShortNameForm' and 'LongNameForm'. Below is the list of all checkboxes with examples (spaces are inserted only for the ease of understanding):

Only main name

        on:     func;
        off:    static void __pascal func(void) const;
No underscores in calling conventions
        on:     void   pascal func(void);
        off:    void __pascal func(void);
No calling conventions for parameters and __based()
        on:  void         func(int (*          f2)(void));
        off: void __cdecl func(int (* __pascal f2)(void));
No return type of functions
        on:         func(void);
        off:    int func(void);
No "based()" specifier
        on:   int                            a;
        off:  int __based(__segname("DATA")) a;
        on:   void __based(void) *b;
        off:  void               *b;
        on:   int __based(__self) (*p)(void);
        off:  int                 (*p)(void);
No calling conventions
        on:     void          func(void);
        off:    void __pascal func(void);
No postfix const
        on:     void aclass::func(void);
        off:    void aclass::func(void) const;
No access keywords
        on:             void func(void);
        off:    private void func(void);
No throw descriptions
        on:     void func(void);
        off:    void func(void) throw(Class::Member);
No static and virtual keywords
        on:                    void aclass::func(void);
        off:    static virtual void aclass::func(void);
No UDT keywords
        on:            A & func(      A *,      B *);
        off:     class A & func(class A *, enum B *);
No const and volatile keywords
        on:     char       * func(void);
        off:    char const * func(void);
No __closure keyword
        Do not display '__closure'
No __unaligned keyword
        Do not display '__unaligned'
No __pin/__box/__gc
        Do not display '__pin', '__box', '_gc'
Suppress pointer modifiers
     Selection    16Names     Description
     ---------    -------     -----------
     near           Yes     Do not display 'near'
     near/__ptr64           Do not display 'near' and '__ptr64'
     far            Yes     Do not display 'far'
     all, 16bit     Yes     Do not display any modifiers
     huge           Yes     Do not display 'huge'
     __ptr64                Do not display '__ptr64'
     Display all    Yes     Display all modifiers
     Display none   Auto    Do not display any modifiers

     16bit means that the demangler will assume that
     names were generated by 16bit compilers. Otherwise,
     it will assume names generated by 32/64 bit compilers.
Quash j_
        This option allows IDA to demangle a name even if it was formed
        by adding j_ prefix to a mangled name. The prefix j_ will simply
        be thrown away.
Transfer j_
        This option also allows IDA to demangle names with prefix j_.
        Unlike the previous option, this one will show the prefix
        in the demangled name.
Ignore postfix _nn
        This option allows IDA to demangle names formed by adding
        postfix _nn to a mangled name (n is any digit).


 自定义图表布局

自定义图表布局
每个节点都有一个带有标题按钮的标题栏。标题栏可用于置换节点。Displacing nodes 或 edges creates a custom layout. The custom layouts are 自动 saved in the database. If there is a custom layout for the 函数, IDA never destroys it without your explicit permission. This behavior has its drawbacks: when the nodes are resized (because of added 注释, for example), the old layout will be retained and the nodes could overlap. In this case, the user can ask IDA to redo the layout 或 manually move the overlapping nodes. To avoid displacing nodes inadvertently, turn on the lock graph layout option.

用户还可以单击边缘布局点(边缘弯曲点)并拖动它们。如果两个边布局点太近，则其中一个将被删除。To 创建new edge layout points, use Shift-DoubleClick on the edge.

返回到 图表视图


 Dalvik 调试器

Dalvik 调试器
Dalvik 调试器是一个用来调试 Android 应用程序写入 Dalvik 虚拟机的插件。它还包括源代码级别的调试。

Dalvik 调试器的特定选项：

    ADB executable

        IDA needs to know where the 'adb' utility resides, and tries various
        methods to locate it automatically. Usually IDA finds the path to adb,
        but if it fails then we can define the ANDROID_SDK_HOME or the
        ANDROID_HOME environment variable to point to the directory where the
        Android SDK is installed to. 或者在此处将路径设置为 "adb"。

    Emulator/device 序列号

        If multiple emulator/device instances are running, you must specify
        the target instance to connect to.

    Package name

        Set the package name for the application as specified in
        AndroidManifest.xml. It is a mandatory option to start an application.
        If you plan to use "附加到进程" 调试器 action then you may
        leave this field empty.

    Activity

        If your want to start an application using the "Start process"
        debugger action then you have to set this option too. Copy it from
        AndroidManifest.xml. If you plan to use the "Attach to process"
        debugger action then you may leave this field empty.

    命令行参数

        Every object inside Dalvik VM has an ID. It is the 64-bit number.
        If you want to see it in "Locals"/"Watches" windows then set this
        checkbox.
源代码级调试
   为了使用源代码级调试，你必须设置应用程序源代码文件的路径。要这样应使用“选项/源路径”菜单项。

    Our dalvik debugger presumes that the application sources reside
    in the current (".") directory.  If this is not the case, you can
    map current directory (".") to the directory where the source files
    are located.
List of special things about our Dalvik debugger:
  - In Dalvik there is no stack and there is no SP register.
    The only available register is IP.
  - The method frame registers and slots (v0, v1, ...) are represented as
    local variables in IDA.
    We can see them in the Debugger/Debugger Windows/Locals window
  - The stack trace is available from "Debugger/Windows/Stack trace"
  - When the application is running, it may execute some system code.
    If we break the execution by clicking on the "Cancel" button,
    quite often we may find ourselves outside of the application,
    in the system code. The value of the IP register is 0xFFFFFFFF in this
    case, and 堆栈跟踪 shows only system calls and a lot of 0xFFFFFFFFs.
    It means that IDA could not locate the current execution position inside
    the application. We recommend to set more breakpoints inside the
    application, resume the execution and interact with application by
    clicking on its windows, selecting menu items, etc.
    The same thing can occur when we step out the application or
    step into the system code. In the last case we can use "Run until
    return" debugger command to return to the application code.
Locals window
    IDA considers the method frame registers, slots, and
    variables (v0, v1, ...) as local variables.
    To see their values we have to open the "Locals" window
    from the "Debugger/Debugger windows/Locals" menu item.

    If the信息 about the frame is available (the symbol table is
    intact) then IDA shows the method arguments, the method 局部变量
    with names and other non-named 变量.
    Otherwise some 变量 values will not be displayed because IDA
    does not know their types. 变量 without type信息 are
    marked with "Bad type" in the "Locals" window.
    To see the 变量 value in this case please use the "监视" window.
监视 window
    To 打开the "监视" window please select the "调试器/Windows/监视"
    menu item. In this window we can add any 变量 to watch its value.

    Please note that we have to 指定type of 变量 if it is not known.
    Use C-style casts:
        (Object*)v0
        (String)v6
        (char*)v17
        (int)v7

    We do not need to 指定the real type of an object 变量,
    the "(Object*)" cast is enough.  IDA can derive the real object type
    itself.

    ATTENTION! An incorrect type may cause the Dalvik VM to crash.

    There is not much we can do about it. Our recommendation is to never
    cast an integer 变量 to an object type, the Dalvik VM usually
    crashes if we do that. But the integer cast "(int)" is safe in practice.

    Keeping the above in the mind, do not leave the cast entries
    in the "监视" window for a long time. 删除them before any
    executing 指令 that may change the type of the watched 变量
另参见 调试器子菜单。


 Dalvik 调试器扩展函数

Dalvik 调试器扩展函数

// Get local variable or function argument value
//       name - variable name ("v0", "v1", ... or user defined name)
auto dalvik_get_local(string name);

// Get typed local variable value //       name - variable name ("v0", "v1", ... or user defined name) //       wanted_type - Java VM's representation of type signature auto dalvik_get_local_typed(string name, string wanted_type);
// Get object instance field value //       oid - object id //       name - object field name auto dalvik_get_instance_fld(int64 oid, string name);
// Get number or array elements //       oid - array object id long dalvik_get_array_size(int64 oid);
// Get array element by index //       oid - object id //       idx - element index auto dalvik_get_array_elem(int64 oid, long idx);


 数据库为空

数据库为空
尽管数据库存在，但它是空的。请删除它并重新开始。

如果以前已将数据库保存到文本文件中，则可以加载它。有关说明，请参阅 转储数据库 命令。

另参见 IDA 使用帮助


 数据库未关闭

数据库未关闭
在上一次 IDA 会话之后，数据库没有关闭。这很可能是由于电源故障、计算机意外重启或其他异常会话终止而发生的。

你可以尝试修复数据库，但最好的解决方案是使用完整的打包数据库或使用备份。

修复可能无法恢复数据库。

另参见 转储数据库命令。


 数据库快照管理器

数据库快照管理器

 操作名称: ShowSnapMan
此命令显示数据库快照管理器。 在此对话框中，可以恢复以前保存的快照，重命名或删除它们。

注意：快照仅适用于常规数据库。解压缩的数据库不支持它们。

另参见 获取数据库快照</a> 命令。


 dbg_appcall

dbg_appcall

Call application function
     ea - address to call
     type - type of the function to call. can be specified as:
             - declaration string. example: "int func(void);"
             - typeinfo object. example: get_tinfo(ea)
             - zero: the type will be retrieved from the idb
     ... - arguments of the function to call
返回：the result of the function call
If the call fails because of an access violation or other exception,
a runtime error will be generated (it can be caught with try/catch)
In fact there is rarely any need to call this function explicitly.例如：\r\n     _printf(“”你好\n"")\r\n将调用应用程序函数_printf 前提是有\r\n没有同名的 IDC 功能。\r

anyvalue dbg_appcall(ea, type, ...);
// Set/get appcall options #define set_appcall_options(x) set_inf_attr(INF_APPCALL_OPTIONS, x) #define get_appcall_options()  get_inf_attr(INF_APPCALL_OPTIONS)
#define APPCALL_MANUAL 0x0001 // Only set up the appcall, do not run it. // you should call cleanup_appcall() when finished #define APPCALL_DEBEV  0x0002   // Return debug event information // If this bit is set, exceptions during appcall // will generate idc exceptions with full // information about the exception #define APPCALL_TIMEOUT 0x0004  // dbg_appcall with timeout // The timeout value in milliseconds is specified // in the high 2 bytes of the 'options' argument: // If timed out, exception message will contain "timeout". #define SET_APPCALL_TIMEOUT(x) ((x<<16)|0x0004) // dbg_appcall with timeout
With dbg_appcall, it is possible to call an arbitrary function from the debugged application without any special measures like dll injection or modifying the process memory. The call can be simplified to func(args), if the function name is a valid identifier. For example, given this:
        verinfo = object();
        verinfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFOA);

the following dbg_appcall:
        GetVersionExA(&verinfo);

will call create an instance of OSVERSIONINFOA in the application memory and call GetVersionExA with a pointer to it. After the call, it will convert the OSVERSIONINFO instance into an IDC object. The verinfo variable will contain:
object __at__:        18FEB0h dwBuildNumber:        7600. dwMajorVersion:          6. dwMinorVersion:          1. dwOSVersionInfoSize: dwPlatformId:            2. szCSDVersion: "\x00\x00\x00\x00..."
The _at_ attribute tells us the address of the structure. If this particular case it is not very useful since the object was temporary, but in other cases it could be useful.
dbg_appcall converts IDC objects to C objects and vice versa. The conversion is controlled by the type information. The following rules control the conversion:
 PLAIN SCALARS:

  - if the target type a plain scalar type (not a pointer),
    a simple conversion is done, with sign extension or truncation.
    For example, an IDC value of -1 is converted into an __int32(0xFFFFFFFF).
    For example, an IDC value of 0x555 is converted into an __int8(0x55).

 POINTERS:

  - if the target type a pointer and the corresponding idc value is a string,
    the string is accepted as the pointed object. It is simply copied to the
    process memory without any modifications. There will be a terminating zero
    after the string.

    If the corresponding idc value a number, its value is used as the pointer
    value. To create pointers to numbers, use the & operator.

    If the corresponding idc value is not a string, it is converted to C
    and a pointer to the converted object will be used to initialize the pointer.

 STRUCTURES:

  - if the target type is a structure, ida tries to initialize its fields one by
    one, by accessing the corresponding attributes. For example, in the above
    sample only the dwOSVersionInfoSize attribute exists, and its corresponding
    field will be initialized with its value. If a field does not exist,
    the corresponding field will be initialized with zeroes.

 ARRAYS:

  - each array element is initialized individually, expect if the corresponding
    idc value is a string. In this case, the string value is used as the value
    of the whole array. It is the user's responsibility to prepare a valid
    string that will represent an array in this case.

Some more examples. Calling printf is very easy:
  auto n = 5;
  auto s = "short";
  _printf("Hello world, number is %d, string is %s\n", n, s);

Calling sscanf will require using the & operator:
  auto x;
  auto nsuccess = _sscanf(s, "%d", &x);

Structures can be passed by ref without & because they are always passed by reference:
  verinfo = object();
  GetVersionExA(verinfo);

All calling conventions, including   __usercall, are supported.
For calls that generate exceptions, single stepping is possible using the APPCALL_MANUAL bit.


 调试器选项

调试器选项

 操作名称: SetupDebugger
此对话框允许指定与调试器相关的不同设置。

Events

  - Suspend on debugging start

      如果选中，调试器将在调试后直接挂起
      开始。

  - Evaluate event condition on exit

      如果选中，调试器将立即评估事件条件
      在关闭调试会话之前(一旦我们收到 PROCESS_EXITED 或
      PROCESS_DETACHED 事件)

  - 在进程入口点挂起

      If selected, the 调试器 will insert a temporary breakpoint
      at the main 入口点 of the debugged application.

  - Suspend on thread start/exit

      If selected, the 调试器 will suspend if a new thread starts
      或 if an existing thread terminates.

  - Suspend on library load/unload

      If selected, the 调试器 will suspend if a new library is
      loaded 或 if a previously loaded library is unloaded.

  - Suspend on debugging message

      If selected, the 调试器 will suspend if the debugged application
      generates a message destined to the 调试器.
Event condition
      When one 或 more debug events (see above) are checked then this
      option is used to 指定a condition. In the following example,
      the 调试器 will suspend the prcoess whenever a module with the
      name test.dll is loaded:

 GetEventId() == LIBRARY_LOAD && strstr(GetEventModuleName(), "test.dll") != -1
Log
  - 段 modifications

      If selected, the 调试器 will print信息 regarding
      段 modifications (creation, deletion, 或 resizing of
      段) since the last event. Note that the 调试器
      doesn't continuously track 段 modifications, but detects
      those only if a debugging event occurs.

  - Thread start/exit

      If selected, the 调试器 will print a message if a new thread
      starts 或 if an existing thread terminates.

  - Library load/unload

      if Selected, the 调试器 will print a message if a new library is
      loaded 或 if a previously loaded library is unloaded.

  - Breakpoint

      If selected, the 调试器 will print a message if the debugged process
      reaches a breakpoint.

  - Debugging message

      If selected, the 调试器 will print debugging messages from
      the application.
选项
  - Reconstruct the stack

 If selected, the 调试器 will try to reconstruct the chain of stack frames, based on信息 available on the stack and in the   函数 堆栈变量.

  - Show 调试器 breakpoint instructions

      If selected, the 调试器 will show breakpoint instructions inserted
      by the 调试器 itself. This 函数 is mainly useful if the user
      wants to see the real content of the memory.

  - Use hardware temporary breakpoints

      If selected, IDA will try to use 硬件断点 for the temporary
      breakpoints used to implement the "步过" and "run to" functionality.
      This feature is useful when debugging read-only 或 self-modifying code,
      since it does not change the contents of the memory.
      IDA will fall back to software breakpoints if the attempt to set a
      硬件断点 fails.

  - Autoload PDB 文件

      If selected, IDA will invoke the PDB plugin to try to load PDB symbols
      for every new module loaded into process.

  - Set as just-in-time 调试器

      If changed from off to on, IDA will try to register itself as a
      just-in-time 调试器 (invoked by the system in case of application
      crashes) on dialog close.
编辑 exceptions
      This button allows the user to   setup
      how the 调试器 will react to specific exceptions.
Reload exceptions
      This button reloads the exception table from the exceptions.cfg
      文件.

 另参见 调试器子菜单。


 调试器子菜单

调试器子菜单
以下是调试器命令：
  调试器窗口
  跟踪子菜单
  线程列表
  模块列表
  启动过程
  附加到进程...
  进程选项
  暂停进程
  终止进程
  与进程分离
  拍摄内存快照
  手动内存区域
  步入
  步过
  运行直到返回
  运行到光标
  设置当前 IP
  显示应用程序屏幕
  断点
  源视图
  监视视图(源级别)
  监视(汇编程序级别)
  跟踪
  调试器选项
  切换调试器...
另参见


 调试器窗口

调试器窗口

 操作名称: 调试器
打开调试器窗口。

在此窗口中，你可以查看所选线程的寄存器值。调试器始终选择发生最新调试事件的线程。

对于大多数寄存器，我们有两个不同的框：

       - 第一个框(左侧)表示寄存器的当前值。
         蓝色表示自上次调试事件以来该值已更改。
         紫色表示该值已被用户修改。
         此控件上有一个弹出菜单，提供不同的命令。

       - 第二个框(右侧)显示寄存器的当前值，
         像地址一样解释(如果可能的话)。
对于段寄存器，我们只有一个表示当前值的框。

对于标志寄存器，我们有一个表示当前值的框，以及指示最重要标志状态的小框。

弹出菜单可在窗口中的任何位置访问，它允许用户显示或隐藏窗口的不同部分：工具栏、线程列表和可用的寄存器类。

另参见 调试器子菜单。


 调试器：控件

调试器：控件

//  在当前线程中执行一条指令。
//  其他线程保持挂起状态。
//
//  注意
//   在此调用之后，你必须调用 wait_for_next_event()
//   为了找出发生了什么。通常你会
//    获取 STEP 事件，但其他事件是可能的(例如，
//    可能会发生异常，或者进程可能会退出)。
//   此备注适用于所有执行控制功能。
//   事件代码取决于发出的命令。
// returns: success

success step_into(void);
// Execute one instruction in the current thread, // but without entering into functions // Others threads keep suspended. // See the important note to the step_into() function
success step_over(void);
// Execute the process until the given address is reached. // If no process is active, a new process is started. 请参阅 step_into() 函数的重要说明
success run_to(long ea, long pid=NO_PROCESS, long tid=NO_THREAD);
// Execute instructions in the current thread until // a function return instruction is executed (aka "step out"). // Other threads are kept suspended. 请参阅 step_into() 函数的重要说明
success step_until_ret(void);


 调试器：事件

调试器：事件

Wait for the next event
This function (optionally) resumes the process
execution and wait for a debugger event until timeout
     wfne - combination of WFNE_... constants
     timeout - number of seconds to wait, -1-infinity
返回: debugger event codes, see below

long wait_for_next_event(long wfne, long timeout);
// convenience function #define resume_process() wait_for_next_event(WFNE_CONT|WFNE_NOWAIT, 0) // wfne flag is combination of the following: #define WFNE_ANY    0x0001 // return the first event (even if it doesn't suspend the process) // if the process is still running, the database // does not reflect the memory state. you might want // to call refresh_debugger_memory() in this case #define WFNE_SUSP   0x0002 // wait until the process gets suspended #define WFNE_SILENT 0x0004 // 1: be slient, 0:display modal boxes if necessary #define WFNE_CONT   0x0008 // continue from the suspended state #define WFNE_NOWAIT 0x0010 // do not wait for any event, immediately return DEC_TIMEOUT // (to be used with WFNE_CONT) #define WFNE_USEC   0x0020 // timeout is specified in microseconds // (minimum non-zero timeout is 40000us)
// debugger event codes #define NOTASK         -2            // process does not exist #define DBG_ERROR      -1            // error (e.g. network problems) #define DBG_TIMEOUT     0            // timeout #define PROCESS_STARTED   0x00000001 // New process started #define PROCESS_EXITED    0x00000002 // Process stopped #define THREAD_STARTED    0x00000004 // New thread started #define THREAD_EXITED     0x00000008 // Thread stopped #define BREAKPOINT        0x00000010 // Breakpoint reached #define STEP              0x00000020 // One instruction executed #define EXCEPTION         0x00000040 // Exception #define LIB_LOADED        0x00000080 // New library loaded #define LIB_UNLOADED      0x00000100 // Library unloaded #define INFORMATION       0x00000200 // User-defined information #define PROCESS_ATTACHED  0x00000400 // Attached to running process #define PROCESS_DETACHED  0x00000800 // Detached from process #define PROCESS_SUSPENDED 0x00001000 // Process has been suspended
// refresh_idaview_anyway debugger memory // Upon this call IDA will forget all cached information // about the debugged process. This includes the segmentation // information and memory contents (register cache is managed // automatically). Also, this function refreshes exported name // from loaded DLLs. // You must call this function before using the segmentation // information, memory contents, or names of a non-suspended process. // This is an expensive call.
void refresh_debugger_memory(void);
// Get debugged process state // 返回: one of the DSTATE_... constants (see below)
long get_process_state(void);
#define DSTATE_SUSP             -1 // process is suspended #define DSTATE_NOTASK            0 // no process is currently debugged #define DSTATE_RUN               1 // process is running
// *********************************************** // Get various information about the current debug event // These function are valid only when the current event exists // (the process is in the suspended state)
// For all events: long get_event_id(void); long get_event_pid(void); long get_event_tid(void); long get_event_ea(void); long is_event_handled(void);
// For PROCESS_STARTED, PROCESS_ATTACHED, LIB_LOADED events: string get_event_module_name(void); long get_event_module_base(void); long get_event_module_size(void);
// For PROCESS_EXITED, THREAD_EXITED events long get_event_exit_code(void);
// For THREAD_STARTED (thread name) // For LIB_UNLOADED (unloaded library name) // For INFORMATION (message to display) string get_event_info(void);
// For BREAKPOINT event long get_event_bpt_hea(void);
// For EXCEPTION event long get_event_exc_code(void); long get_event_exc_ea(void); long can_exc_continue(void); string get_event_exc_info(void);


 调试器：模块

调试器：模块

// Enumerate process modules
// These function return the module base address

long get_first_module(void); long get_next_module(long base);
// Get process module name //      base - the base address of the module // 返回: required info
string get_module_name(long base);
// Get process module size //      base - the base address of the module // 返回: required info or -1
long get_module_size(long base);


 调试器：选项

调试器：选项

Get/set debugger options
     opt - combination of DOPT_... constants
返回: old options

long set_debugger_options(long opt);
#define DOPT_SEGM_MSGS    0x00000001 // print messages on debugger segments modifications #define DOPT_START_BPT    0x00000002 // break on process start #define DOPT_THREAD_MSGS  0x00000004 // print messages on thread start/exit #define DOPT_THREAD_BPT   0x00000008 // break on thread start/exit #define DOPT_BPT_MSGS     0x00000010 // print message on breakpoint #define DOPT_LIB_MSGS     0x00000040 // print message on library load/unlad #define DOPT_LIB_BPT      0x00000080 // break on library load/unlad #define DOPT_INFO_MSGS    0x00000100 // print message on debugging information #define DOPT_INFO_BPT     0x00000200 // break on debugging information #define DOPT_REAL_MEMORY  0x00000400 // don't hide breakpoint instructions #define DOPT_REDO_STACK   0x00000800 // reconstruct the stack #define DOPT_ENTRY_BPT    0x00001000 // break on program entry point #define DOPT_EXCDLG       0x00006000 // exception dialogs: #  define EXCDLG_NEVER    0x00000000 // never display exception dialogs #  define EXCDLG_UNKNOWN  0x00002000 // display for unknown exceptions #  define EXCDLG_ALWAYS   0x00006000 // always display #define DOPT_LOAD_DINFO   0x00008000 // automatically load debug files (pdb)
// *********************************************** // Set remote debugging options //       hostname - remote host name or address //                  if empty, revert to local debugger //       password - password for the debugger server //       portnum  - port number to connect (-1: don't change) // 返回: nothing
void set_remote_debugger(string hostname, string password, long portnum);


 用 QEMU 调试代码片段

用 QEMU 调试代码片段
使用 “运行外部程序” 选项，可以直接从 IDA 内部轻松调试小型 ARM、MIPS 或 PowePC 代码片段。

1) Download and install QEMU. Win32 builds can be downloaded from homepage3.nifty.com/takeda-toshiya/qemu/.

2) 编辑 cfg\gdb_arch.cfg 文件，将 "set QEMUPATH" 行更改为指向 QEMU 的安装目录。

3) 在 远程 GDB 调试器选项 中(调试器|调试器选项、设置特定选项)、启用“调试前运行程序”。

4) Click "Choose a configuration" and choose a predefined configuration. Choose "for snippets", if mentioned.

5) If necessary, 编辑 the 命令行 或 memory map.

6) Click OK, OK to confirm and close the options dialog.

7) 在 调试器|进程选项 中确保 Hostname 设置为 "localhost" 并且 port 为非零。

8) Select the code range to emulate 或 at least the first 指令. Alternatively, you can rename the starting address "ENTRY" and end address as "EXIT".

9) 选择调试器|运行或按 F9。

IDA will write the database into an ELF 文件 (if %e was specified), start QEMU with the specified 命令行 and connect to its GDB stub. It will set the SP and PC values so that the code can be stepped through.

NOTE

While it can be very useful, QEMU emulation has certain limitations:

1) the memory map is usually fixed at compile time. So if your program addresses intersect some of the system regions as specified by the memory map, IDA will refuse to start debugging. In that case, you can either rebase the program so that it fits into RAM regions 或 check other QEMU board configurations for a compatible memory layout.

2) the emulation starts at the system (kernel) level when there is no OS loaded. That means that system calls and imported functions will not work.

3) the hardware access will only work to the extent emulated by QEMU. If the code you are emulating does not match the chosen board configuration of QEMU, the code accessing the hadrware most likely will not work properly, if at all.

另参见 外部程序和 GDB 调试器 远程 GDB 调试器


 用 gdbserver 调试

用 gdbserver 调试
gdbserver 是一个作为独立程序实现的 GDB 存根。它运行要调试的程序或附加到进程，然后等待命令。远程 GDB 调试器模块已使用 Cygwin 和 Linux 提供的 gdbserver 进行了测试。

若要从头开始调试特定程序，请运行以下命令：

    gdbserver localhost:23946 <program>
，然后在 IDA 中选择 Debugger、Attach、。

调试正在运行的进程：

    gdbserver --multi localhost:23947
然后选择 Debugger，Attach，in IDA，然后输入要附加的进程的 PID。

调试正在运行的进程的另一种方法是：

    gdbserver localhost:23947 --attach <PID>
，然后在 IDA 中选择 Debugger，Attach，。

要从 IDA 内部启动程序，首先启动调试器服务器：

    gdbserver --multi localhost:23947
然后使用调试器，启动进程或调试器，在 IDA 中运行。
 NOTE
--multi 选项仅在 GDB 6.8 或更高版本中可用。

返回到 远程 GDB 调试器


 用 OpenOCD 调试

用 OpenOCD 调试
确保目标的 .cfg 文件中存在以下行：
 gdb_port 3333
如有必要，请编辑端口号。在进程选项中指定该端口，然后使用“调试器”和“附加”命令。

提示:

  使用 GDB 命令行 将命令直接发送到 OpenOCD 互调器。
返回到 远程 GDB 调试器


 用 QEMU 调试

用 QEMU 调试
Run QEMU with -s switch to enable its GDB stub. The default port 数字 is 1234. If desired, the -p 命令行 switch can be used to change it. The -S 命令行 switch causes the execution to be suspended at startup. 例如:
 qemu.exe -s -S -L . -m 128 -hda linux.img -soundhw all -localtime -M pc
For better debugging, make sure to set the following options in GDB 调试器选项:
 Software breakpoints at EIP+1: disabled
 Use CS:IP in real mode: enabled (when debugging 16-bit (real-mode) code)
In other aspects 用 QEMU 调试 is the same as debugging for other targets.

返回到 远程 GDB 调试器


 用 VMWare 调试

用 VMWare 调试
建议使用 VMWare Workstation 6.5 进行调试，但早期版本也可以使用。仅支持 32 位调试。

要启用使用 GDB 协议进行调试，请将以下行添加到虚拟机的 .vmx 文件中：

   debugStub.listen.guest32 = "TRUE"
   debugStub.hideBreakpoints= "TRUE"
若要调试 VM 启动，请使用：
   monitor.debugOnStartGuest32 = "TRUE"
请注意，执行将在 BIOS 中开始。

若要接受来自远程计算机的连接，必须指定以下行：

   debugStub.listen.guest32.remote = "TRUE"
VMWare Workstation will listen on port 8832.

提示:

由于 GDB 服务器不报告内存布局，因此必须手动指定。例如，要调试 BIOS 启动代码，请使用基本 F000 创建从 F0000 到 10000 的 16 位段。

使用 GDB 命令行 获取有关寄存器的额外信息。例如，使用 "r cr0" 查看 cr0 寄存器的当前值，或使用 "r cs" 查看保护模式下 CS 选择器的基数、限制和其他属性。

返回到 远程 GDB 调试器


 声明结构体变量

声明结构体变量

 操作名称: MakeStructVar
此命令声明指定结构体类型的变量。

IDA 将要求您选择结构体类型。 您必须 定义 一些结构体类型才能使用此命令。

如果 目标汇编程序 支持它，IDA 将以简洁的形式显示结构体(仅使用一行)。 要展开简洁的结构体变量，请使用 取消隐藏 命令。

您还可以使用此命令在另一个结构体中声明结构体字段(即也支持嵌套结构体)。

另参见 编辑|结构体子菜单。


 decode_insn

decode_insn

Decode an instruction and returns an insn_t object (check ua.hpp)
     ea - linear address of the instruction to decode
The return values are:
     0 => if the function fails
   or:
     insn_t object:
       cs, ip, ea, itype, size, auxpref, insnpref, segpref, flags
       n: number of operands
       is_canonical: Boolean. True if its a canonical instruction.
       feature, mnem: canonical feature and mnemonic string (if is_canonical is True)
       Op0..Op7: instances of op_t (check ua.hpp)
                 n, type, offb, offo, flags, dtyp, reg, value, addr, specval,
                 specflag1, specflag2, specflag3, specflag4

object decode_insn(long ea);


 定义新结构体

定义新结构体

 操作名称: AddStruct
This command defines a new structure or a new union. The new structure is created with zero length. You will have to add structure members using structure manipulation commands.

If the entered structure name denotes a standard structure type from a loaded type library, then its definition will be automatically used. In this case, the value of the 'create union' checkbox will be ignored.

此命令在打开结构体窗口时可用。

You can add new members to the structure using the following commands:

        command         hotkey
        -------         ------
    make data            D
    make strlit           A
    make array           *
    rename               N
You may also insert/delete undefined bytes into the middle of the structure by using expand and shrink commands.

"Create before current structure" means that the new structure will be placed immediately before the current structure type. Otherwise, the new structure is placed after the current structure.

"Don't include in the list" means that the structure will not be included in the list of the structures which appears when the user applies the structure definition, for example, when he creates a variable of this structure type. 当你定义了此结构体类型的所有变量并希望减少列表中的选项数时，建议选中此复选框。

另参见 编辑|结构体子菜单。如何输入标识符


 定义枚举成员

定义枚举成员

 操作名称: AddConst
此命令允许你定义枚举成员。枚举成员是一个符号常量。你必须指定其名称和值。不能在枚举中定义超过 256 个具有相同值的常量。

如果当前枚举是位域，则需要指定位掩码。若要了解位掩码，请阅读 位域。

另参见 编辑|枚举子菜单。


 define_exception

define_exception

Add exception handling information
     code - exception code
     name - exception name
     desc - exception description
     flags - exception flags (combination of EXC_...)
返回: failure description or ""

string define_exception(long code, string name, string desc, long flags);
#define EXC_BREAK  0x0001 // break on the exception #define EXC_HANDLE 0x0002 // should be handled by the debugger? #define EXC_MSG    0x0004 // instead of warn, log the exception to the output window #define EXC_SILENT 0x0008 // do not warn or log to the output window


 define_local_var

define_local_var

Create a local variable
     start, end - range of addresses for the local variable.
                  For the stack variables the end address is ignored.
                  If there is no function at 'start' then this function.
                  will fail.
     location  -  the variable location in the "[bp+xx]" form where xx is
                  a number. The location can also be specified
                  as a register name.
     name      -  name of the local variable
返回: 1-ok, 0-failure

success define_local_var(long start, long end, string location, string name);


 删除隐藏范围

删除隐藏范围

 操作名称: DelHiddenArea
此命令允许你删除隐藏的反汇编范围(以前使用 隐藏命令定义)。

另参见 隐藏命令。

另参见 编辑|视图子菜单


 del_array_element

del_array_element

delete an array element
     tag     - tag of array (AR_LONG or AR_STR)
     id      - array id
     idx     - index of an element
返回: 1-正常，0-失败

success del_array_element(long tag, long id, long idx);


 del_enum

del_enum

delete enum type
     enum_id - id of enum

void del_enum(long enum_id);


 del_enum_member

del_enum_member

delete a member of enum - a symbolic constant
     enum_id - id of enum
     value   - value of symbolic constant.
     serial  - serial number of the constant in the enumeration.
               See op_enum() for for details.
     bmask   - bitmask of the constant
               ordinary enums accept only -1 as a bitmask
返回: 1-正常，0-失败

success del_enum_member(long enum_id, long value, long serial, long bmask);


 del_extra_cmt

del_extra_cmt

Delete an extra comment line
     ea   - linear address
     n    - number of additional line (0..MAX_ITEM_LINES)
To delete anterior  line #n use (E_PREV + n)
To delete posterior line #n use (E_NEXT + n)

void del_extra_cmt(long ea, long n);


 del_fixup

del_fixup

delete fixup information
     ea - address to delete fixup information about
返回: none

void del_fixup(long ea);


 del_func

del_func

delete a function
     ea - any address belonging to the function
返回: !=0 - ok

success del_func(long ea);


 del_idc_hotkey

del_idc_hotkey

Delete IDC function hotkey

success del_idc_hotkey(string hotkey);


 del_items

del_items

Convert item (instruction/data) to unexplored bytes.
The whole item (including the head and tail bytes) will be destroyed.
It is allowed to pass any address in the item to this function
     ea     - any address within the item to delete
     flags  - combination of DELIT_... constants
     nbytes - number of bytes in the range to be undefined
返回: 1-ok, 0-failure

success del_items(ea_t ea, long flags=0, long nbytes=1);
#define DELIT_SIMPLE    0x0000  // simply undefine the specified item #define DELIT_EXPAND    0x0001  // propogate undefined items, for example // if removing an instruction removes all // references to the next instruction, then // plan to convert to unexplored the next // instruction too. #define DELIT_DELNAMES  0x0002  // delete any names at the specified // address range (except for the starting // address). this bit is valid if nbytes > 1 #define DELIT_NOTRUNC   0x0004  // don't truncate the current function


 del_segm

del_segm

Delete a segment
  ea      - any address in the segment
  flags   - combination of SEGMOD_... flags

success del_segm(long ea, long flags);
#define SEGMOD_KILL    0x0001 // disable addresses if segment gets shrinked or deleted #define SEGMOD_KEEP    0x0002 // keep information (code & data, etc) #define SEGMOD_SILENT  0x0004 // be silent #define SEGMOD_KEEP0   0x0008 // flag for internal use, don't set #define SEGMOD_KEEPSEL 0x0010 // do not try to delete unused selector #define SEGMOD_NOMOVE  0x0020 // don't move info from the start of segment to the new start address // (for set_segm_start()) #define SEGMOD_SPARSE  0x0040 // use sparse storage if extending the segment // (for set_segm_start(), set_segm_end())


 del_selector

del_selector

delete a selector
        arguments:      sel - the selector number to delete
        返回:        nothing
        note:           if the selector is found, it will
                        be deleted

void del_selector(long sel);


 del_source_linnum

del_source_linnum

delete information about source line number
arguments: ea      - linear address
     nothing

void del_source_linnum(long ea);


 del_sourcefile

del_sourcefile

Delete information about the source file
     ea - linear address belonging to the source file
返回: NULL - source file information is not found
         otherwise returns pointer to file name

success del_sourcefile(long ea);


 del_stkpnt

del_stkpnt

Delete SP register change point
     func_ea - function start
     ea      - linear address
returns: 1-ok, 0-failed

success del_stkpnt(func_ea, ea_t ea);


 del_struc

del_struc

delete a structure type
     id - structure type ID
返回: 0 if bad structure type ID is passed
         1 otherwise the structure type is deleted. All data
           and other structure types referencing to the
           deleted structure type will be displayed as array of bytes.

success del_struc(long id);


 del_struc_member

del_struc_member

delete structure member
     id            - structure type ID
     member_offset - offset of the member
返回: !=0 - ok.
注意：IDA 允许结构体成员之间有 'holes'。
      It treats these 'holes' as unnamed arrays of bytes.

long del_struc_member(long id, long member_offset);


 del_user_info

del_user_info

Delete information about the user who created the database

void del_user_info();


 delattr

delattr

删除对象属性
     self - 对象
     attr - 属性名称
线程安全函数。

success delattr(object self, string attr);


 删除段

删除段

 操作名称: KillSegment
此命令允许你删除分段。

IDA 将询问你是否允许禁用该段占用的地址。如果允许此操作，则将删除有关段的所有信息。换言之，IDA 将丢弃有关指令或数据、注释等的信息。

如果勾选“禁用地址”复选框，IDA 会在程序中将该段占用的地址标记为“不存在”。你将丢失 *ALL* 信息，包括字节值。

不可能反汇编不在任何段中的地址的内容，因此，如果要恢复该部分代码的反汇编，则必须创建一个新段。

你还可以编辑(见下文)相邻段将其 扩展 到这些地址。

IDA 将询问你是否允许禁用该段占用的地址。如果你给予许可，有关该段的信息将被删除，否则 IDA 将丢弃有关指令/数据、注释等的信息，但保留字节值，以便你之后能够创建另一个段。

要反汇编段占用的地址，你需要再次创建一个新段(即，没有段就无法反汇编字节)。 你还可以将另一个相邻段 扩展 到这些地址。

另参见 编辑|段子菜单。


 删除结构体

删除结构体

 操作名称: DelStruct
This command deletes the current structure. Beware, when you delete a structure, all references to it will be destroyed as well. 即使稍后重新创建它，也必须再次指定对它的所有引用。

You may use this command to delete unions also.

此命令在打开结构体窗口时可用。

另参见 编辑|结构体子菜单。


 删除结构体成员

删除结构体成员

 请记住，删除成员也会删除所有信息
关于此成员，包括注释、成员名称等。
另参见 编辑|结构体子菜单。


 删除枚举成员

删除枚举成员

 操作名称: DelConst
请记住，删除成员也会删除有关成员的所有信息，包括注释、成员名称等。

另参见 编辑|枚举子菜单。


 删除枚举类型

删除枚举类型

 操作名称: DelEnum
此命令删除当前枚举。请注意，当你删除枚举时，对它的所有引用都将被销毁。即使稍后重新创建它，也必须再次指定对它的所有引用。

当你打开枚举 窗口时，此命令可用。

另参见 编辑|枚举子菜单。


 删除断点

删除断点

 操作名称: BreakpointDel
此命令删除当前地址处的现有断点。
另参见:
   断点列表
   添加断点
   编辑断点
   断点子菜单


 删除桌面

删除桌面
此命令将删除包含桌面配置的 桌面。

另参见

         桌面
         加载桌面...命令
         保存桌面...命令
         重置桌面命令


 删除函数

删除函数

 操作名称: DelFunction
删除函数只会删除有关函数的信息，例如堆栈变量、注释、函数类型等信息。

组成函数的指令将保持不变。

另参见

         编辑|函数子菜单。
         创建函数
         编辑函数


 删除监视

删除监视

 操作名称: DelWatch
该命令删除一个现有的监视。
 另参见 监视列表
          添加监视
          监视子菜单
          源级别监视


 delete_all_segments

delete_all_segments

Delete all segments, instructions, comments, i.e. everything
except values of bytes.

void delete_all_segments();


 delete_array

delete_array

delete array
This function deletes all elements of the array.
     id      - array id

void delete_array(long id);


 删除段

删除段
如果要删除该段，请选中“确认删除”复选框

“禁用地址”复选框

        CAUTION: ALL INFORMATION ABOUT THE SEGMENT WILL BE LOST!
如果禁用分段占用的地址，则有关这些地址的所有信息都将丢失。你将不会再在屏幕上看到它们。

否则，该段将被删除，但其数据将保持不变。你可以使用创建新段命令为这些地址创建另一个段。


 demangle_name

demangle_name

Demangle a name
     name - name to demangle
     disable_mask - a mask that tells how to demangle the name
                    it is a good idea to get this mask using
                    get_inf_attr(INF_SHORT_DN) or get_inf_attr(INF_LONG_DN)
Returns: a demangled name
If the input name cannot be demangled, returns 0

string demangle_name(string name, long disable_mask);


 分解名称

分解名称

 操作名称: SetDemangledNames
IDA 可以识别最流行的 C++ 编译器中被混淆的 C++ 名称：
        - Microsoft
        - Borland
        - Watcom
        - Visual Age
        - GNU
分解后的名称以两种形式表示：短形式和长形式。当名称用作引用时使用短形式，在声明时使用长形式。

你可以设置必须如何表示分解的 C++ 名称：

        - 作为注释。 this representation allows you to obtain
          recompilable source text
        - instead of mangled names. this representation makes the output
          more readable. the disadvantage is that you cannot recompile the
          output
        - don't display demangled names.
You can setup short and long forms of demangled names. Short form is used when a reference to the name is made; long form is used at the declaration.

To make demangled names more readable, we introduce the possibility to suppress pointer modifiers (near/far/huge).

To demangle GNU C v3.x names, the "Assume GCC v3.x names" checkbox should be set, otherwise such names might not be demangled. furthermore, to make the demangled name more compact, unsigned types may be displayed as uchar, uint, ushort, ulong. The same with signed basic types.

If the "Override type info" checkbox is set, the demangled name overrides the type information if both are present.

另参见 如何自定义分解名称


 演示版本限制

演示版本限制
The demo version works only with new databases and doesn't save the disassembly results in an IDB file.

Unlike the full version, it cannot create .ASM and .LST files.

The demo version will accept only some file formats as input. Currently, the supported file formats are: PE, ELF, Mach-O

Note that it will stop working after a while: this is a demo, not a full version, isn't it? :)

For information about the full version please visit https://www.hex-rays.com/products/ida


 桌面

桌面
IDA 在桌面中保存不同的设置：主窗口配置、工具栏配置和所有数据库窗口的配置。

提供不同的桌面:

 <Database>
     此桌面配置存储在数据库本身中，
     并在每次打开此数据库时自动加载。
     如果关闭并保存数据库，IDA 还会自动将当前桌面配置保存到该桌面。

 <Database debugger>
     此桌面配置也存储在数据库中，
     并在每次启动调试器时加载。
     对于 <Database> 桌面，一旦调试器停止，IDA 会自动将当前桌面配置保存到此桌面。

 <Default>
     此桌面配置存储在注册表中，
     并在每次启动 IDA 时加载，而无需打开数据库，
     或首次创建新数据库时。

 <Default debugger>
     此桌面配置存储在注册表中，
     并在首次启动调试器时加载。

  命名桌面
     这些桌面配置存储在注册表中，
     用户可在反汇编或调试时手动加载。
请注意，如果屏幕分辨率发生更改，IDA 将对主窗口和工具栏使用默认配置。

另参见

         加载桌面... 命令
         保存桌面... 命令
         删除桌面... 命令
         重置桌面 命令


 从进程分离

从进程分离

 操作名称: ProcessDetach
此命令将调试器与调试进程分离。 注意：
另参见:
   启动进程
   暂停进程
   终止进程
   调试器子菜单


 detach_process

detach_process

将调试器与调试进程分离。

success detach_process(void);


 二进制跟踪的比较

二进制跟踪的比较
将当前加载的跟踪与记录的跟踪进行比较

此命令显示一个窗口，用于选择要与当前加载的跟踪进行比较的跟踪文件，该跟踪文件显示在“跟踪”窗口中。

如果在 跟踪选项中启用了突出显示选项，则当前加载的跟踪中的指令将以背景 "main color" 显示，而来自差异跟踪文件的指令将以 "diff color" 显示。 常用说明将突出显示两者的平均值。

另参见:
   清除跟踪
   选择跟踪
   其他选项
   移除二进制跟踪
   导入二进制跟踪
   导出二进制跟踪
   导出跟踪到文本文件
   显示跟踪调用图表


 禁用撤消

禁用撤消

 操作名称: DisableUndo
此命令将完全禁用撤消功能。

另请参阅 撤消 重做 重置撤消 打开撤消历史记录


 反汇编窗口

反汇编窗口

 操作名称: WindowOpen
"WindowOpen" 命令打开一个包含反汇编的新窗口。IDA 在启动时自动打开一个反汇编窗口。

如果当前位置是属于函数的指令，则 图表视图 可用。你可以使用空格键在文本视图和图形视图之间切换。你还可以通过使用“-”键缩小到调用图来切换到邻近视图。

使用反汇编 编辑 命令来改进列表。

使用 Shift-<箭头> 或 Alt-L 放置 定位器。如果你有鼠标，你也可以用它放下定位器。

双击鼠标等同于 <Enter> 键。

在反汇编的左侧，有一个 箭头窗口 (GUI 版本)。此外，GUI 版本会加亮显示当前标识符。

 另请参见 视图|打开子视图子菜单
          主要帮助索引


 磁盘定位错误

磁盘定位错误
如果出现这种情况，请通知我们的技术支持人员。


 磁盘读取错误

磁盘读取错误
当 IDA 试图读取超过文件末尾的内容时，可能会出现此错误。


 磁盘写入错误

磁盘写入错误
最有可能的情况是磁盘已满。

随着 IDA 对输入文件的分析，数据库的规模也在不断扩大。 如果磁盘上没有可用空间，IDA 可能会突然停止并退出并伴有错误信息。


 显示地址交叉引用的图表

显示地址交叉引用的图表

 操作名称: ChartXrefsFrom
此命令显示程序中当前地址/选定地址范围的代码交叉引用图表。

在这个方向上，不会分析数据交叉引用以避免过载的图表。

地址表示为节点。交叉引用表示为节点之间的边。

另参见 视图|图表子菜单。


 显示地址的交叉引用图表

显示交叉引用到地址图表

 操作名称: ChartXrefsTo
此命令显示代码和数据交叉引用到程序中所选地址的当前地址/范围的图表。

地址表示为节点。交叉引用表示为节点之间的边。

另参见 视图|图表子菜单。


 显示函数调用图表

显示函数调用图表

 操作名称: CallFlow
该命令显示程序中所有函数调用的图表。

函数表达为节点。调用被表达为节点之间的边缘。外部函数指令被忽略。

另参见 视图|图表子菜单。


 显示函数流程图

显示函数流程图

 操作名称: GraphFunc
此命令显示当前函数的流程图。

流程图的彩色 egdes 表达条件跳转指令的结果。绿色表达满足条件，红色表达不满足。

另参见 视图|图表子菜单。


 显示使用定义的交叉引用图表

显示使用定义的交叉引用图表

 操作名称: ChartXrefsUser
此命令显示用户定义的交叉引用图表，该图表从/到程序中选定地址的当前地址/范围。

可以选择要分析的交叉引用的方向。 如果选中“递归”标志，则会分析所有找到的交叉引用以查找新的交叉引用。 您可以选择仅在当前方向上搜索新引用地址的交叉引用。 只有交叉引用、数据交叉引用、库函数和库函数的交叉引用可以被忽略。

可以指定递归深度。如果选中了“打印递归点”，并且某个函数具有超出“递归深度”设置定义的范围之外的其他交叉引用，则会打印包含点的小节点。

“打印注释”标志使生成的函数节点也包含函数注释。

地址表示为节点。交叉引用表示为节点之间的边。 使用的颜色与 IDA 中的颜色相同。

另参见 视图|图表子菜单。


 将数据库转储到 IDC 文件

将数据库转储到 IDC 文件

 操作名称: DumpDatabase
This command saves current IDA database into a text file.

You can use it as a safety command:

  - to protect your work from disasters
  - to migrate information into new database formats of IDA.
This command is used when you want to switch to a new version of IDA. Usually each new version of IDA has its own database format. To create a new format database, you need:
  1. to issue the 'Dump...' command for the old
     database (using old version of IDA). You will
     get an IDC file containing all information
     from your old database.
  2. to reload your database using new IDA with switch -x.
  3. to compile and execute the IDC file with command
    'Execute IDC file' (usually F2)
Please note that this command does not save everything to text file. Any nformation about the local variables will be lost!

另参见其他 生成输出文件命令。


 将类型信息转储到 IDC 文件

将类型信息转储到 IDC 文件

 操作名称: DumpTypes
此命令将有关用户定义类型的信息从 IDA 数据库保存到文本文件中。

有关枚举、结构体类型和其他用户定义类型的信息以文本形式保存为 IDC 程序。

可以使用此命令将类型定义从一个数据库迁移到另一个数据库。

另参见其他 生成输出文件命令。


 转储/正常视图

转储/正常视图

 操作名称: ToggleDump
This command switches the current disassembly window mode between dump mode and normal mode. Initially all disassembly windows are in normal mode so you can see instructions and data. When you are in dump mode, no instructions or data are displayed. All bytes of the program will be dumped on the screen as plain bytes and in ASCII. This command may be useful when you want to find something in the program visually. Do not forget that many commands continue to work in dump mode. For example, you can use binary search command.

The text version supports only paragraph aligned addressing in the view. Switching to the hex dump view and back may change the cursor position in the disassembly listing.

另参见 选项子菜单。


 DYLD 共享缓存实用程序

DYLD 共享缓存实用程序
This plugin (nicknamed "dscu" for brevity) is essentially just an extension of the Mach-O loader. It allows you to manually load modules from a dyldcache that were not loaded when first opening the cache in IDA (the plugin is only activated after using the "single module" option for a dyldcache).

For a quick overview of the dscu functionality, see menu File>Load file>DYLD 共享缓存实用程序.

Loading Modules ---------------

有几种方法可以从缓存中手动加载模块：

1) Use File>Load file>DYLD 共享缓存实用程序>Load module... and choose which module to load

2) Right-click on an unmapped address in the disassembly, and select 'Load module '

3) Programatically:

  n = idaapi.netnode()
  n.create("$ dscu")
  n.supset(2, "/usr/lib/libobjc.A.dylib")
  idaapi.load_and_run_plugin("dscu", 1)
Loading Sections ----------------

dscu also allows you to load a subset of a given module.

Any section from any of the dyldcache's submodules can be loaded individually. This is especially useful when analyzing Objective-C code, since often times it is convenient to only load Objective-C info from a given module without loading all of its code.

For example, if you see a pointer to a selector string that has not been loaded:

  ADRP  X8, #0x1AECFF7F9@PAGE
  ADD   X1, X8, #0x1AECFF7F9@PAGEOFF ; SEL
  MOV   X0, X21 ; id
  BL    _objc_msgSend_0
Right-click on "0x1AECFF7F9" and dscu will provide you with two options:
  Load UIKitCore:__objc_methname
  Load UIKitCore
The UIKitCore module is huge, so perhaps you don't want to load the entire thing, but still want to clean up the disassembly. If you choose "Load UIKitCore:__objc_methname", dscu will load only these selector strings into the database:
  ADRP  X8, #sel_alloc@PAGE ; "alloc"
  ADD   X1, X8, #sel_alloc@PAGEOFF ; SEL
  MOV   X0, X21 ; id
  BL    _objc_msgSend_0
This operation is much faster, and still provides a lot of benefit to the analysis.

Sections can also be loaded via:

  File>Load file>DYLD Shared Cache Utils>Load section...
or programmatically with:
  node = idaapi.netnode()
  node.create("$ dscu")
  node.altset(3, 0x1AECFF7F9) # address can be any address in the section
  idaapi.load_and_run_plugin("dscu", 2)
另参见 Objective-C Analysis Plugin Debugger for macOS Remote iOS debugger


 编辑结构体

编辑结构体

 操作名称: EditStruct
此命令允许用户更改结构体对齐方式

结构体对齐用于计算结构体末尾的填充字节数。例如，如果对齐方式为 4，最后一个字段是偏移量 11h 处的字节，则 IDA 将添加 3 个字节的填充，使结构体大小为 14h(4 的倍数)。

对齐方式必须是 2 的幂。

此命令在“结构体”窗口中可用。

另参见 编辑|结构体子菜单。如何输入数字。


 编辑枚举成员

编辑枚举成员

 操作名称: EditConst
此命令允许你重命名枚举成员。枚举成员是一个符号常量。其名称在程序中必须是唯一的。

若要重命名枚举类型名称，请将光标放在枚举的名称上。

另参见 编辑|枚举子菜单。


 编辑断点

编辑断点

 操作名称: BreakpointEdit
此命令将打开一个对话框，用于编辑现有断点。

Location

  断点位置：绝对地址、符号名称、
  模块偏移量组合，或源文件名和行号。
  确切的位置语法取决于断点类型：absolute、module
  relative, symbolic, 或 source code。
Condition
  每次到达断点时，都将对该 IDC 表达式进行评估。 如果表达式返回 true(非零)，调试器将执行
  选定的操作。请注意，你可以在
  调试器处于活动状态时的 IDC 脚本。这样的测试是允许的，
  例如：EAX == EBX+5 或 get_wide_dword(ESP+0x10) == 34

  你也可以使用 "..." 按钮输入多行条件，或指定要使用的另一种脚本语言。 更多信息请看这里。
Settings
  启用：
        如果启用或禁用断点。 禁用的断点
        不会写入调试的进程。

  硬件：
        如果启用，IDA 将使用硬件断点。 断点
        必须为它们指定模式和大小(见下文)。

  Module relative:
        The breakpoint location is stored as a combination of a module
        name and an offset. This kind of breakpoint is useful for
        DLLs that are loaded to various addresses because their addresses
        cannot be calculated in advance. 示例: kernel32+0x1234

  Symbolic:
        The breakpoint location is stored as a combination of a symbol
        name and a possible offset. This kind of breakpoint is useful for
        symbols that can be imported from different DLLs because their addresses
        cannot be calculated in advance. 示例: myfunc+44

  Source code:
        The breakpoint location is stored as a combination of a source file
        name and a line number. Can be used only if the source code of the
        debugged application is available. 示例: myfile.cpp:55

  Low level condition:
        Evaluate the condition on the remote computer. Such conditions are
        faster, especially during remote debugging, because there is no
        network traffic between IDA and the remote computer on each
        breakpoint hit. 更多详情
Actions
  Break:
        Suspend the debugged application

  Trace:
        Add a new entry to the trace log

  Refresh debugger memory:
        By default IDA does not refresh the memory config before evaluating
        a breakpoint condition. This option enables the refresh.
        To refresh it manually, call refresh_debugger_memory

  Enable tracing:
        Enable tracing when the breakpoint hits. This is different from trace
        breakpoints (where only a new entry is added to the trace log).

  Disable tracing:
        Disable tracing when the breakpoint fires.

  Tracing type:
        Instruction, Function and Basic block level tracing types can be selected
        for breakpoints where enable/disable tracing have been selected.
Hardware breakpoint size
        Number of bytes to watch: 1, 2 or 4 bytes for normal hardware breakpoints.
        Any size for page breakpoints.
Hardware breakpoint mode
        The access type the breakpoint will react: read/write, write, execute.
In the case of Intel hardware breakpoints, some limitations are enforced (in contrast with page breakpoints). It is impossible to create more than 4 hardware breakpoints. The address of the breakpoint must be aligned appropriately:
  - 2-byte breakpoints must be word-aligned.
  - 4-byte breakpoints must be dword-aligned.
Please note that hardware breakpoints occur AFTER the instruction execution while software breakpoints occur BEFORE the instruction.

Usually, it is easier to use software breakpoints, except if:

  - we want to be sure the memory is not modified by the debugger
  (instruction breakpoints modify the debugged process memory).

  - we want to detect accesses to data bytes.

  - the specified address is write protected (really rare!).

另参见:
   a href="1404.html断点列表
   添加断点
   删除断点
   断点条件
   断点子菜单   IDC 函数索引


 编辑函数

编辑函数

 操作名称: EditFunction
Here you can change function bounds, its name and flags. In order to change only the function end address, you can use FunctionEnd command.

If the current address does not belong to any function, IDA beeps.

This command allows you to change the function frame parameters too. You can change sizes of some parts of frame structure.

IDA considers the stack as the following structure:

      +------------------------------+
      | function arguments           |
      +------------------------------+
      | return address               |
      +------------------------------+
      | saved registers (SI,DI,etc)  |
      +------------------------------+  <- BP
      | local variables              |
      +------------------------------+  <- SP
For some processors or functions, BP may be equal to SP. In other words, it can point to the bottom of the stack frame.

You may specify the number of bytes in each part of the stack frame. The size of the return address is calculated by IDA (possibly depending on the far function flag).

"Purged bytes" specifies the number of bytes added to SP upon function return. This value will be used to calculate the SP changes at call sites (used in some calling conventions, such as __stdcall in Windows 32-bit programs.)

"BP based frame" allows IDA to automatically convert [BP+xxx] operands to stack variables.

"BP equal to SP" means that the frame pointer points to the bottom of the stack. It is usually used for the processors which set up the stack frame with EBP and ESP both pointing to the bottom of the frame (for example MC6816, M32R).

If you press <Enter> even without changing any parameter,IDA will reanalyze the function.

Sometimes, EBP points to the middle of the stack frame. FPD (frame pointer delta) is used to handle such situations. FPD is the value substracted from the EBP before accessing variables. 一个示例：

           push    ebp
           lea     ebp, [esp-78h]
           sub     esp, 588h
           push    ebx
           push    esi
           lea     eax, [ebp+74h]

      +------------------------------+
      | function arguments           |
      +------------------------------+
      | return address               |
      +------------------------------+
      | saved registers (SI,DI,etc)  |
      +------------------------------+  <- typical BP
      |                              |
      |                              |
      |                              |  <- actual BP
      | local variables              |
      |                              |
      |                              |
      |                              |
      +------------------------------+  <- SP
In our example, the saved registers area is empty (since EBP has been initialized before saving EBX and ESI). The difference between the 'typical BP' and 'actual BP' is 0x78 and this is the value of FPD.

After specifying FPD=0x78 the last instruction of the example becomes

           lea     eax, [ebp+78h+var_4]
where var_4 = -4

Most of the time, IDA calculates the FPD value automatically. If it fails, the user can specify the value manually.

If the value of the stack pointer is modified in an unpredictable way, (e.g. "and esp, -16"), then IDA marks the function as "fuzzy-sp".

If this command is invoked for an imported function, then a simplified dialog box will appear on the screen.

另参见

         函数标志
         创建函数
         删除函数
         编辑|函数子菜单。


 编辑子菜单

编辑子菜单
此子菜单允许用户修改文本表达形式并修补文件。它还具有用于控制分析的命令：
 定位器
 导出数据
 撤消
 重做

 转换为指令
 转换为数据
 转换为 STRLIT 字符串
 转换为数组
 取消定义
 重命名

 操作数类型子菜单
 注释子菜单

 函数子菜单
 结构体子菜单
 枚举子菜单
 段子菜单
 补丁程序子菜单
 其他子菜单
 插件子菜单
另参见 菜单栏子菜单。


 编辑跟踪描述

编辑跟踪描述
显示二进制跟踪文件的描述

此命令显示一个窗口，其中包含所选二进制跟踪文件的描述，并允许对其进行编辑。

另参见:
   清除跟踪
   选择跟踪
   其他选项
   移除二进制跟踪
   导入二进制跟踪
   导出二进制跟踪
   导出跟踪到文本文件
   显示跟踪调用图表


 编辑|注释子菜单

编辑|注释子菜单
此子菜单允许你操作不同类型的注释。使用它们使反汇编的文本更易于理解。
 创建常规注释
 创建可重复的注释
 创建其他注释行
另参见 编辑子菜单。


 编辑|操作数类型子菜单

编辑|操作数类型子菜单
This submenu allows you to change the operand types to offsets, numbers, chars, etc. Use it to make disassembled text more understandable.
 Convert operand to offset
 Convert operand to number
 Convert operand to character
 Convert operand to segment
 Convert operand to enum
 Convert operand to stack variable
 Change operand sign
 Bitwise negate operand
 User-defined operand
 Set operand type
If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and show it in red. Use these commands to delete suspicious marks.

Some of these commands can be applied to a selected range. Click here to learn about the rules applied to such operations.

另参见 编辑子菜单。


 编辑|操作数类型|数字子菜单

编辑|操作数类型|数字子菜单

   将操作数转换为数字
   将操作数转换为十六进制数
   将操作数转换为十进制数
   将操作数转换为八进制数
   将操作数转换为二进制数
   将操作数转换为浮点数
   切换前导零
另参见 编辑|操作数类型子菜单。


 编辑|操作数类型|偏移量子菜单

编辑|操作数类型|偏移量子菜单

   将操作数转换为偏移量(数据段)
   将操作数转换为偏移量(代码段)
   将操作数转换为偏移量(任意段)
   将操作数转换为偏移量(自定义基数)
   将操作数转换为结构体偏移量
另参见 编辑|操作数类型子菜单。


 编辑|其他子菜单

编辑|其他子菜单

      创建对齐指令...
      手动指令...
      颜色说明...
      隐藏/显示边框
另参见 编辑子菜单。


 编辑|补丁程序核心子菜单

编辑|补丁程序核心子菜单
This submenu allows you to patch the image of the input file. More precisely, IDA never modifies the input file. The image of the input file which was loaded to the database will be modified.

You can modify the image of the input file:

        - change a byte
        - change a word
        - enter an assembler instruction (only for IBM PC)
IDA will display the original value, the current value and file offset. If the file offset is equal to 0xFFFFFFFF then the current byte comes from a compressed page (LX/LE/NE iterated pages, for example) and/or it is not possible to tell the file position.

You can create a difference file and use an external tool to apply the patches or you can apply the patches directly to the file using IDA.

The following commands are availabe:

 Patch byte or word
 Assemble...
 Apply patches to input file...
另参见：
 Produce EXE file
 Produce DIF file
 Edit submenu.


 编辑|段子菜单

编辑|段子菜单
此子菜单允许你操作程序的片段：
 创建新区段...
 删除区段...
 更改区段属性...
 移动区段...
 变基程序...
 更改句段翻译...

 设置默认段寄存器值...
 更改段寄存器值...
另参见：
 如何选择区段
 如何跳转到区段
 编辑子菜单。


 空输入文件

空输入文件
输入文件不包含任何指令或数据，即没有任何东西可以反汇编。

某些文件格式允许文件不为空但不包含任何要反汇编的内容的情况。例如，COFF/OMF/EXE 格式可能包含一个文件头，该头仅声明文件中没有可执行部分。

文件中可能有类型信息、编译器选项和其他辅助信息。这就是为什么文件看起来不为空但 IDA 找不到任何要反汇编的内容的原因。


 空导航堆栈

空导航堆栈

 操作名称: EmptyStack
This command clears the jump stack.

另参见

         跳转子菜单
         返回跳转命令。


 enable_tracing

enable_tracing

Enable step tracing
     trace_level - what kind of trace to modify
     enable      - 0: turn off, 1: turn on
Returns: success

success enable_tracing(long trace_level, long enable);
#define TRACE_STEP 0x0  // lowest level trace. trace buffers are not maintained #define TRACE_INSN 0x1  // instruction level trace #define TRACE_FUNC 0x2  // function level trace (calls & rets) #define TRACE_BBLK 0x4  // basic block level trace


 end_type_updating

end_type_updating

End type updating. Refreshes the type system
at the end of type modification operations

     utp  - (one of UTP_... consts)
returns: none

success end_type_updating(long utp);


 输入标记描述

输入标记描述
标记说明是任何文本行。该说明仅供参考。


 输入字符串进行搜索

输入字符串进行搜索
请输入任何要搜索的字符串。

搜索不区分大小写，搜索方向为前向。

如果找不到子字符串，光标将不会移动。


 枚举书签

枚举书签
参见: 选择标记位置


 枚举子菜单

枚举子菜单
Commands of this submenu are available in the enums window:
      Add an enum
      Delete an enum
      Edit an enum
      Define an enum member
      Edit an enum member
      Delete an enum member
All enum members names must be unique in the program. You cannot define more than 256 enum members (symbolic constants) with the same value.

请注意，你可以在此处创建 位域定义。

还可以为枚举和每个枚举成员添加注释。In order to specify an enum comment, you must stand at the enum name. 使用常规命令设置注释：

另参见 编辑子菜单。


 枚举窗口

枚举窗口

 操作名称: OpenEnums
此命令将打开枚举定义窗口。

你可以在此处修改枚举定义：添加/编辑/删除 枚举, 添加/编辑/删除 枚举成员(即用户定义的符号常量)

请注意，你可以在此处创建 位域定义。

还可以为枚举和每个枚举成员添加注释。为了指定枚举注释，你必须站在枚举名称上。使用常规命令设置注释：

另参见 视图|打开子视图子菜单。


 环境变量

环境变量

The following 环境变量 are used by IDA:

TMP 或 TEMP     Specifies the directory where the temporary 文件 will be created. Default: C:\TEMP
EDITOR          The name of the preferred text editor.
IDALOG          Specifies the name of the log file. Everything appearing in the message window will be dumped there. Default: none
IDALOG_SILENT   Suppress all output to the message window. If the IDALOG variable is set, messages will continue to be written to the log file. Otherwise, they will be lost.
IDADIR          Specifies the IDA directory. Default: the directory where IDA executable is located
IDA_LOADALL     The selected loader will load all segments without asking
IDAUSR          Specifies the directory for user-specific settings. Default: Windows:  %APPDATA%/Hex-Rays/IDA Pro Linux:    $HOME/.idapro Mac OS X: $HOME/.idapro
                This variable can contain multiple paths, in which case they must
                be separated by the platform's path separator character (i.e., ';'
                on Windows, and ':' on Linux & Mac OS X.)

          NOTE: Using %IDAUSR% for loading plugins.

                %IDAUSR% will be considered when scanning for plugins: for
                each directory component of %IDAUSR%, IDA will iterate on
                files in its "plugins" subdirectory, in alphabetical order.

                Plugins with the same case-insensitive file name (without
                extension) are considered to be duplicates and are ignored;
                only the first plugin with a given name will be considered.
                Thus, let's say %IDAUSR% is set to "C:\my_idausr", and a file
                "C:\my_idausr\plugins\DWARF.py" exists, then
                "C:\my_idausr\plugins\DWARF.py" will be picked up first while
                "%IDADIR%\plugins\dwarf.dll" will be considered conflicting,
                and thus ignored.

                In addition, in each directory, IDA first looks for plugins
                with the native extension (e.g., ".dll" on Windows) and only
                then looks for files with extensions corresponding to
                extension languages (e.g., ".idc", ".py", ...)
                Consequently if two files, say "foo.dll" and "foo.py", are
                present in the same directory, "foo.dll" will be picked first,
                and "foo.py" will be considered conflicting, and thus ignored.

          NOTE: Using %IDAUSR% for overriding configuration.

                %IDAUSR% will be considered when looking for configuration
                files, after the config file found in %IDADIR%\cfg has been
                read.

                After %IDADIR%\cfg\<filename> has been read & applied, for
                each directory component of %IDAUSR%, IDA will look for
                cfg/<filename> in it, and, if found, read & apply its
                contents as well.

                This enables users to have their own small, fine-tuned
                configuration files containing just the bits they wanted to
                override, stored in one (or more) folder(s) of their choosing.

          NOTE: Using %IDAUSR% for specifying themes

                %IDAUSR% will be considered when scanning for themes: for
                each directory component of %IDAUSR%, IDA will iterate on
                subdirectories in its "themes" subdirectory.

          NOTE: Using %IDAUSR% for providing additional loaders, processor
                modules, .til files, .sig and .ids files

                %IDAUSR% will also be considered when building the list of
                existing loaders, processor modules, .til, .sig and .ids files.
                The following directories will be inspected:
                       %IDAUSR%\loaders
                       %IDAUSR%\procs
                       %IDAUSR%\til\<arch-name>
                       %IDAUSR%\sig\<arch-name>
                       %IDAUSR%\ids\<platform-name>

IDA_MINIDUMP    (Windows only) If IDA crashes, it creates a minidump file with the MiniDumpWrite(). Use this environment variable to specify MiniDump flags (a combination of MINIDUMP_TYPE flags as a hexadecimal number). If set to "NO", IDA will not write a dump.
IDA_MDMP_INIT   (Windows only) Let IDA load dbghlp.dll on startup so it is used for crash dump file generation in case of a crash. If not set, IDA will load dbghlp.dll dynamically (if needed). Using this option may cause the Windbg debugger plugin to malfunction in case its dbghlp.dll does not match the one loaded by IDA.
IDA_NOEH        If set, disable IDA's own exception handler and let all possible crashes to be handled by the OS or active debugger. It is useful if you're debugging a crash in a plugin or processor module.
IDAIDS          Specifies the directory with the IDS files. Default: %IDADIR%\IDS
IDASGN          Specifies the directory with the SIG files. Default: %IDADIR%\SIG
IDATIL          Specifies the directory with the TIL files. Default: %IDADIR%\TIL
IDAIDC          Specifies the directory with the IDC files. Default: %IDADIR%\IDC
IDA_LIBC_PATH   Useful only on Android remote host. Specifies the exact path to the system libc.so
IDA_SKIP_SYMS   Useful only on Linux host. Turns off loading of exported symbols for the main executable file at the start of a debugging session
IDA_NORELOC     Disables processing of the relocation information for some file formats
IDA_NOEXP       Disables processing of the export information for some file formats
IDA_NOTLS       Disables processing of the TLS entries for some file formats
IDA_NOEXP       Disables processing of the export information for some file formats
IDA_NOTLS       Disables processing of the TLS entries for some file formats
H8_NOSIZER      Disables the display of the operand sizes for H8 module
IDA_LOADALL     Load all segments of the input file without futher confirmations
IDA_DEBUGBREAKPROCESS (Windows only) IDA debugger will use the DebugBreakProcess() API to break into the process. Otherwise it will instead attempt to set temporary breakpoints for all threads.
IDA_NO_REBASE   IDA Debugger will not rebase the program when debugging. (This will be in effect even if the debugger plugin implements the rebase_if_required_to callback)
IDABXPATHMAP    Variables related to the Bochs debugger. IDABXENVMAP     See plugins/bochs/startup.* for more details.
IDA_NOWIN       (Text MS Windows version only) Bypass the code trying to find out the foreground window. This code causes problems under WINE.
IDA_DONT_SWITCH_SCREENS (text version only) Tells IDA to keep only one screen even during local debugging sessions. For local debugging sessions, IDA keeps by default one screen for the debugged application and one screen for itself.
IDA_NOAUTOCOMP  Do not autodetect compiler for name demangling. If this variable is absent and the current compiler is one of MS, Borland and Watcom, the compiler is autodetected.
IDA_ELF_PATCH_MODE Overrides patch mode for the new ELF files. If this variable is defined, it must contain a number. Each bit of this number corresponds to an option from the following list:
   0: Replace PIC form of 'Procedure Linkage Table' to non PIC form
   1: Direct jumping from PLT (without GOT) regardless of its form
   2: Convert PIC form of loading '_GLOBAL_OFFSET_TABLE_[]' of address
   3: Obliterate auxiliary bytes in PLT & GOT for 'final autoanalysis'
   4: Natural form of PIC GOT address loading in relocatable file
   5: Unpatched form of PIC GOT references in relocatable file
   6: Mark 'allocated' objects as library-objects (MIPS only)

IDA_DYLD_SHARED_CACHE_SLIDE Mach-O loader: specify the dyld shared cache image ASLR slide value (hexadecimal) or 'search' for automatic detection. If not set, slide is assumed to be 0 (unslid image).
The following variables are used to fine-tune the Linux version of IDA:
TVLOG    the name of the log-file if it is not defined, use syslog with LOG_WARNING priority
TERM     the terminal definition (see terminfo)
TVHEADLESS disable all output (for i/o redirection) if this variable defined, the TVOPT variable is ignored This environment variable also works also in graphical versions of IDA. When set, the graphical interface will not restore desktops, toolbars or show the main window.
TVOPT    the enduser flags. Has many subfields delimited by commas ','. noX11   - when libX11.so is not compatible noGPM   - when libgpm.so is not compatible ansi    - OR mono    - when the terminfo data of your display does not declare it as having the ANSI-color support ign8    - ignore '8bit as meta key' in the terminfo description xtrack  - if your xterm-emulator in telnet client does not support mode 1002 (only 1000), set this flag alt866  - do not encode pseudographic symbols (for the console with alt-font loaded) cyrcvt= - cyrilic conversion (oem/koi8r). possible values are: linux   - for linux russian users and PuTTY (in/out koi8r) kwin    - output in koi8 and input in cp1251 - any telnet windows - for many telnet and any linux users (in/out 1251)
 Client name | Terminal   | TVOPT  | Client settings
 ------------|------------|--------|---------------------------------------
             |            |        |
 SecureCRT   |xterm-scokey| xtrack | Emulation->Terminal: xterm,
             |            |        | Emulation->keyboard: either the
             |            |        |   built-in keyboard, either custom
             |            |        |                  'xt-sco.key' file
             |            |        | Advanced->Terminaltype: xterm-scokey
             |            |        |
 SecureCRT   |   xterm    | xtrack | Emulation->Terminal: xterm+internal kbd
             |            |        |
             |            |        |
 Putty       |xterm-scokey|   -    | Terminal,Keyboard: Control?, Standard,
             |            |        |                    SCO, Normal, Normal
             |            |        |
 Putty       |   xterm    |   -    | Terminal,Keyboard: ControlH, Standard,
             |            |        |                    ~num, Normal, Normal
             |            |        |
 Console     |   linux    |   -    | default
             |            |        |
 X11:xterm   |   xterm    |   -    | default

We recommend to use the 'xterm-scokey' terminal type for remote clients.
When the terminal type is xterm-scokey, add  the following string to /etc/inputrc (or to ~/.inputrc):
"\e[.": delete char
When working on the console without GPM installed, append "noGPM" to TVOPT.
Russian users should append the following settings to the above:
                  | APPEND  TO TVOPT  | APPEND TO Client Settings
 -----------------|---------------------|----------------------------
 Console          | alt866,cyrcvt=linux |
                  |                     |
 X11              | cyrcvt=linux        |
                  |                     |
 Putty            | cyrcvt=linux        | Window,Translation: use font in
                  |                     |           both ANSI and OEM modes
                  |                     |
 SecureCRT        |                     |
   with koi8font  |                     |
    and kbd-hook  | cyrcvt=linux        |
    with koi8font | cyrcvt=kwin         |
   with ANSI-font | cyrcvt=windows      |
                  |                     |
    The best settings for russian users on the console are:
         setfont alt-8x16.psf.gz -m koi2al
         loadkey ru-ms.map
         export TVOPT=cyrcvt=linux,alt866


 加载覆盖错误

加载覆盖错误
发生以下情况之一：
        - overlay stub is not found
        - overlay relocation data is incorrect
i.e. the input file structure is bad.


 eval

eval

Evaluate an expression, in the current scripting language.
     expr - 表达式
返回值：表达式值。
If there are problems, the returned value will be "IDC_FAILURE: xxx"
where xxx is the error description
Thread-safe function.

string or long eval(string expr);
// Macro to check for evaluation failures: #define EVAL_FAILURE(code) (value_is_string(code) && substr(code, 0, 13) == "IDC_FAILURE: ")


 eval_python

eval_python

计算 python 表达式。
     expr - 表达式
返回值：表达式值。
如果无法计算表达式，此函数将引发异常。
线程安全函数。

any eval_python(string expr);


 异常

异常
This dialog box allows to setup how the 调试器 will react to specific exceptions. For each exception, two settings can be specified, simply by selecting the desired exception, and clicking the '编辑' button in the popup menu.

Suspend program

        指定发生异常时调试器是否挂起。
        If 'Passed to' == application and the application handles
        the exception successfully, the execution will not be suspended
        regardless of the 'Suspend' value.
Passed to
        指定是否将异常传递给应用程序本身
        或由调试器处理。 If the debugged program contains exception
        handling code, it is better to select 'Application'.
Report
  Warn

        显示包含异常信息的警告消息。

  Log

        Instead of displaying a warning message, log to the output window the exception
       信息.

  Silent

        Do not show a warning message nor log to the output window.
对于“插入”命令添加的新异常，必须指定异常名称和代码。These values must be unique, the name cannot be empty, and the code cannot be zero.
 另参见 调试器子菜单。


 exec_idc

exec_idc

编译和执行 IDC 语句
     input - IDC 语句
返回值：1 - OK，否则引发异常
线程安全函数。

long exec_idc(string input);


 exec_python

exec_python

执行 python 语句。
     stmt - 声明
如果执行语句，则返回数字 0，否则返回错误字符串
线程安全函数。

string or long exec_python(string stmt);


 执行脚本文件

执行脚本文件

 操作名称: Execute
你可以执行内置脚本引擎(IDC 或 Python)支持的任何脚本文件，或插件添加的脚本语言。要使用的脚本语言由脚本的文件扩展名选择。

另参见

         立即执行 脚本命令
         加载... 子菜单命令。


 退出 IDA

退出 IDA

 操作名称: Quit
此命令终止当前 IDA 会话。IDA 会将所有更改写入磁盘，并关闭所有数据库。

你可以启用/禁用数据库打包。打包数据库时，它由一个扩展名为 IDB 的文件组成。当数据库未打包时，它由磁盘上的多个文件组成。如果禁用打包，则在下一个会话中无法终止IDA。建议不要将数据库保留在解压缩形式中，因为你将没有备份副本。

还可以在打包数据库之前对数据库执行垃圾回收。垃圾回收会删除未使用的数据库页，使其更小。但是，IDA 在工作时需要一些空闲的数据库页面，因此当你重用数据库时，它将再次分配它们。删除和添加空闲页面需要时间，最重要的是，它会更改数据库控制块。

仅当你不打算在不久的将来使用数据库时，才使用垃圾回收。

IDA 将记住有关屏幕、光标位置、跳转堆栈等的所有信息。以下信息将丢失：

        击键宏，
        定位器位置
要恢复反汇编会话，只需键入："ida file”

另参见

         其他文件...子菜单命令。
         终止 命令。


 exit_process

exit_process

终止调试器
取消当前调试器进程并返回到反汇编模式
   参数: none
   返回: success

success exit_process(void);


 展开结构体

展开结构体

 操作名称: ExpandStruct
此命令通过在游标位置插入未定义的字节来扩展当前结构体。The cursor must not be at the end of the structure. To define a member at the end of the structure, just use normal data definition commands.

当你打开结构体窗口时，此命令可用。

另参见 编辑|结构体子菜单。


 expand_struc

expand_struc

扩展或收缩结构体类型
     id - 结构体类型 ID
     offset - 结构体中的偏移量
     delta - 要添加或删除的字节数
     recalc - 重新计算位置
              使用结构体类型
返回： !=0- ok

success expand_struc(long id, long offset, long delta, long recalc);


 导出二进制跟踪

导出二进制跟踪
将“跟踪”窗口中显示的所有事件导出到二进制跟踪文件

此命令将当前跟踪导出到二进制跟踪文件，该跟踪显示在跟踪窗口中。可以稍后加载跟踪、移除跟踪或与其他跟踪文件进行比较。

另参见:
   清除跟踪
   选择跟踪
   其他选项
   编辑跟踪描述
   二进制跟踪的比较
   导入二进制跟踪
   移除二进制跟踪
   导出跟踪到文本文件
   显示跟踪调用图表


 导出数据

导出数据

    "导出数据" 对话框可以将二进制数据导入为不同的格式


 导出跟踪到文本文件

导出跟踪到文本文件
将“跟踪”窗口中显示的所有事件导出到文本文件

此命令将 跟踪窗口中显示的当前跟踪导出到文本文件。

另参见:
   清除跟踪
   选择跟踪
   其他选项
   编辑跟踪描述
   二进制跟踪的比较
   导入二进制跟踪
   导出二进制跟踪
   移除二进制跟踪
   导出跟踪到文本文件


 导出窗口

导出窗口

 操作名称: OpenExports
该命令 打开导出窗口.

你可以在此窗口中使用 列表查看器 命令。

另参见 视图|打开子视图子菜单。


 外部程序和 GDB 调试器

外部程序和 GDB 调试器
远程 GDB 调试器选项中的“调试前运行程序”选项允许在启动调试会话时自动运行程序(如调试服务器)。If you enable it, the following options become available:

命令行

        要运行程序的命令行。 The following special symbols can be used:

        %i: input file name from the Process options dialog
        %p: port number from the Process options dialog
        %e: file name of a temporary ELF file created from the database contents
Initial SP
        IDA will set the SP (or a similar register) after connecting to the server
Choose a configuration
        加载 one of the pre-defined configurations (命令行, memory map and SP value)
        described in the gdb_arch.cfg 文件.
Memory map
        编辑 the memory map for the external server. It will be used during debugging.
One use of these options is to debug small code snippets using the QEMU emulator.

另参见

   远程 GDB 调试器选项
   调试器子菜单


 fclose

fclose

close a file
     handle - file handle
返回: nothing
Thread-safe function.

void fclose(long handle);


 fgetc

fgetc

read one byte from file
     handle  - file handle
返回: -1 - error
         otherwise a byte read.
线程安全函数。

long fgetc(long handle);


 文件子菜单

文件子菜单
在此子菜单中，你可以：
  加载文件               加载文件
  脚本命令               执行脚本命令
  生成输出文件        生成输出文件
  操作系统外壳        执行操作系统命令
  保存数据库            以打包形式保存数据库
  将数据库另存为...   将数据库以打包形式保存在另一个文件中
  获取数据库快照     获取数据库快照
  终止                     终止 - 不保存更改
  退出                     退出 DOS - 保存更改
另参见 菜单栏子菜单。


 filelength

filelength

get file length
     handle - file handle
返回: -1 - error
         otherwise file length in bytes
Thread-safe function.

long filelength(long handle);


 文件|加载文件子菜单

文件|加载文件子菜单
此子菜单允许你将其他文件加载到数据库中。
  重新加载输入文件
  脚本文件
  二进制文件
  IDS 文件
  调试信息文件
  PDB 调试信息文件
  TDS 调试信息文件
  FLIRT 签名文件
  C 头文件
另参见 其他文件...子菜单命令。


 文件|生成输出文件子菜单

文件|生成输出文件子菜单
此子菜单允许你生成各种输出文件。它还允许你卸载数据库。

下面的文本文件生成操作将使用 当前选择的输出文件编码。

另参见 其他文件...子菜单命令。


 查找

查找

以下函数搜索指定的字节
     ea - 起始地址
     标志是以下位的组合:
返回 BADADDR - 未找到

#define SEARCH_UP       0x00            // 向后搜索
#define SEARCH_DOWN     0x01        // 向前搜索
#define SEARCH_NEXT     0x02           // 从下一个/上一个项开始搜索
                       // 仅对 find_text() 和 find_binary() 有用
                     // 对于其他查找...函数隐式设置为
#define SEARCH_CASE     0x04          // 搜索区分大小写（仅适用于 bin&txt 搜索）
#define SEARCH_REGEX    0x08          // 启用正则表达式（仅适用于 TXT）
#define SEARCH_NOBRK    0x10         // 不测试 ctrl-break
#define SEARCH_NOSHOW   0x20        // 不显示搜索进度

long find_suspop(long ea, long flag);
long find_code(long ea, long flag);
long find_data(long ea, long flag);
long find_unknown(long ea, long flag);
long find_defined(long ea, long flag);
long find_imm(long ea, long flag, long value);
long find_text(long ea, long flag, long y, long x, string str);
               // y - ea 处开始的文本行数 (0..MAX_ITEM_LINES)
               // x - 该行的 x 坐标
long find_binary(long ea, long flag, string str);
               // str - 用户为 Core 中搜索文本输入的字符串
               // 示例:  "41 42" - 查找 2 个字节 41h, 42h
               // 默认基数取决于当前 IDP 模块(ibm pc 的基数为 16)


 查找所有错误

查找所有错误

 操作名称: FindAllErrors
此命令搜索包含任何错误的所有字符串，并显示这些错误的列表。 您可以使用此列表来检查错误并根据需要更正它们。
另参见:
   错误字符串
   搜索子菜单


 查找所有可疑操作数

查找所有可疑操作数

 操作名称: FindAllSuspicious
该命令搜索所有可疑操作数并显示它们的列表。你可以使用此列表来检查操作数，并根据需要进行修改。
另参见:
   a href=569.html"可疑操作数
   搜索子菜单


 查找断点

查找断点

 操作名称: BreakpointFind
如果需要，打开断点窗口，然后在其中查找当前断点。
另参见:
   断点列表
   添加断点
   编辑断点
   断点子菜单


 find_custom_data_format

find_custom_data_format

Get id of a custom data format
     name - name of the custom data format
Returns: id or -1

long find_custom_data_format(string name);


 find_custom_data_type

find_custom_data_type

Get id of a custom data type
     name - name of the custom data type
Returns: id or -1

long find_custom_data_type(string name);


 find_func_end

find_func_end

Determine a new function boundaries
     ea  - starting address of a new function
返回: if a function already exists,
         then return its end address.
         if a function end cannot be determined,
         then return BADADDR
         otherwise return the end address of the new function

long find_func_end(long ea);


 find_selector

find_selector

Find a selector that has mapping to the specified paragraph.
        arguments:      val - value to search for
        返回:        the selector number if found
                        otherwise the input value (val & 0xFFFF)
        note:           selector values are always in paragraphs

long find_selector(long val);


 firstattr

firstattr

Get the first object attribute
     self  - object
If there are no attributes, returns 0
Thread-safe function.

string firstattr(object self);


 FLAIR 冲突：具有给定名称的函数已存在

FLAIR 冲突：具有给定名称的函数已存在

 描述:
        It means that IDA recognized the 函数 as coming
        from a standard library but there already was another 函数
        with the same name in the program.

 What to do:
        Examine the 函数 and rename it as you wish.


 FLAIR 匹配未定：对预期函数的引用

FLAIR 匹配未定：对预期函数的引用

 描述:
        IDA 将代码字节与至少一个字节进行匹配
        签名条目，但预期找不到
        代码中某些偏移量处的交叉引用。

        请考虑以下 .pat 文件内容：

                5589E583EC18A1........890424E8........C9C3...................... 00 0000 0015 :0000 _test ^000F _my_fun0
                5589E583EC18A1........890424E8........C9C3...................... 00 0000 0015 :0000 _smuk ^000F _my_fun1

        Now, turn that .pat 文件 into a signature (.sig) 文件, telling
        sigmake to include 函数 references into signature
        (using the -r switch).
       然后，将 .sig 文件应用到你正在检查的二进制文件。
        If IDA recognizes the 0x15-bytes long pattern in the binary, it
        will check that, at offset 0xF from the start of the match,
        a call to either "_my_fun0" 或 "_my_fun1" is performed.

        If either one of the two is found, then that code will
        be named "test", 或 "smuk", respectively.
        Otherwise, a SIGFNREF problem will be signalled.

 What to do:
        Examine the code pointed to by the address at the given
        offset (i.e., 0xF) and try and determine whether
        that 函数 could be "_my_fun0", 或 "_my_fun1".
        If so, name it accordingly and re-apply the signature.

        An alternative is to 生成 the signature (.sig)
        文件 without the cross-references to functions
        (i.e., dropping the '-r' switch).
        But beware of collisions: a pattern like the
        one above will inevitably create a collision, since the
        pattern bytes are similar for the two entries.


 fopen

fopen

open a file
arguments: similiar to C fopen()
返回: 0 - error
         otherwise a file handle
Thread-safe function.

long fopen(string file, string mode);


 强制零字段偏移

强制零字段偏移

 操作名称: ZeroStructOffset
此命令强制 IDA 显示完整的结构体成员名称，即使成员的偏移量等于零。

If used twice, the command cancels itself.

示例: Suppose we have the following structure:

        xxx     struc
        a       db ?
        b       db ?
        c       db ?
        xxx     ends

        dloc    xxx ?

  Normally IDA displays references to it like this:

        mov     eax, offset dloc
        mov     eax, offset dloc.b

  If you force IDA, then it displays member 'a':

        mov     eax, offset dloc.a
        mov     eax, offset dloc.b
另参见 编辑|结构体子菜单。


 forget_exception

forget_exception

Delete exception handling information
     code - exception code

success forget_exception(long code);


 format_cdata

format_cdata

Format value(s) as a C/C++ data initializers
     outvec - reference to the output object
              after the call will contain array of strings
     value  - value to format
     type   - type of the data to format
     options- optional object, which may have the attributes PTV_...
                     'ptvf' - combination of PTV_... constants:
                     'flags'      number representation (e.g. hex_flag(), dec_flags(), etc)
                     'max_length' max length of the formatted text (0 means no limit)
                     'arrbase'    for arrays: the first element of array to print
                     'arrnelems'  for arrays: number of elements to print
                     'margin'     length of one line (0 means to print everything on one line)
                     'indent'     how many spaces to use to indent nested structures/arrays
     info   - object to store additional information about the generated lines
              after the call will contain array of objects, each of which has:
                     'ea' - address of the line
                     'type' - typeinfo of the line (may include label for the line as 'name')
              may be specified as 0 if this info is not required
Returns: error code

long format_cdata(object &outvec, anyvalue value, typeinfo type, object options, object &info);
#define PTV_DEREF  0x0001  // take value to print from the database. // its address is specifed by value.num (default) #define PTV_QUEST  0x0002  // print '?' for uninited data #define PTV_EMPTY  0x0004  // return empty string for uninited data (default) #define PTV_CSTR   0x0008  // print constant strings inline (default) #define PTV_EXPAND 0x0010  // print only top level on separate lines // max_length applies to separate lines // margin is ignored #define PTV_LZHEX  0x0020  // print hex numbers with leading zeroes #define PTV_STPFLT 0x0040  // fail on bad floating point numbers // (if not set, just print ?flt for them) #define PTV_SPACE  0x0080  // add spaces after commas and around braces (default) #define PTV_DEBUG  0x0100  // format output for debugger


 fprintf

fprintf

fprintf
     handle  - file handle
     format  - format string
返回: 0 - ok
         -1 - error
Thread-safe function.

long fprintf(long handle, string format, ...);


 fputc

fputc

write one byte to file
     handle  - file handle
     byte    - byte to write
返回: 0 - ok
         -1 - error
Thread-safe function.

long fputc(long byte, long handle);


 fseek

fseek

set cursor position in the file
     handle - file handle
     offset - offset from origin
     origin - 0 = from the start of file
              1 = from the current cursor position
              2 = from the end of file
返回: 0 - ok
         otherwise error
Thread-safe function.

long fseek(long handle, long offset, long origin);


 ftell

ftell

get cursor position in the file
     handle - file handle
返回: -1 - error
         otherwise current cursor position
Thread-safe function.

long ftell(long handle);


 func_contains

func_contains

Does the given function contain the given address?
     func_ea - any address belonging to the function
     ea - linear address

success func_contains(long func_ea, long ea);


 函数调用窗口

函数调用窗口

 操作名称: OpenCallers
该命令 打开函数调用窗口.

调用当前函数的所有函数都显示在窗口顶部。

从当前函数调用的所有函数都显示在窗口底部。

当光标移动到另一个函数时，列表会自动刷新。

另参见 视图|打开子视图子菜单。


 函数块相关的函数

函数块相关的函数

// Get a function chunk attribute
//       ea     - any address in the chunk
//       attr   - one of: FUNCATTR_START, FUNCATTR_END
//                        FUNCATTR_OWNER, FUNCATTR_REFQTY
// returns: desired attribute or -1

long get_fchunk_attr(long ea, long attr);
// Set a function chunk attribute //       ea     - any address in the chunk //       attr   - nothing defined yet //       value  - desired bg color (RGB) // 返回: 0 if failed, 1 if success
success set_fchunk_attr(long ea, long attr, long value);
// Get a function chunk referer //       ea     - any address in the chunk //       idx    - referer index (0..get_fchunk_attr(FUNCATTR_REFQTY)) // 返回: referer address or BADADDR
long get_fchunk_referer(long ea, long idx);
// Get next function chunk //       ea     - any address // 返回: the starting address of the next //          function chunk or BADADDR // This function enumerates all chunks of all functions in the database
long get_next_fchunk(long ea);
// Get previous function chunk //       ea     - any address // 返回: the starting address of the previous //          function chunk or BADADDR // This function enumerates all chunks of all functions in the database
long get_prev_fchunk(long ea);
// Append a function chunk to the function //       funcea   - any address in the function //       ea1, ea2 - boundaries of a function tail to add. //                  If a chunk exists at the specified addresses, //                  it must have exactly the specified boundaries // 返回: 0 if failed, 1 if success
success append_func_tail(long funcea, long ea1, long ea2);
// Remove a function chunk from the function //       funcea - any address in the function //       ea1    - any address in the function chunk to remove // 返回: 0 if failed, 1 if success
success remove_fchunk(long funcea, long tailea);
// Change the function chunk owner //       tailea - any address in the function chunk //       funcea - the starting address of the new owner // 返回: 0 if failed, 1 if success // The new owner must already have the chunk appended before the call
success set_tail_owner(long tailea, long funcea);
// Get the first function chunk of the specified function //       funcea - any address in the function // 返回: the function entry point or BADADDR // This function returns the first (main) chunk of the specified function
long first_func_chunk(long funcea);
// Get the next function chunk of the specified function //         arguments:      funcea - any address in the function //                         tailea - any address in the current chunk //         返回:        the starting address of the next //                         function chunk or BADADDR // This function returns the next chunk of the specified function
long next_func_chunk(long funcea, long tailea);


 函数标志

函数标志
The following flags can be set in function properties:

Does not return

The function does not return to caller (for example, calls a process exit function or has an infinite loop). If no-return analysis is enabled in Kernel Options, IDA will not analyze bytes following the calls to this function.

Far function

On processors which distinguish near and far functions (e.g. PC x86), mark the function as 'far'. This may affect the size of the special stack frame field reserved for the return address, as well as analysis of calls to this function.

Library func

Mark the function as part of compiler runtime library code. This flag is usually set when applying FLIRT signatures

Static func

Mark the function as static. Currently this flag is not used by IDA and is simply informational.

BP based frame

Inform IDA that the function uses a frame pointer (BP/EBP/RBP on PC) to access local variables. The operands of the form [BP+xxx] will be automatically converted to stack variables.

BP equal to SP

Frame pointer points to the bottom of the stack instead of at the beginning of the local variables area as is typical.

Fuzzy SP

Function changes SP by an unknown value, for example: and esp, 0FFFFFFF0h

Outlined code

The function is not a real function but a fragment of multiple functions' common instruction sequence extracted by the compiler as a code size optimization (sometimes called "code factoring"). During decompilation, body of the function will be expanded at the call site.

另参见

         编辑|函数子菜单。
         编辑函数
         追加函数尾部...


 函数跟踪

函数跟踪

 操作名称: ToggleTraceFunctions
此命令启动函数跟踪。然后，你可以像往常一样使用所有调试器命令：调试器将保存调用函数或返回函数的所有地址。

在内部，调试器逐步运行当前线程，以正确检测所有函数调用和返回。这就解释了为什么函数跟踪比正常执行慢。

另参见 跟踪窗口
          跟踪管理
          清除跟踪
          指令跟踪
          基本块跟踪
          添加写入跟踪
          添加读取/写入跟踪
          添加执行跟踪
          跟踪选项
          跟踪子菜单。


 重播器调试器提供的函数

重播器调试器提供的函数

// Step back in the currently replayed trace
// Returns: error code (0 if none happened).

success step_back(void);
// Set the current event number, changing the PC register. // Input  : the event to move to // Events are numbered in reverse order, i.e. 0 is the last available event. // Returns: error code.
success set_current_tev(long event);
// Get the current event number. // Returns: the current event number.
long get_current_tev(void);


 WinDbg 调试器提供的函数

WinDbg 调试器提供的函数

// Send arbitrary command to the WinDbg engine
// Returns: the command output

string send_dbg_command(string cmd);
// Read a model specific register // Returns: the register value. if this function fails, //          an exception with the error code is raised // Note: this function works only in the kernel mode
int64 read_msr(long reg_id);
// Write a model specific register // Returns: windows error code (0-ok) // Note: this function works only in the kernel mode
success write_msr(long reg_id, int64 value);


 函数子菜单

函数子菜单
此子菜单允许你在反汇编中操作函数：
      创建函数...
      编辑函数...
      追加函数尾部...
      删除功能尾部...
      删除函数...
      设置函数结束
      定义堆栈变量...
      更改堆栈指针...
      重命名寄存器...
      设置函数/项类型...
另参见 编辑子菜单。


 函数窗口

函数窗口

 操作名称: OpenFunctions
将显示程序中所有函数的列表。您可以使用列表查看器命令添加、删除、修改函数。

每个函数都列出了:

        - 函数名称
        - 包含函数的段
        - 段内函数的偏移量
        - 函数长度(以字节为单位)
        - 本地变量保存寄存器的大小(以字节为单位)
        - 传递给函数的参数的大小(以字节为单位)
此窗口的最后一列采用以下格式:
        R - 函数返回给调用方
        F - 远函数
        L - 库函数
        S - 静态函数
        B - 基于 BP 的框架。 IDA 将自动转换所有帧指针 [BP xxx] 操作数
            到堆栈变量。
        T - 函数具有类型信息
        = - 帧指针等于初始堆栈指针
            在本例中，帧指针指向帧的底部
        M - 保留
        S - 保留
        I - 保留
        C - 保留
        D - 保留
        V - 保留
如果函数设置了颜色，则其线条将使用指定的颜色进行着色。 否则，库和 lumina 函数将使用相应的颜色着色。 否则，该线不会着色。

粗体字体用于具有明确(用户指定)原型的函数。此外，一些插件也可能设置此标志。 反编译器按原样获取此类原型，而其他原型仅被视为反编译期间的起点。

可以自动将函数列表与活动反汇编器、伪代码或十六进制视图同步。 为此，右键单击函数列表，然后选择“打开同步”。

另参见 视图|打开子视图子菜单。


 gen_file

gen_file

Generate an output file
     type  - type of output file. One of OFILE_... symbols. See below.
     fp    - the output file handle
     ea1   - start address. For some file types this argument is ignored
     ea2   - end address. For some file types this argument is ignored
     flags - bit combination of GENFLG_...
返回: number of the generated lines.
         -1 if an error occurred
         OFILE_EXE: 0-can't generate exe file, 1-ok

int gen_file(long type, long file_handle, long ea1, long ea2, long flags);
// output file types:
#define OFILE_MAP  0 #define OFILE_EXE  1 #define OFILE_IDC  2 #define OFILE_LST  3 #define OFILE_ASM  4 #define OFILE_DIF  5
// output control flags:
#define GENFLG_MAPSEGS 0x0001          // map: generate map of segments #define GENFLG_MAPNAME 0x0002          // map: include dummy names #define GENFLG_MAPDMNG 0x0004          // map: demangle names #define GENFLG_MAPLOC  0x0008          // map: include local names #define GENFLG_IDCTYPE 0x0008          // idc: gen only information about types #define GENFLG_ASMTYPE 0x0010          // asm&lst: gen information about types too #define GENFLG_GENHTML 0x0020          // asm&lst: generate html (gui version only) #define GENFLG_ASMINC  0x0040          // asm&lst: gen information only about types


 gen_flow_graph

gen_flow_graph

Generate a flow chart GDL file
     outfile - output file name. 将使用 GDL 扩展
     title - 图表标题
     ea1- 范围到流程图的开头
     ea2- 范围到流程图的结束。if ea2 == BADADDR
               then ea1 is treated as an address within a function.
               该函数将绘制流程图。
     flags   - combination of CHART_... constants

success gen_flow_graph(string outfile, string title, long ea1, long ea2, long flags);
#define CHART_PRINT_NAMES 0x1000 // print labels for each block? #define CHART_GEN_GDL     0x4000 // generate .gdl file (file extension is forced to .gdl) #define CHART_WINGRAPH    0x8000 // call wingraph32 to display the graph #define CHART_NOLIBFUNCS  0x0400 // don't include library functions in the graph


 gen_simple_call_chart

gen_simple_call_chart

Generate a function call graph GDL file
     outfile - output file name. 将使用 GDL 扩展
     title - 图表标题
     ea1- 范围到流程图的开头
     ea2- 范围到流程图的结束。if ea2 == BADADDR
               then ea1 is treated as an address within a function.
               该函数将绘制流程图。
     flags   - combination of CHART_GEN_GDL, CHART_WINGRAPH, CHART_NOLIBFUNCS

success gen_simple_call_chart(string outfile, string title, long flags);


 generate_disasm_line

generate_disasm_line

Get disassembly line
     ea - linear address of instruction
     flags - combination of the GENDSM_ flags, or 0
返回: "" - could not decode instruction at the specified location
note: this function may return not exactly the same mnemonics
as you see on the screen.

string generate_disasm_line(long ea, long flags);  // get disassembly line
// flags for generate_disasm_line #define GENDSM_FORCE_CODE 1     // generate a disassembly line as if // there is an instruction at 'ea' #define GENDSM_MULTI_LINE 2     // if the instruction consists of several lines, // produce all of them(useful for parallel instructions)


 get_array_element

get_array_element

get value of array element
     tag     - tag of array, specifies one of two
               array types AR_...
     id      - array id
     idx     - index of an element
返回: value of the specified array element.
         note that this function may return char or long
         result. Unexistent array elements give zero as
         a result.

string or long get_array_element(long tag, long id, long idx);
#define AR_LONG 'A'     // array of longs #define AR_STR  'S'     // array of strings


 get_array_id

get_array_id

get array id by its name
     name - name of existing array.
返回: -1 - no such array
         otherwise returns id of the array

long get_array_id(string name);


 get_bmask_cmt

get_bmask_cmt

get bitmask comment (only for bitfields)
     enum_id - id of enum
     bmask   - bitmask of the constant
     repeatable - type of comment, 0-regular, 1-repeatable
返回: comment attached to bitmask if it exists.
         otherwise returns 0.

long get_bmask_cmt(long enum_id, long bmask, long repeatable);


 get_bmask_name

get_bmask_name

get bitmask name (only for bitfields)
     enum_id - id of enum
     bmask   - bitmask of the constant
返回: name of bitmask if it exists. otherwise returns 0.

long get_bmask_name(long enum_id, long bmask);


 get_bookmark

get_bookmark

get marked position
     slot    - slot number: 0..1023
               if the specifed value is <= 0,
               IDA will ask the user to select slot.
返回: -1 - the slot doesn't contain a marked address
         otherwise returns the marked address

long get_bookmark(long slot);


 get_bookmark_desc

get_bookmark_desc

get marked position comment
     slot    - slot number: 0..1023
返回: 0 if the slot doesn't contain a marked address
         otherwise returns the marked address comment

string get_bookmark_desc(long slot);


 get_bytes

get_bytes

Return the specified number of bytes of the program
      ea - linear address
      size - size of buffer in normal 8-bit bytes
      use_dbg - use debugger memory or just the database
returns: 0-failure
         or a string containing the read bytes

string get_bytes(long ea, long size, long use_dbg);


 get_cmt

get_cmt

获取缩进注释
     ea - 线性地址
     repeatable: 0-常规，!=0-可重复注释

string get_cmt(long ea, long repeatable);


 get_color

get_color

get item color
     ea - address of the item
     what - type of the item (one of COLWHAT... constants)
returns: color code in RGB (hex 0xBBGGRR)

long get_color(long ea, long what);
// color item codes: #define CIC_ITEM 1          // one instruction or data #define CIC_FUNC 2          // function #define CIC_SEGM 3          // segment
#define DEFCOLOR 0xFFFFFFFF     // Default color


 get_curline

get_curline

Get the disassembly line at the cursor

string get_curline();


 get_current_thread

get_current_thread

Get current thread ID
返回: -1 if failure

long get_current_thread(void);


 get_db_byte

get_db_byte

Get one byte (8-bit) of the program at 'ea' from the database
even if the debugger is active.
     ea - linear address
返回: byte value. If the byte has no value then 0xFF is returned.
If the current byte size is different from 8 bits, then the returned value
may have more 1's.
To check if a byte has a value, use is_loaded(ea)

long get_db_byte(long ea);              // get a byte at ea


 get_debug_name

get_debug_name

Get the name assigned to the ea by the debugger module
     ea  - linear address
     how - one of the DEBNAME_ constants

string get_debug_name(long ea, long how);
#define DEBNAME_EXACT 0 // find a name at exactly the specified address #define DEBNAME_LOWER 1 // find a name with the address >= the specified address #define DEBNAME_UPPER 2 // find a name with the address >  the specified address #define DEBNAME_NICE  3 // find a name with the address <= the specified address


 get_debug_name_ea

get_debug_name_ea

Get the address of a symbol created by the debugger module

long get_debug_name_ea(string name);


 get_debugger_event_cond

get_debugger_event_cond

Return the debugger event condition

返回：
string get_debugger_event_cond();


 get_entry

get_entry

检索入口点地址
     ordinal - 入口点编号
               它由 get_entry_ordinal() 返回
返回：-1 如果入口点不存在
         否则，返回入口点地址。
         如果入口点地址等于其序号，则入口点没有序号。

long get_entry(long ordinal);


 get_entry_name

get_entry_name

retrieve entry point name
     ordinal - entry point number
               it is returned by get_entry_ordinal()
返回: entry point name or ""

string get_entry_name(long ordinal);


 get_entry_ordinal

get_entry_ordinal

检索入口点序号
     索引 -0..get_entry_qty()-1
返回：如果入口点不存在，则返回 0
         否则返回入口点序号

long get_entry_ordinal(long index);


 get_entry_qty

get_entry_qty

检索入口点数
返回值：入口点数

long get_entry_qty(void);


 get_enum

get_enum

get enum ID by the name of enum
     name - name of enum
返回: ID of enum or -1 if no such enum exists

long get_enum(string name);


 get_enum_cmt

get_enum_cmt

get comment of enum
     enum_id - ID of enum
     repeatable - 0:get regular comment
                  1:get repeatable comment
返回: comment of enum

string get_enum_cmt(long enum_id, long repeatable);


 get_enum_flag

get_enum_flag

get flag of enum
     enum_id - ID of enum
返回: flags of enum. These flags determine representation
         of numeric constants (binary, octal, decimal, hex)
         in the enum definition. See start of this file for
         more information about flags.
         Returns 0 if enum_id is bad.

long get_enum_flag(long enum_id);


 get_enum_idx

get_enum_idx

get serial number of enum by its ID
     enum_id - ID of enum
返回: (0..get_enum_qty()-1) or -1 if error

long get_enum_idx(long enum_id);


 get_enum_member

get_enum_member

get id of constant
     enum_id - id of enum
     value   - value of constant
     serial  - serial number of the constant in the enumeration.
               See op_enum() for for details.
     bmask   - bitmask of the constant
               ordinary enums accept only -1 as a bitmask
返回: id of constant or -1 if error

long get_enum_member(long enum_id, long value, long serial, long bmask);


 get_enum_member_bmask

get_enum_member_bmask

get bit mask of symbolic constant
     const_id - id of symbolic constant
返回: bitmask of constant or 0
                        ordinary enums have bitmask = -1

long get_enum_member_bmask(long const_id);


 get_enum_member_by_name

get_enum_member_by_name

get member of enum - a symbolic constant ID
     name - name of symbolic constant
返回: ID of constant or -1

long get_enum_member_by_name(string name);


 get_enum_member_cmt

get_enum_member_cmt

get comment of a constant
     const_id   - id of const
     repeatable - 0:get regular comment
                  1:get repeatable comment
返回: comment string

string get_enum_member_cmt(long const_id, long repeatable);


 get_enum_member_enum

get_enum_member_enum

get id of enum by id of constant
     const_id - id of symbolic constant
返回: id of enum the constant belongs to.
                        -1 if const_id is bad.

long get_enum_member_enum(long const_id);


 get_enum_member_name

get_enum_member_name

get name of a constant
arguments: const_id - id of const
返回: name of constant

string get_enum_member_name(long const_id);


 get_enum_member_value

get_enum_member_value

get value of symbolic constant
     const_id - id of symbolic constant
返回: value of constant or 0

long get_enum_member_value(long const_id);


 get_enum_name

get_enum_name

get name of enum
     enum_id - ID of enum
返回: name of enum or empty string

string get_enum_name(long enum_id);


 get_enum_qty

get_enum_qty

get number of enum types
返回: number of enumerations

long get_enum_qty(void);


 get_enum_size

get_enum_size

get size of enum
     enum_id - ID of enum
返回: number of constants in the enum
         Returns 0 if enum_id is bad.

long get_enum_size(long enum_id);


 get_enum_width

get_enum_width

get width of enum elements
     enum_id - ID of enum
返回: size of enum elements in bytes
         (0 if enum_id is bad or the width is unknown).

long get_enum_width(long enum_id);


 get_exception_code

get_exception_code

Get exception code
     idx - number of exception in the vector (0..get_exception_qty()-1)
返回: exception code (0 - error)

long get_exception_code(long idx);


 get_exception_name

get_exception_name

Get exception information
     code - exception code
see also define_exception (definition of exception flags)

string get_exception_name(long code); // returns "" on error long get_exception_flags(long code);  // returns -1 on error


 get_exception_qty

get_exception_qty

Get number of defined exception codes

long get_exception_qty(void);


 get_extra_cmt

get_extra_cmt

Get extra comment line
     ea - linear address
     n  - number of line (0..MAX_ITEM_LINES)
          MAX_ITEM_LINES is defined in IDA.CFG
To get anterior  line #n use (E_PREV + n)
To get posterior line #n use (E_NEXT + n)
Returns number 0 if the comment line does not exit

string get_extra_cmt(long ea, long n);


 get_field_ea

get_field_ea

Get address of the specified field using the type information
     ea         - address of the strcture
     field_name - name of the structure field
If the database contains a structurue at the specified ea and the
type information is present, this function will return the address of the
structure field.

long get_field_ea(long ea, string field_name);
例如:
  .data:00413060 errtable        dd 1   ; oscode
  .data:00413060                 dd 16h ; errnocode

        msg("address is: %x\n", _errtable.errnocode);

prints 413064. The "_errtable.errnocode" expression is essentially a shortcut for:
get_field_ea(get_name_ea_simple("_errtable"), "errnocode")


 get_file_ext

get_file_ext

获取文件名的扩展名

string get_file_ext(string filename);


 get_first_bmask

get_first_bmask

get first bitmask in the enum (bitfield)
     enum_id - id of enum (bitfield)
返回: the smallest bitmask of constant or -1
         no bitmasks are defined yet
         All bitmasks are sorted by their values as unsigned longs.

long get_first_bmask(long enum_id);


 get_first_enum_member

get_first_enum_member

get first constant in the enum
     enum_id - id of enum
     bmask   - bitmask of the constant
               ordinary enums accept only -1 as a bitmask
返回: value of constant or -1 no constants are defined
         All constants are sorted by their values as unsigned longs.

long get_first_enum_member(long enum_id, long bmask);


 get_first_index

get_first_index

get index of the first existing array element
     tag     - tag of array (AR_LONG or AR_STR)
     id      - array id
返回: -1 - array is empty
         otherwise returns index of the first array element

long get_first_index(long tag, long id);


 get_first_member

get_first_member

get offset of the first member of a structure
     id            - structure type ID
返回: -1 if bad structure type ID is passed
         or structure has no members
         otherwise returns offset of the first member.
         注意:IDA 允许结构体成员之间存在 'holes'。它将这些 'holes' 视为未命名的字节数组。
         <b>注意：</b>在 IDA 的内部结构体中，联盟成员位于随后的字节偏移量处： 成员 0 -> 偏移 0x0、
               成员 1 -> 偏移 0x1，等等

long get_first_member(long id);


 get_first_seg

get_first_seg

Get first segment
返回: linear address of the start of the first segment
BADADDR - no segments are defined

long get_first_seg();


 get_first_struc_idx

get_first_struc_idx

get index of first structure type
返回: -1 if no structure type is defined
         index of first structure type.
         Each structure type has an index and ID.
         INDEX determines position of structure definition
          in the list of structure definitions. Index 1
          is listed first, after index 2 and so on.
          The index of a structure type can be changed any
          time, leading to movement of the structure definition
          in the list of structure definitions.
         ID uniquely denotes a structure type. 结构体
          在创建时获取唯一 ID，并且此 ID
          无法更改。Even when the structure type gets
          deleted, its ID won't be resued in the future.

long get_first_struc_idx(void);


 get_fixup_target_dis

get_fixup_target_dis

获取修复目标位移
     ea - 获取相关信息的地址
返回： -1- 在指定地址没有修复
         否则返回修复目标位移

long get_fixup_target_dis(long ea);


 get_fixup_target_flags

get_fixup_target_flags

get fixup target flags
     ea - address to get information about
返回: 0 - no fixup at the specified address
         otherwise returns fixup flags:

long get_fixup_target_flags(long ea);
#define FIXUPF_REL      0x1  // fixup is relative to the linear address #define FIXUPF_EXTDEF   0x2  // target is a location (otherwise - segment) #define FIXUPF_UNUSED   0x4  // fixup is ignored by IDA #define FIXUPF_CREATED  0x8  // fixup was not present in the input file


 get_fixup_target_off

get_fixup_target_off

获取修复目标偏移量
     ea - 获取相关信息的地址
返回： -1- 在指定地址没有修复
         否则返回修复目标偏移量

long get_fixup_target_off(long ea);


 get_fixup_target_sel

get_fixup_target_sel

获取修复目标选择器
     ea - 获取相关信息的地址
返回： -1- 在指定地址没有修复
         否则返回修复目标选择器

long get_fixup_target_sel(long ea);


 get_fixup_target_type

get_fixup_target_type

获取修正目标类型
     ea - 获取相关信息的地址
返回： -1- 在指定地址没有修复
         否则返回修复目标类型 FIXUP_...

long get_fixup_target_type(long ea);
#define FIXUP_MASK      0xF #define FIXUP_BYTE      FIXUP_OFF8 // 8-bit offset. #define FIXUP_OFF8      0       // 8-bit offset. #define FIXUP_OFF16     1       // 16-bit offset. #define FIXUP_SEG16     2       // 16-bit base--logical segment base (selector). #define FIXUP_PTR32     3       // 32-bit long pointer (16-bit base:16-bit // offset). #define FIXUP_OFF32     4       // 32-bit offset. #define FIXUP_PTR48     5       // 48-bit pointer (16-bit base:32-bit offset). #define FIXUP_HI8       6       // high  8 bits of 16bit offset #define FIXUP_HI16      7       // high 16 bits of 32bit offset #define FIXUP_LOW8      8       // low   8 bits of 16bit offset #define FIXUP_LOW16     9       // low  16 bits of 32bit offset #define FIXUP_REL       0x10    // fixup is relative to the linear address // specified in the 3d parameter to set_fixup() #define FIXUP_SELFREL   0x0     // self-relative? //   - disallows the kernel to convert operands //      in the first pass //   - this fixup is used during output // This type of fixups is not used anymore. // Anyway you can use it for commenting purposes // in the loader modules #define FIXUP_EXTDEF    0x20    // target is a location (otherwise - segment) #define FIXUP_UNUSED    0x40    // fixup is ignored by IDA //   - disallows the kernel to convert operands //   - this fixup is not used during output #define FIXUP_CREATED   0x80    // fixup was not present in the input file


 get_flags

get_flags

Get internal flags without MS_VAL and FF_IVL.
     ea - linear address
MS_VAL and FF_IVL may be expensive to retrieve when the debugger is active.
返回：内部标志的 32 位值。请参阅此文件的开头
进行解释。

long get_flags(long ea);


 get_forced_operand

get_forced_operand

获取手动输入的操作数字符串
     ea - 线性地址
     n - 操作数：
             0 - 第一个操作数
             1 - 第二个操作数

string get_forced_operand(long ea, long n);


 get_fpnum

get_fpnum

Get value of a floating point number (4/8 bytes)
     ea - linear address or string that contains float number byte rep
Returns: a floating point number at the specified address.
If the bytes at the specified address cannot be represented as a floating
point number, then return integer value -1.
If the first argument has not long or string type, throw an exception

float get_fpnum(long ea, long size);
// Convenience macros: #define get_float(ea)     get_fpnum(ea, 4) #define get_double(ea)    get_fpnum(ea, 8)


 get_frame_args_size

get_frame_args_size

Get size of arguments in function frame which are purged upon return
     ea - any address belonging to the function
返回: Size of function arguments in bytes.
         如果函数没有帧，则返回 0
         如果函数不存在，则返回 -1

#define get_frame_args_size(ea)  get_func_attr(ea, FUNCATTR_ARGSIZE)


 get_frame_id

get_frame_id

Get ID of function frame structure
     ea - any address belonging to the function
返回: ID of function frame.
         In order to access stack variables you need to use
         structure member manipulation functions with the
         obtained ID.
         -1 if function or function frame does not exist.

#define get_frame_id(ea)  get_func_attr(ea, FUNCATTR_FRAME)


 get_frame_lvar_size

get_frame_lvar_size

Get size of local variables in function frame
     ea - any address belonging to the function
返回: Size of local variables in bytes.
         如果函数没有帧，则返回 0
         如果函数不存在，则返回 -1

#define get_frame_lvar_size(ea)  get_func_attr(ea, FUNCATTR_FRSIZE)


 get_frame_regs_size

get_frame_regs_size

Get size of saved registers in function frame
     ea - any address belonging to the function
返回: Size of saved registers in bytes.
         If the function doesn't have a frame, return 0
         This value is used as offset for BP
         (if FUNC_FRAME is set)
         If the function does't exist, return -1

#define get_frame_regs_size(ea)  get_func_attr(ea, FUNCATTR_FRREGS)


 get_frame_size

get_frame_size

Get full size of function frame
     ea - any address belonging to the function
返回: Size of function frame in bytes.
         This function takes into account size of local
         variables + size of saved registers + size of
         return address + number of purged bytes.
         The purged bytes correspond to the arguments of
         __stdcall functions.
         If the function doesn't have a frame, return size of
         function return address in the stack.
         If the function does't exist, return 0

long get_frame_size(long ea);


 get_full_flags

get_full_flags

Get full internal flags
     ea - linear address
This function returns all bits, including MS_VAL and FF_IVL.
These bits may be expensive to retrieve when the debugger is active.
返回：内部标志的 32 位值。请参阅此文件的开头
进行解释。

long get_full_flags(long ea);


 get_func_attr

get_func_attr

get a function attribute
     ea   - any address belonging to the function
     attr - one of FUNCATTR_... constants
返回: -1 - error
         otherwise returns the attribute value

long get_func_attr(long ea, long attr);
#ifndef __EA64__ #define FUNCATTR_START    0     // readonly: function start address #define FUNCATTR_END      4     // readonly: function end address #define FUNCATTR_FLAGS    8     // function flags #define FUNCATTR_FRAME   16     // readonly: function frame id #define FUNCATTR_FRSIZE  20     // readonly: size of local variables #define FUNCATTR_FRREGS  24     // readonly: size of saved registers area #define FUNCATTR_ARGSIZE 28     // readonly: number of bytes purged from the stack #define FUNCATTR_FPD     32     // frame pointer delta #define FUNCATTR_COLOR   36     // function color code #define FUNCATTR_OWNER   16     // readonly: chunk owner (valid only for tail chunks) #define FUNCATTR_REFQTY  20     // readonly: number of chunk parents (valid only for tail chunks) #else // EA64 #define FUNCATTR_START    0 #define FUNCATTR_END      8 #define FUNCATTR_FLAGS   16 #define FUNCATTR_FRAME   24 #define FUNCATTR_FRSIZE  32 #define FUNCATTR_FRREGS  40 #define FUNCATTR_ARGSIZE 48 #define FUNCATTR_FPD     56 #define FUNCATTR_COLOR   64 #define FUNCATTR_OWNER   24 #define FUNCATTR_REFQTY  32 #endif


 get_func_cmt

get_func_cmt

retrieve function comment
     ea - any address belonging to the function
     repeatable - 1: get repeatable comment
                  0: get regular comment
返回: function comment string

string get_func_cmt(long ea, long repeatable);


 get_func_flags

get_func_flags

retrieve function flags
     ea - any address belonging to the function
返回: -1 - function doesn't exist
         otherwise returns the flags FUNC_...

#define get_func_flags(ea)        get_func_attr(ea, FUNCATTR_FLAGS)
#define FUNC_NORET         0x00000001     // function doesn't return #define FUNC_FAR           0x00000002     // far function #define FUNC_LIB           0x00000004     // library function #define FUNC_STATIC        0x00000008     // static function #define FUNC_FRAME         0x00000010     // function uses frame pointer (BP) #define FUNC_USERFAR       0x00000020     // user has specified far-ness // of the function #define FUNC_HIDDEN        0x00000040     // a hidden function #define FUNC_THUNK         0x00000080     // thunk (jump) function #define FUNC_BOTTOMBP      0x00000100     // BP points to the bottom of the stack frame #define FUNC_NORET_PENDING 0x00000200     // Function 'non-return' analysis // must be performed. This flag is // verified upon func_does_return() #define FUNC_SP_READY      0x00000400     // SP-analysis has been performed // If this flag is on, the stack // change points should not be not // modified anymore. Currently this // analysis is performed only for PC #define FUNC_FUZZY_SP      0x00000800     // Function changes SP in untraceable way, // for example: and esp, 0FFFFFFF0h #define FUNC_PROLOG_OK     0x00001000     // Prolog analysis has be performed // by last SP-analysis #define FUNC_PURGED_OK     0x00004000     // 'argsize' field has been validated. // If this bit is clear and 'argsize' // is 0, then we do not known the real // number of bytes removed from // the stack. This bit is handled // by the processor module. #define FUNC_TAIL          0x00008000     // This is a function tail. // Other bits must be clear // (except FUNC_HIDDEN) #define FUNC_LUMINA        0x00010000     // Function info is provided by Lumina #define FUNC_OUTLINE       0x00020000     // Outlined code, not a real function


 get_func_name

get_func_name

retrieve function name
     ea - any address belonging to the function
返回: 0 - function doesn't exist
         otherwise returns function name

string get_func_name(long ea);


 get_func_off_str

get_func_off_str

convert address to 'funcname+offset' string
     ea - address to convert
返回: if the address belongs to a function then
           return a string formed as 'name+offset'
           where 'name'   is a function name
                 'offset' is offset within the function
         else
           return 0

string get_func_off_str(long ea);


 get_gotea

get_gotea

Get address of Global Offset Table
返回: address of the GOT table
         BADADDR - no GOT address detected

long get_gotea();


 get_idb_path

get_idb_path

Get IDB full path
This function returns full path of the current IDB database

string get_idb_path();


 get_imagebase

get_imagebase

获取输入文件的基址

long get_imagebase();


 get_ip_val

get_ip_val

获取当前线程的 IP(程序计数器)寄存器的值

long get_ip_val();


 get_item_end

get_item_end

Get address of the end of the item (instruction or data)
     ea - linear address
返回: address past end of the item at 'ea'

long get_item_end(long ea);


 get_item_head

get_item_head

Get starting address of the item
     ea - linear address
returns: the starting address of the item
         if the current address is unexplored, returns 'ea'

long get_item_head(long ea);


 get_item_size

get_item_size

Get size of instruction or data item in bytes
     ea - linear address
返回: 1..n

long get_item_size(long ea);


 get_last_bmask

get_last_bmask

get last bitmask in the enum (bitfield)
     enum_id - id of enum
返回: the biggest bitmask or -1 no bitmasks are defined yet
         All bitmasks are sorted by their values as unsigned longs.

long get_last_bmask(long enum_id);


 get_last_enum_member

get_last_enum_member

get last constant in the enum
     enum_id - id of enum
     bmask   - bitmask of the constant
               ordinary enums accept only -1 as a bitmask
返回: value of constant or -1 no constants are defined
         All constants are sorted by their values as unsigned longs.

long get_last_enum_member(long enum_id, long bmask);


 get_last_index

get_last_index

get index of the last existing array element
     tag     - tag of array (AR_LONG or AR_STR)
     id      - array id
返回: -1 - array is empty
         otherwise returns index of the last array element

long get_last_index(long tag, long id);


 get_last_member

get_last_member

get offset of the last member of a structure
     id            - structure type ID
返回: -1 if bad structure type ID is passed
         or structure has no members
         otherwise returns offset of the last member.
         注意:IDA 允许结构体成员之间存在 'holes'。它将这些 'holes' 视为未命名的字节数组。
         <b>注意：</b>在 IDA 的内部结构体中，联盟成员位于随后的字节偏移量处： 成员 0 -> 偏移 0x0、
               成员 1 -> 偏移 0x1，等等

long get_last_member(long id);


 get_last_struc_idx

get_last_struc_idx

get index of last structure type
     none
返回: -1 if no structure type is defined
         index of last structure type.
         参见 get_first_struc_idx() 了解
         结构体索引和 ID。

long get_last_struc_idx(void);


 get_local_tinfo

get_local_tinfo

Retrieve a local type
     ordinal -  slot number (1...NumberOfLocalTypes)
返回: typeinfo object or 0

typeinfo get_local_tinfo(long ordinal);


 get_manual_insn

get_manual_insn

Get manual representation of instruction
     ea   - linear address
This function returns value set by set_manual_insn earlier.

string get_manual_insn(long ea);


 get_member_cmt

get_member_cmt

get comment of a member
     id            - structure type ID
     member_offset - member offset.  偏移量可以是
                     成员中的任何偏移量。例如,
                     是 4 个字节长的成员，并且开始
                     在偏移量 2 处，则 2, 3, 4, 5 表示
                     相同的结构体成员。
     repeatable   - 1: get repeatable comment
                    0: get regular comment
返回: 0 if bad structure type ID is passed
           or no such member in the structure
         otherwise returns comment of the specified member.

string get_member_cmt(long id, long member_offset, long repeatable);


 get_member_flag

get_member_flag

get type of a member
     id            - structure type ID
     member_offset - member offset.  偏移量可以是
                     成员中的任何偏移量。例如,
                     是 4 个字节长的成员，并且开始
                     在偏移量 2 处，则 2, 3, 4, 5 表示
                     相同的结构体成员。
返回: -1 if bad structure type ID is passed
            or no such member in the structure
         otherwise returns type of the member, see bit
         definitions above. If the member type is a structure
         then function get_member_strid() should be used to
         get the structure type id.

long get_member_flag(long id, long member_offset);


 get_member_id

get_member_id

get member id
     id         - structure type ID
     member_offset - member offset. 偏移量可以是
                     成员中的任何偏移量。例如,
                     是 4 个字节长的成员，并且开始
                     在偏移量 2 处，则 2, 3, 4, 5 表示
                     相同的结构体成员。
返回: -1 if bad structure type ID is passed or there is
         no member at the specified offset.
         otherwise returns the member id.

long get_member_id(long id, long member_offset);


 get_member_name

get_member_name

get name of a member of a structure
     id            - structure type ID
     member_offset - member offset.  偏移量可以是
                     成员中的任何偏移量。例如,
                     是 4 个字节长的成员，并且开始
                     在偏移量 2 处，则 2, 3, 4, 5 表示
                     相同的结构体成员。
返回: 0 if bad structure type ID is passed
           or no such member in the structure
         otherwise returns name of the specified member.

string get_member_name(long id, long member_offset);


 get_member_offset

get_member_offset

get offset of a member of a structure by the member name
     id            - structure type ID
     member_name   - name of structure member
返回: -1 if bad structure type ID is passed
         or no such member in the structure
         otherwise returns offset of the specified member.
         NOTE: Union members are, in IDA's internals, located
               at subsequent byte offsets: member 0 -> offset 0x0,
               member 1 -> offset 0x1, etc...

long get_member_offset(long id, string member_name);


 get_member_qty

get_member_qty

get number of members of a structure
     id         - structure type ID
返回: -1 if bad structure type ID is passed
         otherwise returns number of members.

long get_member_qty(long id);


 get_member_size

get_member_size

get size of a member
     id            - structure type ID
     member_offset - member offset.  偏移量可以是
                     成员中的任何偏移量。例如,
                     是 4 个字节长的成员，并且开始
                     在偏移量 2 处，则 2, 3, 4, 5 表示
                     相同的结构体成员。
返回: -1 if bad structure type ID is passed
            or no such member in the structure
         otherwise returns size of the specified member in bytes.

long get_member_size(long id, long member_offset);


 get_member_strid

get_member_strid

get structure id of a member
     id            - structure type ID
     member_offset - member offset.  偏移量可以是
                     成员中的任何偏移量。例如,
                     是 4 个字节长的成员，并且开始
                     在偏移量 2 处，则 2, 3, 4, 5 表示
                     相同的结构体成员。
返回: -1 if bad structure type ID is passed
            or no such member in the structure
         otherwise returns structure id of the member.
         If the current member is not a structure, returns -1.

long get_member_strid(long id, long member_offset);


 get_min_spd_ea

get_min_spd_ea

Return the address with the minimal spd (stack pointer delta)
If there are no SP change points, then return BADADDR.
     func_ea - function start
返回: BADDADDR - no such function

long get_min_spd_ea(func_ea);


 get_module_info

get_module_info

Get a description of the module that contains the given ea
returned objct has attributes:
  "name"      - the full path of the module
  "base"      - module's base address
  "size"      - module size
  "rebase_to" - address the module was rebased to
                BADADDR if module was not rebased at all

object get_module_info(long ea);


 get_name

get_name

Get name at the specified address.
     ea        - linear address
     gtn_flags - how exactly the name should be retrieved.
                 combination of GN_ bits
返回: name

string get_name(long ea, long gtn_flags=0);
// GN_ bits for get_name() function. // There is a convenience function calc_gtn_flags() to calculate the GN_LOCAL flag #define GN_VISIBLE   0x0001     // replace forbidden characters by SUBSTCHAR #define GN_COLORED   0x0002     // return colored name #define GN_DEMANGLED 0x0004     // return demangled name #define GN_STRICT    0x0008     // fail if cannot demangle #define GN_SHORT     0x0010     // use short form of demangled name #define GN_LONG      0x0020     // use long form of demangled name #define GN_LOCAL     0x0040     // try to get local name first; if failed, get global #define GN_ISRET     0x0080     // for dummy names: use retloc #define GN_NOT_ISRET 0x0100     // for dummy names: do not use retloc
// Calculate flags for get_name() function static calc_gtn_flags(from, ea) { return func_contains(from, ea) ? GN_LOCAL : 0; }


 get_name_ea

get_name_ea

Get linear address of a name
     from - the referring address.
            Allows to retrieve local label addresses in functions.
            If a local name is not found, then address of a global name is returned.
     name - name of program byte
返回: address of the name
         BADADDR - no such name
Dummy names (like byte_xxxx where xxxx are hex digits) are parsed by this
function to obtain the address. The database is not consulted for them.

long get_name_ea(long from, string name); #define get_name_ea_simple(name)  get_name_ea(BADADDR, name)


 get_next_bmask

get_next_bmask

get next bitmask in the enum (bitfield)
     enum_id - id of enum
     bmask   - value of the current bitmask
返回: value of a bitmask with value higher than the specified
         value. -1 if no such bitmasks exist.
         所有位掩码都按其值作为无符号长整型进行排序。

long get_next_bmask(long enum_id, long value);


 get_next_enum_member

get_next_enum_member

get next constant in the enum
     enum_id - id of enum
     bmask   - bitmask of the constant
               ordinary enums accept only -1 as a bitmask
     value   - value of the current constant
返回: value of a constant with value higher than the specified
         value. -1 不存在这样的常量。
         所有常量都按其值作为无符号长整型进行排序。

long get_next_enum_member(long enum_id, long value, long bmask);


 get_next_fixup_ea

get_next_fixup_ea

查找下一个地址并包含修正信息
     ea - 当前地址
返回： -1- 不再有修正
         否则返回包含修复信息的下一个地址

long get_next_fixup_ea(long ea);


 get_next_func

get_next_func

find next function
     ea - any address belonging to the function
返回: -1 - no more functions
         otherwise returns the next function start address

long get_next_func(long ea);


 get_next_index

get_next_index

get index of the next existing array element
     tag     - tag of array (AR_LONG or AR_STR)
     id      - array id
     idx     - index of the current element
返回: -1 - no more array elements
         otherwise returns index of the next array element

long get_next_index(long tag, long id, long idx);


 get_next_offset

get_next_offset

get next offset in a structure
     id     - structure type ID
     offset - current offset
返回: -1 if bad structure type ID is passed
         or no (more) offsets in the structure
         otherwise returns next offset in a structure.
         注意:IDA 允许结构体成员之间存在 'holes'。它将这些 'holes' 视为未命名的字节数组。
         此函数返回成员偏移量或孔偏移量。

         It will return size of the structure if input
         'offset' belongs to the last member of the structure.
         <b>注意：</b>在 IDA 的内部结构体中，联盟成员位于随后的字节偏移量处： 成员 0 -> 偏移 0x0、
               成员 1 -> 偏移 0x1，等等

long get_next_offset(long id, long offset);


 get_next_seg

get_next_seg

Get next segment
     ea - linear address
返回: start of the next segment
         BADADDR - no next segment

long get_next_seg(long ea);


 get_next_struc_idx

get_next_struc_idx

get index of next structure type
     current structure index
返回: -1 if no (more) structure type is defined
         index of the next structure type.
         参见 get_first_struc_idx() 了解
         结构体索引和 ID。

long get_next_struc_idx(long index);


 get_nsec_stamp

get_nsec_stamp

get the current timestamp, in nanoseconds.
   Retrieves the high-resolution current timestamp, in nanoseconds.
返回：时间戳，一个 64 位数字。

long get_nsec_stamp();


 get_numbered_type_name

get_numbered_type_name

Retrieve a local type name
     ordinal -  slot number (1...NumberOfLocalTypes)
返回: local type name or ""

string get_numbered_type_name(long ordinal);


 get_operand_type

get_operand_type

获取指令操作数的类型
     ea -  线性指令地址
     n  - 操作数:
             0 - 第一个操作数
             1 - 第二个操作数
返回:
     -1   传递的操作数错误

long get_operand_type(long ea, long n);

#define o_void        0  // No Operand                           ----------
#define o_reg         1  // General Register (al, ax, es, ds...) reg
#define o_mem       2  // Direct Memory Reference  (DATA)      addr
#define o_phrase     3  // Memory Ref [Base Reg + Index Reg]    phrase
#define o_displ       4  // Memory Reg [Base Reg + Index Reg + Displacement] phrase+addr
#define o_imm         5  // Immediate Value                      value
#define o_far         6  // Immediate Far Address  (CODE)        addr
#define o_near        7  // Immediate Near Address (CODE)        addr
#define o_idpspec0    8  // IDP specific type
#define o_idpspec1    9  // IDP specific type
#define o_idpspec2   10  // IDP specific type
#define o_idpspec3   11  // IDP specific type
#define o_idpspec4   12  // IDP specific type
#define o_idpspec5   13  // IDP specific type

// x86
#define o_trreg         o_idpspec0      // trace register
#define o_dbreg         o_idpspec1      // debug register
#define o_crreg         o_idpspec2      // control register
#define o_fpreg         o_idpspec3      // floating point register
#define o_mmxreg        o_idpspec4      // mmx register
#define o_xmmreg        o_idpspec5      // xmm register

// arm
#define o_reglist       o_idpspec1      // Register list (for LDM/STM)
#define o_creglist      o_idpspec2      // Coprocessor register list (for CDP)
#define o_creg          o_idpspec3      // Coprocessor register (for LDC/STC)
#define o_fpreglist     o_idpspec4      // Floating point register list
#define o_text          o_idpspec5      // Arbitrary text stored in the operand
#define o_cond          (o_idpspec5+1)  // ARM condition as an operand

// ppc
#define o_spr           o_idpspec0      // Special purpose register
#define o_twofpr        o_idpspec1      // Two FPRs
#define o_shmbme        o_idpspec2      // SH & MB & ME
#define o_crf           o_idpspec3      // crfield      x.reg
#define o_crb           o_idpspec4      // crbit        x.reg
#define o_dcr           o_idpspec5      // Device control register


 get_operand_value

get_operand_value

Get number used in the operand
This function returns an immediate number used in the operand
     ea - linear address of instruction
     n  - the operand number
The return values are:
     operand is an immediate value  => immediate value
     operand has a displacement     => displacement
     operand is a direct memory ref => memory address
     operand is a register          => register number
     operand is a register phrase   => phrase number
     otherwise                      => -1

long get_operand_value(long ea, long n);


 get_ordinal_qty

get_ordinal_qty

Get number of local types + 1
返回: value >= 1. 1 means that there are no local types.

long get_ordinal_qty(void);


 get_original_byte

get_original_byte

Get original value of program byte
     ea - linear address
返回: the original value of byte before any patch applied to it

long get_original_byte(long ea);


 get_prev_bmask

get_prev_bmask

get prev bitmask in the enum (bitfield)
     enum_id - id of enum
     value   - value of the current bitmask
返回: value of a bitmask with value lower than the specified
         value. -1 no such bitmasks exist.
         所有位掩码都按其值作为无符号长整型进行排序。

long get_prev_bmask(long enum_id, long value);


 get_prev_enum_member

get_prev_enum_member

get prev constant in the enum
     enum_id - id of enum
     bmask   - bitmask of the constant
               ordinary enums accept only -1 as a bitmask
     value   - value of the current constant
返回: value of a constant with value lower than the specified
         value. -1 不存在这样的常量。
         所有常量都按其值作为无符号长整型进行排序。

long get_prev_enum_member(long enum_id, long value, long bmask);


 get_prev_fixup_ea

get_prev_fixup_ea

查找带有修正信息的上一个地址
     ea - 当前地址
返回： -1- 不再有修正
         否则，返回包含修复信息的上一个地址

long get_prev_fixup_ea(long ea);


 get_prev_func

get_prev_func

find previous function
     ea - any address belonging to the function
返回: -1 - no more functions
         otherwise returns the previous function start address

long get_prev_func(long ea);


 get_prev_index

get_prev_index

获取上一个现有数组元素的索引
     tag - 数组的标签(AR_LONG 或 AR_STR)
     id - 数组 ID
     idx - 当前元素的索引
返回： -1- 没有数组元素
         否则返回上一个数组元素的索引

long get_prev_index(long tag, long id, long idx);


 get_prev_offset

get_prev_offset

get previous offset in a structure
     id     - structure type ID
     offset - current offset
返回: -1 if bad structure type ID is passed
         or no (more) offsets in the structure
         otherwise returns previous offset in a structure.
         注意:IDA 允许结构体成员之间存在 'holes'。它将这些 'holes' 视为未命名的字节数组。
         此函数返回成员偏移量或孔偏移量。

         It will return size of the structure if input
         'offset' is bigger than the structure size.
         <b>注意：</b>在 IDA 的内部结构体中，联盟成员位于随后的字节偏移量处： 成员 0 -> 偏移 0x0、
               成员 1 -> 偏移 0x1，等等

long get_prev_offset(long id, long offset);


 get_prev_struc_idx

get_prev_struc_idx

get index of previous structure type
     current structure index
返回: -1 if no (more) structure type is defined
         index of the presiouvs structure type.
         参见 get_first_struc_idx() 了解
         结构体索引和 ID。

long get_prev_struc_idx(long index);


 get_processes

get_processes

Take a snapshot of running processes and return their description.
返回: the object with the attributes:
"size" - number of processes
"0", "1", "2", ... up to the number of processes - 1
       - contains object which describes the process with the attributes:
         "pid"  - PID
         "name" - process name, usually executable name prefixed
                  with the process bitness

object get_processes(void);
For example, to get the name of the 5th process:
  extern fifth_name;
  fifth_name = get_processes()[4].name


 get_processor_name

get_processor_name

Get name of the current processor
返回: processor name

string get_processor_name(void);


 get_qword

get_qword

Get value of program quadro word (8 bytes)
     ea - linear address
返回: the value of the quadro word. If failed, throws an exception

long get_qword(long ea); #define qword(ea) get_qword(ea)


 get_reg_value

get_reg_value

get register value
     name - the register name
the debugger should be running. otherwise the function fails
the register name should be valid.
It is not necessary to use this function to get register values
because a register name in the script will do too.
返回: register value (integer or floating point)
Thread-safe function (may be called only from the main thread and debthread)

number get_reg_value(string name);


 get_root_filename

get_root_filename

Get input file name
This function returns name of the file being disassembled

string get_root_filename();             // only the file name string get_input_file_path();           // full path


 get_screen_ea

get_screen_ea

Get linear address of cursor

long get_screen_ea();
#define here  get_screen_ea()


 get_segm_attr

get_segm_attr

get segment attribute
      arguments:      segea - any address within segment
                      attr  - one of SEGATTR_... (see set_segm_attr()) constants

long get_segm_attr(long segea, long attr);


 get_segm_by_sel

get_segm_by_sel

Get segment by segment base
     base - segment base paragraph or selector
返回: linear address of the start of the segment
         BADADDR - no such segment

long get_segm_by_sel(long base);


 get_segm_end

get_segm_end

Get end address of a segment
     ea - any address in the segment
返回: end of segment (an address past end of the segment)
         BADADDR - the specified address doesn't belong to any segment
Note: it is a macro

#define get_segm_end(ea)    get_segm_attr(ea, SEGATTR_END)


 get_segm_name

get_segm_name

Get name of a segment
     ea - any address in the segment
  flags - 0-name as is;1-substitute invalid chars with _
返回: segment name, 0 - no segment at the specified address

string get_segm_name(long ea, long flags=0);


 get_segm_start

get_segm_start

Get start address of a segment
     ea - any address in the segment
返回: start of segment
         BADADDR - the specified address doesn't belong to any segment
Note: it is a macro

#define get_segm_start(ea)  get_segm_attr(ea, SEGATTR_START)


 get_source_linnum

get_source_linnum

get source line number
     ea      - linear address
返回: number of line in the source file or -1

long get_source_linnum(long ea);


 get_sourcefile

get_sourcefile

Get name of source file occupying the given address
     ea - linear address
返回: NULL - source file information is not found
         otherwise returns pointer to file name

string get_sourcefile(long ea);


 get_sp_delta

get_sp_delta

Get modification of SP made by the instruction
     ea      - end address of the instruction
               i.e. the last address of the instruction+1
返回: Get modification of SP made at the specified location
         If the specified location doesn't contain a SP
         change point, return 0
         Otherwise return delta of SP modification

long get_sp_delta(long ea);


 get_spd

get_spd

Get current delta for the stack pointer
     ea      - end address of the instruction
               i.e. the last address of the instruction+1
返回: The difference between the original SP upon
         entering the function and SP for the specified address

long get_spd(long ea);


 get_sreg

get_sreg

Get value of segment register at the specified address
     ea - linear address
     reg - name of segment register
返回: the value of the segment register. The segment registers in
32bit program usually contain selectors, so to get paragraph pointed by
the segment register you need to call sel2para() function.

long get_sreg(long ea, string reg);


 get_str_type

get_str_type

Get string type
     ea - linear address
Returns one of STRTYPE_... constants

long get_str_type(long ea);

// Character-terminated string. The termination characters are kept in // the next bytes of string type.
#define STRTYPE_TERMCHR   (STRWIDTH_1B|STRLYT_TERMCHR<<STRLYT_SHIFT)
// C-style string.
#define STRTYPE_C         STRTYPE_TERMCHR
// Zero-terminated 16bit chars #define STRTYPE_C_16      (STRWIDTH_2B|STRLYT_TERMCHR<<STRLYT_SHIFT)
// Zero-terminated 32bit chars
#define STRTYPE_C_32      (STRWIDTH_4B|STRLYT_TERMCHR<<STRLYT_SHIFT)
// Pascal-style, one-byte length prefix
#define STRTYPE_PASCAL    (STRWIDTH_1B|STRLYT_PASCAL1<<STRLYT_SHIFT)
// Pascal-style, 16bit chars, one-byte length prefix
#define STRTYPE_PASCAL_16 (STRWIDTH_2B|STRLYT_PASCAL1<<STRLYT_SHIFT)
// Pascal-style, two-byte length prefix
#define STRTYPE_LEN2      (STRWIDTH_1B|STRLYT_PASCAL2<<STRLYT_SHIFT)
// Pascal-style, 16bit chars, two-byte length prefix
#define STRTYPE_LEN2_16   (STRWIDTH_2B|STRLYT_PASCAL2<<STRLYT_SHIFT)
// Pascal-style, two-byte length prefix
#define STRTYPE_LEN4      (STRWIDTH_1B|STRLYT_PASCAL4<<STRLYT_SHIFT)
// Pascal-style, 16bit chars, two-byte length prefix
#define STRTYPE_LEN4_16   (STRWIDTH_2B|STRLYT_PASCAL4<<STRLYT_SHIFT)

#define         STRTERM1(strtype)       ((strtype>>8)&0xFF)
                      // 3d byte:
#define         STRTERM2(strtype)       ((strtype>>16)&0xFF)
                      // The termination characters are kept in
                      // the 2nd and 3d bytes of string type
                      // if the second termination character is
                      // '\0', then it is ignored.


 get_strlit_contents

get_strlit_contents

获取字符串内容
     ea   - 线性地址
     len  - 字符串长度。 -1 是指计算最大字符串长度
     type - 字符串类型 (STRTYPE_...常量之一)
返回: 字符串内容或空字符串

string get_strlit_contents(long ea, long len, long type);


 get_struc_by_idx

get_struc_by_idx

get structure ID by structure index
     structure index
返回: -1 if bad structure index is passed
         otherwise returns structure ID.
         参见 get_first_struc_idx() 了解
         结构体索引和 ID。

long get_struc_by_idx(long index);


 get_struc_cmt

get_struc_cmt

get structure type comment
     id         - structure type ID
     repeatable - 1: get repeatable comment
                  0: get regular comment
返回: 0 if bad structure type ID is passed
         otherwise returns comment.

string get_struc_cmt(long id, long repeatable);


 get_struc_id

get_struc_id

get structure ID by structure name
     structure type name
返回: -1 if bad structure type name is passed
         otherwise returns structure ID.

long get_struc_id(string name);


 get_struc_idx

get_struc_idx

get structure index by structure ID
     structure ID
返回: -1 if bad structure ID is passed
         otherwise returns structure index.
         参见 get_first_struc_idx() 了解
         结构体索引和 ID。

long get_struc_idx(long id);


 get_struc_name

get_struc_name

get structure type name
     structure type ID
返回: -1 if bad structure type ID is passed
         otherwise returns structure type name.

string get_struc_name(long id);


 get_struc_qty

get_struc_qty

get number of defined structure types
返回: number of structure types

long get_struc_qty(void);


 get_struc_size

get_struc_size

get size of a structure
     id         - structure type ID
返回: 0 if bad structure type ID is passed
         otherwise returns size of structure in bytes.

long get_struc_size(long id);


 get_thread_qty

get_thread_qty

Get number of threads.

long get_thread_qty(void);


 get_tinfo

get_tinfo

获取函数/变量的类型信息作为 'typeinfo' 对象
     ea - 对象的地址
     type_name - 命名类型的名称
返回： TypeInfo Object， 0- 失败
typeinfo 对象有一个必需属性：typid

typeinfo get_tinfo(long ea); typeinfo get_tinfo(string type_name);


 get_type

get_type

Get type of function/variable
     ea - the address of the object
返回: type string, 0 - failed

string get_type(long ea);


 get_wide_byte

get_wide_byte

Get one wide byte of the program at 'ea'.
     ea - linear address
返回: value of byte. If byte has no value then returns 0xFF
Some processors may access more than 8bit quantity at an address.
从 IDA 的角度来看，这些处理器具有 32 位字节组织。
To check if a byte has a value, use is_loaded(ea).

long get_wide_byte(long ea); #define byte(ea) get_wide_byte(ea)


 get_wide_dword

get_wide_dword

Get value of program double word (4 bytes)
     ea - linear address
返回: the value of the double word. 失败时引发异常。

long get_wide_dword(long ea); #define dword(ea) get_wide_dword(ea)


 get_wide_word

get_wide_word

Get one wide word (2 'byte') of the program at 'ea'.
     ea - linear address
返回: the value of the word. If word has no value then returns 0xFFFF
Some processors may access more than 8bit quantity at an address.
从 IDA 的角度来看，这些处理器具有 32 位字节组织。
此函数考虑了 inf.is_be() 中指定的字节顺序

long get_wide_word(long ea); #define word(ea) get_wide_word(ea)


 getattr

getattr

获取对象属性
     self - 对象
     attr - 属性名称
此函数在不调用 __getattr__() 的情况下获取属性值
线程安全函数。

any getattr(object self, string attr);


 getn_enum

getn_enum

get ID of the specified enum by its serial number
     idx - number of enum (0..get_enum_qty()-1)
返回: ID of enum or -1 if error

long getn_enum(long idx);


 getn_thread

getn_thread

Get the ID of a thread
     idx - number of thread, is in range 0..get_thread_qty()-1
返回: -1 if failure

long getn_thread(long idx);


 getn_thread_name

getn_thread_name

Get the NAME of a thread
     idx - number of thread, is in range 0..get_thread_qty()-1
           or -1 for the current thread
返回: required info

string getn_thread_name(long idx);


 给定位置名称

给定位置名称

 操作名称: MakeName
此命令为当前项目提供名称/重命名/删除 名称。

要删除名称，只需提供一个空名称即可。

如果引用了当前项目，则无法删除其名称。 即使您尝试，IDA 也会生成一个 虚拟 名称。

本地名称

  该名称被认为仅在当前函数中定义。
  请注意，IDA 不会检查整个程序中
  本地名称的唯一性。但是，它确实验证该名称对于该函数来说
  是唯一的。
包含在名称列表中
  在这里，您还可以从名称列表中包含/删除名称。
  如果名称被隐藏，您将不会在 名称窗口中看到它。
公共名称
  您可以将名称声明为公共(全局)名称。 如果当前
  汇编程序支持 "public" 指令，IDA 会用到它。
  否则，该名称的公共性将显示为注释。
自动生成的名称
  自动生成的名称将以不同的颜色显示。
  如果项目未定义，它将自动消失。
弱名称
  您可以将名称声明为弱名称。 如果当前
  汇编程序支持 "weak" 指令，IDA 会用到它。
  否则，名称的弱项将显示为注释。
始终创建名称
  如果此标志处于打开状态，并且指定的名称已存在，
  IDA 将尝试通过向指定名称附加后缀来改变其。
另参见
         编辑子菜单。
         如何输入标识符。
         名称表示。


 图表颜色

图表颜色
图形边缘可以有多种颜色。 在图表视图中：
 - 蓝色：正常边缘
 - 绿色：如果发生跳转(满足其条件)
 - 红色：如果未发生跳转
 - 闪烁：在调试器中时，将跟踪的边缘闪烁
而且，在邻近视图中:
 - 蓝色：代码交叉引用边缘
 - 灰色：数据交叉引用边缘
IDA 加亮显示当前鼠标项。 如果鼠标悬停在边缘上，则会加亮显示该边缘。 如果将鼠标悬停在节点上，则所有相邻的边缘都会加亮显示。 要关闭加亮显示，请将“当前边缘”颜色指定为未定义的自定义颜色。

尚未使用“加亮显示的边缘”和“外部节点”颜色。

返回到 图表视图 或 邻近视图


 图表节点组

图表节点组
可以将任意数量的节点折叠到单个合成节点中。此类合成节点包含用户提供的文本，而不是正常的反汇编列表。如果有选定的节点，则可以从右键单击菜单中使用“group”命令。

甚至可以使用单个节点来创建组。此功能可用于将大型节点折叠为可管理的内容，或隐藏由一个节点组成的组。

创建组后，IDA 会自动刷新图表布局。如果存在自定义布局，则不会将其应用于缩减图表。但是，现有的自定义布局不会被销毁，一旦用户通过删除组或取消折叠组切换到完整图表，就会重新使用。

节点组可以嵌套：合成节点可用于创建其他组。此功能允许将图表简化为单个节点。每个节点一次只能属于一个组。

可以展开组以显示原始节点内容。当前未折叠组(带有鼠标指针的组)的节点帧以特殊颜色显示。默认组帧颜色为黄色。这样，可以通过将鼠标悬停在图表节点上来可视化现有的未折叠组。

还有一些命令可以折叠和取消折叠图表中的所有组。它们可从右键单击菜单中获得。

要编辑合成节点的内容，请使用节点标题上的“设置节点文本”按钮。也可以使用“rename”命令。

IDA 会自动记住每个函数的图表组及其状态。

返回到 图表视图


 图表选项

图表选项
Use graph view by default
        IDA switches to graph mode for each 'jump' command.
Enable graph animation
        Animate the graph layout, movement, and group collapsing/uncollapsing.
        While animation takes time, it gives the user some idea what's going on.
Draw node shadows
        Display shadows for each graph node. Shadows are not displayed
        for really huge or ridiculously small nodes.
Auto fit graph into window
        Zoom the graph so that it occupies the whole window.
Fit window max zoom level 100%
        The 'fit window' command maximal zoom level is 100%.
Re-layout graph if nodes overlap
        IDA recomputes the graph layout if a node overlap is detected.
        The presence of a custom layout (if the user has displaced
        some graph nodes) effectively turns off this option.
Re-layout graph uopn screen refresh
        IDA recomputes the graph layout at each screen refresh.
        Turning this option off accelerates IDA but then
        a manual layout might be required after some operations.
Truncate at the right margin
        All nodes at truncated at the right margin. The right margin
        is specified in the Options, General, Disassembly tab.
        This option narrows the graph but hides some information
        by truncating long lines.
Lock graph layout
        Locks the graph layout by ignoring attempts to displace
        nodes. This prevents the creation of custom layouts that might lead
        to ugly graph layouts when nodes change their sizes.
PROXIMITY VIEW

Show data references

        在邻近视图中显示数据交叉引用项。
Hide library functions
        Do not show data or code cross-references to library functions,
        only show cross-referenced local functions.
Unlimited children recursion
        Recurse until there are no more callees (children) of the currently
        selected central node and all of his children.
Recurse into library functions
        Displays children data or code cross-references from library
        functions.
Max parents recursion
        Maximum recursion level for displaying parents of the currently
        selected central node. The value '0' disables parents recursion.
Max children recursion
        Maximum recursion level for displaying children of the currently
        selected central node. The value '0' means no maximum recursion
        level.
Max nodes per level
        Maximum number of nodes to show per level of children and parents.
返回到 图表视图 或 邻近视图


 图表概览窗口

图表概览窗口
IDA has a small 图表概览窗口. 它以缩小形式显示整个图表，并让用户了解图表的哪一部分在主窗口中可视化。

Clicking on the 图表概览窗口 visualizes different parts of the graph in the main window. 也可以单击并拖动焦点框 - 主窗口将相应地刷新。

图表概览窗口仅在图表视图节点中可见。一旦另一个非模态窗口获得焦点，图表概览就会关闭。It 自动 opens when a 图表视图 is activated.

默认情况下显示图表概览。要隐藏它，请右键单击主工具栏背景，然后选择导航、图表概述菜单项。

The 图表概览窗口 can be resized to accommodate really huge 图表.

返回到 图表视图 或 邻近视图


 图表视图

图表视图
在图表视图中，当前函数表示为与边链接在一起的节点集合。节点表示基本块，边缘表示它们之间的代码交叉引用。

图表视图中仅显示代码项，隐藏数据项。要显示它们，请按空格键切换到文本模式。图表视图可用于属于函数的指令。如果当前项目无法以图表模式显示，IDA 会自动切换到文本模式。它还会显示一个警告，我们建议你在熟悉该概念后立即隐藏该警告。

空格键可用于在图表视图和文本视图之间切换。

请选择以下主题之一以了解有关图表的更多信息：


 图表子菜单

图表子菜单
以下是绘制各种图表的命令：

  显示函数流程图
  显示函数调用图表
  显示地址的交叉引用图表
  显示交叉引用自地址的图表
  显示自定义交叉引用图表
IDA 使用外部程序来显示图形。程序名称为 wingraph32.exe，位于当前目录中。

用户可以使用 IDA.CFG 文件中的 GRAPH_VISUALIZER 参数更改此程序的名称 。

用户可以缩放图表并在窗口中移动它。

另参见 视图子菜单。


 guess_type

guess_type

Guess type of function/variable
     ea - the address of the object.
          can be the structure member id too
返回: type string, 0 - failed

string guess_type(long ea);


 has_value

has_value

Do flags contain byte value? (i.e. has the byte a value?)
if not, the byte is uninitialized.

#define has_value(F)   ((F & FF_IVL) != 0)     // any defined value?


 hasattr

hasattr

对象属性是否存在？
     self - 对象
     attr - 属性名称
线程安全函数。

success hasattr(object self, string attr);


 Hashes

Hashes

associative arrays (the same as hashes in Perl)
to create a hash, use create_array() function
you can use the following function with hashes:
     get_array_id(), rename_array(), delete_array()
The following additional functions are defined:

success set_hash_long(long id, string idx, long value); success set_hash_string(long id, string idx, string value); long    get_hash_long(long id, string idx); string  get_hash_string(long id, string idx); success del_hash_string(long id, string idx); string  get_first_hash_key(long id); string  get_next_hash_key(long id, string idx); string  get_last_hash_key(long id); string  get_prev_hash_key(long id, string idx);


 隐藏范围

隐藏范围

// ----------------------------------------------------------------------------
//                           H I D D E N  A R E A S
// ----------------------------------------------------------------------------

// Hidden ranges - address ranges which can be replaced by their descriptions
// hide a range //       start, end  - range boundaries //       description - description to display if the range is collapsed //       header      - header lines to display if the range is expanded //       footer      - footer lines to display if the range is expanded //       visible     - the range state //       color       - RGB color code (-1 means default color) //  返回: !=0 - ok
success add_hidden_range(long start, long end, string description, string header, string footer, long color);
// set hidden range state //       ea      - any address belonging to the hidden range //       visible - new state of the range //  返回: !=0 - ok
success update_hidden_range(long ea, long visible);
// delete a hidden range //       ea - any address belonging to the hidden range //  返回: !=0 - ok
success del_hidden_range(long ea);


 隐藏

隐藏

 操作名称：Hide
此命令允许你隐藏反汇编的一部分。你可以隐藏函数、段或创建特殊的隐藏范围。

如果指定了某个范围，则会在此范围上创建一个特殊的隐藏范围。

如果光标位于段开头的段名称上，则该段将被隐藏。IDA 将仅显示隐藏段的标题。

如果光标位于结构体变量上，并且目标汇编程序具有“可以显示简洁结构体或 INFFL_ALLASM”位，则该结构体将折叠成一行并以简洁的形式显示。

否则，当前函数将被隐藏。IDA 将仅显示隐藏函数的标头。

如果没有当前函数，则 IDA 将发出哔哔声。

如果你想在屏幕上看到隐藏的项目，你可以使用取消隐藏命令或启用显示隐藏项。如果要删除以前创建的隐藏范围，可以使用 del hidden range 命令。

另参见 编辑|视图子菜单


 隐藏全部项

隐藏全部项

 操作名称: HideAll
此命令允许你隐藏：
  - 在反汇编窗口中调用的所有函数和隐藏范围
  - 在结构体窗口中调用的所有结构体
  - 在枚举窗口中调用的所有枚举
IDA 将仅显示隐藏项的标题。

如果要在屏幕上查看隐藏项，可以使用取消隐藏命令或启用隐藏项的显示。

另参见 取消隐藏所有命令。

另参见 编辑|视图子菜单


 隐藏/取消隐藏边框

隐藏/取消隐藏边框

 操作名称: ToggleBorder
此命令允许你隐藏一个细边框，类似于 IDA 在指令和数据之间自动生成的边框。如果边框已隐藏，则会再次显示。

请注意，你可以在 注释对话框中一次隐藏所有边框。

另参见 编辑|其他子菜单


 高亮显示标识符

高亮显示标识符
在图表版本中，IDA 高亮显示光标下的标识符。例如，如果光标位于 "EAX" 寄存器上，则所有出现的 "EAX" 都将以黄色背景显示。此功能旨在通过加亮显示反汇编的有趣部分，来简化程序分析。例如，如果用户想要查看对 "EAX" 的所有引用，他只需单击屏幕上的任何 "EAX"，所有这些引用都会被加亮显示。

通过按上、下、左、右键或简单地单击标识符进行选择。

按 PageUp、PageDown、Home、End 键、使用滚动条或按 Alt-Up、Alt-Down、Ctrl-Up、Ctrl-Down 键不会更改选择。

Alt-Up 和 Alt-Down 键分别向后或向前执行对当前选定标识符的搜索。

Ctrl-Up 和 Ctrl-Down 键滚动反汇编文本。

IDA 不会加亮显示行前缀处的段名称，因为它不是很有用。

可以关闭高亮显示。相应的复选框位于 选项、常规、浏览器 选项卡中。


 如何输入数字

如何输入数字
你可以输入任何带有常量的“C”表达式。长算术将用于计算。

在这些表达式中，可以使用在程序中创建的所有名称。


 如何输入段值

如何输入段值
你必须以十六进制数或段名称的形式输入段基值。如果你输入无效的细分，IDA 将向你发出警告。

你也可以输入段寄存器名称。


 如何输入地址

如何输入地址
输入的地址应为十六进制数字或位置名称。当你以十六进制格式输入地址时，你可以省略地址的段部分，并将使用当前段。超出程序限制的地址无效。

此外，你还可以输入带有位移的位置名称：

        name+5
最后，你可以指定一个相对地址：
        +10             再增加 0x10 字节
         -5               向后 5 个字节
如果输入的字符串无法识别为十六进制数或位置名称，IDA 将尝试使用当前脚本解释器将其解释为表达式。默认解释器是 IDC。

特别地址：

        $ - 当前位置(取决于当前汇编程序)
示例：
        456          当前段，偏移 0x456
        5E            当前段，偏移 0x5E
        3000:34     段 0x3000，偏移 0x34
        ds:67         段由 ds 指向，偏移 0x67
        0:4000000     线性地址  0x4000000
        使用名称 'start' 启动位置


 如何输入标识符

如何输入标识符
标识符是以字母开头且仅包含字母和数字的名称。允许的字符列表在配置文件 IDA.CFG 中指定。所有名称都区分大小写。

配置文件中也指定了名称的最大长度：

        MAX_NAME_LENGTH=120     // 新名称的最大长度
默认值为 120。

有些汇编程序的名称长度限制较短，请注意！

如果你输入非法名称，IDA 会警告你。


 如何输入文本

如何输入文本

 在 IDA 的文本版本中，您可以使用以下键:

 Enter          开始新行
 Ctrl-Enter    完成输入
 Esc        取消输入
 F1        提供 一些帮助

                                        Shift-<arrow>  Select
 Ctrl-L         Search Again            Shift-Ins       Paste
 Ctrl-O         Indent Mode             Shift-Del       Cut
 Ctrl-T         Delete Word             Ctrl-Ins        Copy
 Ctrl-U         Undo                    Ctrl-Del        Clear
 Ctrl-Y         Delete Line             Ctrl-K B        Start Select
 Ctrl-Left      Word Left               Ctrl-K H        Hide Select
 Ctrl-Right     Word Right
 Ctrl-PgUp      Text Start              Ctrl-Q A        Replace
 Ctrl-PgDn      Text End                Ctrl-Q F        Search
                                        Ctrl-Q H        Delete Line Start
                                        Ctrl-Q Y        Delete Line End
仅包含空格的输入等于空输入。

不要忘记也可以使用剪贴板。


 如何移动/调整窗口大小

如何移动/调整窗口大小
键盘：

箭头、Home、End、PgUp、PgDn 可移动窗口。 所有带 Shift 的按键都会调整窗口大小。 Ctrl 键与其他键的组合键更快地移动/缩放窗口

鼠标：

移动：

调整大小：


 如何在 IDA 中使用列表查看器

如何在 IDA 中使用列表查看器
The following commands work in the list viewers:

1. All usual movement keys: PgUp,PgDn,Home,End and arrows.

2. It is possible to position to a line simply by typing in the desired line number.

3. It is possible to position on a line by typing in its beginning. In this case the user can use: Backspace key to erase the last character typed in. Ctrl-Enter to find another line with the same prefix. Please note that List Viewer ignores the prefix of a line up to the last backslash (\\) or slash (/) if it exists.

4. Alt-T search for a substring (case-insensitive) Ctrl-T repeat last search

5. If the list is not in dialog mode, you can use the following keys: Enter jump to the selected item in the last IDA View window Ctrl-E edit the current item Del delete the current item Ins insert a new item Ctrl-U refresh information in the window

6. Quick filtering is available using Ctrl-F. More complex filters can be defined with a right click (only the GUI mode).

7. The list can be sorted by any column by clicking on it. Please note that maintaining a frequently modified list sorted can be very time consuming, so try not to sort non-modal lists during the initial analysis. (sorting is available only in the GUI mode).

8. 右键单击可能会显示列表查看器的其他功能。

Esc or Enter close modal list viewers.


 如何使用帮助子系统

如何使用帮助子系统
The following keys exist: F1 this screen Shift-F1 help index Ctrl-F1 IDC index Tab next highlighted phrase Shift-Tab prev highlighted phrase Enter follow a link Backspace previous help screen F5 zoom help window Esc close help window
  箭头        移动一步
  PgUp          向上翻页
  PgDn          向下翻页
  Ctrl-PgUp     窗口顶部
  Ctrl-PgDn     窗口底部
  Home          行开始
  End           行的逻辑结尾


 IDA 地址空间概念

IDA 地址空间概念
Internally, IDA has 32-bit linear address space (IDA64 uses 64-bit address space). The internal addresses are called "linear addresses". The input program is loaded into this linear address space.

Please note that usually the linear addresses are not used in the program directly. During disassembling, we use so-called "virtual addresses", which are calculated by the following formula:

        VirtualAddress = LinearAddress - (SegmentBase << 4);
We see that the SegmentBase determines what addresses will be displayed on the screen. More than that, IDA allows to create several segments with the same virtual address in them. For this, you just need to create segments with correct segment base values.

Normally a SegmentBase is a 16bit quantity. To create a segment with base >= 0x10000, you need to use selectors. However, if you try to create a segment with a segment base >= 0x10000, IDA will automatically choose appropriately a free selector and setup for the new segment.

All SegmentBases are looked up in the selector table.

IDA 中有一些地址限制。

There is a range of addresses that are used for internal housekeeping. This range can be specified by the configuration variable PRIVRANGE (start address and size). It is not recommended to use these addresses for other purposes.

There is also one address which must never be used in the disassembly. It is the 'all ones' address, or -1. Internally, it is used as a BADADDR (bad address). No address or address range can include BADADDR.

 Click here to see an example of segment creation
 (simple case - IBM PC)

 Click here to see an example of segment creation
 (simple case - Z80)

 Click here to see another example of segment creation
 (automatically chosen selector)

 Click here to see another example of segment creation
 (user-defined selector)
另参见 How to change segment translation


 IDA 查看书签

IDA 查看书签
参见: 选择标记位置


 IDAClang 插件

IDAClang 插件
IDAClang 插件随 IDA 一起提供，它提供了使用加载 C 标头 操作解析包含任意复杂 C/C++/Objective-C 源代码的头文件的功能。

To enable the IDAClang parser, go to Options>Compiler>Source parser, and select "clang". 然后使用“文件>加载文件>解析 C 头文件”对给定的源文件调用解析器。

Since IDAClang is based on the third-party libclang parser, it can only parse standalone source files that contain valid C/C++/Objective-C syntax.

另参见 Load C header command.


 idadir

idadir

Get IDA directory
This function returns the directory where IDA.EXE resides

string idadir();


 IDC: 类

IDC: 类
类可以以下列方式声明：
  class name
  {
    method1(...) {}
    ...
  };
在类中，方法函数被声明为不带 'static' 关键字。带类名称的方法是类的构造函数。例如：
  class myclass
  {
     myclass(x,y)
     {
       print("myclass constructor has been called with two arguments: ", x, y);
       this.x = x;
       this.y = x;
     }
     ~myclass()
     {
       print("destructor has been called: ", this);
     }
  };
在类方法中， 'this' 变量可用于引用当前对象。

每个类只允许有一个构造函数。

类实例的创建方式如下：

  o = myclass(1, 2);
对象属性(或字段)的访问方式如下：
  print(o.x);
  o.y = o.x + 1;
分配新属性后会创建一个新属性：
  o.new_attr = 1;
访问不存在的属性会生成异常，该异常可以被捕获。

存在以下特殊方法名称：

  __setattr__(attr, value)
    当为对象属性分配新值时，将调用此方法。
    此方法可以执行其他操作，而不是分配值。
    要从此方法修改类属性，请使用 setattr()
    全局函数。
    比较使用：Python _setattr_ 方法

  __getattr__(attr)
    当访问对象属性进行读取时，将调用此方法。
    Instead of simply returning a value, this method can do something else,
    for example to calculate the attribute on the fly. To retrieve a
    attribute from this function, use the getattr() global function.
    比较使用: Python _getattr_ 方法
Simple class inheritance is support. Derived classed are declared like this:
  class derived : base
  {
    ...
  };
Here we declare the 'derived' class that is derived from the 'base' class. For derived classes, the base class constructor can be called explicitly:
  class derived : base
  {
    derived() : base(args...)
    {
    }
  };
If the base class constructor is not called explicitly, IDA will call it implicitly, without any arguments.

It is possible to call base class methods using full names:

    base::func(this, args...);
The 'this' argument must be passed explicitly in this case.

When there are no more references to an object, it is automatically destroyed. We use a simple reference count algorithm to track the object use. Circularly dependent objects are not detected: they are never destroyed.

The following built-in object classes exist:

  - object: the default base class for all new classes. When the base class
    is not specified, the new class will inherit from 'object'
    This class has no fields and no special constructor. It has the following
    methods:

     void object.store(typeinfo, ea, flags)
     void object.retrieve(typeinfo, ea, flags)

  - exception: class used to report exceptions. 它具有以下属性：

    file - 发生异常的源文件名
    func - 当前函数名称
    line - 行号
    pc - 程序计数器值 (idc 内部)

    运行时错误也会报告为异常。 它们是另外两个字段：

    qerrno      - 运行时错误代码
    description - 可打印的错误说明

    此类没有特殊的构造函数，也没有方法。

  - typeinfo：用于表示类型信息的类。 它具有以下属性：

    type  - 二进制编码类型字符串
    fields - 类型的字段名称(例如结构体成员名称)
    name -(可选)变量/函数名称

    Human readable form of the typeinfo can be obtained by calling the
    print() method. The type size can be calculated
    using the size() method.

  - loader_input_t: class to read files.


 IDC: 常量

IDC: 常量
IDC 中可以使用以下常量：
 - 长数字 (32 位版本的 IDA 为 32 位，64 位版本的 IDA 为 64 位)

    12345 - 十进制常量
    0x444 - 十六进制常量
    01236 - 八进制常数
    0b110 - 二进制常量
    'c'   - 字符常量

  任何数值常量都可以有“u”和“l”后缀，它们将被忽略。

 - 64 位数字。 若要声明 64 位常量，请使用“ i64 ”后缀：

   123i64

   此外，如果一个常量不适合 32 位，它将自动
   存储为 64 位常量。

 - 字符串。 字符串使用双引号声明。反斜杠
   字符可以用作转义：

   "string"
   "string\nwith four embedded \x0\x00\000\0 zeroes"

   一行中的多个字符串常量将自动连接：

   "this" " is" " one " "string"


 IDC: 异常

IDC: 异常
任何运行时错误都会生成异常。异常将终止执行。可以捕获异常，而不是终止执行：
        auto e;
        try
        {
          ... some statements that cause a runtime error...
        }
        catch ( e )
        {
          // e holds the exception information
          // it is an instance of the exception class
        }
try/catch 块可以嵌套。如果当前函数没有 try/catch 块，则将检查调用函数，依此类推，直到我们找到 try/catch 块或退出 main 函数。如果未找到 try/catch 块，则报告未处理的异常。

也可以显式抛出异常。任何对象都可以被抛出。例如:

        throw 5;
will throw value '5'.


 IDC: 表达式

IDC: 表达式
在 IDC 表达式中，您可以使用几乎所有 C 操作，但以下操作除外:
  complex assignment operations as '+='
常量 的定义或多或少类似于 C 语言，但有一些细微的差异。

有四种类型转换操作：

  long(expr)  浮点数在转换过程中被截断
  char(expr)
  float(expr)
  __int64(expr)
但是，很少需要显式类型转换，因为所有类型转换都是自动进行的:
  - addition:
        if both operands are strings,
          string addition is performed (strings are concatenated);
        if both operands are objects,
          object combination is performed (a new object is created)
        if floating point operand exists,
          both operands are converted to floats;
        otherwise
          both operands are converted to longs;

  - subtraction/multiplication/division:
        if floating point operand exists,
          both operands are converted to floats;
        if both operands are objects and the operation is subtraction,
          object subtraction is performed (a new object is created)
        otherwise
          both operands are converted to longs;

  - comparisons (==,!=, etc):
        if both operands are strings, string comparison is performed;
        if floating point operand exists,
          both operands are converted to floats;
        otherwise
          both operands are converted to numbers;

  - all other operations:
        operand(s) are converted to longs;
If any of the long operands is 64bit, the other operand is converted to 64bit too.

There is one notable exception concerning type conversions: if one operand is a string and the other is zero (0), then a string operation is performed. 在本例中，零将转换为空字符串。

& 运算符用于获取对变量的引用。 引用本身一旦创建就无法修改。 对它们的任何赋值都将修改目标变量。 例如:

        auto x, r;
        r = &x;
        r = 1;   // x is equal to 1 now
对引用的引用将立即得到解决:
        auto x, r1, r2;
        r1 = &x;
        r2 = &r1; // r2 points to x
由于所有非对象参数都是按值传递给函数的，因此引用是按引用传递参数的好方法。


 IDC: 函数

IDC: 函数
IDC 函数始终返回一个值。 有 2 种函数:
  - 内置函数
  - 用户定义的函数
用户定义的函数是这样声明的:
  static func(arg1,arg2,arg3)
  {
    statements ...
  }
无需指定参数类型，因为所有必要的类型转换都是自动执行的。

默认情况下，所有函数参数都按值传递，但以下参数除外:

  - 对象始终通过引用传递
  - 函数始终通过引用传递
  - 可以使用 & 运算符通过引用传递变量
如果要调用的函数不存在，IDA 将尝试使用调试的程序标签解析该名称。 如果成功，则执行 dbg_appcall。


 IDC: loader_input_t 类

IDC: loader_input_t 类
The loader_input_t class can read from input files. It has the following methods:
 long read(vref buf, long size);
  long size();
  long seek(long pos, long whence);
  long tell();
  string gets(long maxsize);
  string getz(long pos, long maxsize);
  long getc();
  long readbytes(vref result, long size, long mf);
  void close();
Instances of this class can be created by calling the open_loader_input function.

See other IDC classes.


 IDC: 预定义符号

IDC: 预定义符号
The following symbols are predefined in the IDC preprocessor:
  _NT_           IDA is running under MS Windows
  _LINUX_        IDA is running under Linux
  _MAC_          IDA is running under Mac OS X
  _UNIX_         IDA is running under Unix (linux or mac)
  _EA64_         64-bit version IDA
  _QT_           GUI version of IDA (Qt)
  _GUI           GUI version of IDA
  _TXT_          Text version of IDA
  _IDA_VERSION_  The current IDA version. 例如: "8.3"
  _IDAVER_       The current, numerical IDA version. 例如: "830" means v8.3
这些符号也是在解析 C 头文件时定义的。


 IDC: Slices

IDC: Slices
Slices 操作符可以应用 IDC 对象是字符串。

对于字符串，该 Slices 操作符表达一个子字符串：

  str[i1:i2] - 从 i1 到 i2 的子字符串。i2 被排除
  str[idx]   - 一个字符子字符串在 'idx'。
               这个等于 str[idx:idx+1]
  str[:idx]  - 子字符串从字符串的开始到 idx
               这个等于 str[0:idx]
  str[idx:]  - 子字符串从 idx 到字符串的结尾
               这个等于 str[idx:0x7fffffff]
超出范围的任何索引都将默认被调整为校正值。如果 i1 >= i2，则返回空字符串。负指数用于表达从字符串末尾计数的位置。

字符串 Slices 可以用在赋值的右侧。例如：

  str[0:2] = "abc";
将字符串开头的两个字符替换为“abc”。

对于对象，Slices 操作符表达属性的子集。它可以用来模拟数组：

  auto x = object();
  x[0] = value1;
  x[1] = "value2";
x[i1:i2] 表达 i1 和 i2 之间的数值的所有属性(排除 i2)。

Slices 操作符忽略任何非数字的属性。


 IDC: 语句

IDC: 语句
In IDC there are the following statements:
 expression;        (expression-statement)
  if (expression) statement
  if (expression) statement else statement
  for ( expr1; expr2; expr3 ) statement
  while (expression) statement
  do statement while (expression);
  break;
  continue;
  return ;
  return;              the same as 'return 0;'
  { statements... }
   try statement catch ( var ) statement
  throw ;
  ;                    (empty statement)
Please note that the 'switch' statement is not supported.


 IDC: 变量

IDC: 变量
在 IDA 中有两种变量：
  - 局部变量: 它们创建在函数的输入中，并在退出时删除

  - 全局变量: 它们在编译时创建，并在数据库关闭时删除
变量可以包含：
  - LONG: 32 位带符号长整形 (在 IDA 64-位版本中为 64-位)
  - INT64: 64-位带符号长整型
  - STR: 字符字符串
  - FLOAT: 浮点数字(附加的精度，最多 25 个十进制数字)
  - OBJECT: 带有属性和方法的对象
            (一个非常接近 C++ 类的概念)   更多
  - REF: 引用另一个变量
  - FUNC: 函数引用
局部变量以该方式声明：
  auto var1;
  auto var2 = <expr>;
全局变量这样声明：
  extern var;
全局变量可以多次重新定义。 IDA 将静默忽略随后的声明。请注意, 全局变量不能在声明时初始化。

所有 C 和 C++ 关键字都是保留字，不能用作变量名称。

虽然可以在函数体中的任何地方声明一个变量，但是所有的变量都在函数输入时初始化，并且只有在退出时才会被删除。因此，除非用赋值运算符明确指定，否则在循环体中声明的变量将不会在每个循环迭代中重新初始化。

如果无法识别变量或函数名称，IDA 将尝试使用反汇编应用程序中的名称来解析它们。在其中成功，名称由其在反汇编列表中的值替换。例如：

  .data:00413060 errtable        dd 1   ; oscode
  .data:00413060                 dd 16h ; errnocode

        msg("address is: %x\n", _errtable);
将输出 413060。如果标签表达结构体，可以引用到它的字段：
        msg("address is: %x\n", _errtable.errnocode);
将输出 413064。请注意，IDA 不会尝试读取数据，而只返回结构体字段的地址。字段地址也可以使用 get_field_ea 函数计算。

注意: 当调试器处于活动状态时，可以在 IDC 脚本中使用处理器寄存器名称。读取此类的变量会返回相应的寄存器值。写入此类变量会修改调试进程中的寄存器值。仅当应用程序处于挂起模式时，才能访问此类变量。

注意: 另一种模拟全局作用域变量的方法是使用 array 函数并创建全局持久数组。


 开关的非法使用

开关的非法使用
当你第二次或多次启动 IDA 时，并非所有开关都可以使用。以下是有效的开关：
 -a 禁用 自动分析
 -d 调试
另参见 IDA 使用帮助


 导入二进制跟踪

导入二进制跟踪
Import a binary trace file from a different IDB

This command allows to import binary trace files recorded for an IDB with a different MD5. For example, it can be used to load recorded traces from a malware sample which is practically the same, but differs in a few bytes.

另参见:
   清除跟踪
   选择跟踪
   其他选项
   编辑跟踪描述
   二进制跟踪的比较
   移除二进制跟踪
   导出二进制跟踪
   导出跟踪到文本文件
   显示跟踪调用图表


 import_type

import_type

Copy information from type library to database
   Copy structure, union, or enum definition from the type library
   to the IDA database.
        idx       - the position of the new type in the list of
                    types (structures or enums)
                    -1 means at the end of the list
        type_name - name of type to copy
   返回: BADNODE-failed, otherwise the type id
                (structure id or enum id)

long import_type(long idx, string type_name);


 未找到导入的模块

未找到导入的模块

  IDA 在以下位置找不到指定的模块：
    - 当前目录
    - 操作系统目录(参见 switch -W
      和配置文件参数 WINDIR，OS2DIR)

  或
        - 该模块不能被接受，因为：
        - 模块名称(记录在文件中)不匹配
          预期名称
        - 该模块不包含任何导出的名称(所有导出的函数
          按序号导出)
按序号条目导入的条目将不会被注释。如果 IDA 找到一个模块，则按序号导入的所有条目都将被注释如下：
  KERNEL_91:
                retf            ; INITTASK
                                  ^^^^^^^^^
                                  comment
此注释将传送(重复)到调用此条目的所有位置：
                call    far ptr KERNEL_91 ; INITTASK
IDA 会搜索名为 "modulename.*" 的所有文件以查找该模块。如果你知道导入的模块位于另一个目录中，请将其复制到当前目录。如果模块文件名与 "modulename.*" 不同，请重命名。加载数据库后，可以删除复制的模块。

IDA 还会在 PATHed 目录中 IDA.EXE 所在的目录的 IDS 子目录的当前目录中查找文件 "modulename.ids"

你可以自己创建这样的文件。例如，查看 DOSCALLS。IDS 子目录中的 IDS。


 导入窗口

导入窗口

 操作名称: OpenImports
该命令 打开导入窗口.

你可以在此窗口中使用 列表查看器 命令。

另参见 视图|打开子视图子菜单。


 inf_attr

inf_attr

The following functions allow you to set/get common parameters.
Please note that not all parameters can be set directly.

long    get_inf_attr(long attr); success set_inf_attr(long attr, long value);
// Set or clear bits in parameter //      attr   - same as for get_inf_attr()/set_inf_attr() functions //      bits   - bit mask //      on     - boolean value, set or clear bits // Convenience function void set_flag(long attr, long bits, long on);
// 'attr' may be one of the following:
#define INF_VERSION      0              // ushort;  Version of database #define INF_PROCNAME     1              // char[16];Name of current processor #define INF_GENFLAGS     2              // ushort;  General flags: #define         INFFL_AUTO       0x01   //              Autoanalysis is enabled? #define         INFFL_ALLASM     0x02   //              May use constructs not supported by //              the target assembler #define         INFFL_LOADIDC    0x04   //              Loading an idc file that contains database info #define         INFFL_NOUSER     0x08   //              do not store user info in the database #define         INFFL_READONLY   0x10   //              (internal) temporary interdiction to modify the database #define         INFFL_CHKOPS     0x20   //              check manual operands? (unused) #define         INFFL_NMOPS      0x40   //              allow non-matched operands? (unused) #define         INFFL_GRAPH_VIEW 0x80   //              currently using graph options (\dto{graph}) #define INF_LFLAGS       3              // uint32   IDP-dependent flags #define     LFLG_PC_FPP     0x00000001  //              decode floating point //              processor instructions? #define     LFLG_PC_FLAT    0x00000002  //              Flat model? #define     LFLG_64BIT      0x00000004  //              64-bit program? #define     LFLG_IS_DLL     0x00000008  //              is dynamic library? #define     LFLG_FLAT_OFF32 0x00000010  //              treat REF_OFF32 as 32-bit offset for 16bit segments (otherwise try SEG16:OFF16) #define     LFLG_MSF        0x00000020  //              byte order: is MSB first? #define     LFLG_WIDE_HBF   0x00000040  //              bit order of wide bytes: high byte first? #define     LFLG_DBG_NOPATH 0x00000080  //              do not store input full path #define     LFLG_SNAPSHOT   0x00000100  //              is memory snapshot? #define     LFLG_PACK       0x00000200  //              pack the database? #define     LFLG_COMPRESS   0x00000400  //              compress the database? #define     LFLG_KERNMODE   0x00000800  //              is kernel mode binary?
#define INF_DATABASE_CHANGE_COUNT 4     // uint32; database change counter; keeps track of byte and segment modifications
#define INF_FILETYPE     5              // ushort;  type of input file (see ida.hpp) #define         FT_EXE_OLD      0       //              MS DOS EXE File (obsolete) #define         FT_COM_OLD      1       //              MS DOS COM File (obsolete) #define         FT_BIN          2       //              Binary File #define         FT_DRV          3       //              MS DOS Driver #define         FT_WIN          4       //              New Executable (NE) #define         FT_HEX          5       //              Intel Hex Object File #define         FT_MEX          6       //              MOS Technology Hex Object File #define         FT_LX           7       //              Linear Executable (LX) #define         FT_LE           8       //              Linear Executable (LE) #define         FT_NLM          9       //              Netware Loadable Module (NLM) #define         FT_COFF         10      //              Common Object File Format (COFF) #define         FT_PE           11      //              Portable Executable (PE) #define         FT_OMF          12      //              Object Module Format #define         FT_SREC         13      //              R-records #define         FT_ZIP          14      //              ZIP file (this file is never loaded to IDA database) #define         FT_OMFLIB       15      //              Library of OMF Modules #define         FT_AR           16      //              ar library #define         FT_LOADER       17      //              file is loaded using LOADER DLL #define         FT_ELF          18      //              Executable and Linkable Format (ELF) #define         FT_W32RUN       19      //              Watcom DOS32 Extender (W32RUN) #define         FT_AOUT         20      //              Linux a.out (AOUT) #define         FT_PRC          21      //              PalmPilot program file #define         FT_EXE          22      //              MS DOS EXE File #define         FT_COM          23      //              MS DOS COM File #define         FT_AIXAR        24      //              AIX ar library #define         FT_MACHO        25      //              Mac OS X Mach-O file #define INF_OSTYPE       6              // ushort;  FLIRT: OS type the program is for #define         OSTYPE_MSDOS 0x0001 #define         OSTYPE_WIN   0x0002 #define         OSTYPE_OS2   0x0004 #define         OSTYPE_NETW  0x0008 #define INF_APPTYPE      7              // ushort;  FLIRT: Application type #define         APPT_CONSOLE 0x0001     //              console #define         APPT_GRAPHIC 0x0002     //              graphics #define         APPT_PROGRAM 0x0004     //              EXE #define         APPT_LIBRARY 0x0008     //              DLL #define         APPT_DRIVER  0x0010     //              DRIVER #define         APPT_1THREAD 0x0020     //              Singlethread #define         APPT_MTHREAD 0x0040     //              Multithread #define         APPT_16BIT   0x0080     //              16 bit application #define         APPT_32BIT   0x0100     //              32 bit application #define INF_ASMTYPE      8              // uchar;   target assembler number (0..n) #define INF_SPECSEGS     9              // uchar;   What format do special segments use? 0-unspecified, 4-entries are 4 bytes, 8- entries are 8 bytes //          program execution
#define INF_AF          10              // uint32;  Analysis flags: #define AF_CODE         0x00000001      //              Trace execution flow #define AF_MARKCODE     0x00000002      //              Mark typical code sequences as code #define AF_JUMPTBL      0x00000004      //              Locate and create jump tables #define AF_PURDAT       0x00000008      //              Control flow to data segment is ignored #define AF_USED         0x00000010      //              Analyze and create all xrefs #define AF_UNK          0x00000020      //              Delete instructions with no xrefs
#define AF_PROCPTR      0x00000040      //              Create function if data xref data->code32 exists #define AF_PROC         0x00000080      //              Create functions if call is present #define AF_FTAIL        0x00000100      //              Create function tails #define AF_LVAR         0x00000200      //              Create stack variables #define AF_STKARG       0x00000400      //              Propagate stack argument information #define AF_REGARG       0x00000800      //              Propagate register argument information #define AF_TRACE        0x00001000      //              Trace stack pointer #define AF_VERSP        0x00002000      //              Perform full SP-analysis. (\ph{verify_sp}) #define AF_ANORET       0x00004000      //              Perform 'no-return' analysis #define AF_MEMFUNC      0x00008000      //              Try to guess member function types #define AF_TRFUNC       0x00010000      //              Truncate functions upon code deletion
#define AF_STRLIT       0x00020000      //              Create string literal if data xref exists #define AF_CHKUNI       0x00040000      //              Check for unicode strings #define AF_FIXUP        0x00080000      //              Create offsets and segments using fixup info #define AF_DREFOFF      0x00100000      //              Create offset if data xref to seg32 exists #define AF_IMMOFF       0x00200000      //              Convert 32bit instruction operand to offset #define AF_DATOFF       0x00400000      //              Automatically convert data to offsets
#define AF_FLIRT        0x00800000      //              Use flirt signatures #define AF_SIGCMT       0x01000000      //              Append a signature name comment for recognized anonymous library functions #define AF_SIGMLT       0x02000000      //              Allow recognition of several copies of the same function #define AF_HFLIRT       0x04000000      //              Automatically hide library functions
#define AF_JFUNC        0x08000000      //              Rename jump functions as j_... #define AF_NULLSUB      0x10000000      //              Rename empty functions as nullsub_...
#define AF_DODATA       0x20000000      //              Coagulate data segs at the final pass #define AF_DOCODE       0x40000000      //              Coagulate code segs at the final pass #define AF_FINAL        0x80000000      //              Final pass of analysis
#define INF_AF2         11              // uint32;  Analysis flags 2
#define AF2_DOEH        0x00000001      //              Handle EH information #define AF2_DORTTI      0x00000002      //              Handle RTTI information #define AF2_MACRO       0x00000004      //              Try to combine several instructions into a macro instruction
#define INF_BASEADDR    12              // uval_t;  base paragraph of the program #define INF_START_SS    13              // sel_t;   value of SS at the start #define INF_START_CS    14              // sel_t;   value of CS at the start #define INF_START_IP    15              // ea_t;    IP register value at the start of #define INF_START_EA    16              // ea_t;    Linear address of program entry point #define INF_START_SP    17              // ea_t;    SP register value at the start of #define INF_MAIN        18              // ea_t;    address of main() #define INF_MIN_EA      19              // ea_t;    The lowest address used //          in the program #define INF_MAX_EA      20              // ea_t;    The highest address used //          in the program - 1 #define INF_OMIN_EA     21              // ea_t; #define INF_OMAX_EA     22              // ea_t; #define INF_LOWOFF      23              // ea_t;    low limit of voids #define INF_HIGHOFF     24              // ea_t;    high limit of voids #define INF_MAXREF      25              // uval_t;  max xref depth #define INF_PRIVRANGE_START_EA 27       // ea_t;    Range of addresses reserved for internal use. #define INF_PRIVRANGE_END_EA 28         // ea_t;    Initially specified by cfgvar PRIVRANGE
#define INF_NETDELTA    29              // sval_t; Delta value to be added to all adresses for mapping to netnodes. // Initially 0. // CROSS REFERENCES #define INF_XREFNUM     30              // uchar;   Number of references to generate //          0 - xrefs won't be generated at all #define INF_TYPE_XREFNUM 31             // uchar;   Number of references to generate //          in the struct & enum windows //          0 - xrefs won't be generated at all #define INF_REFCMTNUM   32              // uchar; number of comment lines to //        generate for refs to ASCII //        string or demangled name //        0 - such comments won't be //        generated at all #define INF_XREFFLAG    33              // uchar;   xrefs representation: #define         SW_SEGXRF       0x01    //              show segments in xrefs? #define         SW_XRFMRK       0x02    //              show xref type marks? #define         SW_XRFFNC       0x04    //              show function offsets? #define         SW_XRFVAL       0x08    //              show xref values? (otherwise-"...")
// NAMES #define INF_MAX_AUTONAME_LEN 34         // ushort;  max autogenerated name length (without zero byte) #define INF_NAMETYPE    34              // char;    dummy names represenation type #define         NM_REL_OFF      0 #define         NM_PTR_OFF      1 #define         NM_NAM_OFF      2 #define         NM_REL_EA       3 #define         NM_PTR_EA       4 #define         NM_NAM_EA       5 #define         NM_EA           6 #define         NM_EA4          7 #define         NM_EA8          8 #define         NM_SHORT        9 #define         NM_SERIAL      10 #define INF_SHORT_DEMNAMES 36           // uint32;  short form of demangled names #define INF_LONG_DEMNAMES 37            // uint32;  long form of demangled names //          see demangle.h for definitions #define INF_DEMNAMES    38              // uchar;   display demangled names as: #define         DEMNAM_CMNT  0          //              comments #define         DEMNAM_NAME  1          //              regular names #define         DEMNAM_NONE  2          //              don't display #define         DEMNAM_GCC3  4          //          assume gcc3 names (valid for gnu compiler) #define         DEMNAM_FIRST 8          //          override type info #define INF_LISTNAMES   39              // uchar;   What names should be included in the list? #define         LN_NORMAL       0x01    //              normal names #define         LN_PUBLIC       0x02    //              public names #define         LN_AUTO         0x04    //              autogenerated names #define         LN_WEAK         0x08    //              weak names
// DISASSEMBLY LISTING DETAILS #define INF_INDENT      40              // uchar;   Indention for instructions #define INF_CMT_INDENT  41              // uchar;   Indention for comments #define INF_MARGIN      42              // ushort;  max length of data lines #define INF_LENXREF     43              // ushort;  max length of line with xrefs #define INF_OUTFLAGS    44              // uint32;  output flags #define         OFLG_SHOW_VOID  0x0002  //              Display void marks? #define         OFLG_SHOW_AUTO  0x0004  //              Display autoanalysis indicator? #define         OFLG_GEN_NULL   0x0010  //              Generate empty lines? #define         OFLG_SHOW_PREF  0x0020  //              Show line prefixes? #define         OFLG_PREF_SEG   0x0040  //              line prefixes with segment name? #define         OFLG_LZERO      0x0080  //              generate leading zeroes in numbers #define         OFLG_GEN_ORG    0x0100  //              Generate 'org' directives? #define         OFLG_GEN_ASSUME 0x0200  //              Generate 'assume' directives? #define         OFLG_GEN_TRYBLKS 0x0400 //              Generate try/catch directives? #define INF_CMTFLG      45              // uchar;   comments: #define         SCF_RPTCMT       0x01   //              show repeatable comments? #define         SCF_ALLCMT       0x02   //              comment all lines? #define         SCF_NOCMT        0x04   //              no comments at all #define         SCF_LINNUM       0x08   //              show source line numbers #define         SCF_TESTMODE     0x10   //              testida.idc is running #define         SCF_SHHID_ITEM   0x20   //              show hidden instructions #define         SCF_SHHID_FUNC   0x40   //              show hidden functions #define         SCF_SHHID_SEGM   0x80   //              show hidden segments #define INF_LIMITER     46              // uchar;   Generate borders? #define INF_BIN_PREFIX_SIZE 47          // short;   # of instruction bytes to show //          in line prefix #define INF_PREFFLAG    48              // uchar;   line prefix type: #define         PREF_SEGADR     0x01    //              show segment addresses? #define         PREF_FNCOFF     0x02    //              show function offsets? #define         PREF_STACK      0x04    //              show stack pointer? #define         PREF_PFXTRUNC   0x08    //              truncate instruction bytes if they would need more than 1 line
// STRING LITERALS #define INF_STRLIT_FLAGS 49             // uchar;   string literal flags #define         STRF_GEN        0x01    //              generate names? #define         STRF_AUTO       0x02    //              names have 'autogenerated' bit? #define         STRF_SERIAL     0x04    //              generate serial names? #define         STRF_COMMENT    0x10    //              generate auto comment for string references? #define         STRF_SAVECASE   0x20    //              preserve case of strings for identifiers #define INF_STRLIT_BREAK 50             // uchar;   string literal line break symbol #define INF_STRLIT_ZEROES 51            // char;    leading zeroes #define INF_STRTYPE     52              // int32;   current ascii string type //          is considered as several bytes: //      low byte: // Number of bytes per "units" in a string. #define STRWIDTH_1B 0 #define STRWIDTH_2B 1 #define STRWIDTH_4B 2 #define STRWIDTH_MASK 0x03 // The string layout; how the string is laid out in data. #define STRLYT_TERMCHR 0 #define STRLYT_PASCAL1 1 #define STRLYT_PASCAL2 2 #define STRLYT_PASCAL4 3 #define STRLYT_MASK 0xFC #define STRLYT_SHIFT 2
#define INF_STRLIT_PREF 53              // char[16];ASCII names prefix #define INF_STRLIT_SERNUM 54            // uval_t;  serial number
// DATA ITEMS #define INF_DATATYPES   55              // uval_t;  data types allowed in data carousel
// COMPILER #define INF_CC_ID       57              // uchar;   compiler #define      COMP_MASK        0x0F      //              mask to apply to get the pure compiler id #define         COMP_UNK      0x00      // Unknown #define         COMP_MS       0x01      // Visual C++ #define         COMP_BC       0x02      // Borland C++ #define         COMP_WATCOM   0x03      // Watcom C++ #define         COMP_GNU      0x06      // GNU C++ #define         COMP_VISAGE   0x07      // Visual Age C++ #define         COMP_BP       0x08      // Delphi #define         COMP_UNSURE   0x80      // uncertain compiler id #define INF_CC_CM       58              // cm_t;  memory model & calling convention. see below #define INF_CC_SIZE_I   59              // uchar;  sizeof(int) #define INF_CC_SIZE_B   60              // uchar;  sizeof(bool) #define INF_CC_SIZE_E   61              // uchar;  sizeof(enum) #define INF_CC_DEFALIGN 62              // uchar;  default alignment #define INF_CC_SIZE_S   63              // uchar; #define INF_CC_SIZE_L   64              // uchar; #define INF_CC_SIZE_LL  65              // uchar; #define INF_CC_SIZE_LDBL 66             // uchar;  sizeof(long double) #define INF_ABIBITS     67              // uint32; ABI features #define   ABI_8ALIGN4       0x00000001  //   4 byte alignment for 8byte scalars (__int64/double) inside structures? #define   ABI_PACK_STKARGS  0x00000002  //   do not align stack arguments to stack slots #define   ABI_BIGARG_ALIGN  0x00000004  //   use natural type alignment for argument if the alignment exceeds native word size (e.g. __int64 argument should be 8byte aligned on some 32bit platforms) #define   ABI_STACK_LDBL    0x00000008  //   long double areuments are passed on stack #define   ABI_STACK_VARARGS 0x00000010  //   varargs are always passed on stack (even when there are free registers) #define   ABI_HARD_FLOAT    0x00000020  //   use the floating-point register set #define   ABI_SET_BY_USER   0x00000040  //   compiler/abi were set by user flag and require SETCOMP_BY_USER flag to be changed #define   ABI_GCC_LAYOUT    0x00000080  //   use gcc layout for udts (used for mingw) #define   ABI_MAP_STKARGS   0x00000100  //   register arguments are mapped to stack area (and consume stack slots) #define   ABI_HUGEARG_ALIGN 0x00000200  //   use natural type alignment for an argument //   even if its alignment exceeds double native word size //   (the default is to use double word max). //   e.g. if this bit is set, __int128 has 16-byte alignment #define INF_APPCALL_OPTIONS 68          // uint32; appcall options
// Pointer size, memory model, and calling convention are encoded using: #define  CM_MASK   0x03         // Default pointer size: #define   CM_UNKNOWN     0x00   //   unknown #define   CM_N8_F16      0x01   //   if sizeof(int)<=2: near 1 byte, far 2 bytes #define   CM_N64         0x01   //   if sizeof(int)>2: near 8 bytes, far 8 bytes #define   CM_N16_F32     0x02   //   near 2 bytes, far 4 bytes #define   CM_N32_F48     0x03   //   near 4 bytes, far 6 bytes #define  CM_M_MASK   0x0C       // Memory model: #define   CM_M_NN        0x00   //   small:   code=near, data=near (or unknown if CM_UNKNOWN) #define   CM_M_FF        0x04   //   large:   code=far, data=far #define   CM_M_NF        0x08   //   compact: code=near, data=far #define   CM_M_FN        0x0C   //   medium:  code=far, data=near
#define is_code_far(cm) (((cm) & 4) != 0) // Does the given model specify far code? #define is_data_far(cm) (((cm) &= CM_M_MASK) && (cm) != CM_M_FN) // Does the given model specify far data?
\defgroup CM_CC_ //@{ #define  CM_CC_MASK   0xF0      // Calling convention #define   CM_CC_INVALID    0x00 // this value is invalid #define   CM_CC_UNKNOWN    0x10 // unknown calling convention #define   CM_CC_VOIDARG    0x20 // function without arguments // if has other cc and argnum == 0, // represent as f() - unknown list #define   CM_CC_CDECL      0x30 // stack #define   CM_CC_ELLIPSIS   0x40 // cdecl + ellipsis #define   CM_CC_STDCALL    0x50 // stack, purged #define   CM_CC_PASCAL     0x60 // stack, purged, reverse order of args #define   CM_CC_FASTCALL   0x70 // stack, purged (x86), first args are in regs (compiler-dependent) #define   CM_CC_THISCALL   0x80 // stack, purged (x86), first arg is in reg (compiler-dependent) #define   CM_CC_GOLANG     0xB0 // GO: arguments and return value in stack #define   CM_CC_SPECIALE   0xD0 // ::CM_CC_SPECIAL with ellipsis #define   CM_CC_SPECIALP   0xE0 // Equal to ::CM_CC_SPECIAL, but with purged stack. #define   CM_CC_SPECIAL    0xF0 // usercall: locations of all arguments // and the return value are explicitly specified
// Convenience function to set a flag bit static set_flag(off, bit, value) { auto v = get_inf_attr(off); v = value ? (bit | v) : (~bit & v); return set_inf_attr(off, v); } // Set/get application bitness #define inf_set_64bit()          set_flag(INF_LFLAGS, LFLG_64BIT, 1) #define inf_set_32bit()          set_flag(INF_LFLAGS, LFLG_PC_FLAT, 1) #define inf_is_64bit()           ((get_inf_attr(INF_LFLAGS) & LFLG_64BIT) != 0) #define inf_is_32bit_or_higher() ((get_inf_attr(INF_LFLAGS) & LFLG_PC_FLAT) != 0)


 立即调试器

立即调试器
The -r command line switch is used to run the built-in debugger without creating a database in advance. The format is this switch is:
  -rdebname{params}:pass@hostname:port+pid
The explanation of the fields:
  debname       Debugger name. Should contain the debugger
                module name. 示例: win32, linux. This prefix
                can be shortened or even completely
                omitted if there is no ambiguity
  params        Optional parameter for the debugger module
                The parameters from the appropriate configuation file
                can be specified here, separated by semicolons.
  pass          Password for the remote debugger server
  hostname      Host name or address of the remote debugger server
  port          Port number to use to connect to the debugger server
  pid           PID of the process to attach
All fields except the first one are optional. Also, the pid field can be specified as '+'. IDA will display the process list to attach. See examples below for typical command lines:
  ida -rwin32 file args
        Run 'file' with command line 'args' in the local debugger
        We have to specify the debugger name to avoid ambiguities.
  ida -rwindbg+450
        Attach to process 450 on the local machine using the windbg backend
  ida -rl:hippy@mycom:4567+
        Connect to the remote linux computer 'mycom' at port 4567 using the
        password 'hippy' and display the list of processes running on it.
        Allow the user to select a process and attach to it.
  ida -rl@mycom /bin/ls e*
        Run '/bin/ls' command on the 'mycom' computer using the remote
        debugger server on Linux. 使用空密码和
        默认端口号。Pass "e*" as the parameter to /bin/ls.
  ida -rl@mycom whobase.idb
        Run '/usr/bin/who' command on the 'mycom' computer using the
        remote linux debugger server. 使用空密码和
        默认端口号。IDA will extract the name of the
        executable from the whobase.idb file in the local current
        directory. If the database does not exist, then this command
        will fail.
  ida "-rwindbg{MODE=1}@com:port=\\.\pipe\com_1,baud=115200,pipe,reconnect+"
        Attach using windbg in kernel mode. The connection string is
        "com:port=\\.\pipe\com_1,baud=115200,pipe,reconnect". 迷你数据库
        将即时创建。
When the -r switch is used, IDA works with the databases in the following way:
        - if a database corresponding to the input 文件 exists and
        the -c switch has not been specified, then IDA will use the
        database during the debugging session

        - otherwise, a temporary database will be created
Temporary databases contain only meta-information about the debugged process and not the memory contents. The user can make a memory snapshot any time before the process stops. If IDA detects that a 命令 will cause the process to exit 或 detach IDA, it will propose to make a snapshot.

The rest of the 命令行 is passed to the launched process.

In the case there is no input 文件 (when attaching to an existing process, for example), then the temporary database is created in the standard temporary directory. For Windows, this directory is usually "Local Setting\Temp" in the user profile directory.

另参见

  如何启动远程调试


 指令跟踪

指令跟踪

 操作名称: ToggleTraceInstructions
此命令启动指令跟踪。然后，你可以像往常一样使用所有调试器命令：调试器将保存每条指令的所有修改的寄存器值。

当你在“跟踪”窗口中单击指令跟踪事件时，IDA 会在执行此指令之前显示相应的寄存器值。在 “跟踪”窗口的“结果”列中，你还可以查看此指令修改了哪些寄存器。例如，通过使用此信息，你可以快速确定哪条指令修改了特定寄存器，甚至可以回溯执行流程。请注意，IP 寄存器永远不会打印在“结果”列中，尽管它通常被几乎任何指令修改(除了一些前缀指令，如 REP MOVSB 等)。

在内部，调试器逐步运行当前线程，以正确获取所有必需的寄存器值。这就解释了为什么指令跟踪比正常执行慢。

另参见 跟踪窗口
          跟踪管理
          清除跟踪
          函数跟踪
          基本块跟踪
          添加写入跟踪
          添加读取/写入跟踪
          添加执行跟踪
          跟踪选项
          跟踪子菜单。


 Intel/ARM macOS 调试器

Intel/ARM macOS 调试器
On macOS, the suggested approach is to use Remote debugging with one of the mac_server* binaries that are shipped with IDA - even when debugging apps on your local machine.

Using a standalone debug server application makes it easier to get around the codesigning and debugging restrictions that are built into macOS. Note that this is also the approach used by lldb. Internally lldb uses a dedicated debugserver that implements the core debugger engine - so IDA does the same.

可以在 ida.app 中使用本地 Mac OS X 调试器，但必须以根用户身份运行 IDA。

要深入了解 macOS 调试，请参阅我们的教程：

另参见:
   如何启动远程调试
   调试器子菜单
   启动进程
   远程 iOS 调试器


 内部错误

内部错误
注释数据库已损坏。IDA 不会生成注释。


 调用外部帮助

调用外部帮助

 操作名称: ExternalHelp
此命令调用外部帮助。

在 MS Windows 版本的 IDA 中，它使用从光标位置获取的参数启动 WinHelp。

在 IDATUI.CFG/IDAGUI.CFG 中的 HELPFILE 参数。指向帮助文件名。

另参见 窗口子菜单。


 调用 OS Shell

调用 OS Shell

 操作名称: Shell
通过使用此命令，可以暂时退出到操作系统。

此命令在 MS DOS 版本中不可用。

使用此命令时，数据库将保持打开状态，因此请小心。

另参见 其他文件...子菜单命令。


 is_bf

is_bf

is enum a bitfield?
     enum_id - id of enum
返回: 1-yes, 0-no, ordinary enum

success is_bf(long enum_id);


 is_code

is_code

#define MS_CLS  0x00000600             // Mask for typing
#define FF_CODE 0x00000600             // Code ?
#define FF_DATA 0x00000400             // Data ?
#define FF_TAIL 0x00000200             // Tail ?
#define FF_UNK  0x00000000             // Unknown ?

#define is_code(F)       ((F & MS_CLS) == FF_CODE) // is code byte? #define is_data(F)       ((F & MS_CLS) == FF_DATA) // is data byte? #define is_tail(F)       ((F & MS_CLS) == FF_TAIL) // is tail byte? #define is_unknown(F)    ((F & MS_CLS) == FF_UNK)  // is unexplored byte? #define is_head(F)       ((F & FF_DATA) != 0)      // is start of code/data?


 is_loaded

is_loaded

Is the byte initialized?

#define is_loaded(ea)    has_value(get_full_flags(ea))  // any defined value?


 is_mapped

is_mapped

Is the specified address 'ea' present in the program?

success is_mapped(long ea);


 is_union

is_union

is a structure a union?
     id            - structure type ID
返回: 1: yes, this is a union id
         0: no

Unions are a special kind of structures
long is_union(long id);


 is_value...() 函数

is_value...() 函数

检查变量类型
如果变量类型是预期的变量类型，则返回 true
线程安全功能。

success value_is_string(var); success value_is_long(var); success value_is_float(var); success value_is_object(var); success value_is_func(var); success value_is_pvoid(var); success value_is_int64(var);


 返回跳转

返回跳转

 操作名称: Return
此命令将带你返回到历史记录中的上一个位置。 它从 Jumps Stack 中获取位置。

另参见

         跳转子菜单
         撤消"返回跳转"命令。
         空堆栈命令。


 立即跳转

立即跳转

 操作名称: JumpEnter
By pressing <Enter> you navigate in the program in the same way as in a hypertext (the way the web browers and help screens use).

This is the easiest way to explore the program: just position the cursor at the desired name and press "@<JumpEnter>".

你当前的地址将保存在 跳转堆栈中。

返回跳转命令 (通常是 Esc) 会让你返回。

If the cursor is at a stack variable, a window with stack variables is opened and the definition of the stack variable is displayed.

另参见

         跳转 子菜单
         Empty Stack 命令。


 跳转子菜单

跳转子菜单
在此菜单中，你可以选择一个命令以跳转到文件中的指定位置。 跳转速度非常快，你之前的位置被保存。此子菜单包含以下项：
 立即跳转
 返回跳转
 撤消上次返回跳转
 空导航堆栈
 跳转到地址
 跳转到指定位置
 跳转到段开始
 跳转到段寄存器更改点
 跳转到有问题的位置
 标记位置
 跳转到标记位置
 跳转到交叉引用
 跳转到对操作数的交叉引用
 跳转到函数
 跳转到入口点
 跳转到文件偏移量
另参见
        快速导航的搜索菜单。
        跳转堆栈概念。
        菜单栏子菜单


 跳转到有问题的位置

跳转到有问题的位置

 操作名称: JumpQ
This command allows you to jump to a problematic location. IDA will display the Problems List and will allow you to select a problem.

返回跳转命令 (通常是 Esc) 会让你返回。

另参见跳转子菜单。


 跳转到交叉引用

跳转到交叉引用

 操作名称: JumpXref
此命令显示对当前位置的交叉引用列表：你可以通过按 Enter 跳转到所选位置。

点击此处查看交叉引用对话框的说明。

另参见

         跳转子菜单。
         跳转到交叉引用自
         跳转到操作数交叉引用


 从当前位置跳转到交叉引用

从当前位置跳转到交叉引用

 操作名称: JumpXrefFrom
该命令 shows you a list of cross-references from the current location: you can 跳转 to the selected one by pressing Enter.

点击此处查看交叉引用对话框的说明。

另参见

         跳转 子菜单
         跳转到交叉引用
         跳转到对操作数的交叉引用


 跳转到操作数的交叉引用

跳转到操作数的交叉引用

 操作名称: JumpOpXref
此命令显示对当前操作数的交叉引用列表：你可以通过按 Enter 跳转到选定的操作数。

点击此处查看交叉引用对话框的说明。

另参见

         跳转子菜单。
         跳转到交叉引用
         跳转到交叉引用自


 跳转到入口点

跳转到入口点

 操作名称: JumpEntryPoint
此命令显示入口点列表：你可以通过按 Enter 键跳转到所选入口点。

入口点列表是在创建数据库时创建的。在此之后不会对其进行修改(例如，重命名导出的函数不会更改入口点列表)。

另参见跳转子菜单。


 跳转到函数

跳转到函数

 操作名称: JumpFunction
此命令显示函数列表：你可以通过按 Enter 键跳转到所选函数。

另参见

        跳转到下一个函数
        跳转到上一个函数
        跳转 子菜单
        如何选择函数


 跳转到下一个函数

跳转到下一个函数

 操作名称: JumpNextFunc
This command searches the start of the next function and jumps to the found address.


 跳转到上一个函数

跳转到上一个函数

 操作名称: JumpPrevFunc
This command searches the start of the previous function and jumps to the found address.


 跳转到以前标记的位置

跳转到以前标记的位置

 操作名称: JumpPosition
此命令将跳转到所选位置。IDA 将要求你选择目标位置。之后： - 当前地址保存在 跳转堆栈中。- 光标定位到指定地址。

返回跳转命令 (通常是 Esc) 会让你返回。

你可以使用“标记位置”命令 标记位置。

另参见跳转子菜单。


 跳转到名称的位置

跳转到名成的位置

 操作名称: JumpName
此命令允许您通过从名称列表中选择名称定义来跳转到该定义。

IDA 将显示名称列表（按地址排序），您可以选择一个名称。 Dummy names (generated by IDA) are not listed. Hidden names are not listed either. You can control which names are listed in the Names representation dialog box.

另参见

         跳转 子菜单
         如何使用列表器。


 跳转到指定地址

跳转到指定地址

 操作名称: JumpAsk
此命令跳转到程序中的指定地址。IDA 会要求你提供目标地址。你可以输入名称或地址作为十六进制数，带或不带段。如果你输入有效地址，则：
  - 当前地址保存在跳转堆栈中。
  - 光标定位到指定地址。
返回跳转命令 (通常是 Esc) 会让你返回。

在结构体视图和枚举视图中，光标将移动到当前类型中相应的偏移量。

另参见

         跳转 子菜单
         如何输入地址。


 跳转到指定的文件偏移量

跳转到指定的文件偏移量

 操作名称: JumpFileOffset
IDA will ask you for a target 文件 offset. 该命令 jumps to the address corresponding to this specified 文件 offset. If this 文件 offset corresponds to a valid address then:
  - 当前地址保存在跳转堆栈中。
  - 光标定位到相应的地址。
返回跳转命令 (通常是 Esc) 会让你返回。

另参见

         跳转子菜单


 跳转到指定段

跳转到指定段

 操作名称: JumpSegment
此命令跳转到所选段的开头。IDA 将要求你选择目标细分市场。后：
  - 当前地址保存在跳转堆栈中。
  - 光标定位到指定地址。
返回跳转命令 (通常是 Esc) 会让你返回。

另参见：

        如何选择段
        其他与段相关的命令
        跳转 子菜单


 跳转到指定的段寄存器更改点

跳转到指定的段寄存器更改点

 操作名称: JumpSegmentRegister
This command jumps to the selected Segment Register Change Point. IDA will ask you to select a target change point. And after:
  - 当前地址保存在跳转堆栈中。
  - 光标定位到指定地址。
返回跳转命令 (通常是 Esc) 会让你返回。

另参见跳转子菜单。


 跳转堆栈

跳转堆栈
每个 IDA 窗口都有自己的跳转堆栈。此堆栈保留光标位置。许多 IDA 命令使用跳转堆栈，即它们将旧的光标位置保存到堆栈中。 例如，当你位于地址 3000:0100 并按 Ctrl-C 键(查找指令)时，3000:0100 将保存到跳转堆栈中并开始搜索。之后，你可以使用返回跳转命令返回旧位置。

你可以使用空堆栈菜单命令清除跳转堆栈。


 jumpto

jumpto

Move cursor to the specifed linear address
     ea - linear address
Screen is refreshed at the end of IDC execution

success jumpto(long ea);


 内核分析选项 1

内核分析选项 1
跟踪执行流
  此选项允许 IDA 跟踪执行流并将所有
  引用 指令的字节。
将典型代码序列标记为代码
  IDA 知道每个处理器的一些典型代码序列。
  例如，它知道典型的序列

          push    bp
          mov     bp, sp

  如果启用此选项，IDA 将搜索所有典型序列
  即使没有引用，也可以将它们转换为指令
  对他们来说。 搜索在加载时执行。
查找并创建跳转表
  此选项允许 IDA 尝试猜测跳转的地址和大小
  表。 请注意，禁用此选项不会禁用
  识别 C 型典型开关结构体。
数据段的控制流被忽略
  如果设置，IDA 将不会分析
  纯数据段。 通常纯数据段有一些
  指令(例如 thunk 函数)，这就是此选项的原因
  默认设置为关闭状态。 对于 Mach-O 文件，它被设置为
  因为纯数据段中不包含指令。
分析和创建所有交叉引用
  如果禁用此选项，IDA 将不会彻底分析该程序：它
  将简单地跟踪执行流程，仅此而已(没有交叉引用，没有额外的
  支票等)
删除不带交叉引用的指令
  此选项允许 IDA 在不对指令进行任何交叉引用的情况下取消定义指令。
  例如，如果你在函数的开头 取消定义 了一条指令，IDA 将跟踪执行流并删除所有失去引用的指令。
如果存在数据交叉引用 data->code32，则创建函数
  如果 IDA 遇到从 DATA 段到 32 位的数据引用
  CODE 段，它将检查是否存在有意义的
  (可反汇编)指令在目标上。 如果有一个
  指令，它会将其标记为指令并创建
  那里的函数。
如果存在调用，则创建函数
  此选项允许 IDA 在调用时创建 函数 (proc)
  指令存在。 例如，存在：

          call loc_1234

  导致在标签 loc_1234 处创建函数
创建函数尾部
  此选项允许 IDA 查找和附加单独定位的
  函数尾部到函数定义。
创建堆栈变量
  此选项允许 IDA 自动创建堆栈变量和
  函数参数。
传送堆栈参数信息
  此选项传送堆栈参数信息
  (类型和名称)添加到调用方的堆栈中。如果调用者被调用，则信息将在整个程序中进一步传送。目前，类型传送实际上是
  简单和非智能：第一个遇到的类型
  将使用堆栈变量。
传送寄存器参数信息
  此选项传送寄存器参数信息
  (类型和名称)发送给调用方。如果调用方也被调用，则信息将在整个程序中进一步传送。
跟踪堆栈指针
  此选项允许 IDA 跟踪SP 寄存器的值。
执行全栈指针分析
  此选项允许 IDA 执行堆栈指针
  使用单纯形法进行分析。 此选项有效
  仅适用于 IBM PC 处理器。
执行“不返回”分析
  此选项允许 IDA 执行控制流分析，并确定不会返回给其调用方的函数。 例如，“exit()”函数没有
返回到其调用方。
尝试猜测成员函数类型
  如果设置，IDA 将使用 demangled 来猜测成员函数类型
  名字。 请注意，此规则有时可能会产生错误
  结果，例如，静态成员函数的结果。IDA 没有
  将它们与非静态成员函数区分开来的方法。
  如果清除，IDA 将仅猜测非成员函数的类型。
另参见 分析选项 2 分析选项 3


 内核分析选项 2

内核分析选项 2
删除代码时截断函数
  当函数端的代码被删除时截断函数。
  如果关闭此选项，IDA 不会修改功能删除代码时的定义。
如果数据交叉引用存在，则创建字符串文本
  If IDA encounters a data reference to an undefined item, it checks for the
  presence of the string literal at the target. If the length of the candidate
  string literal is big enough (more than 4 chars in 16bit or data
  segments; more than 16 chars otherwise), IDA will automatically create
  a string literal.
Check for unicode strings
  This option allows IDA to check for the presence of the unicode
  strings in the program and creates them if necessary.
  IDA will check for the unicode strings only if the string style
  is set to "C-style (0 terminated)" or "Unicode".
Create offsets and segments using fixup info
  IDA will use relocation information to make the disassembly
  nicer. More precisely, it will convert all data items with
  relocation information to words or dwords like this:

          dd offset label
          dw seg seg000

  If an instruction has a relocation information attached to it,
  IDA will convert its immediate operand to an offset or segment:

          mov     eax, offset label

  You can display the relocation information attached to the current
  item by using show internal flags command.
Create offset if data xref to seg32 exists
  If IDA encounters a data reference to 32bit segment and the target
  contains 32bit value which can be represented as an offset expression,
  IDA will convert it to an offset.
Convert 32bit instruction operand to offset
  This option works only in 32bit and 64bit segments.
  If an instruction has an immediate operand and the operand
  can be represented as a meaningful offset expression, IDA will
  convert it to an offset. However, the value of immediate operand
  must be higher than 0x10000.
Automatically convert data to offsets
  This option allows IDA to convert all newly created data items
  to offsets if the following conditions are satisfied:
    - the offset target is a valid address in the program
    - the target address is higher than 0x20
    - the target does not point into the middle of an item
    - if the target is code, the execution does not flow to it
      from the previous instruction
    - the data is dword (4 bytes) in a 32-bit segment
      or qword(8 bytes) in a 64-bit segment
    - the segment type is not special (extern, communal, abs...)
Use flirt signatures
  Allows usage of FLIRT technology
Comment anonymous library functions
  This option appends a comment to anonymous library functions.
  The comment consists of the description of the FLIRT signature
  which has recognized the function and marked it as coming
  from a library.
Multiple copy library function recognition
  This option allows FLIRT to recognize several copies of the same
  function in the program.
Automatically hide libary functions
  This option hides the functions recognized by FLIRT.
  It will have effect only from the time it is set.
Rename jump functions as j_...
  This option allows IDA to rename simple functions containing only

          jmp somewhere

  instruction to "j_somewhere".
Rename empty functions as nullsub_...
  This option allows IDA to rename empty functions containing only
  a "return" instruction as "nullsub_..."
  (... is replaced by a serial number: 0,1,2,3...)
Coagulate data at the final pass
  This option is meaningful only if "Make final analysis pass"
  is enabled. It allows IDA to convert unexplored bytes
  to data arrays in the non-code segments.
Coagulate code at the final pass
  This option is meaningful only if "Make final analysis pass"
  is enabled. It allows IDA to convert unexplored bytes
  to data arrays in the code segments.
Make final analysis pass
  This option allows IDA to coagulate all unexplored bytes
  by converting them to data or instructions.
另参见 analysis options 1 analysis options 3


 内核分析选项 3

内核分析选项 3
Enable EH analysis
  If this option is set on, IDA uses EH information of the binary for
  more detailed analysis.
Enable RTTI analysis
  If this option is set on, IDA tries to detect C++ Run-Time Type
  Indentification and does additional analysis based on this information.
Enable macros
  This option is disabled if the processor module does not support macros.

  If this option is on, IDA will combine several instructions into one macro
  instruction.
  For example for the ARM processor,

      ADRP Rx, label@PAGE
      ADD  Rx, Rx, label@PAGEOFF

  will be replaced by

      ADRL Rx, label
另参见 analysis options 1 analysis options 2


 键盘布局

键盘布局

 操作名称: KeyboardHelp
此命令显示当前键盘布局。

你可以在配置文件中更改布局

        IDATUI.CFG(适用于文字版)
        IDAGUI.CFG(适用于 GUI 版本)
此命令仅在文本版本中可用。

另参见 窗口子菜单。


 键盘宏

键盘宏
You can define a keyboard macro to automate frequent keystroke sequences. They are defined in the same manner as in the Borland IDE:
        - Press Alt--
        - Press <key> - macro name
        - Enter macro body
        - Press Alt-=
All macros are lost when you exit IDA. If you want to have a static macro which is not lost when you quit IDA, then write it down into IDATUI.CFG file. The format of a macro definition is explained here.

NOTE: keyboard macros are available only in the text version of IDA.


 lastattr

lastattr

Get the last object attribute
     self  - object
If there are no attributes, returns 0
Thread-safe function.

string lastattr(object self);


 Linux 调试器

Linux 调试器
Linux 调试器具有以下特殊性和局限性：

- 调试器服务器一次只能处理一个 IDA 客户端

- 默认情况下，64 位调试器将尝试加载“libunwind-x86_64.so.8”和“libunwind-ptrace.so.0”以帮助堆栈恢复。

- ARMLinux: 不支持硬件断点

-ARMLinux：不支持浮点寄存器

-ARMLinux：不支持 THUMB 模式

- 在调试器选项、设置特定选项中配置调试器特定选项(仅适用于 64 位)。

  - Path to libunwind:
    - "libunwind-x64_64.so.8" (the default): the debugger will try to load
      libunwind "libunwind-x86_64.so.8" + "libunwind-ptrace.so.0" pair
      using the regular 'ld' search path.
    - "libunwind-x64_64.so" (note the lack of ".8" at the end): like the
      default, except the debugger will look for "libunwind-x86_64.so"
      and "libunwind-ptrace.so" (this is particularly useful for working
      with libunwind "dev" packages)
    - absolute path to libunwind-x64_64.so.8 or libunwind-x64_64.so: Linux debugger
      will try to load libunwind only from the provided path.
    - absolute path to "libunwind-x64_64.so[.8]": the debugger will try
      to load the two libraries from there (the absolute path to
      "libunwind-ptrace.so[.0]" will be derived from that of
      "libunwind-x64_64.so[.8]")
    - left blank: don't use libunwind to collect stack traces.

  By default this is set to libunwind-x86_64.so meaning the default
  path will be used to load libunwind-x86_64.so(.8) and libunwind-ptrace.so(.0). If an absolute
  path is provided, both libraries will be loaded from this path. If left emtpy, the call
  stack will be analysed by Ida and not libunwind.

另参见:
   启动进程
   调试器子菜单
   如何启动远程调试


 函数列表

函数列表
你可以在此窗口中使用 列表查看器 命令。下面是此窗口的 格式 。


 加载附加的二进制文件

加载附加的二进制文件
以下是对话框字段的说明：
 加载段    - The paragraph where the 文件 will be loaded.
 加载偏移量     - Specifies offset of the first byte from the start of
                   the first 段. For example, if load offset=0x2700
                   and load 段=0x1000, the first byte of the 文件 will
                   be at 1000:2700, 或 in 线性地址ing, 0x12700.
 文件 offset     - 偏移量in the input 文件 to load bytes from.
 字节数 - 要从文件加载的字节数。
                   0 表达尽可能多地加载。
 创建段 - 如果未选中，IDA 不会创建段。

 代码段           - 如果选中，IDA 将创建一个代码段。
                          relevant for processors which have different
                          code/数据段 addressing schemes (for
                          example, Atmel AVR).


 加载附加文件

加载附加文件

 操作名称: LoadFile
此命令加载二进制文件。新文件将添加到当前数据库中，并保留所有现有信息。

文件内容将在程序中显示为未探查的字节。

此命令仅允许你加载二进制文件。

另参见 加载...子菜单命令。


 加载 C 头文件

加载 C 头文件

 操作名称: LoadHeaderFile
此命令允许你将 C 头文件中的类型声明应用于程序。

IDA 像 C 编译器一样读取和解析指定的头文件。换句话说，它模仿了 C 编译器的前端，但有一些限制：

        - only type declarations are allowed. The function definitions
          in the input file are skipped
        - not all C++ header files are not supported, only simple classes can
          be parsed
        - the compiler specific predefined macros are not defined,
          you have to define them manually in the header file
Don't forget to specify the compiler and memory model in the compiler setup dialog box before loading a header file.

All type declarations found in the input file are stored in the current database in the form of a type library. These type declarations can be used to define new structure and enumeration definitions by pressing "Add standard structure" or "Add standard enum" buttons in the Add enum type... and Add struct type... dialog boxes.

In the case of an error in the input file, the error messages appear in the message window. In any case, the function declarations that are already parsed are not deleted from the database. IDA stops parsing the input file when 20 errors occur.

IDA 7.7 introduced an alternative header file parser based on libclang.

另参见 加载...子菜单命令。 本地类型窗口 IDAClang 插件


 加载调试信息文件

加载调试信息文件

 操作名称: LoadDbgFile
此命令加载 DBG 文件。

如果被反汇编的程序具有配套的 DBG 文件，则此命令可用于将信息从 DBG 文件加载到数据库中。如果 IDA 可以在包含输入文件的目录中找到 DBG 文件，则会自动加载这些文件。

内置调试信息加载器无法加载 NB10 格式文件和 PDB 文件。要加载这些文件，请使用一个特殊的插件 PDB.DLL，该插件可以使用 编辑->插件 子菜单手动运行。此插件使用 MS WINDOWS DLL 加载调试信息，因此具有以下限制:

        - 它仅适用于 MS Windows
        - 它将仅加载与当前兼容的 PDB
          安装 IMAGEHLP.DLL
另参见 加载...子菜单命令。


 加载桌面

加载桌面
此命令显示所有可用的桌面(存储在数据库或注册表中)。按 <Enter> 从所选桌面加载桌面配置。按 <Del> 可删除所选桌面。

另参见

         桌面
         保存桌面...命令
         删除桌面...命令
         重置桌面命令


 加载文件对话框

加载文件对话框
以下是对话框字段的说明：
 加载地址 - 将加载文件的段落。
                仅对 EXE 和二进制文件有意义。对于新的 exe
                文件，请使用“手动加载”功能。
 加载偏移量 - 仅与二进制文件相关。
                指定从第一段开始的第一个字节的偏移量。例如, 如果加载偏移=0x2700 且
                加载地址=0x1000, 则文件的第一个字节将在 1000:2700。
 DLL 目录 - IDA 将在其中查找引用的 DLL 文件的路径。
                请注意，如果 IDA 发现 .IDS 文件，它不寻找 .DLL 文件。
 创建段 - 与二进制文件相关。如果未选中，IDA 将不会创建段。
 加载资源 - 如果未选中，则 IDA 不会从 NE 文件加载资源。
 重命名 DLL 条目 - 如果未勾选，IDA 将对按序号导入的条目进行重复注释。
                      否则，IDA 将条目重命名为有意义的名称。
 手动加载 - 仅与 NE、LE、LX、ELF 文件相关。
                     如果选中，IDA 将询问文件的每个对象的加载地址和选择器。
                     仅供有经验的用户使用！
 填补段间隙 - 仅与 COFF 和 OMF 文件相关。
                     如果选中，IDA 将填补段之间的空白，创建一个大块。
                     该选项便于加载大型对象文件。
 制作导入部分 - 仅适用于 PE 文件。
                     如果选中，IDA 将转换 .idata 部分定义到“extrn”指令并截断它。
                     遗憾的是，.idata 部分有时会有一些附加数据，
                     因此如果某些信息没有加载到数据库中，则需要禁用此功能。
 创建 FLAT 组 - 仅与 IBM PC PE 文件相关。
                     如果选中，IDA 将自动创建 FLAT 组，并将其选择器作为段寄存器的默认值。
 代码段 - 如果选中，IDA 将创建代码，但不会创建数据段。适用于具有不同代码/数据段寻址方案的
                     处理器(例如 Atmel AVR)。
 加载选项 - 仅与 ELF，JAVA 文件相关。
                     如果选中，IDA 将询问附加的加载程序选项。仅供有经验的用户使用！


 加载 FLIRT 签名文件

加载 FLIRT 签名文件

 操作名称: LoadSigFile
此命令允许你将其他签名文件应用于程序。

签名文件包含标准运行时函数的模式。在它们的帮助下，IDA 能够识别标准函数并相应地命名它们。

IDA 尝试自动检测必要的签名文件，但不幸的是，这并不总是可行的。此命令将指定的签名文件添加到计划的签名文件队列中。

签名文件位于 SIG 目录的子目录中。每个处理器都有自己的子目录。子目录的名称等同于处理器模块文件的名称(例如，z80 表示 z80.w32)。注意：IBM PC 签名位于 SIG 目录本身中。注意：IDASGN 环境变量可用于指定签名目录的位置。

加载签名文件还有另一种方法：你可以通过以下方式插入/删除签名文件:

        - 打开签名窗口
        - 按 Ins 将签名文件插入队列
        - 按 Del 从队列中删除签名文件
这是应用签名的首选方法，因为有用的信息(如已识别的功能数)会显示在签名窗口中。

注意：FLIRT 仅适用于具有正常字节大小的处理器。 字节大小必须等于 8(不支持具有宽字节的处理器，如 AVR 或 DSP56K)

另参见 加载...子菜单命令。


 加载 IDS 文件

加载 IDS 文件

 操作名称: LoadIdsFile
此命令加载 IDS 文件。

IDS 文件包含有关已知函数(例如来自 MS Windows API 的函数)的信息，即:

        - 它们的名称
        - 它们在 DLL 中的序号
        - 最终的信息性注释
        - 堆栈上传递的参数数量
        - 返回时清除的参数数量
如果在 IDS 目录中找到 IDS 文件，则会自动加载这些文件。此命令允许你从任何目录加载 IDS 文件，即使在主文件加载到数据库中也是如此。

另参见 加载...子菜单命令。


 加载 PDB 调试信息文件

加载 PDB 调试信息文件

 操作名称: LoadPdbFile
该命令加载 PDB 文件。

If the program being disassembled has a companion PDB 文件, then 该命令 may be used to load信息 from the PDB 文件 into the database.

Please note that the PDB loader uses the system DLL IMAGEHLP.DLL to load the PDB 文件. The system DLL may refuse to load the PDB 文件 if it is from another operating system version 或 for some other reason.For them, IDA can fall back to using Microsoft DLLs (the default is "do not fall back"). Please read more in cfg/pdb.cfg.

另参见:
   a href=430.html"加载...子菜单命令
   调试器模块列表命令。
        Debugger module list 命令。


 加载 TDS 调试信息文件

加载 TDS 调试信息文件

 操作名称: LoadTdsFile
该命令 loads a TDS 文件.

If the program being disassembled has a companion TDS 文件, 该命令 may be used to load信息 from the TDS 文件 into the database.

The TDS 文件 must be placed in the same directory together with the input 文件.

LoadTdsFile 命令启动一个特殊的插件 TDS.DLL 可以使用 编辑 -> 插件 子菜单手动运行该插件。

另参见 加载...子菜单命令。


 load_and_run_plugin

load_and_run_plugin

Load and run a plugin
The plugin name is a short plugin name without an extension
返回: 0 if could not load the plugin, 1 if ok

success load_and_run_plugin(string name, long arg);


 load_debugger

load_debugger

加载调试器
     dbgname - 调试器模块名称
                  示例: win32, linux, mac.
      use_remote - 0/1: 使用远程调试器或不使用
当从命令行运行 idc 脚本时才需要该函数。
在其他情况下 IDA 自动调试器模块。

success LoadDebugger(string dbgname, long use_remote);


 loader_input_t

loader_input_t

Open an input file for reading
     filename - name of the file to open
     is_remote- !=0 means to open a file on the remote computer
                (possible only during remote debugging)
Returns loader_input_t object or 0

loader_input_t open_loader_input(string filename, long is_remote);


 loader_input_t.close

loader_input_t.close

Close the input file

void loader_input_t.close();


 loader_input_t.getc

loader_input_t.getc

Read one byte from the input file
Returns -1 if no more bytes

long loader_input_t.getc();


 loader_input_t.gets

loader_input_t.gets

Read one line of text from the input file
     maxsize - maximal size of the line
返回：
string loader_input_t.gets(long maxsize);


 loader_input_t.getz

loader_input_t.getz

从输入文件中读取以零结尾的字符串
     pos - 要从中读取的文件位置
     maxsize - 字符串的最大大小
返回值：a string 或 0

string loader_input_t.getz(long pos, long maxsize);


 loader_input_t.read

loader_input_t.read

Read from the input file
     buf - reference to the variable that will hold the read bytes
           in form of a string
     size - number of bytes to read
Returns: number of read bytes

long loader_input_t.read(vref buf, long size);
// 例如:
        auto li, buf;
        li = open_loader_input("myfile", 0);
        li.read(&buf, 100);


 loader_input_t.readbytes

loader_input_t.readbytes

Read a multibyte value from the input file
     result - reference to the variable that will hold the result
     size   - size of the value. Usually is: 1, 2, 4, 8
     be     - treat bytes as big-endian?
返回: 0: 正常，-1: 失败

long loader_input_t.readbytes(vref result, long size, long mf);


 loader_input_t.seek

loader_input_t.seek

Seek in the input file
     pos - position to seek to
     whence - where from?
Returns: the new file position

long loader_input_t.seek(long pos, long whence);
#define SEEK_SET   0 // from the file start #define SEEK_CUR   1 // from the current position #define SEEK_END   2 // from the file end


 loader_input_t.size

loader_input_t.size

Get size of the input file

long loader_input_t.size();


 loader_input_t.tell

loader_input_t.tell

获取当前文件位置

long loader_input_t.tell();


 loadfile

loadfile

load file into IDA database
     handle - file handle or loader_input_t object
     pos    - position in the file
     ea     - linear address to load
     size   - number of bytes to load
返回: 0 - error
         1 - ok

success loadfile(long handle, long pos, long ea, long size);


 本地类型窗口

本地类型窗口

 操作名称: OpenLocalTypes
每个数据库都嵌入了一个本地类型库。 此类型库 (til) 用于存储当前数据库的本地类型。 它们通常是通过 解析 头文件创建的。

此命令将打开本地类型窗口。 用户可以在此处操作本地类型:

  - the existing types can be modified (the default hotkey is Ctrl-E)
  - the existing types can be deleted (the default hotkey is Del)
  - new types can be added (the default hotkey is Ins)
Please note that Ins can be used to add many types at once. For that the user just needs to enter multiple declarations, one after another in the dialog box.

However, Ctrl-E permits for editing of one type at a time. This may cause problems with complex structure types with nested types. Nested types will not be saved by Ctrl-E.

If the edited type corresponds to an idb type (struct or enum), then the corresponding type will be automatically synchronized. If the user modifies an idb type in the struct/enum windows, the corresponding local type will be updated too. So the type synchronization works both ways.

Some types in this list are created automatically by IDA. They are copies of the types defined in the Struct or Enum views. Such types are displayed using in gray, as if they are disabled.

Types displayed in black are considered as C level types. Read more.

Each type in the local type library has an ordinal number and may have a name.

Be careful when deleting existing types because if there are references to them, they will be invalidated.

本地类型可以映射到另一种类型。Such an operation deletes the existing type and redirects all its references to the destination type. Circular dependencies are forbidden. In the case of a user mistake, a mapped type can be deleted and recreated with the correct information.

 另请参阅 视图|打开子视图 子菜单。
          类型库窗口
          C++ 类型详细信息


 本地视图(源代码级别)

本地视图(源代码级别)
该窗口显示当前函数的局部变量值 (基于寄存器和堆栈)。


 低和高的可疑操作数限制

低和高的可疑操作数限制
If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and display it in red/orange.

Two values control the definition of suspiciousness. An operand is 'suspicious' if it has an immediate value between low and high 'suspicious' limits. The comparison is always unsigned, i.e. in the instruction

        mov ax,[bp-2]

  the immediate operand is 0xFFFE, not -2.
IDA uses a simple heuristic to determine initial suspiciousness limits. You may change these limits any time you want.

另参见

         注释对话框
         如何输入数字。


 低级断点条件

低级断点条件
低级断点条件 can be used to speed up the 调试器. They are evaluated like this:
  - in case of 远程调试, the condition is evaluated on the remote
    computer. The following actions are bypassed:
      - sending of the breakpoint event to the local computer
      - switching from debthread to the main thread
      - updating internal IDA 结构体 and caches
      - updating the screen

  - in case of local debugging, the condition is evaluated at low level.
    The following actions are bypassed:
      - switching from debthread to the main thread
      - updating internal IDA 结构体 and caches
      - updating the screen
In both cases, there is a significant speed up. This improvement imposes some limitations on the breakpoint condition:
  - only   IDC expressions can be used for low level conditions
  - only functions marked as 'thread-safe' may be called
  - only entire registers can be accessed (e.g. EAX is ok but AL is not)
Essentially this means that the only available functions are:
  - read/write process registers
  - read/write process memory
  - 文件 i/o
  - auxiliary string and object functions
  - Message() 函数 (for debugging the 断点条件)
低级断点条件 are available only for Win32, WinCE, Linux, Mac, Android debuggers.


 ltoa

ltoa

Convert a number to a string.
     n - number
     radix - number base (2, 8, 10, 16)
Thread-safe function.

string ltoa(long n, long radix);


 Lumina 元数据

Lumina 元数据
元数据目前包含以下信息:
  - 函数地址、名称、原型
  - 函数框架布局
  - 堆栈变量
  - 用户定义的 SP 更改点
  - 指令操作数的表示
  - 函数和说明注释
我们计划在未来向元数据添加更多信息。

另参见 Lumina 子菜单


 Lumina 选项

Lumina 选项
This options tab allows for modification of Lumina credentials and use settings.

Use the public server

        Sets host and port to the default public server hosted by Hex-Rays.
        No username or password is required.
Use a private server
        Allows for setting the name/address and port of a private server.
        If username and password credentials are needed, they can be specified here.
Automatically use Lumina server for analysis
        Instructs IDA to fetch function metadata from the current Lumina server,
        after the initial auto-analysis is complete. This helps with the recognition
        of known functions stored in the database of the Lumina server.


 Lumina 子菜单

Lumina 子菜单
此子菜单包含与 Lumina 服务器一起使用的操作：
    提取所有元数据
    推送所有元数据
    查看所有元数据
    提取当前函数元数据
    推送当前函数元数据
要了解有关 Lumina 的更多信息，请阅读：
  https://www.hex-rays.com/products/ida/lumina


 主要理念

主要理念
IDA 是一个交互式反汇编程序，这意味着用户主动参与反汇编过程。IDA 不是程序的自动分析器。IDA 会为你提供有关可疑指令、未解决的问题等的提示。你的工作是告知 IDA 如何进行。

如果你是第一次使用 IDA，这里有一些非常有用的命令:

  - 转换为指令 : 热键为 "C"
  - 转换为数据 : 热键为 "D"
你所做的所有更改都将保存到磁盘。当你再次运行 IDA 时，将从磁盘中读取有关正在反汇编的文件的所有信息，以便你可以继续工作。

有关其他命令，请参阅 菜单系统和帮助。


 主菜单栏

主菜单栏
所有 IDA 命令均可从以下菜单中获得：
 文件
 编辑
 跳转
 搜索
 视图
 调试器
 Lumina
 选项
 窗口


 make_array

make_array

Create an array.
     ea      - linear address
     nitems  - size of array in items
This function will create an array of the items with the same type as the
type of the item at 'ea'. If the byte at 'ea' is undefined, then this
function will create an array of bytes.

success make_array(long ea, long nitems);


 手动内存区域

手动内存区域

 操作名称: ManualRegions
此命令将打开一个包含手动内存区域的窗口。在此窗口中，用户可以操作内存区域定义：添加或删除它们。

某些调试器后端(例如 gdb 后端)不提供内存布局信息。 IDA 需要此信息才能显示内存内容。当此信息不可用时，用户必须指定它。

当调试器处于活动状态时，可以访问定义的内存区域。用户将能够在反汇编窗口中看到内存内容。

如果用户和调试器后端均未提供内存信息，则 IDA 将假定整个内存空间均可访问。但是，最好更精确地指定内存布局。

另参见 调试器子菜单。


 标记位置

标记位置

 操作名称: MarkPosition
你可以标记文件的某些位置，以便能够快速跳转到它们。位置的文本描述可能有助于轻松找到所需的位置。

首先为标记选择一个插槽，然后输入位置的描述。

另参见跳转子菜单。


 达到段的最大数字

达到段的最大数字
When IDA tried to delete bytes outside of any segment, the maximal number of contiguous chunks is reached. This is NOT a fatal error.

Some bytes outside of any segment will be present => the output text will be incorrect because of these bytes. However, you can delete them in the output text using a text editor.


 菜单系统

菜单系统
主菜单栏
  文件
    加载文件
      重新加载输入文件
      脚本文件
      二进制文件
      IDS 文件
      调试信息文件
      PDB 调试信息文件
      TDS 调试信息文件
      FLIRT 签名文件
      C 头文件
    脚本命令
    生成输出文件
      生成 MAP 文件
      生成 ASM 文件
      生成 INC 文件
      生成 LST 文件
      生成 EXE 文件
      生成 DIF 文件
      生成 HTML 文件
      生成流程图 GDL 文件
      生成调用图 GDL 文件
      将数据库转储到 IDC 文件
      将类型信息转储到 IDC 文件
      创建 C 头文件
    保存数据库
    将数据库另存为...
    获取数据库快照...
    终止
    退出
  编辑
    定位器
    导出数据
    撤消
    重做
    指令
    数据
    转换为字符串文字
    数组
    未定义
    重命名
    操作数类型
      偏移量
        将操作数转换为偏移量(数据段)
        将操作数转换为偏移量(代码段)
        将操作数转换为偏移量(任意段)
        将操作数转换为偏移量(用户定义的基数)
        将操作数转换为结构体偏移量
      数字
        将操作数转换为数字
        将操作数转换为十六进制数
        将操作数转换为十进制数
        将操作数转换为八进制数
        将操作数转换为二进制数
        将操作数转换为浮点数
        切换前导零
      将操作数转换为字符
      将操作数转换为段
      将操作数转换为符号常量(枚举成员)
      将操作数转换为堆栈变量
      更改操作数符号
      按位否定操作数
      用户定义的操作数
      设置操作数类型
    注释
      创建常规注释
      创建可重复的注释
      创建其他注释行
    函数
      创建函数...
      编辑函数...
      追加函数尾部...
      移除函数尾部...
      删除函数...
      设置函数结束
      定义堆栈变量...
      更改堆栈指针...
      重命名寄存器...
      设置函数/项类型...
    结构体
      添加结构体类型...
      复制结构体类型...
      删除结构体类型
      展开结构体类型...
      收缩结构体类型...
      编辑结构体类型...
      声明结构体变量
      强制零字段偏移
      选择合并成员...
      从数据创建结构体类型...
    枚举
      添加枚举类型...
      删除枚举类型
      编辑枚举类型...
      定义枚举成员...
      编辑枚举成员...
      删除枚举成员
    段
      创建一个新的段...
      删除段...
      更改段属性...
      移动段...
      变基程序...
      更改句段翻译...
      设置默认段寄存器值...
      更改段寄存器值...
    补丁核心
      补丁核心...
      汇编...
      将补丁应用于输入文件...
    其他
      对齐...
      手动指令...
      颜色说明...
      隐藏/显示边框
    插件
  跳转
    立即跳转
    返回跳转
    撤消上次返回跳转
    空导航堆栈
    跳转到地址
    跳转到指定位置
    跳转到段开始
    跳转到段寄存器更改点
    跳转到有问题的位置
    标记位置
    跳转到标记位置
    跳转到交叉引用
    跳转到对操作数的交叉引用
    跳转到功能
    跳转到入口点
    跳转到文件偏移量
  搜索
    可疑操作数
    字符串有错误
    指令字节
    数据字节数
    未探查的字节
    探查的字节数
    即时操作数值
    文本表示形式的子字符串
    子字符串
    不属于任何函数的指令
    查找所有可疑操作数
    查找所有错误
    搜索方向
  视图
    打开子视图...
      打开反汇编窗口
      打开导出窗口
      打开导入窗口
      打开函数窗口
      打开名称窗口
      打开签名窗口
      打开段窗口
      打开段寄存器窗口
      打开选择器窗口
      打开交叉引用窗口
      打开结构体窗口
      打开枚举窗口
      打开本地类型窗口
      打开问题窗口
      打开类型库窗口
      打开字符串窗口
      打开函数调用窗口
      打开记事本
      打开撤消历史记录
    图表...
      显示函数流程图
      显示函数调用图
      显示地址的交叉引用图表
      显示地址的交叉引用图表
      显示用户定义的交叉引用图表
    计算器
    查看段寄存器
    查看内部标志
    数据库快照管理器
    隐藏
    取消隐藏
    删除隐藏范围
    全部隐藏
    全部取消隐藏
    设置隐藏项目...
  调试器
    调试器窗口
    线程列表
    模块列表
    启动进程
    附加到进程...
    进程选项
    暂停进程
    终止进程
    从进程中分离
    获取内存快照
    手动内存区域
    步入
    步过
    运行直到返回
    运行到光标
    设置当前 ip
    显示应用程序屏幕
    断点
      断点列表
      添加断点
      编辑断点
      断点条件
      删除断点
      页面断点
    源视图
      监视视图(源级别)
      局部变量
    监视(汇编程序级别)
      监视列表
      添加监视
      删除监视
    跟踪
      跟踪管理
      跟踪窗口
        选择跟踪
        其他选项
        编辑跟踪说明
        二进制跟踪的比较
        移除二进制跟踪
        导入二进制跟踪
        导出二进制跟踪
        将跟踪导出到文本文件
        显示跟踪调用图
      清除跟踪
      指令跟踪
      函数跟踪
      基本块跟踪
      添加写入跟踪
      添加读/写跟踪
      添加执行跟踪
      堆栈跟踪
      跟踪选项
    调试器选项
    切换调试器...
  Lumina
  选项
    文本表达形式...
    注释...
    交叉引用的表达形式...
    汇编程序指令...
    名称表示...
    拆分的 C++ 名称...
    编译器...
    STRLIT 字符串样式...
    字符串选项...
    颜色...
    转储/普通视图
    设置数据类型...
    处理器类型...
    目标汇编程序...
    分析选项...
    杂项...
  窗口
    加载桌面...
    保存桌面...
    删除桌面...
    重置桌面
    重置隐藏的消息...
    设置视频模式...
    外部帮助
    键盘布局


 消息窗口

消息窗口
IDA 在开始时会打开一个特殊的不可关闭窗口。此窗口称为“消息窗口”。在此窗口中，你会看到各种 IDA 消息。

如果消息窗口隐藏在其他窗口后面，你将看不到 IDA 消息。

你可以将此窗口中显示的所有消息复制到文件中。为此，你必须定义一个环境变量：

        set IDALOG=logfile


 其他选项

其他选项

Editor

        A text editor is to be used when the user decides to edit an
        IDC script using the IDC tollbar.

Navigation band refresh interval (milliseconds)

        Specifies how often the navigation band will be refreshed.
        IDA tries to minimize the number of redrawings because they
        could be really time and processor consuming (imagine
        a huge program, 50-100 megabytes of code. it would
        take a long time to refresh information on the navigation
        band because the whole program will be examined to
        determine how to draw the band). If this option is set to 0,
        the navigation band is refreshed only when the cursor is
        moved far enough to reflect its movement on the band.

Convert already defined bytes

        Determines how IDA should behave when user operations
        would end up redefining some already-defined bytes

Associate .IDB file extension with IDA

        Whether or not the .IDB extension should be associated,
        at the OS-level, with IDA

Enable autocomplete in forms

        Determines whether input fields should provide an auto-complete
        combo box by default

Output files encoding

       The encoding used to generate output text files from IDA
       The value '<default>' means that the IDB's default 8 bit-per-unit
       encoding will be used.


 mkdir

mkdir

create a directory
     dirname - directory name
     mode    - file permissions (for unix)
返回: error code from the system
Thread-safe function.

long mkdir(string dirname, long mode);


 模块列表

模块列表

 操作名称: Modules
打开modules window.

This window lists all the modules loaded by the debugged process. Double click on a module to see the list of its exported names.

The right click menu allows for loading debug信息 for the current module. For that, select the "加载 debug symbols" 命令 from the popup menu. If IDA manages to find and load the corresponding 调试信息文件, it will import all symbols from it into the database. Currently, only PDB files are supported. The operation result is displayed in the 消息窗口.

 另参见 调试器子菜单。
          Load PDB files command.


 移动段

移动段

 操作名称: MoveSegment
This command allows you to move segment(s) to another address. Use it if the segment(s) are loaded at a wrong address.

This command shifts (moves) the selected segments in the memory to the target address. There must be enough free space at the target address for the segments.

All information in the segment will be moved to the new address, but since the addresses change, the disassembly might be not valid anymore (especially if the program is moved to the wrong addresses and the relocation information is not available).

 修复搬迁

        此选项允许 IDA 修改对重定位段的引用或来自重定位段的引用。 如果关闭，移动后的引用可能会出错。
另参见 编辑|段子菜单。


 move_segm

move_segm

Move a segment to a new address
This function moves all information to the new address
It fixes up address sensitive information in the kernel
The total effect is equal to reloading the segment to the target address
     ea    - any address within the segment to move
     to    - new segment start address
     flags - combination MFS_... constants
返回：
long move_segm(long ea, long to, long flags);
#define MSF_SILENT 0x0001 // don't display a "please wait" box on the screen #define MSF_NOFIX 0x0002 // don't call the loader to fix relocations #define MSF_LDKEEP 0x0004 // keep the loader in the memory (optimization) #define MSF_FIXONCE 0x0008 // valid for   rebase_program(): call loader only once #define MSF_NETDELTA 0x0010 // change inf.netdelta if possible#define MSF_NETNODES  0x0080    // move netnodes instead of changing inf.netdelta (this is slower)
#define MOVE_SEGM_OK           0     // all ok #define MOVE_SEGM_PARAM       -1     // The specified segment does not exist #define MOVE_SEGM_ROOM        -2     // Not enough free room at the target address #define MOVE_SEGM_IDP         -3     // IDP module forbids moving the segment #define MOVE_SEGM_CHUNK       -4     // Too many chunks are defined, can't move #define MOVE_SEGM_LOADER      -5     // The segment has been moved but the loader complained #define MOVE_SEGM_ODD         -6     // Can't move segments by an odd number of bytes #define MOVE_SEGM_ORPHAN      -7     // Orphan bytes hinder segment movement #define MOVE_SEGM_DEBUG       -8     // Debugger segments cannot be moved #define MOVE_SEGM_SOURCEFILES -9     // Source files ranges of addresses hinder segment movement #define MOVE_SEGM_MAPPING     -10    // Memory mapping ranges of addresses hinder segment movement #define MOVE_SEGM_INVAL       -11    // Invalid argument (delta/target does not fit the address space)


 移动段开始

移动段开始
编辑段边界时，可以选中“移动相邻段”复选框。

IDA 将尝试缩小/扩展前一个段，以便移动所选段的开头。当然，你不能将段的开头移动得太远：

  - the segment must have at least 1 byte
  - the start address of the segment must be less than the end of the segment
  - no segments can be killed during moving
  - the segment cannot have bytes with negative offsets
You cannot shrink a segment to zero bytes. 段必须至少有一个字节。

This command is mostly used when IDA does not detect the boundary between segments correctly.

Sometimes, IDA creates 2 segments where only one segment must exist. In this case, you should not use this command. Use the following sequence instead:

        - 删除 一个段。
          Choose the one with the bad segment base value.
          Do not disable addresses occupied by the segment being deleted.
        - change boundaries of the other segment.
Caution: moving the first segment of the program will delete all information about the bytes between the old start of the segment and the new start of the segment!

另参见另一个更改段边界的命令：

 编辑段
 编辑|段子菜单。


 msg

msg

Display an UTF-8 encoded message in the message window
     format - printf() style format string
     ...    - additional parameters if any
This function can be used to debug IDC scripts
The result of the stringification of the arguments
will be treated as an UTF-8 string.
线程安全函数。

void msg(string format, ...);
// Print variables in the message window // This function print text representation of all its arguments to the output window. // This function can be used to debug IDC scripts
void print(...);
// Display a message in a message box //      format - printf() style format string //      ...    - additional parameters if any // This function can be used to debug IDC scripts // The user will be able to hide messages if they appear twice in a row on the screen
void warning(string format, ...);
// Display a fatal message in a message box and quit IDA //      format - printf() style format string //      ...    - additional parameters if any
void error(string format, ...);


 名称表达形式

名称表达形式

 操作名称: SetNameType
虚拟名称由 IDA 自动生成。 它们用于表示子程序、程序位置和数据。

虚拟名称具有各种前缀，具体取决于项类型和值:

  sub_          指令，子例程启动
  locret_        '返回' 指令
  loc_          指令
  off_          数据，包含偏移值
  seg_          数据，包含段地址值
  asc_          数据，字符串文字
  byte_          数据，字节
  word_         数据，16 位
  dword_         数据，32 位
  qword_         数据，64 位
  byte3_         数据，3 个字节
  xmmword_      数据，128 位
  ymmword_      数据，256 位
  packreal_      数据，包装真实
  flt_          浮点数据，32 位
  dbl_          浮点数据，64 位
  tbyte_         浮点数据，80 位
  stru_        结构体
  custdata_      自定义数据类型
  algn_       对齐指令
  unk_        未探查的字节
您可以更改虚拟名称的表示形式。 IDA 支持多种类型的虚拟名称:
  0     loc_0_1234     segment base address relative to program base address
                       & offset from the segment base
  1     loc_1000_1234  segment base address & offset from the segment base
  2     loc_dseg_1234  segment name & offset from the segment base
  3     loc_0_11234    segment relative to base address & full address
  4     loc_1000_11234 segment base address & full address
  5     loc_dseg_11234 segment name & full address
  6     loc_12         full address
  7     loc_0012       full address (at least 4 digits)
  8     loc_00000012   full address (at least 8 digits)
  9     dseg_1234      the same as 2, but without data type specifier
 10     loc_1          enumerated names (loc_1,loc_2,loc_3...)
If you have selected names type 10 (enumerated names), you may renumber them using a checkbox. The process is relatively fast, surprisingly.

The best representation for MS DOS programs is #0, for 16-bit processors - #7, and for 32-bit processors - #8. You can change dummy names type any time you want.

You can also set up types of names included in the name list. IDA knows about the following types of names:

        - normal names
        - public names
        - weak public or extern names
        - autogenerated (meaningful) names.
        - dummy (meaningless) names.
Dummy names may be public or weak, but they never appear in the list of names. You can specify the type of a name when you create or modify it.

You can also set maximal length of new names. Old names will not be affected by this parameter.

另参见：

  重命名命令
  选项子菜单


 名称窗口

名称窗口

 操作名称: OpenNames
此命令将打开 名称 窗口。

你可以在此窗口中使用 列表查看器 命令。

GUI 版本为每个名称显示一个小图标:

        L (深蓝色) - 库函数
        F (深蓝色) - 常规函数
        C (浅蓝色) - 指令
        A (深绿色) - 字符串文字
        D (浅绿色) - 数据
        I (紫色) - 导入名称
另参见 视图|打开子视图子菜单。


 负偏移量

负偏移量
段不能具有与段基数为负偏移量的字节。示例：如果段基数 0x3000，则此段的起始地址可以大于或等于 0x30000，但不能有 0x2FFFF 起始地址。


 next_addr

next_addr

Get next address in the program
     ea - linear address
返回: BADADDR - the specified address in the last used address

long next_addr(long ea);


 next_head

next_head

Get next defined item (instruction or data) in the program
     ea    - linear address to start search from
     maxea - the search will stop at the address
             maxea is not included in the search range
返回: BADADDR - no (more) defined items

long next_head(long ea, long maxea);


 next_not_tail

next_not_tail

Get next not-tail address in the program
This function searches for the next displayable address in the program.
指令和数据的尾字节不可显示。
     ea - 线性地址
返回： BADADDR - 没有(更多)非尾部地址

long next_not_tail(long ea);


 nextattr

nextattr

Get the next object attribute
     self  - object
     attr  - current attribute name
If there are no more attributes, returns 0
Thread-safe function.

string nextattr(object self, string attr);


 当前字节没有段

当前字节没有段
Some commands cannot be applied to the addresses without a segment.

Create a segment first. You can do this using the CreateSegment command.


 不是虚拟数组文件

不是虚拟数组文件
最可能的错误是你尝试使用不兼容的 IDA 版本。从 IDA 2.0beta2 开始，虚拟文件的格式发生了变化。


 内存不足，无法完成操作。

内存不足，无法完成操作。
不幸的是，IDA 内存不足。我们现在无能为力。


 记事本

记事本

 操作名称: OpenNotepad
打开记事本窗口，查看有关当前数据库的常规注释。输入的注释将保存在当前数据库中。

Alt-T 热键可用于搜索文本，Ctrl-T 用于重复上次搜索。

记事本仅在 GUI 版本中可用。

另参见 视图|打开子视图子菜单。


 object.retrieve

object.retrieve

Retrieve a C structure from the idb or a buffer and convert it into an object typeinfo - description of the C structure. Can be specified as a declaration string or result of   get_tinfo() or similar functions src - address (ea) to retrieve the C structure from OR a string buffer previously packed with the store method flags - combination of   PIO_... bits
void object.retrieve(typeinfo, src, flags);


 object.store

object.store

Convert the object into a C structure and store it into the idb or a buffer typeinfo - description of the C structure. Can be specified as a declaration string or result of   get_tinfo() or similar functions dest - address (ea) to store the C structure OR a reference to a destination string flags - combination of PIO_.. bits
void object.store(typeinfo, dest, flags);
#define PIO_NOATTR_FAIL 0x0004 // missing attributes are not ok #define PIO_IGNORE_PTRS 0x0008 // do not follow pointers
#define PDF_INCL_DEPS 0x1      // Include dependencies #define PDF_DEF_FWD   0x2      // Allow forward declarations #define PDF_DEF_BASE  0x4      // Include base '__intX' types


 Objective-C 分析插件

Objective-C 分析插件
The objc plugin was created to facilitate analysis of binary files compiled from Objective-C.

For an overview of what the plugin can do, see menu Edit>Plugins>Objective-C Options.

Type Information

The bulk of the plugin's work is done at file load time, when it will parse all Objective-C type information embedded in the binary, and use this to create tinfo_t structures for all known classes and construct prototypes for all known methods.

This analysis can be invoked manually at any time with:

  Edit>Other>Objective-C>Reload Objective-C info
Or:
  idaapi.load_and_run_plugin("objc", 1)
You can also disable objc analysis at load time with command line option:
  -Oobjc:+l
或选中“延迟模式”选项：
  Edit>Other>Objective-C>Objective-C Options...
Decompilation

The plugin will also perform Objective-C analysis during decompilation.

When a function is decompiled, the plugin will analyze any calls to objc_msgSend, and use the arguments to determine if objc_msgSend will ultimately invoke one of the methods in the current database.

If such a situation is detected, the plugin will replace the call to objc_msgSend with a call to the target method, and add an xref to the method. This is done in the hopes that continued use of the decompiler will improve call graphs for Objective-C binaries.

If the target method has type information, then the return type can be used to refine the types of local variables in the pseudocode, which in turn could lead to more method calls being detected, and so on.

You can disable objc analysis in the pseudocode with command line option:

  -Oobjc:-h
Or uncheck the "Enable decompiler plugin for Objective-C" option in:
  Edit>Other>Objective-C>Objective-C Options...
Debugging

objc also provides tools for dynamic analysis.

During debugging, you can analyze objc info for a specific library by right-clicking in the Modules window and selecting "Load debug info".

This operation can also be performed programmatically with:

  n = idaapi.netnode()
  n.create("$ objc")
  n.supset(1, "/module/path", 'R')
  idaapi.load_and_run_plugin("objc", 3)
If you prefer that objc does not perform analysis during "Load debug info", (say if DWARF information is available for a module and you prefer that), you can disable this functionality with command line option:
  -Oobjc:-s
或者取消选中以下选项中的“为 Objective-C 启用 SIP ”选项：
  Edit>Other>Objective-C>Objective-C Options...
Step Into Message

The plugin also implements a "step into" debugger action for Objective-C.

If you use this action before a call to objc_msgSend, objc will try to calculate the address of method that is being invoked, and break at the method address rather than step into the objc_msgSend function itself.

You can perform this action with shortcut:

  Shift+O
Or via the menu option:
  Debugger>Run until message received
或者以编程方式使用：
  idaapi.load_and_run_plugin("objc", 2)
This action can be very useful, but you must be careful. When invoked, the action will automatically run to the address of objc_msgSend, analyze its arguments, then continue to the target method.

If there is no subsequent call to objc_msgSend in the program, you will lose control of the process. It is best to use this action only when you are sure that IP is in the vicinity of an objc_msgSend call.

NSConcreteStackBlock --------------------

The objc plugin can also be used to analyze Apple binaries that make heavy use of blocks: https://clang.llvm.org/docs/Block-ABI-Apple.html

The analysis involves identifying NSConcreteStackBlock instances on the stack, and creating a specialized Block_layout structure to apply to the function's stack frame.

The end result transforms the following sequence of statements:

  loc_BF60:                                 Block_layout_BF60 v1;
    v1 = _NSConcreteStackBlock;             v1.isa        = _NSConcreteStackBlock;
    v2 = 0x...;                             v1.flags      = 0x...;
    v3 = 0;                                 v1.reserved   = 0;
    v4 = __block_invoke;             =>     v1.invoke     = __block_invoke;
    v5 = &__block_descriptor_tmp;           v1.descriptor = &__block_descriptor_tmp;
    v6 = ...                                v1.lvar1      = ...
    v7 = ...                                v1.lvar2      = ...
    ...                                     ...
    func(&v1);                              func(&v1);
Already this cleans up the analysis quite a lot, but more importantly this new Block_layout_BF60 structure will be applied to the prototype of __block_invoke, which can heavily improve the pseudocode.

Block analysis can be performed on the database with:

  Edit>Other>Objective-C>Analyze stack-allocated blocks (entire database)
或者以编程方式使用：
  idaapi.load_and_run_plugin("objc", 5)
You can also perform block analysis on a specific function:
  Edit>Other>Objective-C>Analyze stack-allocated blocks (current function)
Or with shortcut:
  Ctrl+Shift+S
或者以编程方式：
  n = idaapi.netnode()
  n.create("$ objc")
  n.altset(1, 0xBF60, 'R') # the address can be any address within the function
  idaapi.load_and_run_plugin("objc", 5)
These actions work in both the disassembly and pseudocode windows, but note that you must refresh the pseudocode with F5 for the changes to take full effect.

Also, please note that this feature makes use of the microcode in the hexrays SDK, so you must have the decompiler in order to use it.

NSConcreteGlobalBlock ---------------------

Global blocks (i.e. blocks that don't make use of local variables) are much easier to analyze, and simply involve identifying references to NSConcreteGlobalBlock in the __const segment.

Global blocks are analyzed automatically at load time, but the analysis can be performed manually at any time with:

  Edit>Other>Objective-C>Re-analyze global block functions
Or:
  idaapi.load_and_run_plugin("objc", 4)
Command Line ------------

下面是可以传递给 objc 的命令行参数的摘要：

可以使用 "+"或"-"启用或禁用 objc 功能，后跟以下字符之一：

  v: 冗长模式
  s: 源信息提供程序
  h: 十六进制反编译器分析
  l: 懒惰模式
例如，-Oobjc:+v:+l:-s 将启用冗余和懒惰模式，并禁用 objc SIP。

另参见 适用于 macOS 的调试器 远程 iOS 调试器 DYLD 共享缓存实用程序


 废弃的数据库格式

废弃的数据库格式
请使用旧版本的 IDA。IDA 的当前版本不支持该数据库。


 op_bin

op_bin

Convert an operand of the item (instruction or data) to a binary number
     ea  - linear address
      n  - number of operand
             0 - the first operand
             1 - the second, third and all other operands
             -1 - all operands
Note: the data items use only the type of the first operand
Returns: 1-ok, 0-failure

success op_bin(long ea, int n);
// Convert an operand of the item (instruction or data) to an octal number
success op_oct(long ea, int n);
// Convert operand to decimal, hex, char
success op_dec(long ea, int n); success op_hex(long ea, int n); success op_chr(long ea, int n);


 op_enum

op_enum

Convert operand to a symbolic constant
(for the explanations of 'ea' and 'n' please see op_bin())
     enumid - id of enumeration type
     serial - serial number of the constant in the enumeration
              The serial numbers are used if there are more than
              one symbolic constant with the same value in the
              enumeration. In this case the first defined constant
              get the serial number 0, then second 1, etc.
              There could be 256 symbolic constants with the same
              value in the enumeration.

success op_enum(long ea, int n, long enumid, long serial);


 op_flt

op_flt

Convert operand to a floating-point number (for the explanations of 'ea' and 'n' please see   op_bin())
success op_flt(long ea, int n);


 op_man

op_man

Specify operand represenation manually.
(for the explanations of 'ea' and 'n' please see op_bin())
     str - a string represenation of the operand
IDA will not check the specified operand, it will simply display
it instead of the orginal representation of the operand.

success op_man(long ea, long n, string str);// manually enter n-th operand


 op_num

op_num

Convert operand to a number (with default number base, radix)
(for the explanations of 'ea' and 'n' please see op_bin())

success op_num(long ea, int n);


 op_offset

op_offset

Convert operand to a complex offset expression
This is a more powerful version of op_plain_offset() function.
It allows to explicitly specify the reference type (off8, off16, etc)
and the expression target with a possible target delta.
复杂表达式由 IDA 以下列形式表示：

        target + tdelta - base

If the target is not present, then it will be calculated using
        target = operand_value - tdelta + base
The target must be present for LOW.. and HIGH.. reference types
     ea      - linear address of the instruction/data
     n       - number of operand to convert (the same as in op_plain_offset)
     reftype - one of REF_... constants
     target  - an explicitly specified expression target. if you don't
               want to specify it, use -1. Please note that LOW... and
               HIGH... reference type requre the target.
     base    - the offset base (a linear address)
     tdelta  - a displacement from the target which will be displayed
               in the expression.

success op_offset(long ea, int n, long reftype, long target, long base, long tdelta);
#define REF_OFF8    0              // 8bit full offset #define REF_OFF16   1              // 16bit full offset #define REF_OFF32   2              // 32bit full offset #define REF_LOW8    3              // low 8bits of 16bit offset #define REF_LOW16   4              // low 16bits of 32bit offset #define REF_HIGH8   5              // high 8bits of 16bit offset #define REF_HIGH16  6              // high 16bits of 32bit offset #define V695_REF_VHIGH   7         // obsolete #define V695_REF_VLOW    8         // obsolete #define REF_OFF64   9              // 64bit full offset // note: processor modules or plugins may register additional // custom reference types (for example, REF_HIGHA16 is // used by MIPS, SPARC, PPC, ALPHA, TRICORE, etc.) #define REFINFO_RVA         0x10   // based reference (rva) #define REFINFO_PASTEND     0x20   // reference past an item // it may point to an nonexistitng address // do not destroy alignment dirs #define REFINFO_NOBASE      0x80   // offset base is a number // implies that base have be any value // nb: base xrefs are created only if base // points to the middle of a segment #define REFINFO_SUBTRACT  0x0100   // the reference value is subtracted from // the base value instead of (as usual) // being added to it #define REFINFO_SIGNEDOP  0x0200   // the operand value is sign-extended (only // supported for REF_OFF8/16/32/64) #define REFINFO_NO_ZEROS  0x0400  ///< an opval of 0 will be considered invalid #define REFINFO_NO_ONES   0x0800  ///< an opval of ~0 will be considered invalid


 op_offset_high16

op_offset_high16

Convert operand to a high offset
High offset is the upper 16bits of an offset.
This type is used by PPC, MIPS, and other RISC processors.
(for the explanations of 'ea' and 'n' please see op_bin())
     target - the full value (all 32bits) of the offset

success op_offset_high16(long ea, int n, long target);


 op_plain_offset

op_plain_offset

Convert operand to an offset
(for the explanations of 'ea' and 'n' please see op_bin())
     base - base of the offset as a linear address
            If base == BADADDR then the current operand becomes non-offset
示例:
 seg000:2000 dw      1234h
and there is a segment at paragraph 0x1000 and there is a data item
within the segment at 0x1234:
 seg000:1234 MyString        db 'Hello, world!', 0
Then you need to specify a linear address of the segment base to
create a proper offset:
     op_plain_offset(to_ea("seg000", 0x2000), 0, 0x10000);
and you will have:
 seg000:2000 dw      offset MyString
Motorola 680x0 processor have a concept of "outer offsets".
If you want to create an outer offset, you need to combine number
of the operand with the following bit:

#define OPND_OUTER      0x80                    // outer offset base // Please note that the outer offsets are meaningful only for // Motorola 680x0.
success op_plain_offset(long ea, int n, long base);


 op_seg

op_seg

Convert operand to a segment expression
(for the explanations of 'ea' and 'n' please see op_bin())

success op_seg(long ea, int n);


 op_stkvar

op_stkvar

Convert operand to a stack variable
(for the explanations of 'ea' and 'n' please see op_bin())

success op_stkvar(long ea, int n);


 op_stroff

op_stroff

Convert operand to an offset in a structure
(for the explanations of 'ea' and 'n' please see op_bin())
     strid - id of a structure type
     delta - struct offset delta. usually 0. denotes the difference
             between the structure base and the pointer into the structure.

success op_stroff(long ea, int n, long strid, long delta);


 打开子视图

打开子视图
以下是打开各种窗口、显示信息等的命令。
  打开反汇编窗口
  打开导出窗口
  打开导入窗口
  打开函数窗口
  打开名称窗口
  打开签名窗口
  打开段窗口
  打开段寄存器窗口
  打开选择器窗口
  打开交叉引用窗口
  打开结构体窗口
  打开枚举窗口
  打开本地类型窗口
  打开问题窗口
  打开类型库窗口
  打开字符串窗口
  打开函数调用窗口
  打开记事本
  打开撤消历史记录
某些窗口允许你使用 列表 查看器命令来操作窗口内容。

另参见 视图子菜单。


 选项子菜单

选项子菜单
此子菜单允许你更改各种选项和设置：
    文本表达形式...
    注释...
    交叉引用的表达形式...
    禁用历史记录
    清除撤消历史记录
    汇编程序指令...
    名称表示...
    Demangled C 名称...
    编译器...
    字符串样式...
    字符串选项...
    颜色...
    转储/正常视图
    设置数据类型...

    处理器类型...
    目标汇编程序...

    分析选项...
另参见 菜单栏子菜单。


 OpTypes

OpTypes

#define MS_0TYPE 0x00F00000            // Mask for 1st arg typing
#define FF_0VOID 0x00000000            // Void (unknown)?
#define FF_0NUMH 0x00100000            // Hexadecimal number?
#define FF_0NUMD 0x00200000            // Decimal number?
#define FF_0CHAR 0x00300000            // Char ('x')?
#define FF_0SEG  0x00400000            // Segment?
#define FF_0OFF  0x00500000            // Offset?
#define FF_0NUMB 0x00600000            // Binary number?
#define FF_0NUMO 0x00700000            // Octal number?
#define FF_0ENUM 0x00800000            // Enumeration?
#define FF_0FOP  0x00900000            // Forced operand?
#define FF_0STRO 0x00A00000            // Struct offset?
#define FF_0STK  0x00B00000            // Stack variable?
#define FF_0FLT  0x00C00000            // Floating point number?
#define FF_0CUST 0x00D00000            // Custom format type?

#define MS_1TYPE 0x0F000000            // Mask for 2nd arg typing #define FF_1VOID 0x00000000            // Void (unknown)? #define FF_1NUMH 0x01000000            // Hexadecimal number? #define FF_1NUMD 0x02000000            // Decimal number? #define FF_1CHAR 0x03000000            // Char ('x')? #define FF_1SEG  0x04000000            // Segment? #define FF_1OFF  0x05000000            // Offset? #define FF_1NUMB 0x06000000            // Binary number? #define FF_1NUMO 0x07000000            // Octal number? #define FF_1ENUM 0x08000000            // Enumeration? #define FF_1FOP  0x09000000            // Forced operand? #define FF_1STRO 0x0A000000            // Struct offset? #define FF_1STK  0x0B000000            // Stack variable? #define FF_1FLT  0x0C000000            // Floating point number? #define FF_1CUST 0x0D000000            // Custom format type?
// The following macros answer questions like //   'is the 1st (or 2nd) operand of instruction or data of the given type'? // Please note that data items use only the 1st operand type (is...0)
#define is_defarg0(F)    ((F & MS_0TYPE) != FF_0VOID) #define is_defarg1(F)    ((F & MS_1TYPE) != FF_1VOID) #define is_dec0(F)       ((F & MS_0TYPE) == FF_0NUMD) #define is_dec1(F)       ((F & MS_1TYPE) == FF_1NUMD) #define is_hex0(F)       ((F & MS_0TYPE) == FF_0NUMH) #define is_hex1(F)       ((F & MS_1TYPE) == FF_1NUMH) #define is_oct0(F)       ((F & MS_0TYPE) == FF_0NUMO) #define is_oct1(F)       ((F & MS_1TYPE) == FF_1NUMO) #define is_bin0(F)       ((F & MS_0TYPE) == FF_0NUMB) #define is_bin1(F)       ((F & MS_1TYPE) == FF_1NUMB) #define is_off0(F)       ((F & MS_0TYPE) == FF_0OFF) #define is_off1(F)       ((F & MS_1TYPE) == FF_1OFF) #define is_char0(F)      ((F & MS_0TYPE) == FF_0CHAR) #define is_char1(F)      ((F & MS_1TYPE) == FF_1CHAR) #define is_seg0(F)       ((F & MS_0TYPE) == FF_0SEG) #define is_seg1(F)       ((F & MS_1TYPE) == FF_1SEG) #define is_enum0(F)      ((F & MS_0TYPE) == FF_0ENUM) #define is_enum1(F)      ((F & MS_1TYPE) == FF_1ENUM) #define is_manual0(F)    ((F & MS_0TYPE) == FF_0FOP) #define is_manual1(F)    ((F & MS_1TYPE) == FF_1FOP) #define is_stroff0(F)    ((F & MS_0TYPE) == FF_0STRO) #define is_stroff1(F)    ((F & MS_1TYPE) == FF_1STRO) #define is_stkvar0(F)    ((F & MS_0TYPE) == FF_0STK) #define is_stkvar1(F)    ((F & MS_1TYPE) == FF_1STK) #define is_float0(F)     ((F & MS_0TYPE) == FF_0FLT) #define is_float1(F)     ((F & MS_1TYPE) == FF_1FLT) #define is_custfmt0(F)   ((F & MS_0TYPE) == FF_0CUST) #define is_custfmt1(F)   ((F & MS_1TYPE) == FF_1CUST)
// //      Bits for DATA bytes // #define DT_TYPE       0xF0000000       // Mask for DATA typing
#define FF_BYTE       0x00000000       // byte #define FF_WORD       0x10000000       // word #define FF_DWORD      0x20000000       // dword #define FF_QWORD      0x30000000       // qword #define FF_TBYTE      0x40000000       // tbyte #define FF_STRLIT     0x50000000       // ASCII    ? #define FF_STRUCT     0x60000000       // Struct   ? #define FF_OWORD      0x70000000       // octaword (16 bytes/128 bits) #define FF_FLOAT      0x80000000       // float #define FF_DOUBLE     0x90000000       // double #define FF_PACKREAL   0xA0000000       // packed decimal real #define FF_ALIGN      0xB0000000       // alignment directive #define FF_CUSTOM     0xD0000000       // custom data type #define FF_YWORD      0xE0000000       // ymm word (32 bytes/256 bits) #define FF_ZWORD      0xF0000000       // zmm word (64 bytes/512 bits)
#define is_byte(F)      (is_data(F) && (F & DT_TYPE) == FF_BYTE) #define is_word(F)      (is_data(F) && (F & DT_TYPE) == FF_WORD) #define is_dword(F)     (is_data(F) && (F & DT_TYPE) == FF_DWORD) #define is_qword(F)     (is_data(F) && (F & DT_TYPE) == FF_QWORD) #define is_oword(F)     (is_data(F) && (F & DT_TYPE) == FF_OWORD) #define is_yword(F)     (is_data(F) && (F & DT_TYPE) == FF_YWORD) #define is_tbyte(F)     (is_data(F) && (F & DT_TYPE) == FF_TBYTE) #define is_float(F)     (is_data(F) && (F & DT_TYPE) == FF_FLOAT) #define is_double(F)    (is_data(F) && (F & DT_TYPE) == FF_DOUBLE) #define is_pack_real(F) (is_data(F) && (F & DT_TYPE) == FF_PACKREAL) #define is_strlit(F)    (is_data(F) && (F & DT_TYPE) == FF_STRLIT) #define is_struct(F)    (is_data(F) && (F & DT_TYPE) == FF_STRUCT) #define is_align(F)     (is_data(F) && (F & DT_TYPE) == FF_ALIGN) #define is_custom(F)    (is_data(F) && (F & DT_TYPE) == FF_CUSTOM)
// //      Bits for CODE bytes //
#define MS_CODE 0xF0000000 #define FF_FUNC 0x10000000             // 函数开始? #define FF_IMMD 0x40000000             // Has Immediate value ? #define FF_JUMP 0x80000000             // Has jump table
// //      Loader flags //
#define NEF_SEGS   0x0001               // Create segments #define NEF_RSCS   0x0002               // Load resources #define NEF_NAME   0x0004               // Rename entries #define NEF_MAN    0x0008               // Manual load #define NEF_FILL   0x0010               // Fill segment gaps #define NEF_IMPS   0x0020               // Create imports section #define NEF_FIRST  0x0080               // This is the first file loaded #define NEF_CODE   0x0100               // for load_binary_file: #define NEF_RELOAD 0x0200               // reload the file at the same place: #define NEF_FLAT   0x0400               // Autocreated FLAT group (PE)


 ord

ord

Get code of an ascii character
     str - string with one character
返回: a binary number, character code
另参见 atol() function
Thread-safe function.

long ord(string str);


 其他选项

其他选项
显示一个对话框，其中包含用于管理跟踪文件的其他选项

此命令将显示一个窗口，其中包含用于管理跟踪文件的所有可用命令。

另参见:
   清除跟踪
   选择跟踪
   编辑跟踪描述
   二进制跟踪的比较
   移除二进制跟踪
   导入二进制跟踪
   导出二进制跟踪
   导出跟踪到文本文件
   显示跟踪调用图表


 覆盖的文件

覆盖的文件
某些 EXE 文件是使用覆盖层构建的。这意味着整个文件不会在程序开始时加载到内存中，而只是其中的一部分。其他部分由程序本身加载到动态内存中或程序的某些子程序上。 当你反汇编这样的程序时，这一事实会导致许多困难。

目前，IDA 知道 Borland 和 Microsoft C 和 Pascal 编译器创建的覆盖层。


 打包文件

打包文件
有时，可执行文件以打包形式提供。这意味着要反汇编这些文件，你需要解压缩它们。

如果输入 MZ 可执行文件的重定位表为空，则 IDA 将显示此消息。


 页断点

页断点
页断点是内存访问断点，可以将其设置为检测应用程序何时读取、写入或执行特定内存范围内的代码/数据。页断点与硬件断点非常相似，但与普通硬件断点相比，可以设置的页断点数或其大小没有限制。

内存访问断点是通过根据要添加的页断点的指定类型删除页权限来实现的(例如，对于写入页断点，将从页中删除写入权限)。当应用程序尝试访问特定内存区域而发生访问冲突异常时，IDA 会报告断点命中。

由于可以为内存页的一小部分设置页面断点，但必须更改整个页面的权限，因此页面断点可能会减慢调试器的速度，因为可能会生成许多访问冲突异常。如果应用程序访问的内存超出了所需范围，但在同一页面上，则必须以静默方式处理生成的异常并恢复应用程序。具体而言，代码段中的页断点会大大降低调试器的速度。

自 IDA 版本 6.3 起，以下调试器支持内存访问断点:

Win32

 页断点支持本地和远程调试 32 位和 64 位应用程序。
WinDbg
  页断点仅支持 32 位应用程序的本地调试。
Bochs
  32 位和 64 位应用程序均支持页断点。
  bochs 调试器中的页断点与普通硬件断点一样，但对断点的数量和大小没有限制。
请注意，bochs 调试器中的硬件断点发生在指令执行之后，而常规页断点发生在指令实际执行之前。

另参见:
   断点列表
   添加断点
   删除断点
   编辑断点
   断点子菜单


 parse_decls

parse_decls

Parse many type declarations
     input -  file name or C declarations (depending on the flags)
     flags -  combination of PT_... constants or 0
returns: number of errors

long parse_decls(string input, long flags);
Parse one type declaration input -  a C declaration flags -  combination of PT_... constants or 0 PT_FILE should not be specified in flags (it is ignored) returns: typeinfo object or num 0
typeinfo parse_decl(string input, long flags);


 patch_byte

patch_byte

Change value of a program byte
If debugger was active then the debugged process memory will be patched too
     ea    - linear address
     value - new value of the byte
Returns: 1 if the database has been modified,
         0 if either the debugger is running and the process' memory
           has value 'value' at address 'ea',
           or the debugger is not running, and the IDB
           has value 'value' at address 'ea already.

success patch_byte(long ea, long value);


 patch_dbg_byte

patch_dbg_byte

Change a byte in the debugged process memory only
     ea    - linear address
     value - new value of the byte
Returns: 1 if successful, 0 if not
Thread-safe function (may be called only from the main thread and debthread)

success patch_dbg_byte(long ea, long value);


 patch_dword

patch_dword

Change value of a double word
     ea    - linear address
     value - new value of the double word
Returns: 1 if the database has been modified,
         0 if either the debugger is running and the process' memory
           has value 'value' at address 'ea',
           or the debugger is not running, and the IDB
           has value 'value' at address 'ea already.

success patch_dword(long ea, long value);


 patch_qword

patch_qword

Change value of a quad word
     ea    - linear address
     value - new value of the quad word
Returns: 1 if the database has been modified,
         0 if either the debugger is running and the process' memory
           has value 'value' at address 'ea',
           or the debugger is not running, and the IDB
           has value 'value' at address 'ea' already.

success patch_qword(long ea, long value);


 patch_word

patch_word

Change value of a program word (2 bytes)
     ea    - linear address
     value - new value of the word
Returns: 1 if the database has been modified,
         0 if either the debugger is running and the process' memory
           has value 'value' at address 'ea',
           or the debugger is not running, and the IDB
           has value 'value' at address 'ea already.

success patch_word(long ea, long value);


 跳过修补的字节

跳过修补的字节
程序存储器中的某些字节在可执行文件中没有相应的字节。例如，未初始化的数据不会保留在文件中。OS/2Warp 和 Window 支持压缩页面。

在这种情况下，IDA 无法创建完整的差异文件。它在消息窗口中显示跳过的字节地址及其值。


 修补的字节具有重定位信息

修补的字节具有重定位信息
If a byte has relocation information attached to it, then the value of this byte is changed when the file is loaded into the memory by the system loader or linker. Therefore, it doesn't make much sense (and sometimes it is simply illegal) to modify the byte.

We recommend to return the original value of the byte(s).

You can see the relocation information attached to an item by using the show internal flags command.


 修补映像

修补映像

 操作名称: PatchByte, PatchWord
你可以修改可执行文件并最终 生成一个新文件。

如果修补字节，则可以输入多个字节。点击此 链接 了解输入字符串的格式。

如果在调试器处于活动状态时调用此命令，则 IDA 将修改内存和数据库。如果数据库不包含修补的字节，则只会修改进程内存。

你也可以创建 差异 文件。

另参见

         编辑|补丁核心子菜单。
         如何输入数字。


 暂停进程

暂停进程

 操作名称: ProcessPause
此命令暂停正在运行的进程。请注意，并不总是可以暂停执行系统代码的进程。
另参见:
   启动进程
   终止进程
   调试器子菜单


 PCRE2 LICENCE

PCRE2 LICENCE

PCRE2 is a library of functions to support regular expressions whose syntax
and semantics are as close as possible to those of the Perl 5 language.

Release 10 of PCRE2 is distributed under the terms of the "BSD" licence, as specified below. The documentation for PCRE2, supplied in the "doc" directory, is distributed under the same terms as the software itself. The data in the testdata directory is not copyrighted and is in the public domain.
The basic library functions are written in C and are freestanding. Also included in the distribution is a just-in-time compiler that can be used to optimize pattern matching. This is an optional feature that can be omitted when the library is built.
THE BASIC LIBRARY FUNCTIONS ---------------------------
Written by:       Philip Hazel Email local part: ph10 Email domain:     cam.ac.uk
University of Cambridge Computing Service, Cambridge, England.
Copyright (c) 1997-2016 University of Cambridge All rights reserved.
PCRE2 JUST-IN-TIME COMPILATION SUPPORT --------------------------------------
Written by:       Zoltan Herczeg Email local part: hzmester Emain domain:     freemail.hu
Copyright(c) 2010-2016 Zoltan Herczeg All rights reserved.
STACK-LESS JUST-IN-TIME COMPILER --------------------------------
Written by:       Zoltan Herczeg Email local part: hzmester Emain domain:     freemail.hu
Copyright(c) 2009-2016 Zoltan Herczeg All rights reserved.
THE "BSD" LICENCE -----------------
如果满足以下条件，则允许以源代码和二进制形式重新分发和使用，无论是否进行修改：
    * Redistributions of source code must retain the above copyright notice,
      this list of conditions and the following disclaimer.

    * Redistributions in binary form must reproduce the above copyright
      notice, this list of conditions and the following disclaimer in the
      documentation and/or other materials provided with the distribution.

    * Neither the name of the University of Cambridge nor the names of any
      contributors may be used to endorse or promote products derived from this
      software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
End


 PE .idata 部分有附加数据

PE .idata 部分有附加数据
If "create imports section" in the file loading dialog is checked, IDA will convert .idata section definitions to "extrn" directives and truncate it so it will not contain empty lines.

Unfortunately, sometimes there is some additional data in .idata section so you'll need to disable this feature if some information is not loaded into the database.

IDA tries to detect additional data in .idata section automatically.

If you disable conversion of .idata section to a segment with "extrn" directives, you will see

somename dd ?

instead of

        extrn   somename
directives.

Another impact is that the .idata segment will not be truncated in any way.


 执行整体操作

执行整体操作
如果在应用操作数转换命令之前选择了范围，则 IDA 将显示一个对话框。

你可以选择一系列操作数来执行整体操作:

 ALL OPERANDS
 -----------
The operation will be performed on all operands as a toggle. For example, if you ask to convert to a character, then all non-character operands will become characters, and all character operands will become non-chars.
 OPERAND VALUE RANGE
 -------------------
The operation will be performed on the void operands which contain immediate numbers in the specified range.
 ... OPERANDS
 ------------
This selection will convert all operands with the specified type to undefined operands. 示例: all characters become non-characters.
 NOT ... OPERANDS
 ---------------
This selection allows to convert all operands that do not have the specified type to the specified type. 示例: all non-characters to characters.
 NOT TYPED OPERANDS
 -----------------
This selection allows to convert all operands without any type to the specified type. 示例: all operands with no type to characters.
 APPLY ONLY IF POSSIBLE
 ---------------------
IDA will check whether an operand can be represented with the specified type (as a character constant, for example), and perform type conversion only if the check is successful.


 picture_search

picture_search
picture_search is a plugin that allows you to search for, and inspect pictures that are embedded in the binary.

The key feature of the plugin is the "Search for pictures" action, available in the "Search" menu, that will scan the entire binary (or the selection if there is one) for so-called "magic" numbers of well-known image types (PNG, JPEG, ...), and present the results in a tabular fashion:

                 [Address]         |[Format]
        .noptrdata:0000000000511620|GIF89a
        .noptrdata:00000000005133E0|PNG
        .noptrdata:0000000000517460|JPEG
        .noptrdata:000000000051ADA0|BMP
Note: at this point, pictures have not been decoded yet; the plugin has merely spotted what looks like the start of pictures. Decoding will only happen when triggering any of the following actions.

Double-clicking any row of that list will show the picture directly in IDA. Opening the context menu will reveal even more possibilities: open the picture in the OS's default viewer, save it, jump to its start address...

In addition to this very handy scanning feature, the plugin will add the "Open picture" action to the disassembly listing's context menu when the current position happens to be near data that matches the well-known image types' magic numbers.


 PIN 调试器

PIN 调试器
The PIN 调试器 is a remote 调试器 plugin used to record execution traces. It allows to record traces on Linux and Windows (x86 and x86_64) from any of the supported IDA platforms (Windows, Linux and MacOSX). Support for MacOSX targets is not yet available. Please see the section MacOSX 的 PIN 支持 for more details on this subject.

To use the PIN debugger plugin the following steps must be carried out:

  - Download the appropriate version of PIN from http://www.pintool.org

  - Build the PIN tool

  - Configure the 调试器 specific options in
    调试器选项, Set specific options.

  PIN 调试器 plugin has the following configuration options:

 - PIN Binary Path: Full path to the pin binary. - PIN Tool Path: Directory where the idadbg.so 或 .dll PIN tool resides.
  - Tracing options:
    - Instruction tracing: trace individual instructions
    - Basic block tracing: trace basic blocks
    - Function tracing: trace functions
    - Recording of register values: record register values or not. If
      this option is disabled, only EIP/RIP will be recorded.
  - PIN Tool options:
    - Autolaunch pin for "localhost": When this option is set and
    the host name specified in Debugger, Process Options is "localhost", the PIN
    tool will be executed by IDA. Otherwise IDA expects the PIN tool to be already running and listening. Please refer to   从 IDA 连接远程 PIN 工具实例 for more details. - Debug mode: This flag allows one to see what's happening in the PIN tool side. 它打印出一些调试信息。
- Extra-参数: Additional 命令行 arguments to be used when constructing the 命令行 to launch PIN locally. The extra arguments can be added before the PIN tool specification (before '-t /path/to/pin/tool) or after the PIN tool (after '-t /path/to/pin/tool' but before '-- application').
    Please consult the section "Command Line Switches" of the Intel PIN manual
    for more details.
Optionally you can launch PIN yourself and connect to it from IDA. See Connecting a remote PIN tool instance from IDA for more details.


 MacOSX 的 PIN 支持

MacOSX 的 PIN 支持
Recording traces on MacOSX target is not supported yet. Versions equal or prior to 2.12-55942 does not have support for the API PIN_SpawnInternalThread, which is needed by IDA to communicate with the PIN tool.

However, it's possible to record traces from a Linux or Windows target using the MacOSX version of IDA.


 plan_and_wait

plan_and_wait

Perform full analysis of the range
     sEA        - starting linear address
     eEA        - ending linear address (excluded)
     final_pass - make the final pass over the specified range
返回: 1-ok, 0-Ctrl-Break was pressed.

long plan_and_wait(long sEA, long eEA, long final_pass=1);


 plan_to_apply_idasgn

plan_to_apply_idasgn

Load (plan to apply) a FLIRT signature file
     name - signature name without path and extension
returns: 0 if could not load the signature file, !=0 otherwise

success plan_to_apply_idasgn(string name);


 插件模块

插件模块
插件模块是用 C 语言编写的模块，它为 IDA 提供附加功能。

通常，插件是通过热键或菜单系统调用的。已注册和加载的插件将出现在一个特殊的“编辑|插件”子菜单。插件可以提供更好的分析、繁琐任务的自动化等。

插件模块位于 IDA 的“plugins”子目录中。IDA 能够自动从该目录中查找并加载所有插件。

但是，你可以编写一个配置文件并告诉 IDA 如何加载插件。为此，你需要修改“plugins”子目录中的“plugins.cfg”文件。

此文件的格式很简单：

空行和以“;”开头的行是注释行。其他行必须具有以下结构体：

           menuname filename hotkey arg

 示例:

           Undefine undef    Alt-U  0
如果文件名不包含文件扩展名或目录，IDA 将添加它们。插件模块具有以下扩展名：
        Windows:        *.dll
        Linux:          *.so
        Mac:            *.dylib
注意：编译时支持 64 位地址空间的插件将在扩展名前加上“64”后缀。E.g., 'pdb64.dll'

有关更多详细信息，请参阅有关各个插件模块的信息。

另参见 编辑子菜单。


 插件选项

插件选项
The -O 命令行 switch allows the user to pass options to the plugins. 使用选项的插件应调用 get_plugin_options() 函数来获取它们。

Since there may be many plugins written by independent programmers, each options will have a prefix -O in front of the plugin name.

例如，名为 "decomp" 的插件应期望其参数采用以下格式：

        -Odecomp:option1:option2:option3
在这种情况下，get_plugin_options("decomp") 将返回选项字符串的 "option1:option2:option3" 部分。

If there are several -O options in the 命令行, they will be concatenated with ':' between them.

This switch is not available in the IDA Home edition.


 prev_addr

prev_addr

Get previous address in the program
     ea - linear address
返回: BADADDR - the specified address in the first address

long prev_addr(long ea);


 prev_head

prev_head

Get previous defined item (instruction or data) in the program
     ea    - linear address to start search from
     minea - the search will stop at the address
             minea is included in the search range
返回: BADADDR - no (more) defined items

long prev_head(long ea, long minea);


 prev_not_tail

prev_not_tail

Get previous not-tail address in the program
This function searches for the previous displayable address in the program.
指令和数据的尾字节不可显示。
     ea - 线性地址
返回： BADADDR - 没有(更多)非尾部地址

long prev_not_tail(long ea);


 prevattr

prevattr

Get the previois object attribute
     self  - object
     attr  - current attribute name
If there are no more attributes, returns 0
Thread-safe function.

string prevattr(object self, string attr);


 print_decls

print_decls

Print types in a format suitable for use in a header file
     ordinals - comma-separated list of type ordinals
     flags    - combination of PDF_... constants or 0
返回：
string print_decls(string ordinals, long flags);
#define PT_FILE   0x0001  // input is a file name (otherwise a string containing type declarations) #define PT_SILENT 0x0002  // silent mode #define PT_PAKDEF 0x0000  // default pack value #define PT_PAK1   0x0010  // #pragma pack(1) #define PT_PAK2   0x0020  // #pragma pack(2) #define PT_PAK4   0x0030  // #pragma pack(4) #define PT_PAK8   0x0040  // #pragma pack(8) #define PT_PAK16  0x0050  // #pragma pack(16) #define PT_HIGH   0x0080  // assume high level prototypes // (with hidden args, etc) #define PT_LOWER  0x0100  // lower the function prototypes #define PT_REPLACE 0x0200 // replace the old type #define PT_RAWARGS 0x0400 // leave argument names unchanged // (do not remove underscores)
#define PDF_INCL_DEPS  0x1 // include dependencies #define PDF_DEF_FWD    0x2 // allow forward declarations #define PDF_DEF_BASE   0x4 // include base types: __int8, __int16, etc.. #define PDF_HEADER_CMT 0x8 // prepend output with a descriptive comment


 print_insn_mnem

print_insn_mnem

Get instruction mnemonics
     ea - linear address of instruction
返回: 0 - no instruction at the specified location
note: this function may not return exactly the same mnemonics
as you see on the screen.

string print_insn_mnem(long ea);              // get instruction name


 print_operand

print_operand

Get text representation of an operand
     ea - linear address of instruction (or data)
     n  - number of operand:
             0 - the first operand
             1 - the second operand
返回: the current text representation of operand

string print_operand(long ea, long n);


 问题: 已经是数据或代码

问题: 已经是数据或代码

 描述:
        IDA cannot convert this byte(s) to an instruction
        or data because it would overlap another instruction.

 What to do:
        Make the following overlapping instruction or data 'unexplored'
        using undefine command.


 问题：注意！ 可能是错误的情况

问题：注意！ 可能是错误的情况

 描述：
        这是一个通用的问题消息。 IDA 在没有更详细的情况下使用它
        信息可用，或者问题是特定于处理器的。


 问题: 不能反汇编

问题: 不能反汇编

 描述:
        IDA 不能将指定的字节表示为指令。

 Possible reason(s):
        1. The specified bytes do not form an instruction.
        2. The current processor type is incorrect.

 What to do:
        If you are sure that the specified bytes contain an instruction,
        you can try to change processor type and
        mark these bytes as an instruction using the following command:
         Convert to instruction


 问题：找不到操作数的替代字符串

问题：找不到操作数的替代字符串

 描述:
        The current item has an operand marked as entered manually,
        but IDA cannot find the manually entered string in the database.

 Possible reason(s):
        The database is corrupt.

 What to do:
        Enter the operand manually again. Use one of the following
        commands:
         User-defined operand


 问题: 找不到注释

问题: 找不到注释

        Should not happen!
        Please inform the author if you encounter this problem.


 问题：找不到名称

问题：找不到名称

 描述:
        Two reasons can cause this problem:
          1.Reference to an illegal address is made in the program being
            disassembled;
          2.IDA couldn't find a name for the address but
            it must exist.
 What to do:
        1. If this problem is caused by a reference to an illegal address
            - try to enter the operand manually
            - or make the illegal address legal by creating a new segment.
        2. Otherwise, the database is corrupt.


 问题: 找不到偏移基数

问题: 找不到偏移基数

 描述:
        The current item has an operand marked as an offset,
        but IDA cannot find the offset base in the database.

 Possible reason(s):
        The database is probably corrupted.
        This may occur if the database was corrupted and repaired.

 What to do:
        Mark the operand again as an offset. Use one of the following
        commands:
         Convert to offset (DS)
         Convert to offset (CS)
         Convert to offset by any segment
         Convert to offset by any user-specified base


 问题: 找不到引用

问题: 找不到引用

 描述:
        The current item is marked as referenced from other place(s) in the
        program, but IDA cannot find any reference to it.

 Possible reason(s):
        The database is corrupt.

 What to do:
        Database is corrupt, the best thing to do is
           to reload the database.


 问题：转换为指令/数据的决定是由 IDA 做出的

问题：转换为指令/数据的决定是由 IDA 做出的

 描述:
        In fact, this is not exactly a problem: IDA collects all the locations
        where it has decided to convert undefined bytes to
        instructions or data even if they don't have
        any references to them. We consider this decision as dangerous
        and therefore we provide you with a way to examine all such places.

 What to do:
        Examine the result of conversion and modify the instructions
        or data if IDA has made a wrong conversion.


 问题: 执行流程超出限制

问题: 执行流程超出限制

 描述：
        IDA 遇到跳转或调用指令到非法地址。
        即：
          - 跳转/调用超出程序段
          - 近跳转/调用超出当前段
 应采取的措施：
        1.手动输入操作数
        2. 或创建一个新 段 ，使非法地址合法化
        3. 或使用以下方法之一更改当前线段边界：
              如何更改段属性
              如何移动段


 问题: 未能跟踪堆栈指针的值

问题: 未能跟踪堆栈指针的值

 描述：
        函数末尾的堆栈指针的值不同
        从函数开头的值。 IDA 检查
        仅当函数以 "return" 指令结束时才有区别。
        最可能的原因是堆栈跟踪失败。
        此问题显示在反汇编列表中，其中
       “SP- 分析失败”注释。

 应采取的措施：
        1. 检查 堆栈指针 在各种位置的值
           函数的位置，并尝试找出堆栈跟踪的失败原因。 通常，它失败是因为某些调用的函数更改了
           堆栈指针(例如，通过清除输入参数)
        2. 如果你发现了有问题的函数，请更改 其属性(即返回时清除的字节数)。
        3. Another way is to specify manually how the stack pointer is
           modified. See Change stack pointer command


 问题: 间接执行流程

问题: 间接执行流程

 描述:
        实际上，这不是问题。 IDA 警告您
        这里遇到了间接跳转，无法跟随执行。

 应采取的措施:
        没什么，此条目仅供参考


 问题: 由 IDA 作出的判定是错误的，然后回滚

问题: 由 IDA 作出的判定是错误的，然后回滚

 描述:
        This problem occurs when IDA has converted unexplored bytes to
        instruction(s) and later found that the decision was wrong.
        例如:

                mov     ax, bx
                db 0FFh, 0FFh

        0FFh, 0FFh cannot be converted to an instruction, therefore
        the "mov" instruction cannot be here.

        In this case, IDA automatically destroys the instruction(s)
        and enlists the address as problematic.

 应采取的措施：
        检查最终结果并相应地修改它。


 问题: 行太多

问题: 行太多

 描述:
        The current item (instruction or data) occupies more lines
        on the screen than it is allowed by the current configuration.

 What to do:
        1. If the current item is an array or String literal, try to divide it.
     or 2. Delete Additional comment lines
     or 3. Disable cross-references display
     or 4. Increase the limit in IDA.CFG, the paramter name is MAX_ITEM_LINES.


 问题列表

问题列表
可能会出现以下问题：
 NOOFFSET 找不到偏移基数
 NONAME   找不到名称
 NOFORCED 找不到操作数的替代字符串
 NOCMT    找不到注释
 NOREF    找不到引用
 INDIRJMP 间接执行流程
 NODISASM 无法反汇编
 ALREADY  数据或代码
 BOUNDS   执行流程超出限制
 OVERFLOW  行数过多
 BADSTACK 无法跟踪堆栈指针的值
 LOOKHERE 注意！ 可能是错误的情况
 决策 IDA 决定是否转换为指令/数据
 回滚 IDA 做出的决定是错误的，并回滚
 COLISION FLAIR 冲突：具有给定名称的函数已存在
 SIGFNREF FLAIR 匹配优柔寡断：参考预期的函数
另参见跳转子菜单。


 问题窗口

问题窗口

 操作名称: OpenProblems
此命令将打开问题窗口。问题窗口包含 IDA 在反汇编程序期间遇到的所有问题的 列表。

你可以通过按 Enter 键跳转到问题。所选问题将从列表中删除。

另参见 视图|打开子视图子菜单。


 进程选项

进程选项

 操作名称: SetupProcess
此对话框允许指定与正在调试的进程相关的不同设置。

应用程序

        要启动的主机应用程序。 对于可执行文件，该字段等于 "输入文件"。
        如果此字段错误，IDA 将无法启动程序。
        对于远程调试，此字段表示远程文件。
输入文件
        用于创建数据库的输入文件。
        对于远程调试，此字段表示远程文件。
目录
        目录以启动应用程序。 如果为空，则使用当前目录。
        对于远程调试，此字段表示远程目录。
参数
        可选参数，用于在调试程序(或主机应用程序)
        启动时传递给它。 此字段可能为空。
        标准输入/输出/错误通道可以使用以下方法重定向
        bash shell 表示法。例如：>output 2>&1
主机名称
        如果输入，则表示包含要调试的应用程序的远程主机名称。 在这种情况下，必须启动此主机上的远程 IDA 服务器。
        单击 此处 查看远程服务器列表。
端口
        远程服务器的端口号
密码
        可选密码，用于保护你的服务器免受陌生人连接
        它并运行任意命令。 相同的密码开关必须是
        在远程服务器上指定。
主机名、端口和密码不适用于本地连接到计算机的调试器。
另参见:
   启动进程
   调试器子菜单
   如何启动远程调试


 process_config_directive

process_config_directive

解析一个或多个 ida.cfg 配置指令
     line - 要处理的指令，例如：PACK_DATABASE=2
如果指令错误，将生成致命错误。
这些更改是永久性的：对当前会话和下一届会话有效

void process_config_directive(string directive);


 process_config_line

process_config_line

解析一个或多个 ida.cfg 配置指令
     line - 要处理的指令，例如：PACK_DATABASE=2
如果指令错误，将生成致命错误。
这些更改是永久性的：对当前会话和下一届会话有效

void process_config_line(string directive);


 process_ui_action

process_ui_action

Invokes an IDA UI action by name
      name    - Name of the action
      flags   - Reserved. Must be zero.
返回: 1 - 成功, 0 - 失败

long process_ui_action(string name, long flags);


 处理器类型

处理器类型

 操作名称: SetProcessor
有效的处理器类型包括：
  类型       描述
  -----      ----------

  8086    - Intel 8086                   â”
  80286r  - Intel 80286 real mode        â”‚
  80286p  - Intel 80286 protected mode   â”‚
  80386r  - Intel 80386 real mode        â”‚
  80386p  - Intel 80386 protected mode   â”‚
  80486r  - Intel 80486 real mode        â”‚
  80486p  - Intel 80486 protected mode   â”‚
  80586r  - Intel Pentium & MMX real modeâ”‚ (IBM PC family)
  80586p  - Intel Pentium & MMX prot modeâ”‚
  80686p  - Intel Pentium Pro & MMX      â”‚
  k62     - AMD K6-2 with 3DNow!         â”‚
  p2      - Intel Pentium II             â”‚
  p3      - Intel Pentium III            â”‚
  athlon  - AMD K7                       â”‚
  p4      - Intel Pentium 4              â”‚
  metapc  - Disassemble all IBMPC opcodesâ”˜
  8085    - Intel 8085                   â”
  z80     - Zilog 80                     â”‚
  z180    - Zilog 180                    â”‚ (Zilog 80 family)
  z380    - Zilog 380                    â”‚
  64180   - Hitachi HD64180              â”‚
  gb      - Gameboy                      â”˜
  z8      - Zilog 8                        (Zilog 8 family)
  860xr   - Intel 860 XR                 â” (Intel 860 family)
  860xp   - Intel 860 XP                 â”˜
  8051    - Intel 8051                     (Intel 51 family)
  80196   - Intel 80196                  â” (Intel 80196 family)
  80196NP - Intel 80196NP, NU            â”˜
  m6502   - MOS 6502                     â” (MOS Technology 65xx family)
  m65c02  - MOS 65c02                    â”˜
  pdp11   - DEC PDP/11                     (PDP family)
  68000   - Motorola MC68000             â”
  68010   - Motorola MC68010             â”‚
  68020   - Motorola MC68020             â”‚
  68030   - Motorola MC68030             â”‚
  68040   - Motorola MC68040             â”‚ (Motorola 680x0 family)
  68330   - Motorola CPU32 (68330)       â”‚
  68882   - Motorola MC68020 with MC68882â”‚
  68851   - Motorola MC68020 with MC68851â”‚
  68020EX - Motorola MC68020 with both   â”‚
  colfire - Motorola ColdFire            â”‚
  68K     - Motorola MC680x0 all opcodes â”˜
  6800    - Motorola MC68HC00            â”
  6801    - Motorola MC68HC01            â”‚
  6803    - Motorola MC68HC03            â”‚
  6301    - Hitachi HD 6301              â”‚
  6303    - Hitachi HD 6303              â”‚
  6805    - Motorola MC68HC05            â”‚ (Motorola 8bit family)
  6808    - Motorola MC68HC08            â”‚
  6809    - Motorola MC68HC09            â”‚
  6811    - Motorola MC68HC11            â”˜
  6812    - Motorola MC68HC12
  hcs12   - Motorola MC68HCS12
  6816    - Motorola MC68HC16
  java    - java                           (Java family)
  ppc     - PowerPC big endian           â”
  ppcl    - PowerPC little endian        â”˜ (PowerPC family)
  arm     - ARM little endian            â” (ARM family)
  armb    - ARM big endian               â”˜
  tms320c2- TMS320C2x series             â” (TMS 16bit addressing family)
  tms320c5- TMS320C5x series             â”˜
  tms320c6- TMS320C6x series             â” (TMS VLIW family)
  tms320c3- TMS320C3x series             â”˜
  tms32054- TMS320C54xx series
  tms32055- TMS320C55xx series
  sh3     - Renesas SH-3 (little endian) â”
  sh3b    - Renesas SH-3 (big endian)    â”‚ (Renesas SuperH series)
  sh4     - Renesas SH-4 (little endian) â”‚
  sh4b    - Renesas SH-4 (big endian)    â”‚
  sh2a    - Renesas SH-2A (big endian)   â”˜
  avr     - ATMEL AVR                      (ATMEL family)
  mipsl   - MIPS little endian           â” (MIPS family:R2000, R3000, R4000,
  mipsb   - MIPS big endian              â”‚ R4200, R4300,  R4400, R4600,
  mipsrl  - MIPS & RSP little            â”‚ R8000, R10000)
  mipsr   - MIPS & RSP big               â”‚
  r5900l  - MIPS R5900 little            â”˜
  r5900r  - MIPS R5900 big               â”˜
  h8300   - H8/300x in normal mode       â”
  h8300a  - H8/300x in advanced mode     â”‚ (Hitachi H8 family)
  h8s300  - H8S in normal mode           â”‚
  h8s300a - H8S in advanced mode         â”˜
  h8500   - H8/500                         (Hitachi H8/500 family)
  pic12cxx- Microchip PIC 12-bit (12xxx) â”
  pic16cxx- Microchip PIC 14-bit (16xxx) â”‚ (PIC family)
  pic18cxx- Microchip PIC 16-bit (18xxx) â”˜
  sparcb  - SPARC big endian             â”
  sparcl  - SPARC little endian          â”˜ (SPARC family)
  alphab  - DEC Alpha big endian         â”
  alphal  - DEC Alpha little endian      â”˜ (ALPHA family)
  hppa    - HP PA-RISC big endian          (HP PA-RISC family)
  dsp56k  - Motorola DSP 5600x           â”
  dsp561xx- Motorola DSP 561xx           â”‚ (DSP 56K family)
  dsp563xx- Motorola DSP 563xx           â”‚
  dsp566xx- Motorola DSP 566xx           â”˜
  c166    - Siemens C166                 â”
  c166v1  - Siemens C166 v1 family       â”‚
  c166v2  - Siemens C166 v2 family       â”‚ (C166 family)
  st10    - SGS-Thomson ST10             â”‚
  super10 - Super10                      â”˜
  st20    - SGS-Thomson ST20/C1            (ST20 family)
  st20c4  - SGS-Thomson ST20/C2-C4
  st7     - SGS-Thomson ST7                (ST7 family)
  ia64l   - Intel Itanium little endian  â”
  ia64b   - Intel Itanium big endian     â”˜ (IA64 family)
  cli     - Microsoft.Net platform
  net     - Microsoft.Net platform (alias)
  i960l   - Intel 960 little endian      â”
  i960b   - Intel 960 big endian         â”˜ (i960 family)
  f2mc16l - Fujitsu F2MC-16L             â”
  f2mc16lx- Fujitsu F2MC-16LX            â”˜ (Fujitsu F2MC family)
  78k0    - NEC 78k/0
  78k0s   - NEC 78k/0s
  m740    - Mitsubishi 8-bit
  m7700   - Mitsubishi 16-bit            â”
  m7750   - Mitsubishi 16-bit            â”˜ (Mitsubishi 16-bit family)
  m32r    - Mitsubishi 32-bit            â”
  m32rx   - Mitsubishi 32-bit extended   â”˜ (Mitsubishi 32-bit family)
  st9     - STMicroelectronics ST9+
  fr      - Fujitsu FR family
  m7900   - Mitsubishi M7900
  kr1878  - Angstrem KR1878
  ad218x  - Analog Devices ADSP
  oakdsp  - Atmel OAK DSP
  tricore - Infineon Tricore
  ebc     - EFI Bytecode
  msp430  - Texas Instruments MSP430
你只能在当前系列中更改处理器类型。如果选择了 IBM PC 系列，那么不能选择 Zilog 80 系列，反之亦然。

处理器模块可以接受其他选项，这些选项可以使用 -p 开关在命令行上传递。目前只有 ARM 模块支持它。For example, -parm:ARMv7-A will turn on options specific for the ARMv7-A architecture, such as NEON instruction set.

For information about additional processor modules, please visit our web page at https://www.hex-rays.com/products/ida/processors.shtml

Please note that when you change the processor type, IDA may change the target assembler, so check it out.

You may get a message saying that IDA does not know the specified processor if IDA fails to load the corresponding processor module.

        Windows IDA 使用 .dll 文件扩展名
        Linux IDA 使用 .so 文件扩展名
        Mac IDA 使用 .dylib 文件扩展名
NOTE: modules compiled with support for 64-bit address space, will feature a '64' suffix before the extension. E.g., 'pc64.dll'

NOTE: Changing the processor type leads to reanalysis of the whole program. Sometimes this is useful.

NOTE: when you load a new processor module, all analysis options are reset to the values specified in the configuration file.

IDA determines the default processor using the input file extension and the contents of the input file. The table which describes the input file extensions and the corresponding processor types is located in IDA.CFG file and looks like this:

 DEFAULT_PROCESSOR = {
 /* Extension   Processor */
  "com" :       "8086"                  // IDA will try the specified
  "exe" :       "80386r"                // extensions if no extension is
  "dll" :       "80386r"                // given.
  "drv" :       "80386r"
  "o"   :       "68000"
  "prc" :       "68000"                 // PalmPilot programs
  "axf" :       "arm"
  "h68" :       "68000"                 // MC68000 for *.H68 files
  "i51" :       "8051"                  // i8051   for *.I51 files
  "sav" :       "pdp11"                 // PDP-11  for *.SAV files
  "rom" :       "z80"                   // Z80     for *.ROM files
  "cla" :       "java"                  // Java classes
  "class":      "java"                  // Java classes
  "s19":        "6811"
  "*":          "80386p"                // Default processor
}
如果要更改默认处理器类型，则需要更改此表。你可以添加/删除此表中的行。

另参见: 选项子菜单。ARM 处理器详情。


 生成调用图表 GDL 文件

生成调用图表 GDL 文件

 操作名称: ProduceCallGdl
此命令使用函数调用的图表创建 GDL（图表描述文件）。

IDA 将要求提供输出文件名。无论指定的扩展名如何，都将使用 .GDL 扩展名。

另参见其他生成输出文件命令。


 生成流程图 GDL 文件

生成流程图 GDL 文件

 操作名称: ProduceFuncGdl
此命令使用当前函数的流程图创建 GDL(图形描述文件)。

If there is an active selection, its flow chart will be generated.

IDA 将要求提供输出文件名。无论指定的扩展名如何，都将使用 .GDL 扩展名。

另参见其他生成输出文件命令。


 邻近视图

邻近视图
从 IDA v6.2 开始，程序的调用图可以用图表的形式显示。

In the 邻近视图, the current address, the callers and the callees are represented as a collection of nodes linked together with edges. Nodes represent functions and 数据 references (全局变量, strings, etc..) and edges represent code 或 数据 cross-references between them.

To 打开the 邻近视图 press the '-' key to zoom out and switch to the callgraph of the address under cursor.

Only the address names (函数名称 或 数据 labels) are displayed in the 邻近视图, but not the disassembly, nonetheless, hovering the mouse over a node will display brief disassembly listing in a resizable hint window. To see the complete disassembly listing switch to text 或 graph mode by pressing '+' 或 Space respectively.

When disassembling new 文件, IDA will display a dialog offering to switch to 邻近视图 when applicable. It is possible to turn off this dialog and not show it again.

In the 邻近视图 there are 3 types of nodes: 函数 nodes, 数据 nodes and auxiliar nodes. 函数 nodes are rectangular and they have a toolbar. Those nodes are used to display the callers 或 callees of the current central node (or any of his parents 或 children). Data nodes are rectangular nodes (without a toolbar) and they are used to display the 数据 references (全局变量, strings, etc...) to/from the current central node 或 any of his parents and children.

请选择以下主题之一以了解有关图表的更多信息：


 提取所有元数据

提取所有元数据
此命令从 Lumina 检索有关当前数据库的 元数据。

IDA 将计算数据库中所有重要函数的校验和，并将其发送给 Lumina。此信息将用于匹配和检索元数据，这些元数据将自动应用。

请注意，这可能会覆盖你的更改，因此在调用此命令之前获取数据库快照并保存数据库是一个好主意。

我们所说的非平凡函数是指：

  - 足够长的函数 (>=16 字节)
  - 非库函数
  - 非导入函数 (具有真实主体的函数)
另参见 查看所有元数据，它允许用户以交互方式应用元数据。


 提取当前函数

提取当前函数
此命令尝试从 Lumina 检索有关当前函数的 元数据。如果成功，将自动应用元数据。

另参见 Lumina 子菜单


 推送所有元数据

推送所有元数据
This commands sends metadata about the current database to Lumina.

IDA will calculate checksums for all non-trivial functions in the database, extract metadata about them, and send it to Lumina. The metadata includes function names and types, user comments, operand types, etc.

If Lumina already has metadata about the involved functions, it will be replaced only if the new metadata is better and more complete.

Only functions with non-trivial names are pushed by this command.

另参见 Lumina 子菜单


 推送当前函数

推送当前函数
此命令将有关当前函数的 元数据 发送到 Lumina。

另参见 Lumina 子菜单


 put_bookmark

put_bookmark

mark position
     ea      - address to mark
     lnnum   - number of generated line for the 'ea'
     x       - x coordinate of cursor
     y       - y coordinate of cursor
     slot    - slot number: 0..1023
               if the specifed value is not within the range,
               IDA will ask the user to select slot.
     comment - description of the mark.
               Should be not empty.
返回: none

void put_bookmark(long ea, long lnnum, long x, long y, long slot, string comment);


 qbasename

qbasename

Get the file name part of the given path

string qbasename(string path);


 qdirname

qdirname

Get the directory part of the given path

string qdirname(string path);


 qexit

qexit

Stop execution of IDC program, close the database and exit to OS
     code - code to exit with.
To quit without saving the database, execute the following line:
process_config_directive("ABANDON_DATABASE=YES");

void qexit(long code);


 qisabspath

qisabspath

文件名是绝对的 (不是相对于当前目录的？)

long qisabspath(string file);


 qmake_full_path

qmake_full_path

Convert relative path to absolute path

string qmake_full_path(string path);


 qmakefile

qmakefile

Construct filename from base name and extension

string qmakefile(string base, string ext);


 qsleep

qsleep

Sleep the specified number of milliseconds
This function suspends IDA for the specified amount of time
Thread-safe function.

void qsleep(long milliseconds);


 read_dbg_byte

read_dbg_byte

Get value of program byte using the debugger memory
     ea - linear address
返回： 失败时引发异常。
线程安全函数(只能从主线程和 debthread 调用)

long read_dbg_byte(long ea);


 read_dbg_dword

read_dbg_dword

Get value of program double word (4 bytes) using the debugger memory
     ea - linear address
返回： 失败时引发异常。
线程安全函数(只能从主线程和 debthread 调用)

long read_dbg_dword(long ea);


 read_dbg_memory

read_dbg_memory

Read from debugger memory
     ea - linear address
     size - size of data to read
returns: data as a string. If failed, If failed, throws an exception
Thread-safe function (may be called only from the main thread and debthread)

string read_dbg_memory(long ea, long size);


 read_dbg_qword

read_dbg_qword

Get value of program quadro word (8 bytes) using the debugger memory
     ea - linear address
返回: the value of the quadro word. If failed, throws an exception
Thread-safe function (may be called only from the main thread and debthread)

long read_dbg_qword(long ea);


 read_dbg_word

read_dbg_word

Get value of program word (2 bytes) using the debugger memory
     ea - linear address
returns: the value of the word. 失败时引发异常。
线程安全函数(只能从主线程和 debthread 调用)

long read_dbg_word(long ea);


 read_selection_end

read_selection_end

Get end address of the selected area
returns BADADDR - no selection

long read_selection_end();


 read_selection_start

read_selection_start

Get start address of the selected range
returns BADADDR - no selection

long read_selection_start();


 readlong

readlong

read 4 bytes from file
     handle  - file hanlde
     mostfirst  - 0 least significant byte is first (intel)
                  1 most  significant byte is first
返回: a 32-bit value
Thread-safe function.

long readlong(long handle, long mostfirst);


 readshort

readshort

read 2 bytes from file
     handle    - file hanlde
     mostfirst - 0 least significant byte is first (intel)
                 1 most  significant byte is first
返回: -1 - error
         otherwise: a 16-bit value
Thread-safe function.

long readshort(long handle, long mostfirst);


 readstr

readstr

read a string from file
     handle  - file hanlde
返回: a string
Check for EOF like this: !value_is_string(retvalue)
Thread-safe function.

string readstr(long handle);


 变基程序

变基程序

 操作名称: Rebase 程序
The whole program will be shifted by the specifed amount of bytes in the memory. The following options are available (we strongly recommend to leave them turned on):
 修复搬迁

        此选项允许 IDA 修改对重定位段的引用或来自重定位段的引用。 如果关闭，移动后的引用可能会出错。

 Rebase the whole image

        This option is accessible only if the whole program
        is selected. It allows IDA to adjust internal
        variables on the whole program.
Please note rebasing the program might remove user-defined xrefs.

另参见 编辑|段子菜单。


 rebase_program

rebase_program

Rebase the whole program by 'delta' bytes delta - number of bytes to move the program flags - combination of   MFS_... constants it is recommended to use MSF_FIXONCE so that the loader takes care of global variables it stored in the database 返回：
long rebase_program(long delta, long flags);


 recalc_spd

recalc_spd

Recalculate SP delta for an instruction that stops execution.
     cur_ea  - linear address of the current instruction
返回：
success recalc_spd(cur_ea);


 重做操作

重做操作

 操作名称: Redo
此命令将还原先前发出的 撤消命令。可以多次使用重做。

此命令还会还原在上次执行“撤消”命令后对数据库所做的所有更改，包括自动分析所做的最终有用修改。换言之，修改整个数据库以达到执行最后一个“撤消”命令之前的确切状态。

另参见 撤消 重置撤消 禁用撤消 打开撤消历史记录


 刷新内存

刷新内存

 操作名称: RefreshMemcfg
This command refreshes the segments and memory contents in IDA. It is available only during a debugging session. 注意: this command is currently hidden from the user interface because IDA does synchronize with the process memory automatically.

Please note that IDA itself tries to keep the program segments in sync with the debugged process. However, in order to accelerate the debugger, the synchronization is done only at major events, for example when dynamic library gets loaded or unloadled or a thread is created or deleted. If the memory configuration is changed because of a simple system call (think of VirtualAlloc), IDA might miss it. Use the "refesh memory" command in these cases.

Note2: when IDA detects a discrepancy in the segments, it will automatically synchronize with the process.

另参见 调试器子菜单。


 刷新屏幕

刷新屏幕

// Refresh all disassembly views

void refresh_idaview_anyway(void);
// Refresh all choosers (names, functions, etc)
void refresh_choosers(void);


 正则表达式语法摘要

正则表达式语法摘要
pcre2pattern 文档中介绍了 PCRE2 支持的正则表达式的完整语法和语义。 本文档包含语法的快速参考摘要。

摘引

  \x         其中 x 是非字母数字，是文字 x
  \Q...\E    将括起来的字符视为文字
转义字符

此表适用于 ASCII 和 Unicode 环境。

  \a         alarm, that is, the BEL character (hex 07)
  \cx        "control-x", where x is any ASCII printing character
  \e         escape (hex 1B)
  \f         form feed (hex 0C)
  \n         newline (hex 0A)
  \r         carriage return (hex 0D)
  \t         tab (hex 09)
  \0dd       character with octal code 0dd
  \ddd       character with octal code ddd, or backreference
  \o{ddd..}  character with octal code ddd..
  \U         "U" if PCRE2_ALT_BSUX is set (otherwise is an error)
  \uhhhh     character with hex code hhhh (if PCRE2_ALT_BSUX is set)
  \xhh       character with hex code hh
  \x{hhh..}  character with hex code hhh..
Note that \0dd is always an octal code. The treatment of backslash followed by a non-zero digit is complicated; for details see the section "Non-printing characters" in the pcre2pattern documentation, where details of escape processing in EBCDIC environments are also given.

When \x is not followed by {, from zero to two hexadecimal digits are read, but if PCRE2_ALT_BSUX is set, \x must be followed by two hexadecimal digits to be recognized as a hexadecimal escape; otherwise it matches a literal "x". Likewise, if \u (in ALT_BSUX mode) is not followed by four hexadecimal digits, it matches a literal "u".

字符类型

  .          any character except newline;
               in dotall mode, any character whatsoever
  \C         one code unit, even in UTF mode (best avoided)
  \d         a decimal digit
  \D         a character that is not a decimal digit
  \h         a horizontal white space character
  \H         a character that is not a horizontal white space character
  \N         a character that is not a newline
  \p{xx}     a character with the xx property
  \P{xx}     a character without the xx property
  \R         a newline sequence
  \s         a white space character
  \S         a character that is not a white space character
  \v         a vertical white space character
  \V         a character that is not a vertical white space character
  \w         a "word" character
  \W         a "non-word" character
  \X         a Unicode extended grapheme cluster
\C is dangerous because it may leave the current matching point in the middle of a UTF-8 or UTF-16 character. The application can lock out the use of \C by setting the PCRE2_NEVER_BACKSLASH_C option. It is also possible to build PCRE2 with the use of \C permanently disabled.

By default, \d, \s, and \w match only ASCII characters, even in UTF-8 mode or in the 16-bit and 32-bit libraries. However, if locale-specific matching is happening, \s and \w may also match characters with code points in the range 128-255. If the PCRE2_UCP option is set, the behaviour of these escape sequences is changed to use Unicode properties and they match many more characters.

\p 和 \P 的常规类别属性

  C          Other
  Cc         Control
  Cf         Format
  Cn         Unassigned
  Co         Private use
  Cs         Surrogate

  L          Letter
  Ll         Lower case letter
  Lm         Modifier letter
  Lo         Other letter
  Lt         Title case letter
  Lu         Upper case letter
  L&         Ll, Lu, or Lt

  M          Mark
  Mc         Spacing mark
  Me         Enclosing mark
  Mn         Non-spacing mark

  N          Number
  Nd         Decimal number
  Nl         Letter number
  No         Other number

  P          Punctuation
  Pc         Connector punctuation
  Pd         Dash punctuation
  Pe         Close punctuation
  Pf         Final punctuation
  Pi         Initial punctuation
  Po         Other punctuation
  Ps         Open punctuation

  S          Symbol
  Sc         Currency symbol
  Sk         Modifier symbol
  Sm         Mathematical symbol
  So         Other symbol

  Z          Separator
  Zl         Line separator
  Zp         Paragraph separator
  Zs         Space separator
\p 和 \P 的 PCRE2 特殊类别属性
  Xan        Alphanumeric: union of properties L and N
  Xps        POSIX space: property Z or tab, NL, VT, FF, CR
  Xsp        Perl space: property Z or tab, NL, VT, FF, CR
  Xuc        Univerally-named character: one that can be
               represented by a Universal Character Name
  Xwd        Perl word: property Xan or underscore
Perl and POSIX space are now the same. Perl added VT to its space character set at release 5.18.

SCRIPT NAMES FOR \p AND \P

Ahom, Anatolian_Hieroglyphs, Arabic, Armenian, Avestan, Balinese, Bamum, Bassa_Vah, Batak, Bengali, Bopomofo, Brahmi, Braille, Buginese, Buhid, Canadian_Aboriginal, Carian, Caucasian_Albanian, Chakma, Cham, Cherokee, Common, Coptic, Cuneiform, Cypriot, Cyrillic, Deseret, Devanagari, Duployan, Egyptian_Hieroglyphs, Elbasan, Ethiopic, Georgian, Glagolitic, Gothic, Grantha, Greek, Gujarati, Gurmukhi, Han, Hangul, Hanunoo, Hatran, Hebrew, Hiragana, Imperial_Aramaic, Inherited, Inscriptional_Pahlavi, Inscriptional_Parthian, Javanese, Kaithi, Kannada, Katakana, Kayah_Li, Kharoshthi, Khmer, Khojki, Khudawadi, Lao, Latin, Lepcha, Limbu, Linear_A, Linear_B, Lisu, Lycian, Lydian, Mahajani, Malayalam, Mandaic, Manichaean, Meetei_Mayek, Mende_Kikakui, Meroitic_Cursive, Meroitic_Hieroglyphs, Miao, Modi, Mongolian, Mro, Multani, Myanmar, Nabataean, New_Tai_Lue, Nko, Ogham, Ol_Chiki, Old_Hungarian, Old_Italic, Old_North_Arabian, Old_Permic, Old_Persian, Old_South_Arabian, Old_Turkic, Oriya, Osmanya, Pahawh_Hmong, Palmyrene, Pau_Cin_Hau, Phags_Pa, Phoenician, Psalter_Pahlavi, Rejang, Runic, Samaritan, Saurashtra, Sharada, Shavian, Siddham, SignWriting, Sinhala, Sora_Sompeng, Sundanese, Syloti_Nagri, Syriac, Tagalog, Tagbanwa, Tai_Le, Tai_Tham, Tai_Viet, Takri, Tamil, Telugu, Thaana, Thai, Tibetan, Tifinagh, Tirhuta, Ugaritic, Vai, Warang_Citi, Yi.

CHARACTER CLASSES

  [...]       positive character class
  [^...]      negative character class
  [x-y]       range (can be used for hex characters)
  [[:xxx:]]   positive POSIX named set
  [[:^xxx:]]  negative POSIX named set

  alnum       alphanumeric
  alpha       alphabetic
  ascii       0-127
  blank       space or tab
  cntrl       control character
  digit       decimal digit
  graph       printing, excluding space
  lower       lower case letter
  print       printing, including space
  punct       printing, excluding alphanumeric
  space       white space
  upper       upper case letter
  word        same as \w
  xdigit      hexadecimal digit
In PCRE2, POSIX character set names recognize only ASCII characters by default, but some of them use Unicode properties if PCRE2_UCP is set. You can use \Q...\E inside a character class.

QUANTIFIERS

  ?           0 or 1, greedy
  ?+          0 or 1, possessive
  ??          0 or 1, lazy
  *           0 or more, greedy
  *+          0 or more, possessive
  *?          0 or more, lazy
  +           1 or more, greedy
  ++          1 or more, possessive
  +?          1 or more, lazy
  {n}         exactly n
  {n,m}       at least n, no more than m, greedy
  {n,m}+      at least n, no more than m, possessive
  {n,m}?      at least n, no more than m, lazy
  {n,}        n or more, greedy
  {n,}+       n or more, possessive
  {n,}?       n or more, lazy
ANCHORS AND SIMPLE ASSERTIONS
  \b          word boundary
  \B          not a word boundary
  ^           start of subject
                also after an internal newline in multiline mode
                (after any newline if PCRE2_ALT_CIRCUMFLEX is set)
  \A          start of subject
  $           end of subject
                also before newline at end of subject
                also before internal newline in multiline mode
  \Z          end of subject
                also before newline at end of subject
  \z          end of subject
  \G          first matching position in subject
MATCH POINT RESET
  \K          reset start of match
\K is honoured in positive assertions, but ignored in negative ones.

ALTERNATION

  expr|expr|expr...
CAPTURING
  (...)           capturing group
  (?<name>...)    named capturing group (Perl)
  (?'name'...)    named capturing group (Perl)
  (?P<name>...)   named capturing group (Python)
  (?:...)         non-capturing group
  (?|...)         non-capturing group; reset group numbers for
                   capturing groups in each alternative
ATOMIC GROUPS
  (?>...)         atomic, non-capturing group
COMMENT
  (?#....)        comment (not nestable)
OPTION SETTING
  (?i)            caseless
  (?J)            allow duplicate names
  (?m)            multiline
  (?s)            single line (dotall)
  (?U)            default ungreedy (lazy)
  (?x)            extended (ignore white space)
  (?-...)         unset option(s)
The following are recognized only at the very start of a pattern or after one of the newline or \R options with similar syntax. More than one of them may appear. (*LIMIT_MATCH=d) set the match limit to d (decimal number)
  (*LIMIT_RECURSION=d) set the recursion limit to d (decimal number)
  (*NOTEMPTY)     set PCRE2_NOTEMPTY when matching
  (*NOTEMPTY_ATSTART) set PCRE2_NOTEMPTY_ATSTART when matching
  (*NO_AUTO_POSSESS) no auto-possessification (PCRE2_NO_AUTO_POSSESS)
  (*NO_DOTSTAR_ANCHOR) no .* anchoring (PCRE2_NO_DOTSTAR_ANCHOR)
  (*NO_JIT)       disable JIT optimization
  (*NO_START_OPT) no start-match optimization (PCRE2_NO_START_OPTIMIZE)
  (*UTF)          set appropriate UTF mode for the library in use
  (*UCP)          set PCRE2_UCP (use Unicode properties for \d etc)
Note that LIMIT_MATCH and LIMIT_RECURSION can only reduce the value of the limits set by the caller of pcre2_match(), not increase them. The application can lock out the use of (*UTF) and (*UCP) by setting the PCRE2_NEVER_UTF or PCRE2_NEVER_UCP options, respectively, at compile time.

NEWLINE CONVENTION

These are recognized only at the very start of the pattern or after option settings with a similar syntax.

  (*CR)           carriage return only
  (*LF)           linefeed only
  (*CRLF)         carriage return followed by linefeed
  (*ANYCRLF)      all three of the above
  (*ANY)          any Unicode newline sequence
WHAT \R MATCHES

These are recognized only at the very start of the pattern or after option setting with a similar syntax.

  (*BSR_ANYCRLF)  CR, LF, or CRLF
  (*BSR_UNICODE)  any Unicode newline sequence
LOOKAHEAD AND LOOKBEHIND ASSERTIONS
  (?=...)         positive look ahead
  (?!...)         negative look ahead
  (?<=...)        positive look behind
  (?<!...)        negative look behind
Each top-level branch of a look behind must be of a fixed length.

BACKREFERENCES

  \n              reference by number (can be ambiguous)
  \gn             reference by number
  \g{n}           reference by number
  \g{-n}          relative reference by number
  \k<name>        reference by name (Perl)
  \k'name'        reference by name (Perl)
  \g{name}        reference by name (Perl)
  \k{name}        reference by name (.NET)
  (?P=name)       reference by name (Python)
SUBROUTINE REFERENCES (POSSIBLY RECURSIVE)
  (?R)            recurse whole pattern
  (?n)            call subpattern by absolute number
  (?+n)           call subpattern by relative number
  (?-n)           call subpattern by relative number
  (?&name)        call subpattern by name (Perl)
  (?P>name)       call subpattern by name (Python)
  \g<name>        call subpattern by name (Oniguruma)
  \g'name'        call subpattern by name (Oniguruma)
  \g<n>           call subpattern by absolute number (Oniguruma)
  \g'n'           call subpattern by absolute number (Oniguruma)
  \g<+n>          call subpattern by relative number (PCRE2 extension)
  \g'+n'          call subpattern by relative number (PCRE2 extension)
  \g<-n>          call subpattern by relative number (PCRE2 extension)
  \g'-n'          call subpattern by relative number (PCRE2 extension)
CONDITIONAL PATTERNS
  (?(condition)yes-pattern)
  (?(condition)yes-pattern|no-pattern)

  (?(n)               absolute reference condition
  (?(+n)              relative reference condition
  (?(-n)              relative reference condition
  (?(<name>)          named reference condition (Perl)
  (?('name')          named reference condition (Perl)
  (?(name)            named reference condition (PCRE2)
  (?(R)               overall recursion condition
  (?(Rn)              specific group recursion condition
  (?(R&name)          specific recursion condition
  (?(DEFINE)          define subpattern for reference
  (?(VERSION[>]=n.m)  test PCRE2 version
  (?(assert)          assertion condition
BACKTRACKING CONTROL

The following act immediately they are reached:

  (*ACCEPT)       force successful match
  (*FAIL)         force backtrack; synonym (*F)
  (*MARK:NAME)    set name to be passed back; synonym (*:NAME)
The following act only when a subsequent match failure causes a backtrack to reach them. They all force a match failure, but they differ in what happens afterwards. Those that advance the start-of-match point do so only if the pattern is not anchored. (*COMMIT) overall failure, no advance of starting point
  (*PRUNE)        advance to next starting character
  (*PRUNE:NAME)   equivalent to (*MARK:NAME)(*PRUNE)
  (*SKIP)         advance to current matching position
  (*SKIP:NAME)    advance to position corresponding to an earlier
                  (*MARK:NAME); if not found, the (*SKIP) is ignored
  (*THEN)         local failure, backtrack to next alternation
  (*THEN:NAME)    equivalent to (*MARK:NAME)(*THEN)
CALLOUTS
  (?C)            callout (assumed number 0)
  (?Cn)           callout with numerical data n
  (?C"text")      callout with string data
The allowed string delimiters are ` ' " ^ % # $ (which are the same for the start and the end), and the starting delimiter { matched with the ending delimiter }. To encode the ending delimiter within the string, double it.


 重新加载输入的文件

重新加载输入的文件

 操作名称: ReloadFile
此命令将相同的输入文件重新加载到数据库中。IDA 试图在数据库中保留尽可能多的信息。所有名称、注释、段信息和类似信息都将被保留。

只有单个字节的值才会被更改。

此命令仅适用于某些输入文件类型：如果使用特殊设置将文件加载到数据库中，则此命令可能会失败。在这种情况下，请使用 “将数据库转储到 IDC 文件”命令并手动重新加载文件。

另参见 加载...子菜单命令。


 远程调试

远程调试
1. Launch a remote IDA 调试器 server on the remote host. The remote server is started from the 命令行 and accepts 命令行 parameters. You can 指定a password if you want to protect your 调试器 server from strangers. For example, to launch the server under MS Windows, you could enter:
        win32_remote -Pmy_secret_password
2. 指定the remote 调试器 parameters in the 调试器, 进程选项. 文件路径在远程主机上必须有效。Do not forget to specify the same password as you have specified when launching the server. For example, to debug notepad.exe on the remote computer remote.host.com:
        Application: c:\windows\notepad.exe
        Input 文件:  c:\windows\notepad.exe
        Directory:   c:\windows
        Hostname:    remote.host.com
        Port:        23946
        Password:    my_secret_password
3. The rest of debugging is the same as with local debugging.
 NOTE
The 调试器 server can handle one 调试器 session at once. If you need to debug several applications simultaneously, launch several servers at different network ports.

NOTE

 The Windows CE 调试器 uses ActiveSync protocol to connect to the remote device.
NOTE
 The symbian 调试器 uses a serial port to connect to the remote device.


 远程 GDB 调试器

远程 GDB 调试器
远程 GDB 调试器模块 allows for debugging code using the GDB remote serial protocol. For this, the debuggee must contain a so-called "GDB stub" that controls the execution and handles the remote protocol commands. 有许多此类存根的实现，具有不同的功能。The module has been tested with the following GDB stubs:
 gdbserver: Windows (Cygwin), Linux (ARM, MIPS, PowerPC)
 VMWare: x86 (16/32 bit)
 QEMU: x86 (16/32 bit), ARM, MIPS, PowerPC
 OpenOCD: ARM
It is quite possible that the module will work with other stubs. Note that only x86, ARM, MIPS and PowerPC processors are supported at the moment.

Some GDB stubs support so-called "monitor" commands. For example, VMWare stub can return extra info about system registers. Use the 命令行 at the bottom of the main IDA window to send such commands. The output will be displayed in the 消息窗口. Hint: most stubs have a "help" 命令 (if they support any commands at all).

The module also makes the following 函数 available from IDC:

 string   send_dbg_command(string command);
 NOTE
When using instant debugging, you will need to tell IDA on which CPU the target is running. This is done in the Remote GDB 调试器 options dialog, available via "调试器 specific options" button in the Process options dialog shown when you choose Remote GDB 调试器 from the Run or Attach menu.
 NOTE
Many GDB stubs do not report the address that triggered a hardware breakpoint. In this case, IDA will report a memory breakpoint hit as a generic TRAP signal. Examine the previous instruction to see if it referenced a memory location with breakpoint. When continuing from such a breakpoint, choose not to pass the signal to the program.
 NOTE
IDA can be used together with a J-Link debug probe from SEGGER Microcontroller GmbH:

https://segger.com/jlink-debug-probes.html

另参见

  远程 GDB 调试器选项
  调试器子菜单。


 远程 GDB 调试器选项

远程 GDB 调试器选项
Max packet size
        Maximum packet size supported by the GDB stub (in bytes).
        某些存根可能会在大数据包上崩溃，例如内存读取。 IDA
        will try to split such requests in smaller chunks so that
        replies should fit in this size. You can enter -1 to
        autodetect (in this case IDA will use the size of the
        "g" packet reply as the max packet size).
Timeout
        Default timeout in milliseconds for 远程 GDB stub responses.
        Some targets can be slow to respond, so increase this value
        when having problems, e.g. with disappearing memory bytes.
Run a program before starting debugging
        Check to enable external program options.
Processor
        This option is only visible when   starting 调试器 without a database.
        Use it to 指定on which CPU the target is running. For some processors you can also
        指定the endianness.
Software breakpoints at EIP+1
        Most GDB stubs for x86 report software breakpoint hits with EIP one byte after
        the breakpoint address. However, some emulators report the actual breakpoint
        address. This option allows IDA to recognize such situations.
        Recommendations: uncheck for QEMU, check for others.
Use CS:IP in real mode
        调试实模式(16 位)代码时，存根可以发送
        只有 16 位 IP 寄存器或完整的 EIP (CS<<4 + IP)。
        Enable this option in the former case.
        Recommendations: check for QEMU, uncheck for others.
另参见


 远程 iOS 调试器

远程 iOS 调试器
The Remote iOS 调试器 allows for debugging iOS applications directly from IDA.

IDA's iOS debugger acts as a client to Apple's debugserver. So, you must ensure that the debugserver is already installed on your device for the debugger to work.

See: "

for a detailed tutorial on getting started with iOS.

另参见 远程 GDB 调试器 适用于 macOS 的调试器 如何启动远程调试


 移除二进制跟踪

移除二进制跟踪
从磁盘中删除二进制跟踪文件

此命令显示一个窗口，用于选择要从磁盘中删除的记录跟踪文件。

另参见:
   清除跟踪
   选择跟踪
   其他选项
   编辑跟踪描述
   二进制跟踪的比较
   导入二进制跟踪
   导出二进制跟踪
   导出跟踪到文本文件
   显示跟踪调用图表


 移除函数尾部

移除函数尾部

 操作名称: RemoveFunctionTail
此命令从函数定义中删除光标处的函数尾部。

如果当前函数尾部范围有多个父函数，IDA 将要求选择要从中删除尾部的父函数。

确认后，将从所选函数定义中删除当前函数尾部范围。

如果父项是当前尾部的唯一所有者，则尾部将被销毁。否则，它仍将存在于数据库中。如果被移除的父代是尾部的所有者，则会选择另一个函数作为所有者。

另参见

         编辑|函数子菜单。
         追加函数尾部


 rename

rename

rename a file
     oldname - existing file name
     newname - new file name
返回: error code from the system
Thread-safe function.

long rename(string oldname, string newname);


 重命名堆栈变量

重命名堆栈变量
此命令允许用户重命名堆栈变量。 Enter an identifier for the 堆栈变量 and press Enter.

Internally, 堆栈变量 are represented as structure fields. IDA creates a new 结构体类型 for each 函数 frame.

另参见 编辑|结构体子菜单。如何输入标识符


 重命名结构体/成员

重命名结构体/成员
IDA maintains separate namespaces for each structure. For example, you can define something like this:
 xxx    struc
 xxx    db ?
 xxx    struc
请注意，通常汇编程序有一个通用的命名空间，并且不允许上述示例。

不能指定空名称。

当你打开结构体窗口时，此命令可用。

如果光标位于结构体定义开头的结构体名称上，则 IDA 建议重命名结构体。否则，IDA 建议重命名结构体字段。

如果要重命名结构体，则选项“不包括在列表中”表示该结构体将不会包含在用户应用结构体定义时出现的结构体列体表中(例如，当用户创建此结构体类型的变量时)。当你定义了此结构体类型的所有变量并希望减少列表中的选项数时，建议选中此复选框。

另参见 编辑|结构体子菜单。如何输入标识符


 重命名任何地址

重命名任何地址

 操作名称: MakeAnyName
此命令为指定地址提供名称/重命名/删除 名称。这是 重命名 命令的更强大的变体。

要删除名称，只需指定一个空名称即可。

如果引用了指定的地址，则无法删除其名称。即使你尝试，IDA 也会生成一个 虚拟 名称。

此命令只能从 名称窗口使用。

有关对话框条目的说明，请参阅 重命名当前地址 命令。

另参见

         编辑|其他子菜单。
         如何输入标识符。
         名称表达。


 重命名寄存器

重命名寄存器

 操作名称: RenameRegister
此命令允许你将处理器通用寄存器重命名为某个有意义的名称。虽然这在 IBM PC 上并不经常使用，但它在具有大量寄存器的 RISC 处理器上特别有用。

例如，通用寄存器 R9 意义不大，而像 'CurrentTime' 这样的名称要好得多。

此命令可用于定义新的寄存器名称以及删除它。只需将光标移动到寄存器名称上，然后按回车键即可。如果以空字符串形式输入新寄存器名称，则定义将被删除。

如果在使用此命令之前已选择范围，则定义将限制为所选范围。但无论如何，定义不能跨越函数边界。

如果当前指令不属于任何 函数，则不能使用此命令。

另参见

         编辑|函数子菜单。


 rename_array

rename_array

rename array
     id      - array id returned by create_array() or get_array_id()
     newname - new name of array. There are no
               restrictions on the name (its length should
               be less than 120 characters, though)
返回: 1-正常，0-失败

success rename_array(long id, string newname);


 rename_entry

rename_entry

rename entry point
     ordinal - entry point number
     name    - new name
返回: !=0 - ok

success rename_entry(long ordinal, string name);


 使用指定的操作数重复搜索指令/数据

使用指定的操作数重复搜索指令/数据

 操作名称: JumpImmediate
This command repeats search for immediate command.

另参见搜索子菜单


 重复搜索反汇编中的子字符串

重复搜索反汇编中的子字符串

 操作名称: JumpText
此命令重复 搜索文本 命令。

另参见搜索子菜单


 在文件中重复搜索子字符串

在文件中重复搜索子字符串

 操作名称: JumpBinaryText
此命令重复在核心中搜索文本命令。

另参见搜索子菜单


 Replayer 调试器

Replayer 调试器
重播器调试器是用于重播记录的跟踪的伪调试器。

The replayer debugger supports replaying traces recorded with any of the currently supported debuggers, ranging from local Linux or win32 debuggers to remote GDB targets. Currently supported targets include x86, x86_64, ARM, MIPS and PPC.

To use the replayer debugger you will need first to record a trace by enabling instruction tracing, function tracing or basic block tracing with another debugger. 然后，在跟踪窗口中加载记录的跟踪后，从调试器的下拉列表中选择重播调试器，并像使用任何其他调试器一样正常启动调试器。

One of the advantages of the replay debugger module over re-executing the debuggee is that in the replayer debugger it is possible to step not only forward, but also backwards, making it easier to analyze what happened during the execution of the recorded trace.

There are two types of traces that can be replayed: instruction level traces or partial traces. Instruction level traces are recorded by enabling instruction tracing and partial traces are recorded using either function tracing or basic block tracing. When a trace is recorded with instruction tracing enabled all register values are saved. With basic block or function level tracing only the instruction pointer is saved. Additionally, in basic block tracing the register values are also saved when the last instruction of a basic block is reached or a call in the middle of a basic block is about to be executed.

The replayer debugger module adds a new menu item: Debugger, Step Back command. It can be used to step back to the previous instruction when replaying a recorded trace.

Additional IDC functions provided by the replayer debugger


 重置桌面

重置桌面
此命令通过加载原始 IDA 反汇编桌面或调试器桌面(如果调试器处于活动状态)来重置所有窗口(IDA 主窗口和数据库窗口)。

另参见

         桌面
         加载桌面... 命令
         保存桌面... 命令
         删除桌面... 命令


 重置隐藏消息

重置隐藏消息
该命令重置用户通过勾选“不再显示此消息”复选框被隐藏的所有问题和消息的状态。


 resume_thread

resume_thread

Resume thread
     tid - thread id
Return: -1:network error, 0-failed, 1-ok

long resume_thread(long tid);


 retrieve_input_file_md5

retrieve_input_file_md5

获取输入文件的 MD5 哈希值。
此函数返回输入文件的 MD5 哈希字符串(32 个字符)

string retrieve_input_file_md5();


 rotate_left

rotate_left

rotate a value to the left (or right)
   arguments:
        x      - value to rotate
        count  - number of times to rotate. negative counter means
                 rotate to the right
        nbits  - number of bits to rotate
        offset - offset of the first bit to rotate
返回: the value with the specified field rotated
         all other bits are not modified
Thread-safe function.

long rotate_left(long value, long count, long nbits, long offset);
#define rotate_dword(x, count) rotate_left(x, count, 32, 0) #define rotate_word(x, count)  rotate_left(x, count, 16, 0) #define rotate_byte(x, count)  rotate_left(x, count,  8, 0)


 运行到光标

运行到光标

 操作名称: ThreadRunToCursor
此命令执行指令，直到到达光标下的指令。

在内部，IDA 在光标下的指令上设置一个临时断点。

 另参见 调试器子菜单。


 运行到返回

运行到返回

 操作名称: ThreadRunUntilReturn
This commands execute assembler instructions and stops on the 指令 immediatly following the 指令 that called the current 函数.

Internally, IDA executes each 指令 until a 'return from 函数' 指令 is reached.

另参见:
   步入
   步过
   调试器子菜单


 RunPythonStatement

RunPythonStatement

执行 python 语句。
     statement - 语句
如果执行语句，则返回数字 0，否则返回错误字符串
线程安全函数。

string or long RunPythonStatement(string statement);


 sanitize_file_name

sanitize_file_name

Sanitize the file name.
Remove the directory path, and replace wildcards ? * and chars<' ' with underscore.

string sanitize_file_name(string filename);


 保存数据库

保存数据库

 操作名称: SaveBase
此命令保存并打包当前数据库。

另参见 其他文件...子菜单命令。 将数据库另存为...命令。


 将数据库另存为...

将数据库另存为...

 操作名称: SaveBaseAs
此命令保存并打包当前数据库。IDA 将提示你为数据库文件输入新名称。数据库以 .IDB 扩展名保存。如果不想覆盖早期的数据库，请使用此命令。

另参见

         其他文件...子菜单命令。
         保存数据库命令。


 保存桌面

保存桌面
此命令将当前桌面配置保存到 桌面。

如果输入名称，IDA 会将当前配置保存到数据库或注册表中的命名桌面。

如果选择“默认”，IDA 会将当前配置保存到注册表中的 <Default> 或 <Default debugger>桌面(如果调试器处于活动状态)。

另参见

         桌面
         加载桌面...命令
         删除桌面...命令
         重置桌面命令


 save_database

save_database

Save current database to the specified idb file
     idbname - name of the idb file. if empty, the current idb
               file will be used.
     flags   - DBFL_... bits or 0
see also set_database_flag(), clr_database_flag()

success save_database(string idbname, long flags);
#define DBFL_KILL       0x01            // delete unpacked database #define DBFL_COMP       0x02            // collect garbage #define DBFL_BAK        0x04            // create backup file (if !DBFL_KILL) #define DBFL_TEMP       0x08            // temporary database


 savefile

savefile

save from IDA database to file
     handle  - file handle
     pos     - position in the file
     ea      - linear address to save from
     size    - number of bytes to save
返回: 0 - error
         1 - ok

success savefile(long handle, long pos, long ea, long size);


 分散的参数位置

分散的参数位置
On x64 and other processors the 编译器 sometimes passes 结构体 and unions partially on registers and partially on the stack. Consider the following structure:
  #pragma pack(push, 4)
  struct struc_1
  {
    char c1;
    short s2;
    char c3;
    int i4;
  };
  #pragma pack(pop)
In binary form it looks like this:
  00000000 struc_1         struc ; (sizeof=0xC)
  00000000 c1              db ?
  00000001                 db ? ; 未定义
  00000002 s2              dw ?
  00000004 c3              db ?
  00000005                 db ? ; 未定义
  00000006                 db ? ; 未定义
  00000007                 db ? ; 未定义
  00000008 i4              dd ?
  0000000C struc_1         ends
如果我们有这个函数原型
  void myfunc(struc_1 s);
则 64 位 GNU 编译器将传递如下结构体：
  RDI: c1, s2, and c3
  RSI: i4
由于编译器可以使用如此复杂的调用约定，因此 IDA 需要某种机制来描述它们。为此，使用了分散的参数位置。上面的调用约定可以这样描述：
  void __usercall myfunc(struc_1 s@<0:rdi.1, 2:rdi^2.2, 4:rdi^4.1, 8:rsi.4>);
It reads:
  1 byte  at offset 0 of the argument is  passed in the byte 0 of RDI
  2 bytes at offset 2 of the argument are passed in the byte 1,2 of RDI
  1 byte  at offset 4 of the argument is  passed in the byte 3 of RDI
  4 bytes at offset 8 of the argument are passed starting from the byte 0 of RSI
In other words, the following syntax is used:
  argoff:register^regoff.size
where
  argoff - 参数内的偏移量
  register - 用于传递部分参数的寄存器名称
  regoff - 寄存器内的偏移量
  size - 字节数
The regoff and size fields can be omitted if there is no ambiguity.

If the register is not specified, the expression describes a stack location:

  argoff:^stkoff.size
where
  argoff - 参数内的偏移量
  stkoff - 堆栈帧中的偏移量(第一个堆栈参数位于偏移量 0)
  size - 字节数
Please note that while IDA checks the argument location specifiers for soundness, it can not perform all checks and some wrong locations may be accepted. In particular, IDA in general does not know the register sizes and accepts any offsets within them and any sizes.

另参见 设置类型命令。


 脚本命令

脚本命令

 操作名称: ExecuteLine
你可以输入并执行用内置 IDC 语言或任何其他注册的 extlang 编写的小脚本。

以下是 内置 函数的列表。

另参见

         IDC 语言概述
         执行脚本文件命令
         文件...子菜单命令
         如何使用记事本。


 滚动图表

滚动图表
用户可以通过在图表背景上单击鼠标左键并拖动它来平移(移动)图表。在极少数情况下，当屏幕上没有可见的图表背景时，可以使用按住 Shift 键单击来移动图表。当当前节点占据整个窗口时，这可能发生在非常高的缩放级别上。

鼠标滚轮垂直滚动图表。如果按下 Alt 键，它将水平滚动图表。

Page Up 和 Page Down 键垂直滚动图表。如果键盘箭头到达节点边界，并且无法按指定方向跳转到另一个节点，则可以滚动图表。

滚动图表不会更改键盘光标位置。一旦在屏幕上刷新图表，IDA 将滚动图表，使键盘光标变为可见。

返回到 图表视图 或 邻近视图


 搜索不属于任何函数的字节

搜索不属于任何函数的字节

 操作名称: JumpNotFunction
此命令搜索当前方向上不属于任何函数的第一个字节。

另参见搜索子菜单


 搜索下一个代码

搜索下一个代码

 操作名称: JumpCode
This command searches for the first instruction in the current direction.

另参见搜索子菜单


 搜索下一个数据

搜索下一个数据

 操作名称: JumpData
This command searches for the first defined data item in the current direction.

另参见搜索子菜单


 搜索下一个探测的字节

搜索下一个探测的字节

 操作名称: JumpExplored
This command searches for the first defined byte (instruction or data) in the current direction.

另参见搜索子菜单


 用指定的操作数搜索下一个指令/数据

用指定的操作数搜索下一个指令/数据

 操作名称: AskNextImmediate
This command searches for the first instruction or data byte that contains the specified immediate value. The command is relatively slow (but much faster than the text search), because it disassembles each instruction to find the operand values.

If the immediate value in an instruction has been logically or bitwise negated, then this command will check against the modified value. 示例:

        mov al, -2
will be found if the user searches for the immediate value 2 but not when he searches for 0xFE.

If the checkbox "any untyped value" is checked, then the "value" field is ignored. IDA will look for all immediate values without type in this case.

另参见

         搜索子菜单
         如何输入数字。


 搜索下一个错误字符串

搜索下一个错误字符串

 操作名称: JumpError
This commands searches for the '错误' operands. Usually, these operands are displayed with a red color.

Below is the list of probable causes of 错误 operands:

        - reference to an unexisting address
        - illegal offset base
        - unprintable character constant
        - invalid structure or enum reference
        - and so on...
另参见搜索子菜单


 搜索下一个可疑操作数

搜索下一个可疑操作数

 操作名称: JumpSuspicious
Suspicious operands are the operands that need your attention because they contain an immediate value that could be a number or an offset. IDA does not know about it, so it marks these instructions as 'suspicious'. You can change the suspiciousness of the operands using set lower limit of suspicious operands and set upper limit of suspicious operands commands.

Data arrays are considered to be suspicious if the first element of the data array is within the lower and upper suspicious limits. Values of other elements are not examined.

You can disable the display of the 'suspicious' marks in the Comments Dialog.

NOTE: We strongly recommend that before producing an ASM file you go through all 'suspicious' marks and get rid of them. After this you have a certain level of confidence that the file has been disassembled correctly.

另参见搜索子菜单


 搜索下一个未探测的字节

搜索下一个未探测的字节

 操作名称: JumpUnknown
This command searches for the first unexplored byte in the current direction.

另参见搜索子菜单


 在反汇编中搜索子字符串

在反汇编中搜索子字符串

 操作名称: AskNextText
此命令在反汇编的文本表示形式中搜索指定的子字符串。此命令是一个慢速命令，因为它反汇编每条指令以获取文本表示形式。IDA 将在指示器上显示其进展情况。你可以按 Ctrl-Break 打断此命令。

你也可以搜索 正则表达式。

如果使用定位器选择范围，IDA 将在该范围内搜索指定的子字符串。

请注意，此命令的搜索方式与你在屏幕上看到的内容相同(而不是在二进制图像中)。

对于二进制搜索，请查看 在文件中搜索子字符串

另参见搜索子菜单


 在文件中搜索子字符串

在文件中搜索子字符串

 操作名称: AskBinaryText
此命令在要反汇编的文件中搜索指定的子字符串。此命令可用于快速查找可执行文件中的文本字符串，甚至用于查找对数据的引用。你可以按 Ctrl-Break 打断它。

如果使用定位器选择范围，IDA 将在该范围内搜索指定的子字符串。

子字符串的指定方式如下:

        "这是要搜索的子字符串"
即在双引号中。 此外，你还可以将单个字节值指定为数字:
        6A 10
点击此 链接 了解有关输入字符串格式的更多信息。

例如，如果要查找对以下字符串的引用:

 35F2:106A      db 'Hello',0
你可以在文件中搜索数字 106A。

另参见

         输入字符串格式
         搜索文本命令。
         搜索子菜单


 搜索子菜单

搜索子菜单
在此菜单中，你可以选择一个命令来搜索反汇编中的内容。 搜索速度相对较慢，你之前的位置保存在 跳转堆栈中。

你可以搜索：

   可疑操作数 (需要注意的指令)
   指令
   数据字节数
   未探查的字节
   探查的字节数
   即时操作数值
   文本表示形式中的子字符串
   文件的二进制映像中的子字符串
   不属于任何函数的字节
   查找所有可疑操作数
   有错误的字符串
   查找所有错误
   图片(即光栅图像)

 在两个 方向 (向上和向下)。
另参见
        用于快速导航的跳转菜单。
        菜单栏子菜单


 search_path

search_path

在 PATH 环境变量或当前目录中搜索文件

string search_path(string file, long search_cwd);


 段类名称

段类名称
段类名使用类名(如 CODE、FAR_DATA 或 STACK)标识段。链接器将具有相同类名的段放入运行时内存映射中的连续内存区域。

更改段类只会更改屏幕上的段定义。有以下预定义的段类名称：

        CODE - 纯代码
        DATA - 纯数据
        CONST - 纯数据
        BSS - 未初始化的数据
        STACK - 未初始化的数据
        XTRN - 外部定义段
如果更改段类，并且段类型为“常规”，则段类型将相应更改。

为了设置段类型 "Regular", 你应该将段类更改为 "UNK"。

注意： 段类名称永远不会删除。 一旦定义了段类名称，就不能将其重复用作另一个对象的名称。

另请参见其他 SegEdit 表单字段。


 段寄存器更改点

段寄存器更改点
当 IDA 遇到更改段寄存器的指令时，它会创建一个段寄存器更改点。因此，大多数更改点由 IDA 自己维护。IDA 假定段寄存器不会在更改点之间更改其值。如果发现 IDA 无法找到段寄存器更改，或者要更改寄存器值，则可以使用 更改段寄存器命令创建更改点。你也可以使用设置默认段寄存器值命令更改段寄存器的值。

IDA 对更改点进行分类。在更改点列表中，你可以在寄存器值后看到以下后缀:

 a (auto)   - 由 IDA 创建。 之后可能会被 IDA 更改。
 u (by user)  - 由用户创建。IDA 不会更改它。
IDA 会为更改点生成相应的“假设”指令，如果 相应命令未禁用它。


 段寄存器窗口

段寄存器窗口

 操作名称: ShowSegmentRegisters
此命令将打开段寄存器窗口。该窗口将包含段寄存器 更改点 列表。

你可以在此窗口中使用 列表查看器 命令。

根据当前的处理器类型，你将看到带或不带 FS,GS 的 DS,ES,SS。

另参见 编辑|段子菜单。查看详情|打开子视图子菜单。


 段窗口

段窗口

 操作名称: ShowSegments
此命令将打开区段窗口。 此处对此窗口的格式进行了说明。

你可以在此窗口中使用 列表查看器 命令。

In order to change the selector values, use selectors window.

另参见 视图|打开子视图子菜单。


 sel2para

sel2para

Get mapping of a selector.
        arguments:      sel - the selector number
        返回:        selector value if found
                        otherwise the input value (sel)
        note:           selector values are always in paragraphs

long sel2para(long sel);


 选择跟踪

选择跟踪
Load a binary trace file in the 'Tracing' window.

该命令 displays all the saved trace 文件 that correspond to the MD5 of the current IDB and allows the user to load one of them. The traces can be replayed with the replayer 调试器, inspected manually in the disassembly view 或 displayed as a callgraph in a 邻近视图.

另参见:
   清除跟踪
   其他选项
   编辑跟踪描述
   二进制跟踪的比较
   移除二进制跟踪
   导入二进制跟踪
   导出二进制跟踪
   导出跟踪到文本文件
   显示跟踪调用图表


 选择联合体成员

选择联合体成员

 操作名称: SelectUnionMember
This command tells IDA how to display references to a union from the current cursor location.

示例: Suppose we have the following union:

        xxx     union
        a       db ?
        b       dw ?
        c       dd ?
        ends   xxx

        dloc    xxx ?

  Normally, IDA displays references to "dloc" like this:

        mov     al,  byte ptr dloc
        mov     eax, word ptr dloc

  After using this command, IDA can display the union members:

        mov     al,  dloc.b
        mov     eax, dloc.d
另参见 编辑|结构体子菜单。


 select_thread

select_thread

选择给定线程作为当前调试的线程。
     tid - 要选择的线程的 ID
必须暂停进程才能选择新线程。
返回: success

success select_thread(long tid);


 在图表中选择

在图表中选择
许多图表操作将应用于所选节点。当前节点被视为所有操作的节点选择的一部分。

可以使用鼠标选择图表节点。要一次选择多个节点，请在鼠标操作过程中按住 Ctrl 键。Alt 键从当前选择中删除节点。

在内部，IDA 跟踪选定的节点和边缘布局点。边布局点是边弯曲的点。如果在图形中移动当前选区，则选定的边缘布局点也会移动。

所选节点标题的默认颜色为浅灰色。其他节点标题以白色显示。

返回到 图表视图 或 邻近视图


 selector_by_name

selector_by_name

Get segment selector by name
     segname - name of segment
返回: segment selector or BADADDR

long selector_by_name(string segname);


 选择器窗口

选择器窗口

 操作名称: ShowSelectors
This command opens the selector window. Here you can change the "selector to base" mapping. The selector table is used to look up the selector values when calculating the addresses that are visible in the disassembly listing.

You can use list viewer commands in this window:

        - jump to the paragraph pointed by the selector
        - add a new selector
        - delete selector (if it is not used by any segment)
        - change selector value (this leads to reanalysis of all program)
另参见 视图|打开子视图子菜单。


 send_dbg_command

send_dbg_command

Send arbitrary command to the debugger engine.
返回：

注意：
string send_dbg_command(string cmd);


 设置当前 ip

设置当前 ip

 操作名称: ThreadSetCurrentIp
该命令将当前挂起线程的指令指针设置为当前光标位置。

仅当调试器处于活动状态且进程挂起时，才能访问它。

 另参见 调试器子菜单。


 设置默认段寄存器值

设置默认段寄存器值

 操作名称: SetSegmentRegisterDefault
仅与具有段寄存器的处理器相关。

您可以为当前段指定段寄存器的默认值。 更改默认值时，IDA 将重新分析段，并在无法确定寄存器的实际值时采用默认值。 这需要时间，因此如果引用没有立即更正，请不要感到惊讶。

要指定段寄存器缺省值以外的值，可以使用 更改段寄存器值 命令。

 另参见 编辑|段子菜单。
 另参见 如何输入段值。


 设置搜索方向

设置搜索方向

 操作名称: SetDirection
当前搜索方向显示在屏幕的右上角。 使用此命令，您可以切换显示。

另参见

         搜索子菜单,
         选项子菜单。


 设置函数结束

设置函数结束

 操作名称: FunctionEnd
此命令更改当前或上一个函数边界，以便将其结束设置在光标处。如果不可能，IDA 将发出蜂鸣声。

另参见 编辑|函数子菜单。创建函数 编辑函数


 设置函数/项类型

设置函数/项类型

 操作名称: SetType
该命令允许你指定当前项的类型。

如果光标位于一个名称，则将编辑已命名项的类型。否则，将编辑当前函数类型(如果是一个函数)或当前项类型(如果它有一个名称)。

函数类型必须作为 C 声明输入。隐藏的参数(如 C ++中的 'this' 指针)应该被明确指定。 IDA 将使用类型信息来注释带有关于函数参数信息的反汇编。它也可以被 Hex-Rays 反编译器插件用于更好的反编译。

下面是一个函数声明的示例：

        int main(int argc, const char *argv[]);
要删除类型声明，请输入一个空字符串。

IDA 支持用户定义的调用约定。在此调用约定中，用户可以显式指定参数的位置和返回值。例如:

        int __usercall func@<ebx>(int x, int y@<esi>);
表示具有 2 个参数的函数：第一个参数在堆栈上传递(IDA 自动计算其偏移量)，第二个参数在 ESI 寄存器中传递，返回值存储在 EBX 寄存器中。可以显式指定堆栈位置：
        int __usercall runtime_memhash@<^12.4>(void *p@<^0.4>, int q@<^4.4>, int r@<^8.4>)
__usercall 函数类型有一个限制：应显式指定所有堆栈位置，否则所有堆栈位置都由 IDA 自动计算。用户定义原型的一般规则是：
  - 返回值必须在寄存器中。
    例外：__golang 和 __usercall 调用约定接受堆栈位置。

  - if the return type is 'void', the return location must not be specified

  - if the argument location is not specified, it is assumed to be
    on the stack; consequent stack locations are allocated for such arguments

  - it is allowed to declare nested declarations, for example:
    int **__usercall func16@<eax>(int *(__usercall *x)@<ebx>
                                             (int, long@<ecx>, int)@<esi>);
    Here the pointer "x" is passed in the ESI register;
    The pointed function is a usercall function and expects its second
    argument in the ECX register, its return value is in the EBX register.
    The rule of thumb to apply in such complex cases is to specify the
    the registers just before the opening brace for the parameter list.

  - registers used for the location names must be valid for the current
    processor; some registers are unsupported (if the register name is
    generated on the fly, it is unsupported; inform us about such cases;
    we might improve the processor module if it is easy)

  - register pairs can be specified with a colon like <edx:eax>

  - for really complicated cases this syntax can be used.
IDA also understands the "__userpurge" calling convention. It is the same thing as __usercall, the only difference is that the callee cleans the stack.

The name used in the declaration is ignored by IDA.

If the default calling convention is __golang then explicit specification of stack offsets is permitted. 例如:

   int __usercall myfunc<^8>(__int64 arg<^0>);
Function declarations may have the __spoils keyword. It is used to specify the list of registers spoiled by the function. The syntax is the following:
   int __spoils<eax, bh> func(int x);
If the __spoils keyword is present, the specified list overrides the standard spoiled list. For x86, the standard spoiled list is <eax, edx, ecx>. The list of spoiled registers may be empty.

IDA also understands some attributes in declarations. 例如:

  __attribute__((format(printf,2,3)))
  int myprnt(int id, const char *format, ...);
This declaration means that myprnt is a print-like function; the format string is the second argument and the variadic argument list starts at the third argument.

Below is the full list of attributes that can be handled by IDA. Please look up the details in the corresponding compiler help pages.

  packed        pack structure/union fields tightly, without gaps
  aligned       specify the alignment
  noreturn      declare as not returning function
  ms_struct     use microsoft layout for the structure/union
  format        possible formats: printf, scanf, strftime, strfmon
The following additional keywords can be used in type declarations:
  _BOOL1          a boolean type with explicit size specification (1 byte)
  _BOOL2          a boolean type with explicit size specification (2 bytes)
  _BOOL4          a boolean type with explicit size specification (4 bytes)
  __int8          a integer with explicit size specification (1 byte)
  __int16         a integer with explicit size specification (2 bytes)
  __int32         a integer with explicit size specification (4 bytes)
  __int64         a integer with explicit size specification (8 bytes)
  __int128        a integer with explicit size specification (16 bytes)
  _BYTE           an unknown type; the only known info is its size: 1 byte
  _WORD           an unknown type; the only known info is its size: 2 bytes
  _DWORD          an unknown type; the only known info is its size: 4 bytes
  _QWORD          an unknown type; the only known info is its size: 8 bytes
  _OWORD          an unknown type; the only known info is its size: 16 bytes
  _TBYTE          10-byte floating point value
  _UNKNOWN        no info is available
  __pure          pure function: always returns the same value and does not
                  modify memory in a visible way
  __noreturn      function does not return
  __usercall      user-defined calling convention; see above
  __userpurge     user-defined calling convention; see above
  __spoils        explicit spoiled-reg specification; see above
  __hidden        hidden function argument; this argument was hidden in the
                  source code (e.g. 'this' argument in c++ methods is hidden)
  __return_ptr    pointer to return value; implies hidden
  __struct_ptr    was initially a structure value
  __array_ptr     was initially an array
  __unused        unused function argument
  __cppobj        a c++ style struct; the struct layout depends on this keyword
  __ptr32         explicit pointer size specification (32 bits)
  __ptr64         explicit pointer size specification (64 bits)
  __shifted       shifted pointer declaration
  __high          high level prototype (does not explicitly specify
                  hidden arguments like 'this', for example)
                  this keyword may not be specified by the user but
                  IDA may use it to describe high level prototypes
另参见
         编辑|函数子菜单。


 设置操作数类型

设置操作数类型

 操作名称: SetOpType
使用该命令可以指定光标下操作数的类型。

操作数类型必须作为 C 声明输入。 目前，IDA 本身不使用操作数类型信息。 但是，它可以由 Hex-Rays 反编译器插件使用。 在间接调用的情况下，设置操作数类型最有用：反编译器将使用类型信息来确定调用的输入参数，而不是猜测，这可以使反编译的代码更好。

类型声明的示例:

        int (*func)(int param1, char param2);
若要删除类型声明，请输入空字符串。

有关可能的调用约定的详细信息，请参阅 设置函数/项类型... 菜单项说明。

另参见

         设置功能/项目类型...


 设置视频模式

设置视频模式

 操作名称: SetVideoMode
此命令更改当前视频模式。允许的视频模式列表保存在 IDATUI.CFG 文件，则为 SCREEN_MODES 参数。

请注意，此变量中有两个实例：一个用于 MS-DOS，另一个用于 Windows。

如果你使用 MS DOS 版本，则需要在 SCREEN_MODES 中指定对你的视频卡有效的屏幕模式编号。否则，此命令将不起作用。

另参见 窗口子菜单。


 set_array_long

set_array_long

set long value of array element.
     id      - array id
     idx     - index of an element
     value   - 32bit or 64bit value to store in the array
返回: 1-正常，0-失败

success set_array_long(long id, long idx, long value);


 set_array_params

set_array_params

 设置数组表达格式
      ea      - 线性地址
      flags   - AP_... 常量的组合或 0
      litems  - 每行项的数目。 0 means auto
     align   - element alignment:
                 -1: do not align
                 0:  automatic alignment
                 other values: element width
Returns: 1-ok, 0-failure

success set_array_params(long ea, long flags, long litems, long align);
#define AP_ALLOWDUPS    0x00000001L     // use 'dup' construct #define AP_SIGNED       0x00000002L     // treats numbers as signed #define AP_INDEX        0x00000004L     // display array element indexes as comments #define AP_ARRAY        0x00000008L     // reserved (this flag is not stored in database) #define AP_IDXBASEMASK  0x000000F0L     // mask for number base of the indexes #define   AP_IDXDEC     0x00000000L     // display indexes in decimal #define   AP_IDXHEX     0x00000010L     // display indexes in hex #define   AP_IDXOCT     0x00000020L     // display indexes in octal #define   AP_IDXBIN     0x00000030L     // display indexes in binary


 set_array_string

set_array_string

set string value of array element
     id      - array id
     idx     - index of an element
     str     - string to store in array element
返回: 1-正常，0-失败

success set_array_string(long id, long idx, string str);


 set_bmask_cmt

set_bmask_cmt

set bitmask comment (only for bitfields)
     enum_id - id of enum
     bmask   - bitmask of the constant
     cmt     - comment
     repeatable - type of comment, 0-regular, 1-repeatable
返回: 1-正常，0-失败

long set_bmask_cmt(long enum_id, long bmask, string cmt, long repeatable);


 set_bmask_name

set_bmask_name

set bitmask name (only for bitfields)
     enum_id - id of enum
     bmask   - bitmask of the constant
     name    - name of bitmask
返回: 1-正常，0-失败

success set_bmask_name(long enum_id, long bmask, string name);


 set_cmt

set_cmt

Set an indented comment.
     ea      - linear address
     comment - comment string
     rptble  - is repeatable?

success set_cmt(long ea, string comment, long rptble);


 set_color

set_color

set item color
     ea - address of the item
     what - type of the item (one of COLWHAT... constants)
     color - new color code in RGB (hex 0xBBGGRR)
返回: 1-ok, 0-failure

success set_color(long ea, long what, long color);


 set_database_flag

set_database_flag

Set database flag
     flags - DBFL_... bits
see also save_database() (definition of the DBFL_... bits)

void set_database_flag(long flags);


 set_debugger_event_cond

set_debugger_event_cond

Set a new debugger event condition

string set_debugger_event_cond(string condition);


 set_default_sreg_value

set_default_sreg_value

Set default segment register value for a segment
  ea      - any address in the segment
            if no segment is present at the specified address
            then all segments will be affected
  reg     - name of segment register
  value   - default value of the segment register. -1-undefined.

success set_default_sreg_value(long ea, string reg, long value);


 set_enum_bf

set_enum_bf

set bitfield property of enum
     enum_id - id of enum
     flag    - 1: convert to bitfield
               0: convert to ordinary enum
返回: 1-正常，0-失败

success set_enum_bf(long enum_id, long flag);


 set_enum_cmt

set_enum_cmt

set comment of enum
     enum_id    - id of enum
     cmt        - new comment for the enum
     repeatable - 0:set regular comment
                  1:set repeatable comment
返回: 1-正常，0-失败

success set_enum_cmt(long enum_id, string cmt, long repeatable);


 set_enum_flag

set_enum_flag

set flag of enum
     enum_id - id of enum
     flag    - flags for representation of numeric constants
               in the definition of enum.
返回: 1-正常，0-失败

success set_enum_flag(long enum_id, long flag);


 set_enum_idx

set_enum_idx

specify another serial number for a enum
     enum_id - id of enum
     idx     - new serial number.
               If another enum with the same serial number
               exists, then all enums with serial
               numbers >= the specified idx get their
               serial numbers incremented (in other words,
               the new enum is put in the middle of the list
               of enums).
               If idx >= get_enum_qty() then the enum is
               moved to the end of the list of enums.
返回：注释字符串

success set_enum_idx(long enum_id, long idx);


 set_enum_member_cmt

set_enum_member_cmt

set a comment of a symbolic constant
     const_id - id of const
     cmt     - new comment for the constant
     repeatable - 0:set regular comment
                  1:set repeatable comment
返回: 1-正常，0-失败

success set_enum_member_cmt(long const_id, string cmt, long repeatable);


 set_enum_member_name

set_enum_member_name

rename a member of enum - a symbolic constant
     const_id - id of const
     name     - new name of constant
返回: 1-正常，0-失败

success set_enum_member_name(long const_id, string name);


 set_enum_name

set_enum_name

rename enum
     enum_id - id of enum
     name    - new name of enum
返回: 1-正常，0-失败

success set_enum_name(long enum_id, string name);


 set_enum_width

set_enum_width

set width of enum elements
     enum_id - id of enum
     width   - element width in bytes (0-unknown)
返回: 1-正常，0-失败

success set_enum_width(long enum_id, long width);


 set_exception_flags

set_exception_flags

Set exception flags
     code - exception code
     flags - exception flags (combination of EXC_...)

success set_exception_flags(long code, long flags);


 set_fixup

set_fixup

设置修正信息
     ea - 用于设置有关
     type - 修正类型。 参见 get_fixup_target_type()
                 对于可能的修复类型。
     fixupf -FIXUPF_...位
     targetsel - 目标选择器
     targetoff - 目标偏移量
     displ - 位移
返回：无

void set_fixup(long ea, long type, long fixupf, long targetsel, long targetoff, long displ);
fixupf 参数可能包含以下位：fixup 相对于线性地址 "base"。否则，修正是相对于带有“sel”选择器的段的开头的。#define FIXUPF_REL         0x0001
target is a location (otherwise - segment). Use this bit if the target is a symbol rather than an offset from the beginning of a segment. #define FIXUPF_EXTDEF      0x0002
fixup is ignored by IDA - disallows the kernel to convert operands - this fixup is not used during output #define FIXUPF_UNUSED      0x0004
fixup was not present in the input file #define FIXUPF_CREATED     0x0008


 set_frame_size

set_frame_size

Make function frame
     ea      - any address belonging to the function
     lvsize  - size of function local variables
     frregs  - size of saved registers
     argsize - size of function arguments that will be purged
               from the stack upon return
返回: ID of function frame or -1
         If the function did not have a frame, the frame
         will be created. Otherwise the frame will be modified

long set_frame_size(long ea, long lvsize, long frregs, long argsize);


 set_func_attr

set_func_attr

set a function attribute
     ea    - any address belonging to the function
     attr  - one of FUNCATTR_... constants.
     value - new value of the attribute
返回: 1 - ok
         0 - failed

success set_func_attr(long ea, long attr, long value);


 set_func_cmt

set_func_cmt

set function comment
     ea         - any address belonging to the function
     cmt        - a function comment line
     repeatable - 1: get repeatable comment
                  0: get regular comment

void set_func_cmt(long ea, string cmt, long repeatable);


 set_func_end

set_func_end

change function end address
     ea  - any address belonging to the function
     end - new function end address
返回: !=0 - ok

success set_func_end(long ea, long end);


 set_func_flags

set_func_flags

change function flags
     ea    - any address belonging to the function
     flags - see get_func_flags() for explanations
返回: !=0 - ok

#define set_func_flags(ea, flags) set_func_attr(ea, FUNCATTR_FLAGS, flags)


 set_func_start

set_func_start

更改函数起始地址
     ea - 属于函数的任何地址
     end - 新函数起始地址
返回： !=0- ok

success set_func_start(long ea, long start);


 set_ida_state

set_ida_state

Change IDA indicator.
Returns the previous status.

long set_ida_state(long status);
#define IDA_STATUS_READY    0 // READY     IDA is idle #define IDA_STATUS_THINKING 1 // THINKING  Analyzing but the user may press keys #define IDA_STATUS_WAITING  2 // WAITING   Waiting for the user input #define IDA_STATUS_WORK     3 // BUSY      IDA is busy


 set_local_type

set_local_type

Parse one type declaration and store it in the specified slot
     ordinal -  slot number (1...NumberOfLocalTypes)
                -1 means allocate new slot or reuse the slot
                of the existing named type
     input -  C declaration. Empty input empties the slot
     flags -  combination of PT_... constants or 0
返回: slot number or 0 if error

success set_local_type(long ordinal, string input, long flags);


 set_manual_insn

set_manual_insn

Specify instruction represenation manually.
     ea   - linear address
     insn - a string represenation of the operand
IDA will not check the specified instruction, it will simply display
it instead of the orginal representation.

void set_manual_insn(long ea, string insn);


 set_member_cmt

set_member_cmt

change structure member comment
     id            - structure type ID
     member_offset - offset of the member
     comment       - new comment of the structure member
     repeatable    - 1: change repeatable comment
                     0: change regular comment
返回: !=0 - ok

long set_member_cmt(long id, long member_offset, string comment, long repeatable);


 set_member_name

set_member_name

change structure member name
     id            - structure type ID
     member_offset - offset of the member
     name          - new name of the member
返回: !=0 - ok.

long set_member_name(long id, long member_offset, string name);


 set_member_type

set_member_type

Change structure member type.

此函数可以以两种形式使用。First form: long set_member_type(long id, long member_offset, long flag, long typeid, long nitems);
Second form: long set_member_type(long id, long member_offset, long flag, long typeid, long nitems, long target, long tdelta, long reftype);
arguments: id            - structure type ID member_offset - offset of the member flag    - new type of the member. Should be one of
        FF_BYTE..FF_PACKREAL (see above) combined with FF_DATA
  typeid  - if is_struct(flag) then typeid specifies the structure id for the member
        if is_off0(flag) then typeid specifies the offset base.
        if is_strlit(flag) then typeid specifies the string type (STRTYPE_...). if is_stroff(flag) then typeid specifies the structure id if is_enum(flag) then typeid specifies the enum id Otherwise typeid should be -1 nitems  - number of items in the member the remaining arguments are allowed only if is_off0(flag) and you want to specify a complex offset expression: target  - target address of the offset expr. 你可以将其指定为 -1，ida 会自行计算 tdelta - 偏移目标增量。usually 0 reftype - see REF_... definitions 返回:        !=0 - ok.
long set_member_type(long id, long member_offset, long flag, long typeid, long nitems, long target, long tdelta, long reftype);


 set_name

set_name

Rename an address
     ea - linear address
     name - new name of address. If name == "", then delete old name
     flags - combination of SN_... constants
返回: 1-ok, 0-failure

success set_name(long ea, string name, long flags=SN_CHECK);
#define SN_CHECK        0x00    // Fail if the name contains invalid characters. #define SN_NOCHECK      0x01    // Replace invalid characters silently. // If this bit is set, all invalid chars // (not in NameChars or MangleChars) will be replaced // by '_'. // List of valid characters is defined in ida.cfg #define SN_PUBLIC       0x02    // if set, make name public #define SN_NON_PUBLIC   0x04    // if set, make name non-public #define SN_WEAK         0x08    // if set, make name weak #define SN_NON_WEAK     0x10    // if set, make name non-weak #define SN_AUTO         0x20    // if set, make name autogenerated #define SN_NON_AUTO     0x40    // if set, make name non-autogenerated #define SN_NOLIST       0x80    // if set, exclude name from the list // if not set, then include the name into // the list (however, if other bits are set, // the name might be immediately excluded // from the list) #define SN_NOWARN       0x100   // don't display a warning if failed #define SN_LOCAL        0x200   // create local name. 函数应该存在。// local names can't be public or weak. // also they are not included into the list of names // they can't have dummy prefixes #define SN_IDBENC       0x400   // the name is given in the IDB encoding; // non-ASCII bytes will be decoded accordingly. // Specifying SN_IDBENC also implies SN_NODUMMY #define SN_FORCE        0x800   // if the specified name is already present // in the database, try variations with a // numerical suffix like "_123" #define SN_NODUMMY      0x1000  // automatically prepend the name with '_' if it // begins with a dummy suffix such as 'sub_'. // 另参见 SN_IDBENC #define SN_DELTAIL      0x2000  // if name cannot be set because of a tail byte, // delete the hindering item


 set_processor_type

set_processor_type

Set target processor type.
Once a processor module is loaded, it cannot be replaced until we close the idb.
     processor - name of processor in short form.
     level     - the request level:
 SETPROC_IDB         set processor type for old idb
 SETPROC_LOADER      set processor type for new idb;
                     if the user has specified a compatible processor,
                     return success without changing it.
                     if failure, call loader_failure()
 SETPROC_LOADER_NON_FATAL the same as SETPROC_LOADER but non-fatal failures.
 SETPROC_USER        set user-specified processor
                     used for -p and manual processor change at later time

success set_processor_type(string processor, long level);
#define SETPROC_IDB              0 #define SETPROC_LOADER           1 #define SETPROC_LOADER_NON_FATAL 2 #define SETPROC_USER             3


 set_reg_value

set_reg_value

设置寄存器值
     name - 寄存器名称
     value - 新寄存器值
调试器应正在运行
无需使用此函数来设置寄存器值。
作业左侧的寄存器名称也可以。
线程安全函数(只能从主线程和 debthread 调用)

success set_reg_value(number value, string name);


 set_root_filename

set_root_filename

Set input file name
This function updates the file name that is stored in the database
It is used by the debugger and other parts of IDA
Use it when the database is moved to another location or when you
use remote debugging.

void set_root_filename(string path);


 set_segm_addressing

set_segm_addressing

Change segment addressing
  ea      - any address in the segment
  bitness - 0: 16bit, 1: 32bit, 2: 64bit

success set_segm_addressing(long ea, long bitness);


 set_segm_alignment

set_segm_alignment

Change alignment of the segment
  ea      - any address in the segment
  align   - new alignment of the segment, one of sa... constants
Note: it is a macro

#define set_segm_alignment(ea, alignment) set_segm_attr(ea, SEGATTR_ALIGN, alignment) #define saAbs         0  // Absolute segment. #define saRelByte     1  // Relocatable, byte aligned. #define saRelWord     2  // Relocatable, word (2-byte, 16-bit) aligned. #define saRelPara     3  // Relocatable, paragraph (16-byte) aligned. #define saRelPage     4  // Relocatable, aligned on 256-byte boundary (a "page" // in the original Intel specification). #define saRelDble     5  // Relocatable, aligned on a double word (4-byte) // boundary. This value is used by the PharLap OMF for // the same alignment. #define saRel4K       6  // This value is used by the PharLap OMF for page (4K) // alignment. It is not supported by LINK. #define saGroup       7  // Segment group #define saRel32Bytes  8  // 32 bytes #define saRel64Bytes  9  // 64 bytes #define saRelQword   10  // 8 bytes


 set_segm_attr

set_segm_attr

set segment attribute
     arguments:      segea - any address within segment
                     attr  - one of SEGATTR_... constants
Please note that not all segment attributes are modifiable.
Also some of them should be modified using special functions
like set_segm_addressing, etc.

success set_segm_attr(long segea, long attr, long value);
#ifndef __EA64__ #define SEGATTR_START    0      // starting address #define SEGATTR_END      4      // ending address #define SEGATTR_ORGBASE 16 #define SEGATTR_ALIGN   20      // alignment #define SEGATTR_COMB    21      // combination #define SEGATTR_PERM    22      // permissions #define SEGATTR_BITNESS 23      // bitness (0: 16, 1: 32, 2: 64 bit segment) // Note: modifying the attrbite directly does // not lead to the reanalysis of the segment. // Using set_segm_addressing() is more correct. #define SEGATTR_FLAGS   24      // segment flags #define SEGATTR_SEL     28      // segment selector #define SEGATTR_ES      32      // default ES value #define SEGATTR_CS      36      // default CS value #define SEGATTR_SS      40      // default SS value #define SEGATTR_DS      44      // default DS value #define SEGATTR_FS      48      // default FS value #define SEGATTR_GS      52      // default GS value #define SEGATTR_TYPE    96      // segment type #define SEGATTR_COLOR   100     // segment color #else #define SEGATTR_START    0 #define SEGATTR_END      8 #define SEGATTR_ORGBASE 32 #define SEGATTR_ALIGN   40 #define SEGATTR_COMB    41 #define SEGATTR_PERM    42 #define SEGATTR_BITNESS 43 #define SEGATTR_FLAGS   44 #define SEGATTR_SEL     48 #define SEGATTR_ES      56 #define SEGATTR_CS      64 #define SEGATTR_SS      72 #define SEGATTR_DS      80 #define SEGATTR_FS      88 #define SEGATTR_GS      96 #define SEGATTR_TYPE    184 #define SEGATTR_COLOR   188 #endif
// Segment permissions #define SEGPERM_EXEC  1         // Execute #define SEGPERM_WRITE 2         // Write #define SEGPERM_READ  4         // Read #define SEGPERM_MAXVAL (SEGPERM_EXEC + SEGPERM_WRITE + SEGPERM_READ)
// Valid segment flags #define SFL_COMORG   0x01       // IDP dependent field (IBM PC: if set, ORG directive is not commented out) #define SFL_OBOK     0x02       // orgbase is present? (IDP dependent field) #define SFL_HIDDEN   0x04       // is the segment hidden? #define SFL_DEBUG    0x08       // is the segment created for the debugger? #define SFL_LOADER   0x10       // is the segment created by the loader? #define SFL_HIDETYPE 0x20       // hide segment type (do not print it in the listing)


 set_segm_class

set_segm_class

Change class of the segment
  ea      - any address in the segment
  class   - new class of the segment

success set_segm_class(long ea, string klass);


 set_segm_combination

set_segm_combination

Change combination of the segment
  ea      - any address in the segment
  comb    - new combination of the segment, one of sc... constants
Note: it is a macro

#define set_segm_combination(ea, comb) set_segm_attr(ea, SEGATTR_COMB, comb) #define scPriv     0    // Private. Do not combine with any other program // segment. #define scPub      2    // Public. Combine by appending at an offset that meets // the alignment requirement. #define scPub2     4    // As defined by Microsoft, same as C=2 (public). #define scStack    5    // Stack. Combine as for C=2. This combine type forces // byte alignment. #define scCommon   6    // Common. Combine by overlay using maximum size. #define scPub3     7    // As defined by Microsoft, same as C=2 (public).


 set_segm_name

set_segm_name

Change name of the segment
  ea      - any address in the segment
  name    - new name of the segment

success set_segm_name(long ea, string name);


 set_segm_type

set_segm_type

set segment type
        arguments:      segea - any address within segment
                        type  - new segment type:
        返回:        !=0 - ok
note: this function is a macro, see its definition at the end of idc.idc
Note: it is a macro

#define set_segm_type(ea, type)  set_segm_attr(ea, SEGATTR_TYPE, type)
#define SEG_NORM        0 #define SEG_XTRN        1       // * segment with 'extern' definitions //   no instructions are allowed #define SEG_CODE        2       // pure code segment #define SEG_DATA        3       // pure data segment #define SEG_IMP         4       // implementation segment #define SEG_GRP         6       // * group of segments //   no instructions are allowed #define SEG_NULL        7       // zero-length segment #define SEG_UNDF        8       // undefined segment type #define SEG_BSS         9       // uninitialized segment #define SEG_ABSSYM     10       // * segment with definitions of absolute symbols //   no instructions are allowed #define SEG_COMM       11       // * segment with communal definitions //   no instructions are allowed #define SEG_IMEM       12       // internal processor memory & sfr (8051)


 set_segment_bounds

set_segment_bounds

Change segment boundaries
  ea      - any address in the segment
  startea - new start address of the segment
  endea   - new end address of the segment
  flags   - combination of SEGMOD_... flags

success set_segment_bounds(long ea, long startea, long endea, long flags);


 set_selector

set_selector

set a selector value
        arguments:      sel - the selector number
                        val - value of selector
        返回:        nothing
        note:           ida supports up to 4096 selectors.
                        if 'sel' == 'val' then the
                        selector is destroyed because
                        it has no significance

void set_selector(long sel, long value);


 set_source_linnum

set_source_linnum

set source line number
     ea      - linear address
     lnnum   - number of line in the source file
返回: nothing

void set_source_linnum(long ea, long lnnum);


 set_storage_type

set_storage_type

Set storage type
     start_ea - starting address
     end_ea   - ending address
     stt     - new storage type, one of STT_VA and STT_MM
返回：
long set_storage_type(long start_ea, long end_ea, long stt);
#define STT_VA 0  // regular storage: virtual arrays, an explicit flag for each byte #define STT_MM 1  // memory map: sparse storage. useful for huge objects


 set_struc_cmt

set_struc_cmt

change structure comment
     id      - structure type ID
     comment - new comment of the structure
     repeatable - 1: change repeatable comment
                  0: change regular comment
返回: !=0 - ok

long set_struc_cmt(long id, string comment, long repeatable);


 set_struc_idx

set_struc_idx

change structure index
     id      - structure type ID
     index   - new index of the structure
               See get_first_struc_idx() for the explanation of
               structure indices and IDs.
返回: !=0 - ok

long set_struc_idx(long id, long index);


 set_struc_name

set_struc_name

change structure name
     id      - structure type ID
     name    - new name of the structure
返回: !=0 - ok

long set_struc_name(long id, string name);


 set_target_assembler

set_target_assembler

Set target assembler
     asmidx - index of the target assembler in the array of assemblers
              for the current processor.
返回：

long set_target_assembler(long asmidx);


 setattr

setattr

设置对象属性
     self - 对象
     attr - 属性名称
     value - 值
此函数在不调用 __setattr__() 的情况下设置属性值
返回 false：self 不是对象
线程安全功能。

success setattr(object self, string attr, any value);


 设置数据类型

设置数据类型

 操作名称: SetupData
此命令允许你在 MakeData 命令中选择循环轮播中使用的数据类型。

有效的数据类型包括：

        - byte
        - word          (2 字节)
        - double word   (4 字节)
        - float         (4 字节)
        - quadro word   (8 字节)
        - double        (8 字节)
        - long double   (10 或 12 字节)
        - packed real   (10 或 12 字节)
        - octa word     (16 字节)
当然，并非所有数据类型都可用于所有处理器。例如，英特尔 8051 处理器没有“双字”类型。

此外，此命令允许你为当前未定义的项目选择数据类型并将其转换为数据。

请注意，如果当前处理器不支持某种数据类型，即使你选择了它，也无法分配它。如果取消选择所有数据类型，IDA 将使用“ byte ”类型。

另参见 选项子菜单。


 设置隐藏项

设置隐藏项

 操作名称: SetupHidden
此命令允许你切换 隐藏 项目的显示。

自动隐藏库函数

        此选项隐藏 FLIRT 识别的函数。
        如果只会从设置选项时开始生效。
显示隐藏的指令
        如果设置了此选项，IDA 将显示所有指令
        即使它们被隐藏，也未隐藏。
显示隐藏函数
        如果设置了此选项，IDA 会将所有函数显示为未隐藏，即使它们已隐藏。
显示隐藏的区段
        如果设置了此选项，IDA 会将所有区段显示为未隐藏，即使它们已隐藏。
另参见 视图子菜单。


 移位指针

移位指针
Sometimes in binary code we can encounter a pointer to the middle of a structure. Such pointers usually do not exist in the source code but an optimizing compiler may introduce them to make the code shorter or faster.

Such pointers can be described using shifted pointers. 移位指针是一个常规指针，其中包含有关父结构体名称及其开头偏移量的附加信息。例如:

        struct mystruct
        {
          char buf[16];
          int dummy;
          int value;            // <- myptr points here
          double fval;
        };
        int *__shifted(mystruct,20) myptr;
The above declaration means that myptr is a pointer to 'int' and if we decrement it by 20 bytes, we will end up at the beginning of 'mystruct'.

Please note that IDA does not limit parents of shifted pointers to structures. 调整后移位的指针可以指向除“ void ”以外的任何类型。

Also, negative offsets are supported too. They mean that the pointer points to the memory before the structure.

When a shifted pointer is used with an adjustment, it will be displayed with the 'ADJ' helper function. For example, if we refer to the memory 4 bytes further, it can be represented like this:

        ADJ(myptr)->fval
Shifted pointers are an improvement compared to the CONTAINING_RECORD macro because expressions with them are shorter and easier to read.

另参见 设置类型命令。


 显示应用程序屏幕

显示应用程序屏幕

 操作名称: ShowUserScreen
该命令 displays the application screen.

It is useful for the text mode 调试器.

When the debugged application runs in the same window as IDA itself, the application output is hidden by IDA windows. This command allows to see the application screen in this case.

To return to IDA display, press any key.

该命令 is available when the application is suspended 或 finished.

 另参见 调试器子菜单。


 显示跟踪调用图表

显示跟踪调用图表
在邻近视图中显示已加载跟踪的调用图表

此命令在邻近视图中显示当前加载的跟踪调用图表。

另参见:
   清除跟踪
   选择跟踪
   其他选项
   编辑跟踪描述
   二进制跟踪的比较
   导入二进制跟踪
   导出二进制跟踪
   移除二进制跟踪
   显示跟踪调用图表


 显示撤消历史记录

显示撤消历史记录

 操作名称: ShowUndoHistory
此命令将打开一个包含撤消历史记录的窗口。它可从“视图”和“打开”子视图子菜单中获取。

双击一行可将数据库恢复到相应操作之前的状态。

可以使用相应的上下文菜单命令截断撤消历史记录。所选操作的撤消信息将与有关所有先前操作的信息一起删除。

可重做的用户操作以斜体显示。撤消缓冲区中的当前位置以粗体显示，通常表示第一个可重做的用户操作。

另参见 撤消 重做 重置撤消 禁用撤消


 收缩结构体

收缩结构体

 操作名称: ShrinkStruct
This command shrinks the current structure by deleting undefined bytes at the cursor location. The cursor must be at an undefined byte. IDA will ask the user the number of bytes to remove.

当你打开结构体窗口时，此命令可用。

另参见 编辑|结构体子菜单。


 签名窗口

签名窗口

 操作名称: OpenSignatures
此命令将打开签名窗口。

对于每个签名，将显示以下内容:

        - name of file with the signature
        - state of signature:
                - Planned: the signature will be applied
                - Current: the signature is being applied
                - Applied: the signature has been applied
        - number of functions found using the signature
        - description of the signature
You can modify the planned signatures list here: add/delete library modules to be used during the disassembling.

You cannot delete an applied signature from the list.

To add a signature to the list for the application press <Ins>. 你将看到一个签名列表，这些签名可以应用于正在反汇编的程序。

Text version: Not all signature files will be displayed (for example, 32 bit signatures will not be shown for a 16 bit program). If you want to see the full list of signatures, select the first line of the list saying SWITCH TO FULL LIST OF SIGNATURES.

签名文件位于 SIG 目录的子目录中。Each processor has its own subdirectory. The name of the subdirectory is equal to the name of the processor module file (z80 for z80.w32, for example). 注意：IBM PC 签名位于 SIG 目录本身中。注意：IDASGN 环境变量可用于指定签名目录的位置。

另参见

         查看详情|打开子视图子菜单。
         如何使用列表查看器


 IDA 的静默模式

IDA 的静默模式
In this mode, IDA will not display dialog boxes on the screen. Instead, it will assume the default answer and proceed. For example, if you press @<Quit>, IDA will promptly exit to OS without asking for any confirmation.

To return to normal mode you will need to execute an IDC function:

        batch(0);
i.e. disable batch "silent" mode. To execute a script command, select File|Script command... menu item or press @<ExecuteLine> hotkey.


 sizeof

sizeof

计算类型的大小
     type - 要计算大小的类型，可以指定为 typeinfo 对象(例如 get_tinfo() 的结果)或带有 C 声明的字符串(例如 "int")
返回： 类型的大小，如果出错则为-1

long sizeof(typeinfo type);


 源代码视图

源代码视图
此窗口显示源代码文件的内容。 IDA 会自动打开源代码视图，前提是在“选项、源路径”中指定了源代码路径的正确映射。

此窗口还可能显示反编译结果，因为它被视为源代码。 如果源文件不可用，这可能很有用。


 指定指令颜色

指定指令颜色

 操作名称: ColorInstruction
此命令允许你指定当前指令或数据项的背景颜色。

只有 GUI 版本支持不同的背景颜色。指定未定义的自定义颜色将重置指令颜色。

另参见编辑|其他子菜单。


 手动指定指令表达

手动指定指令表达

 操作名称: ManualInstruction
此命令允许你指定程序中指令或数据的表达形式。

如果 IDA 无法根据需要表达当前指令，请使用它。如果指令本身正常，并且只有一个操作数被错误表达，则使用 手动输入操作数 命令。

若要删除手动表达，请指定一个空字符串。

另参见编辑|其他子菜单。


 指定目标汇编程序

指定目标汇编程序

 操作名称: SetAssembler
此命令允许你更改目标汇编程序，即为其生成输出的汇编程序。 从菜单中选择目标汇编程序。菜单项取决于当前的 处理器类型。

注意： 目前，IDA 仅支持 80x86 处理器的通用汇编程序。 我们建议使用 Borland 的 TASM 来编译输出汇编程序文件。


 split_sreg_range

split_sreg_range

Set value of a segment register.
     ea - linear address
     reg - name of a register, like "cs", "ds", "es", etc.
     value - new value of the segment register.
     tag   - one of SR_... constants
IDA keeps tracks of all the points where segment registers change their
values. This function allows you to specify the correct value of a segment
register if IDA is not able to find the corrent value.

success split_sreg_range(long ea, string reg, long value, long tag=SR_user);
#define SR_inherit      1               // the value is inherited from the previous range #define SR_user         2               // the value is specified by the user #define SR_auto         3               // the value is determined by IDA #define SR_autostart    4               // used as SR_auto for segment starting address


 sprintf

sprintf

Return a formatted string.
     format - printf-style format string.
              %a - means address expression.
              floating point values are output only in one format
               regardless of the character specified (f, e, g, E, G)
              %p is not supported.
线程安全函数。

string sprintf(string format, ...);


 堆栈跟踪

堆栈跟踪

 操作名称: StackTrace
打开堆栈跟踪窗口。

此窗口显示引入当前指令的函数调用。

“堆栈跟踪”窗口的顶部列出了程序调用的最后一个函数。Below this is the listing for the previously called functions. 每一行都表示调用上一行所表示的函数的函数的名称。

双击一行会跳转到实现此调用的指令的确切地址。

目前，IDA 使用 EBP 帧指针值来收集堆栈跟踪信息。It will fail for functions using other methods for the frame.

另参见:
   跟踪子菜单


 堆栈变量窗口

堆栈变量窗口

 操作名称: OpenStackVariables
This command opens the stack variables window for the current function.

The stack variables are internally represented as a structure. This structure consists of two parts: local variables and function arguments.

You can modify stack variable definitions here: add/delete/define stack variables, enter comments for them.

There may be two special fields in this window: " r" and " s". They represent the size of the function return address and of the saved registers in bytes. You cannot modify them directly. To change them, use edit function command.

Offsets at the line prefixes represent offsets from the frame pointer register (BP). The window indicator at the lower left corner of the window displays offsets from the stack pointer.

In order to create or delete a stack variable, use data definitions commands (data, strlit, array, undefine, Rename). Also you may define regular or repeatable comments.

The defined stack variables may be used in the program by converting operands to stack variables.

Esc closes this window.

另参见

         编辑|函数子菜单。
         转换为堆栈变量


 启动进程

启动进程

 操作名称: ProcessStart
该命令启动调试器中的进程。如果进程已暂停，则将继续执行。
另参见:
   附加到进程...
   进程选项
   暂停进程
   终止进程
   从进程分离
   调试器子菜单


 start_process

start_process

Launch the debugger
     path - path to the executable file.
     args - command line arguments
     sdir - initial directory for the process
for all args: if empty, the default value from the database will be used
返回: -1-failed, 0-cancelled by the user, 1-ok
See the important note to the step_into() function

long start_process(string path, string args, string sdir);


 步入

步入

 操作名称: ThreadStepInto
此命令每次执行一条汇编程序指令，单步执行函数。
另参见:
   步过
   运行到返回
   调试器子菜单


 步过

步过

 操作名称: ThreadStepOver
此命令每次执行一条汇编程序指令，在将过程作为单个单元执行时单步执行过程。

在内部，在函数调用的情况下，IDA 会在此函数调用之后的指令上设置一个临时断点。

另参见:
   步入
   运行到返回
   调试器子菜单


 单步跟踪选项

单步跟踪选项

// Get step current tracing options
// Returns combination of ST_... constants

long get_step_trace_options();
// Set step current tracing options. //      options - combination of ST_... constants
void set_step_trace_options(long options);
#define ST_OVER_DEBUG_SEG 0x01 // step tracing will be disabled when IP is in a debugger segment #define ST_OVER_LIB_FUNC  0x02 // step tracing will be disabled when IP is in a library function #define ST_ALREADY_LOGGED 0x04 // step tracing will be disabled when IP is already logged #define ST_SKIP_LOOPS     0x08 // step tracing will try to skip loops already recorded #define ST_DIFFERENTIAL   0x10 // tracing: log only new instructions


 strfill

strfill

Return string filled with the specified character
     chr - character to fill with
     len - number of characters
Returns: filled string
Thread-safe function.

string strfill(long chr, long len);


 字符串编码

字符串编码
IDA Qt can display program strings using different encodings. You can 指定default encodings for all strings 或 override the encoding of a specific string.

The following encodings can be used:

- the default encoding for this string type (8-bit 或 16-bit)

- the string bytes are printed using the current system encoding (after translating with XlatAsciiOutput 数组 in the configuration 文件).

Windows codepages (e.g. 866, CP932, windows-1251)

Charset names (e.g. Shift-JIS, UTF-8, Big5)

You can add new encodings to the list using the contex menu item Insert (Ins hotkey).

On Linux/OS X, you can run "iconv -l" to see the available encodings. Please note that some encodings are not supported on all systems.

另参见 选项子菜单。


 字符串文本样式对话框

字符串文本样式对话框

 操作名称: SetStrlitStyle
With this dialog you can setup string styles and also create a new string immediately at the current location.

The following string styles are defined:

      C-style (zero-terminated)
      DOS style ($ terminated)
      Pascal style (one byte length prefix)
      Wide pascal (two-byte length prefix)
      Delphi (four-byte length prefix)
      Unicode (UTF-16)
      Unicode pascal style (two-byte length prefix)
      Unicode wide pascal style (four-byte length prefix)
      Character terminated
If you select "character terminated" string style then you may specify up to 2 termination characters. The string will be terminated by any of these characters. If the second character is equal to 0, then it is ignored.

In IDA Qt you can also set a specific encoding to be used to display the string, or change the defaults for all strings. 参见 字符串编码。

另参见 选项子菜单。


 字符串选项

字符串选项
This dialog sets up the string literals options:

Generate names

        If this option is set, IDA will give meaningful names to
        newly created string literals.
Names prefix
        This prefix will be used to form the string name.
Mark as autogenerated
        If a name is marked as autogenerated, it will be
        displayed in a different color and will be included in the
        list of names depending on the current setting.
Generate serial names
        IDA can generate serial names for string literals, i.e.

                pref_001,pref_002,pref_003 etc...

        To enable serial names generation, specify
        prefix for names,starting serial number and number of leading zeroes.

        Each time you create a string literal, IDA generates
        a new serial name and assigns it to the string.
String literal next line char
        This symbol, when encountered in the string, will make
        IDA start a new line in the string representation in the
        disassembly. Usually it is the line feed character ('\n').
Comment string literal references:
        This option tells IDA to display the contents of the string
        literal next to the instruction or offset that refers to the string.
另参见 选项子菜单。


 字符串窗口

字符串窗口

 操作名称: OpenStrings
此命令将打开字符串窗口。

字符串窗口包含程序中的所有字符串。但是，如果在打开窗口之前选择了地址范围，则只会检查所选范围的字符串。

你可以通过右键单击列表(或在文本版本中按 Ctrl-U)来设置列表参数。

无论此对话框中的设置如何，该列表始终包含程序中定义的字符串，但用户可以要求 IDA 显示尚未显式定义为字符串的字符串。

可以使用以下参数：

仅显示定义的字符串

        如果选中，IDA 将仅显示显式标记为字符串项的字符串(使用 create string literal 命令)。
        在这种情况下，将忽略其他复选框。
忽略指令/数据定义
        If checked, IDA will ignore 指令/数据 definitions
        and will try to treat them as strings. If it can build a string
        with the length greater than the minimal length, the string
        will be displayed in the list.
        如果“仅定义的字符串”处于打开状态，则忽略此设置。
Strict ASCII (7-bit) strings
        If checked, only strings containing exclusively 7-bit characters
        (8th bit must be zero) will be added to the list. Please note that
        the user can 指定which characters are accepted in the strings
        by modifying the AsciiStringChars parameter in the   ida.cfg 文件.
        如果“仅定义的字符串”处于打开状态，则忽略此设置。
Allowed string types
        Allows the user to specify the string types included in the list.
        This setting is ignored if 'only defined strings' is on.
Minimal string length
        The minimal length the string must have to be added to the list.
另参见 视图|打开子视图子菜单。


 strlen

strlen

Return length of a string in bytes
     str - input string
Returns: length (0..n)
Thread-safe function.

long strlen(string str);


 strstr

strstr

Search a substring in a string
     str    - input string
     substr - substring to search
     icase  - is case-insenstive search?
返回: 0..n - index in the 'str' where the substring starts
         -1   - if the substring is not found
Thread-safe function.

long strstr(string str, string substr, bool icase=false); #define stristr(str, substr) strstr((str), (substr), 1)


 结构体书签

结构体书签
参见: 选择标记位置


 结构体子菜单

结构体子菜单
此子菜单的命令在 结构体窗口中可用。只有声明结构体变量...在反汇编窗口中可用。
      添加结构体类型...
      复制结构体类型...
      删除结构体类型...
      展开结构体类型...
      收缩结构体类型...
      编辑结构体类型...
      声明结构体变量...
      强制零字段偏移
      选择联合体成员...
      从数据创建结构体类型...
      将字段信息复制到指针...
使用常规命令指定结构体和联合成员、它们的类型、注释等。

联合体是一种特殊的结构体。使用结构体定义命令来操作联合。

另参见 编辑子菜单。


 结构体窗口

结构体窗口

 操作名称: OpenStructures
此命令将打开“结构体定义”窗口。

你可以在此处修改结构体定义：添加/重命名/删除结构体、添加/删除/定义结构体成员。

每个结构体都必须具有唯一的名称。字段名称在结构体中必须是唯一的。要创建或删除字段，请使用数据定义命令（data、 string literal、 array、 undefine、 Rename）。 You may also define regular or repeatable comments.

In order to modify member types, use commands from the Edit|Operand types... submenu. For example, to convert a structure member to an offset, use one of the following commands:

      Convert to offset (automatic)
      Convert to offset (from a segment base)
      Convert to offset (complex offset expression)
Some struct types in this window are created automatically by IDA. They are copies of some local types. Such structs are displayed in gray. They are considered as C-level types. As soon as the user edits such a type, it becomes an ASM-level type. Read more.

In the structure header IDA displays the following info:

  - the structure size in bytes
  - the alignment
  - for C level types: copyof_XX where XX is the ordinal type number.
  - for ASM level types: mappedto_XX where XX is the ordinal type number.
    It is possible to jump to the corresponding local type by pressing Enter.
  - for types copied from standard type libraries: "standard type"
另参见 视图|打开子视图子菜单。


 substr

substr

Return substring of a string
     str - input string
     x1  - starting index (0..n)
     x2  - ending index. If x2 == -1, then return substring
           from x1 to the end of string.
线程安全函数。

string substr(string str, long x1, long x2);


 suspend_process

suspend_process

Suspend the running process
Tries to suspend the process. If successful, the PROCESS_SUSPENDED
debug event will arrive (see wait_for_next_event)
   arguments: none
返回: success
To resume a suspended process use the wait_for_next_event function.
请参阅 step_into() 函数的重要说明

success suspend_process(void);


 suspend_thread

suspend_thread

Suspend thread
Suspending a thread may deadlock the whole application if the suspended
was owning some synchronization objects.
     tid - thread id
Return: -1:network error, 0-failed, 1-ok

long suspend_thread(long tid);


 切换调试器

切换调试器

 操作名称: SwitchDebugger
如果当前数据库有多个调试器可用，则此命令允许用户选择调试器。例如，可以使用远程或本地调试器调试 Window32 程序。


 获取数据库快照

获取数据库快照

 操作名称: SaveBaseSnap
该命令获取数据库快照。以后快照可以从数据库快照管理器恢复。

注意：快照仅适用于常规数据库。解压缩的数据库不支持它们。

另参见 查看数据库快照管理器 命令。


 获取内存快照

获取内存快照

 操作名称: TakeSnapshot
This command copies the contents of the process memory to the database. It is available during a debugging session.

The memory contents will be copied to the database. The user may specify that only the segments with the 'loader' attribute will be saved in the database.

The segments with the loader attribute are created by the input file loader and usually contain information from the input file. However, in some cases (like attaching to an existing process), there will not be any loader segments because the input file was not loaded by IDA.

To be able to make a partial snapshot in this case and other similar cases, the user can set or clear the 'loader' attribute of the desired segments using the edit segment command.

After applying this command, the user can terminate the debugging process and continue to analyze the program in the database.

Please note that it is possible to save the database without taking a memory snapshot. Such a database might be used to keep global information about the program like the breakpoint information, notes, etc. However, we recommend to take a memory snapshot of at least the 'loader' segments because it will allow to save also information about the program functions, names, comments, etc.

另参见 调试器子菜单。


 take_memory_snapshot

take_memory_snapshot

Take memory snapshot of the debugged process
     only_loader_segs: 0-copy all segments to idb
                       1-copy only SFL_LOADER segments

success take_memory_snapshot(long only_loader_segs);


 终止进程

终止进程

 操作名称: ProcessTerminate
此命令终止调试的进程。
另参见:
   启动进程
   暂停进程
   从进程分离
   调试器子菜单


 文本表达形式对话框

文本表达形式对话框
此命令将更改反汇编的外观。你可以在此处更改以下复选框/输入字段的值：

Line prefixes

        This checkbox enables or disables line prefixes display.
        Line prefix is the address of the current byte:

         3000:1000      mov ax, bx
         ^^^^^^^^^

        IDA.CFG 参数: SHOW_LINEPREFIXES
Number of opcode bytes
        Opcode bytes are shown below:

         3000:1000 55           push    bp
                   ^^^^^^^^^

        The opcode is the operation code of the current instruction.
        For the data items, the opcodes are elements of data directives.
        Sometimes there is not enough place to display all bytes of an item
        (of a large array, for example). In this case, IDA will display just
        the few first bytes of the item. For the code items, IDA will try
        to display all bytes of the instruction, even if it requires adding
        more lines just for the opcode bytes. If this behavior is not desired,
        the number of opcode bytes can be specified as a negative value.
        A negative value -N means to display N opcode bytes on a line but
        never display empty lines just for the opcode bytes.
        By default, IDA does not display the opcodes.

        IDA.CFG 参数: OPCODE_BYTES
Use segment names
        This option controls the appearance of the segment names in the
        addresses. Example (codeseg has base 3000):

           启用：     codeseg:0034
           禁用：    3000:0034

        IDA.CFG 参数: USE_SEGMENT_NAMES
Segment addresses
        Marking this checkbox, you can disable segment addresses in the
        disassembly. IDA will show only offsets. 示例：

           启用：     codeseg:0034
           禁用：    0034

        IDA.CFG 参数: SHOW_SEGMENTS
Function offsets
        此选项控制行前缀的外观。
        如果启用，地址将显示为偏移量
        从函数开始。示例：

           启用：     somefunc+0x44
           禁用：    cseg:0x4544
右边距
        This option controls the length of disassembly lines for data
        directives.

        IDA.CFG 参数: MAX_DATALINE_LENGTH
Instruction indention
        You can change indention of disassembled instructions:

                         mov ax, bx
         <-------------->
            indention

        IDA.CFG 参数: INDENTION
Display bad instruction <BAD> marks
        有些汇编程序即使必须理解某些指令，也无法理解。 For example, the Z80 processor has several undocumented
        instructions and many assemblers fail to recognize them. IDA knows
        about this fact and tries to produce an output that can be compiled
        without errors, so it replaces such instructions with data bytes.

        英特尔 80x86 处理器的问题更严重：相同
        指令可以以不同的方式编码。 There are 2 operation codes
        for ADD instruction, etc. The worst thing is that the different
        operation codes have different lengths. If the assembler used to
        compile a file and your assembler produce different operation codes,
        you may obtain completely different output files.

        That is why IDA can mark such instructions as <BAD> and replace them
        with data bytes. 示例:

           启用：
                        db 0Fh,86h,7Eh,0,0,0 ; <BAD> jbe     loc_0_205
                        db 0Fh,82h,78h,0,0,0 ; <BAD> jb      loc_0_205
                        db 0Fh,83h,72h,0,0,0 ; <BAD> jnb     loc_0_205
           禁用：
                        jbe     loc_0_205
                        jb      loc_0_205
                        jnb     loc_0_205

        IDA.CFG 参数: SHOW_BAD_INSTRUCTIONS
Use tabulations in output
        You can disable the tab chars (0x09) in the output file if you do not
        like them. By default, IDA produces output files with tab chars.

        IDA.CFG 参数: USE_TABULATION
low suspicious limit high suspicious limit
        Click here to get information about these fields.
Display stack pointer
        If this option is set, IDA will display the value of
        the stack pointer in the line prefix.

        IDA.CFG 参数: SHOW_SP
另参见 选项子菜单。


 当前节点

当前节点
有两个概念：当前节点和所选节点。The node with the keyboard cursor is considered as the current node. If the user clicks on the graph background, the keyboard cursor will disappear and there will be no current node. In the absence of the current node, IDA uses the last valid address for the user commands (like rename and similar commands). For example, if the user invokes the 'rename' command by pressing N and if there is no current node, IDA will still display the 'rename' dialog box for the last valid address.

Clicking on the node title will make the clicked node the current one. The keyboard cursor will be moved to the clicked node. Any selection of the disassembly text will be cancelled upon switching the current node.

The default color for the title of the current node is dark gray.

In addition to the obvious method of clicking with the mouse left-button to select the current node, IDA supports many other methods:

 - Clicking with the mouse wheel selects the clicked node and centers
   the clicked point in the window
 - Keyboard arrows can be used to move from one node to another. When
   the keyboard cursor reaches the node border and the user presses
   the arrow once more, IDA finds a node in the specified direction
   and makes it the current.
 - The Ctrl-Up key displays the list of nodes referring to the current
   node and allows jumping to them. The Ctrl-Down key does the same
   with the referenced nodes.
 - Pressing '5' on the keypad positions the keyboard cursor at
   the window center
 - Left-click on an edge makes one of its ends (source or destination)
   the current node. The node farthest from the click point is selected
 - Ctrl-click on an edge jumps to its destination
 - Alt-click on an edge jumps to its source
Clicking with the mouse on the node text (disassembly listing) has the usual meaning: IDA will move the keyboard cursor to the clicked location. It is also possible to select the disassembly listing within one node.

返回到 图表视图


 名称列表为空

名称列表为空
此命令允许你从用户定义的名称中选择名称。这意味着现在没有定义此类名称，或者所有用户定义的名称都已隐藏。若要为位置命名，请使用 Rename 或 Rename any 命令”。


 线程列表

线程列表

 操作名称: Threads
打开线程窗口。

在此窗口中，你可以查看已调试进程的所有线程。双击线程将跳转到其当前指令(仅当进程已暂停时才可用)。双击还会更改 hlpHelpDebugger[CPU] 窗口的当前线程。

右键单击会弹出一个弹出菜单，你可以在其中暂停或恢复线程。可能存在以下线程状态：

  - Running: the thread is running
  - Ready: the thread is ready to run but the application has been suspended
  - Suspended: the thread has been suspended by the user

 另参见 调试器子菜单。


 to_ea

to_ea

Return value of expression: ((seg<<4) + off)

long to_ea(long seg, long off);


 TO_LONG

TO_LONG

Sign extend, if necessary, the value according to actual program bitness
#ifdef __EA64__
#define TO_LONG(x) (inf_is_64bit() ? (x) : (((x) << 32) >> 32))
#else
#define TO_LONG(x) (x)
#endif


 切换前导零

切换前导零

 操作名称: ToggleLeadingZeroes
This command displays or hides the leading zeroes of the current operand. 示例：
        and     ecx, 40h
then after applying the command it will look like this:
        and     ecx, 00000040h
If you prefer to see leading zeroes in all cases, then open the calculator and enter the following expression:
        set_inf_attr(INF_GENFLAGS, get_inf_attr(INF_GENFLAGS) | INFFL_LZERO);
This will toggle the default for the current database and all numbers without leading zeroes will become numbers with leading zeroes, and vice versa.

另参见 编辑|操作符类型|数字子菜单。


 toggle_bnot

toggle_bnot

Toggle the bitwise not operator for the operand
(for the explanations of 'ea' and 'n' please see op_bin())

success toggle_bnot(long ea, int n);


 toggle_sign

toggle_sign

Change sign of the operand.
(for the explanations of 'ea' and 'n' please see op_bin())

success toggle_sign(long ea, int n);


 tolower

tolower

Convert string to lowercase
     str    - input string
返回: lowercase string
Thread-safe function.

string tolower(string str);


 toupper

toupper

Convert string to uppercase
     str    - input string
返回: uppercase string
Thread-safe function.

string toupper(string str);


 跟踪事件函数

跟踪事件函数

// Return the total number of recorded events
long get_tev_qty();

// Return the address of the specified event //       tev - event number long get_tev_ea(long tev);
// Return the type of the specified event (TEV_... constants) //       tev - event number long get_tev_type(long tev);
#define TEV_NONE  0 // no event #define TEV_INSN  1 // an instruction trace #define TEV_CALL  2 // a function call trace #define TEV_RET   3 // a function return trace #define TEV_BPT   4 // write, read/write, execution trace #define TEV_MEM   5 // memory layout changed #define TEV_EVENT 6 // debug event
// Return the thread id of the specified event //       tev - event number long get_tev_tid(long tev);
// Return the register value for the specified event //       tev - event number //       reg - register name (like EAX, RBX, ...) long get_tev_reg(long tev, string reg);
// Return the number of memory addresses recorded for the specified event //       tev - event number long get_tev_mem_qty(long tev);
// Return the memory pointed by 'index' for the specified event //       tev - event number //       idx - memory address index string get_tev_mem(long tev, long idx);
// Return the address pointed by 'index' for the specified event //       tev - event number //       idx - memory address index string get_tev_mem_ea(long tev, long idx);
// Return the address of the callee for the specified event //       tev - event number long get_call_tev_callee(long tev);
// Return the return address for the specified event //       tev - event number long get_ret_tev_return(long tev);
// Return the address of the specified TEV_BPT event //       tev - event number long get_bpt_tev_ea(long tev);


 跟踪文件函数

跟踪文件函数

// Load a previously recorded binary trace file
//       filename - trace file
success load_trace_file(string filename);

// Save current trace to a binary trace file //       filename - trace file //       description - trace description success save_trace_file(string filename, string description);
// Check the given binary trace file //       filename - trace file success is_valid_trace_file(string filename);
// Diff current trace buffer against given trace //       filename - trace file success diff_trace_file(string filename);
// Clear the current trace buffer void clear_trace();
// Update the trace description of the given binary trace file //       filename - trace file //       description - trace description success set_trace_file_desc(string filename, string description);
// Get the trace description of the given binary trace file //       filename - trace file string get_trace_file_desc(string filename);


 跟踪管理

跟踪管理
Recorded traces can be managed from the 跟踪窗口. Traces are saved in a directory specified in the tracing options dialog.

Saved binary trace files can be loaded, saved and replayed with the new replayer debugger module, diffed against other traces (to spot differences between executions) or displayed in a proximity view (displaying the execution call graph).

另参见 调试器子菜单。


 跟踪选项

跟踪选项

 操作名称: SetupTracing
此对话框允许你指定与追踪要素相关的不同设置。

跟踪缓冲区大小

  此设置指示跟踪缓冲区中可以容纳多少个跟踪事件。
  如果调试器必须插入新事件，并且缓冲区已满，
  最早的跟踪事件将被删除。
  但是，如果指定大小为 0，则缓冲区大小不受限制。
  请注意，例如，在指令跟踪的情况下，所有执行的指令都可以被记录下来，这会很快使内存变慢！
跟踪文件
  如果指定了文件名，则所有将来跟踪的事件都将追加到该文件名中。
跟踪目录
  将保存当前数据库的跟踪文件的目录。 如果未指定，将使用 IDB 目录。
停止条件
  This   IDC expression will be evaluated before the execution
  of each 指令. If the expression returns true, the 调试器 will
  suspend the execution. Please note that you can use register names in
  the condition.
跟踪
  - Trace over 调试器 段

      If selected, the 调试器 will not go step by step in 调试器 段
      (段 not available in the database).

  - Trace over library functions

      If selected, the 调试器 will not go step by step in library functions.

  Enabling these options will speed up the execution, as many instructions
  (from debugger segments and/or library functions) will not be traced.
  Disabling these options can quickly fill the 跟踪窗口, as all
  instructions in DLLs and system functions will be executed step by step.
  Notice that both options influence the way instruction and function tracings
  will work.
  Internally, the debugger proceeds like this:
  - memorize the return address associated with the last executed call
    instruction in database segments (the previously saved one is overwriten).
  - setup a temporary breakpoint on this address once the IP is in a debugger
    segment or library function, disable step by step, and run the thread.
  - reenable step by step once this temporary breakpoint is reached.

  - Do not log already logged IP

      If selected, already executed instructions will not be logged if
      they are executed again.

  - Skip loops

      If selected, tracing will be temporarily disabled for some loops
      constructs.
Highlight
  - Highlight instructions in IDA views

    If selected, recorded instructions will be displayed in IDA views (disassembly
    views) with a different background color.

  - Main color

    The main background color for traced instructions.

  - Diff color

    The background color for the instructions recorded and being diffed against the
    currently loaded trace.
指令跟踪
  - Log if same IP

    If selected, the 调试器 will also log all register modifications occuring
    during the execution of prefixed instructions like REP MOVSB, ...
函数跟踪
  - Log return instructions

      If selected, the 调试器 will also log 函数 returns.
      If disabled, only 函数 calls are logged.
基本块跟踪
  - Log basic block instructions

      If selected, all instructions from the current basic block will be logged
      and displayed in the 'Tracing' window, instead of only the last instruction of
      the basic block.

另参见:
   跟踪窗口
   跟踪管理
   清除跟踪
   指令跟踪
   函数跟踪
   基本块跟踪
   添加写入跟踪
   添加读取/写入跟踪
   添加执行跟踪
   跟踪子菜单。


 跟踪子菜单

跟踪子菜单
下面是使用调试器的跟踪功能的命令。
 跟踪管理
  跟踪窗口
  清除跟踪
  指令跟踪
  函数跟踪
  基本块跟踪
  添加写入跟踪
  添加读取/写入跟踪
  添加执行跟踪
  堆栈跟踪
  跟踪选项
另参见 调试器子菜单。


 跟踪窗口

跟踪窗口

 操作名称: TracingWindow
Opens the 'Tracing' window.

In this window, you can view some信息 related to all traced events. The tracing events are the信息 saved during the execution of a program. Different type of trace events are available: 指令跟踪 events , 函数 tracing events and write, read/write 或 execution tracing events.

During the execution, the list of traced events is disabled, as it couldn't be continuously synchronised with the execution without rendering the whole tracing very slow.

If a '='字符 is displayed in the 'Thread' and 'Address' columns, it indicates that the trace event occured in the same thread and at the same address as the previous trace event.

另参见:
   清除跟踪
   指令跟踪
   函数跟踪
   基本块跟踪
   添加写入跟踪
   添加读取/写入跟踪
   添加执行跟踪
   跟踪选项
   跟踪子菜单


 trim

trim

Remove trailing zero bytes from a string
     str - input string
Returns: trimmed string
Thread-safe function.

string trim(string str);


 TRUNC

TRUNC

根据实际程序位数固定地址
#define TRUNC(ea) (inf_is_64bit() ? (ea) : ((ea) & 0xFFFFFFFF))


 类型库窗口

类型库窗口

 操作名称: OpenTypeLibraries
此命令将打开类型库窗口。在这里，用户可以加载和卸载标准类型库。

标准类型库包含编译器提供的标准 C 标头中的类型定义。通常，IDA 会尝试自动确定目标编译器及其类型库，但如果失败，则此窗口允许你加载相应的类型库。

此外，不要忘记在编译器设置 对话框中指定编译器和内存模型。

另参见 视图|打开子视图子菜单。


 typeinfo.print

typeinfo.print

Print typeinfo in a human readable form
  flags - optional parameter, combination of PRTYPE_... bits
The typeinfo object must have the "typid" attribute
If the "name" attribute is present, it will be used in the output too
If failed, returns 0

string typeinfo.print(flags);
#define PRTYPE_1LINE   0x0000 // print to one line #define PRTYPE_MULTI   0x0001 // print to many lines #define PRTYPE_TYPE    0x0002 // print type declaration (not variable declaration) #define PRTYPE_PRAGMA  0x0004 // print pragmas for alignment #define PRTYPE_SEMI    0x0008 // append ; to the end #define PRTYPE_CPP     0x0010 // use c++ name (only for print_type2) #define PRTYPE_DEF     0x0020 // tinfo_t: print definition, if available #define PRTYPE_NOARGS  0x0040 // tinfo_t: do not print function argument names #define PRTYPE_NOARRS  0x0080 // tinfo_t: print arguments with #FAI_ARRAY as pointers #define PRTYPE_NORES   0x0100 // tinfo_t: never resolve types (meaningful with PRTYPE_DEF) #define PRTYPE_RESTORE 0x0200 // tinfo_t: print restored types for #FAI_ARRAY and #FAI_STRUCT #define PRTYPE_NOREGEX 0x0400 // do not apply regular expressions to beautify name #define PRTYPE_COLORED 0x0800 // add color tag COLOR_SYMBOL for any parentheses, commas and colons #define PRTYPE_METHODS 0x1000 // tinfo_t: print udt methods


 typeinfo.size

typeinfo.size

Return the type size in bytes
0xFFFFFFFF is the size cannot be calculated

long typeinfo.size();


 取消定义字节

取消定义字节

 操作名称: MakeUnknown
This command deletes the current instruction or data, converting it to 'unexplored' bytes. IDA will delete the subsequent instructions if there are no more references to them (functions are never deleted).

If you have selected a range using the anchor, all the bytes in this range will be converted into 'unexplored' bytes. In this case, IDA will not delete any other instructions even if there are no references to them after the deletion.

另参见 编辑子菜单


 撤消操作

撤消操作

 操作名称: Undo
This command reverts the database to the state before executing the last user action. It is possible to apply Undo multiple times, in this case multiple user actions will be reverted.

Please note the entire database is reverted, including all modifications that were made to the database after executing the user action and including the ones that are not connected to the user action. For example, if a third party plugin modified the database during or after the user action, this modification will be reverted. In theory it is possible to go back in time to the very beginning and revert the database to the state state that was present immediately after performing the very first user action. However, in practice the undo buffers overflow because of the changes made by autoanalysis. Autoanalysis generates copious amounts of undo data. Also please note that maintaining undo data during autoanalysis slows it down a bit. In practice it is not a big deal because the limit on the undo data is reached quite quickly (in a matter of minutes). Therefore, if during analysis the user does not perform any actions that modify the database, the undo feature will turn itself off temporarily.

However, if you prefer not to collect undo data at all during the initial autoanalysis, just turn off the UNDO_DURING_AA parameter in ida.cfg.

The configuration file ida.cfg has 2 more undo-related parameters:

  UNDO_MAXSIZE  max size of undo buffers; default: 128MB
                once this limit is reached, the undo info about the oldest
                user action will be forgotten.

  UNDO_DEPTH    max number of user actions to remember; default: 1000000
                if set to 0, the undo feature will be unavailable.
Since there is a limit on the size of undo buffers, any action, even the tiniest, may become non-undoable after some time. This is true because the analysis or plugins may continue to modify the database and overflow the buffers. Some massive actions, like deleting a segment, may be non-undoable just because of the sheer amount of undo data they generate.

Please note that Undo does not affect the state of IDC or Python scripts. Script variables will not change their values because of Undo. Also nothing external to the database can be changed: created files will not be deleted, etc.

Some actions cannot be undone. For example, launching a debugger or resuming from a breakpoint cannot be undone.

另参见 重做 重置撤消 禁用撤消 打开撤消历史记录


 撤消最后的 'Return' 命令

撤消最后的 'Return' 命令

 操作名称: UndoReturn
This command cancels the last Jump back command.

另参见

         跳转 子菜单
         空导航堆栈 命令。


 意外的数据库格式

意外的数据库格式
数据库格式比预期的更新。是因为你使用的是旧的 IDA 版本。唯一可以做的就是获得新的 IDA版本。


 取消隐藏

取消隐藏

 操作名称: Unhide
此命令允许你取消隐藏反汇编的隐藏部分。

如果光标位于隐藏的函数名称上，则该函数将被取消隐藏。

如果光标位于简洁的结构体变量上，则该结构体将被展开并以常规形式显示。

如果光标位于隐藏范围上，则隐藏范围将被取消隐藏。

如果光标位于隐藏的段名称上，则该段将被取消隐藏。

另参见 隐藏 命令和 设置隐藏 命令。

另参见 编辑|视图子菜单


 显示全部项

显示全部项

 操作名称: UnhideAll
此命令允许你取消隐藏：
  - 在反汇编窗口中调用的所有段、函数和隐藏范围
  - 在结构体窗口中调用的所有结构体
  - 在枚举窗口中调用的所有枚举
另参见 隐藏所有命令。

另参见 编辑|视图子菜单


 unlink

unlink

delete a file
     filename - existing file/dir name
返回: error code from the system
Thread-safe function.

long unlink(string filename);


 解包数据库是危险的

解包数据库是危险的
首先，你可能会丢失所有信息，因为你将没有数据库的备份副本。IDA 对解压缩的数据库进行修改，如果发生一些意外情况，解压缩的数据库通常会损坏。IDA 能够修复这个数据库，但有些信息可能会不可逆转地丢失，导致灾难性的后果。

解压缩数据库的唯一优点是它的加载速度非常快。同样，退出 IDA 的速度也很快。

如果禁用打包，则下次装入数据库时，abort 命令将不可用。

我们强烈建议不要使用解压缩的数据库。

今后要禁用此提示，只需修改 IDATUI.CFG 或 IDAGUI.CFG 文件中的 ASK_EXIT_UNPACKED 参数即可。

请注意，当“文件 -> 另存为”与解压缩的数据库一起使用时，IDA 将继续使用解压缩的数据库，而不是新创建的数据库(另存为一个)。在这种情况下，请关闭并重新打开新创建的数据库，以确保 IDA 将使用它而不是原始数据库。


 update_extra_cmt

update_extra_cmt

Set or update extra comment line
     ea   - linear address
     n    - number of additional line (0..MAX_ITEM_LINES)
     line - the line to display
IDA displays additional lines from number 0 up to the first unexisting
additional line. So, if you specify additional line #150 and there is no
additional line #149, your line will not be displayed.
MAX_ITEM_LINES is defined in IDA.CFG
To set anterior  line #n use (E_PREV + n)
To set posterior line #n use (E_NEXT + n)

void update_extra_cmt(long ea, long n, string line);


 升级 IDA 数据库

升级 IDA 数据库
如果 IDA 发现你的数据库具有旧格式，它将尝试将数据库升级到新格式。升级过程是完全自动的，不需要用户干预。但是，升级数据库后，你将无法使用旧版本的 IDA 使用它。因此，IDA 在升级数据库之前会要求你进行确认。

此功能仅适用于从 IDA 版本 2.05 开始的数据库。


 自定义操作数

自定义操作数

 操作名称: ManualOperand
如果 IDA 不以所需的形式表示操作数，则可以指定任何字符串而不是操作数。在这种情况下，IDA 将只在指令中显示指定的字符串，而不是默认操作数。

当前操作数(光标下方)将受到影响。

此命令不仅可以用于指令，还可以用于数据项。

IDA 建议将以前的手动操作数作为输入表单中的默认值。

若要删除手动操作数并恢复为默认文本，请指定一个空字符串。

当你使用操作数类型子菜单更改操作数类型时，IDA 会自动删除手动输入的操作数。

注意： 如果使用程序中的标签作为操作数字符串，则会生成文本偏移引用。 在其他情况下，不会生成交叉引用。

另参见 编辑|操作数类型子菜单。


 validate_idb_names

validate_idb_names

check consistency of IDB name records, return number of bad ones
     do_repair: (bool) try to repair netnode header it TRUE

long validate_idb_names(long do_repair = 0);


 各种对话框帮助消息

各种对话框帮助消息

打包的文件
错误的重定位表
文件末尾的其他信息
覆盖的文件
加载叠加层时出错
达到最大段数
无法生成可执行文件
输入文件格式错误
选择标记编号
输入标记描述
选择标记位置
IDA 查看书签
结构体书签
枚举书签
无法重命名字节
找不到文件分段
负偏移
无法移动段起始地址
无法移动段起始地址
无法创建数据库
数据库未关闭
过时的数据库格式
名称列表为空
升级 IDA 数据库
意外的数据库格式
未找到导入的模块
加载文件对话框
PE .idata 部分包含其他数据
使用指定的操作数重复搜索指令/数据
在反汇编中重复搜索子字符串
重复搜索文件中的子字符串
移动段
删除段
自动分析未完成
IDA 的静默模式
重命名结构体/成员
删除结构体成员
解压缩的数据库很危险
数据库为空
非法使用切换
找不到输入文件
跳过修补的字节
修补的字节具有重定位信息
当前字节无段
空程序
加载其他二进制文件
修补重定位字节
NotVaFile
VaTooHighVersion
桌面
无法创建段寄存器范围
无法分配给段寄存器


 各种图表提示

各种图表提示
1)以下操作可以提高图表绘制的速度:
 - 关闭动画
 - 关闭节点阴影
 - 指定相同的顶部和底部背景颜色
 - 关闭“重新布局”选项(可能会导致图表内容过时)
 - 关闭图表概览窗口
2)打印图表：'print' 命令在图表工具栏上可用。 默认情况下，图表工具栏是可见的，但如果您过去保存了自定义桌面配置，则该配置将不可见。 要进行设置，请选中“视图”、“工具栏”、“图表视图”菜单项。

3)处理大的图表：不要忘记节点组，并使用它们来使图表更简单。

返回到 图表视图


 查看所有元数据

查看所有元数据
此命令从 Lumina 检索有关当前数据库的 元数据。

IDA 将计算数据库中所有重要函数的校验和，并将其发送给 Lumina。此信息将用于匹配和检索元数据。之后，IDA 将显示匹配函数的列表。

然后，用户可以选择所需的元数据并将其应用于数据库。如果结果不令人满意，可以还原更改。

窗口关闭后，无法再还原更改。

在窗口的底部，有方便的按钮，用于应用或恢复所有可用的元数据。

另参见 提取所有元数据，它会自动应用所有检索到的元数据。

另参见 Lumina 子菜单


 查看内部标志

查看内部标志

 操作名称: ShowFlags
此命令显示当前项的内部标志值。该信息将显示在消息窗口中。

另参见 视图子菜单。


 查看段寄存器

查看段寄存器

 操作名称: ShowRegisters
此命令在 消息窗口中显示段寄存器内容。

你也可以使用此命令刷新反汇编窗口。

另参见

         编辑|段子菜单。
         视图子菜单。


 视图子菜单

视图子菜单
以下是打开各种窗口、显示信息等的命令。
  打开子视图...
  图表...

  计算器
  查看段寄存器
  查看内部标志

  隐藏
  取消隐藏
  删除隐藏范围
  全部隐藏
  全部取消隐藏
  设置隐藏项目...
另参见 菜单栏子菜单。


 虚拟数组：VA 版本过高

虚拟数组：VA 版本过高
最可能的错误是你尝试使用旧版本的 IDA 打开数据库。请使用较新版本的 IDA 打开此数据库。


 监视列表

监视列表

 操作名称: WatchList
打开监视列表窗口。

在该窗口中，你可以查看存储的监视。监视允许用户连续查看定义项的值。

 另参见 添加监视
           删除监视
           监视子菜单
           源级别监视


 监视视图(源级别)

监视视图(源级别)
在此窗口中，用户可以查看所选变量的值。

全局变量(数据项名称)以及当前函数的局部变量可以通过按 Ins 来添加。

表达式也可以添加到视图中，它们将被视为 IDC 表达式。

表达式的开头可能有一个类型强制转换。例如

(int)0x12345678

表示地址 0x12345678 处的内存内容应显示为整数。注意：要显示字符串，请使用 "char[]" 作为拼写错误。

另参见 源代码视图


 监视子菜单

监视子菜单
下面是使用调试器监视(汇编程序级别)的命令。
  监视列表
  添加监视
  删除监视
另参见: 调试器子菜单


 WinDbg 调试器

WinDbg 调试器
WinDbg 调试器插件使用调试工具包中的 Microsoft 调试引擎 COM 接口。

若要使用 WinDbg 调试器插件，必须执行以下步骤:

  - 请从以下位置下载最新的调试工具
  http://www.microsoft.com/whdc/devtools/debugging/default.mspx

  - 在“调试器选项”、“设置特定选项”中配置调试器特定选项。

  Windbg 调试器插件具有以下配置选项:

  - The Debugging Tools folder: This should be configured to point to the same
  folder where Microsoft Debugging Tools are installed. The plugin will try to
  guess where the tools are, but if it fails, a manual intervention will be required.
  If this option is not set, then the plugin will try to use dbgeng.dll from
  MS Windows system folder, while normal debug operations will work, extensions will not.

  - Kernel mode debugging: Check this option when debugging the kernel.

  - User-mode debugging: Check this option to debug MS Windows applications.

  - Non-Invasive debugging: Check this option to enable attaching to user-mode
  processes non-invasively

  - Kernel mode debugging with reconnect and initial break: Select this option
  when debugging a kernel and when the connection string contains 'reconnect'. This option
  will assure that the 调试器 breaks as soon as possible after a reconnect.

  - Output flags: These flags tell the debugging engine which kind of output
  messages to display and which to omit
The WinDbg 调试器 plugins has the following features:
  - Send commands to the 调试器 engine when the debugging session starts.
  Use the "." key to switch to the 命令行 and start typing commands.
  Please note that while it is possible to send any 命令 to the engine, only the
  commands that change the execution status should not be used:
  go ("g"), step ("t"), 步入 ("p"), etc...

 - Symbol信息: If the symbol path is configured properly, then the 调试器 engine will fetch debug symbols from the appropriate location (symbol server, cache, etc...) For example, setting the following environment 变量 before starting IDA: _NT_SYMBOL_PATH=srv*c:\pdb_cache*   msdl.microsoft.com/download/symbols

  - Multi-processor support: 调试器 Engine will 创建a virtual thread for
  each processor that it finds. Similarily, IDA will present these processors as threads.

  - 远程调试支持：可以使用进程服务器 "dbgsrv.exe"
启用远程调试。 例如:

    1. Run "dbgsrv -t tcp:port=PORT_NUM,server=HOST_NAME"

    2. Verify that the server is correctly running by listing all process
    servers on the given HOST_NAME:

      cdb -QR \\HOST_NAME

    3. Finally, run IDA and 指定the following connection string:
      tcp:port=PORT_NUM,server=HOST_NAME

  - Use WinDbg extensions: it is possible to use the extension commands that
  usually work with WinDbg. Make sure that the "Debugging Tools folder" setting
  is properly set so that this feature works.

  - Kernel Debugging: It is possible to debug the kernel the same way as it is
  done with WinDbg. Simply setup the target kernel and configure the WinDbg
  plugin by checking the "kernel mode debugging" option and by typing a correct
  connection string. If the user detaches from a kernel session (using 调试器/Detach Process),
  the debugged kernel will resume. However, if the user selects 调试器/终止进程,
  the kernel will be suspended (it will wait until another client attaches to it).

  - 支持转储文件：可以将以下两种方式生成的转储文件加载到 IDA 中
  手动(使用 ".dump" 命令)或从崩溃进程或内核生成的崩溃转储。 Please refer check the   windmp 文件加载器 reference.

  After the dump has been loaded, it is possible to run the 调试器 and investigate about
  the crash by typing Windbg commands into the 命令行 window.
  For example, one could check the call-stack 或 use any other Windbg extension.

  - External breakpoints: it is possible to use the 命令行 to 创建breakpoints
  that are not supported by IDA but supported by the debugging engine: in that
  case, all unknown (external) breakpoints will suspend IDA when they trigger.
The WinDbg 调试器 can be used to debug local programs as well as remote programs. This is controlled via the connection string in the "Process Option" dialog. If it is left blank,it means that a local debugging is in effect. Otherwise, a debug engine compatible connection string is expected. 如果无法接受连接字符串，IDA 将显示错误消息：在这种情况下，请尝试将相同的连接字符串与“cdb”或“windbg”一起使用，看看它是否有效。

The WinDbg 调试器模块 adds a new menu item: 调试器, WinDbg 命令。 It can be used to send arbitrary commands to the 调试器 engine. The 命令 output is displayed in the 消息窗口.

Additional IDC functions provided by the WinDbg debugger


 Windmp 文件加载器

Windmp 文件加载器
Windmp 加载器模块可以将 *.dmp 文件加载到 IDA 中进行静态分析。

要使 Windmp 加载程序正常运行，需要指定 MS 调试器引擎库 (dbgeng.dll) 的路径。该选项可以在 CFG\IDA.CFG 中的 DBGTOOLS 项下设置。如果未设置此值，则 Windmp 将尝试检测路径。

Windmp 可用于加载大型转储文件，但这将导致一个巨大的数据库，因此可以手动加载给定的输入文件:

  - 仅加载模块段：如果使用，Windmp 将仅加载与已加载模块相关的段
  并跳过所有其他内存段

  - 不加载符号名称：如果符号路径配置正确，则 Windmp 将
  获取并重命名所有已知地址; 你可以通过不加载符号名称来跳过此步骤。

  - 跳过大于的区段：跳过给定大小的区段，从而加快加载速度。
  如果此值为零，则不会使用此选项。
除了静态分析之外，还可以在 windbg 调试器模块下运行转储文件。


 窗口子菜单

窗口子菜单
此子菜单允许你操作屏幕上的窗口。你还可以：
    设置视频模式... (文字版)
    调用外部帮助
    查阅键盘布局 (文字版)
另参见 菜单栏子菜单。


 write_dbg_memory

write_dbg_memory

Write to debugger memory
     ea - linear address
     data - string to write
返回: number of written bytes (-1 - network/debugger error)
Thread-safe function (may be called only from the main thread and debthread)

long write_dbg_memory(long ea, string data);


 writelong

writelong

write 4 bytes to file
     handle    - file hanlde
     dword     - a 32-bit value to write
     mostfirst - 0 least significant byte is first (intel)
                 1 most  significant byte is first
返回: 0 - ok
Thread-safe function.

long writelong(long handle, long dword, long mostfirst);


 writeshort

writeshort

write 2 bytes to file
     handle    - file hanlde
     word      - a 16-bit value to write
     mostfirst - 0 least significant byte is first (intel)
                 1  most  significant byte is first
返回: 0 - ok
Thread-safe function.

long writeshort(long handle, long word, long mostfirst);


 writestr

writestr

将字符串写入文件
     handle  - 文件句柄
     str - 要写入的字符串
返回： 0 - ok
线程安全函数。

long writestr(long handle, string str);


 交叉引用

交叉引用

// 请参阅示例文件 xrefs.idc 以了解如何使用这些函数。

// 流程类型 (与 XREF_USER 结合使用！):
#define fl_CF   16              // 远调用
#define fl_CN   17             // 近调用
#define fl_JF   18              // 远跳转
#define fl_JN   19             // 近跳转
#define fl_F    21              // 普通流程

#define XREF_USER 32        // 所有用户指定的交叉引用类型必须与该位结合使用

// 标记执行流程 'from' 'to'
success add_cref(long from, long to, long flowtype);

// 取消标记执行流程 'from' 'to'
// undef - 如果不再引用 'to' ，则将其设为未定义
// 返回 1 - 计划设为未定义的
long del_cref(long from, long to, int undef);

// 以下函数包含普通流程 (首先返回普通流程引用):

// 从 'from' 获取第一个代码交叉引用
long get_first_cref_from(long From);

// 获取下一个代码交叉引用自
long get_next_cref_from(long from, long current);

// 获取第一个代码交叉引用到 'to'
long get_first_cref_to(long to);

// 获取下一个代码交叉引用到 'to'
long get_next_cref_to(long to, long current);

// 以下函数不考虑普通流程：
long get_first_fcref_from(long from);
long get_next_fcref_from(long from, long current);
long get_first_fcref_to(long to);
long get_next_fcref_to(long to, long current);

// 数据引用类型 (与 XREF_USER 结合使用！):
#define dr_O    1                       // 偏移量
#define dr_W    2                      // 写入
#define dr_R    3                       // 读取
#define dr_T    4                       // 文本 (手动操作数中的名称)
#define dr_I    5                       // 信息的

// 创建数据引用
success add_dref(long From, long to, long dreftype);

// 取消标记数据引用
void del_dref(long from, long to);

// 从 'from' 获取第一个数据交叉引用
long get_first_dref_from(long from);
long get_next_dref_from(long From, long current);

// 获取第一个数据交叉引用到 'to'
long get_first_dref_to(long to);
long get_next_dref_to(long to, long current);

// 返回由 get_first_.../get_next_... 函数获取的最后一个交叉引用类型。
// 返回值为 fl_... 或 dr_...
 long get_xref_type(void);


 xtol

xtol

将 ascii 字符串转换为二进制数。
(此函数与 C 库中的十六进制“strtoul”相同，使用 long() 表示 atol)
线程安全函数。

long xtol(string str);


 缩放图表

缩放图表
该图表可以放大和缩小。有几种方法可以缩放图表：
 - 使用 Ctrl-滚轮。 当前鼠标位置将是缩放中心点(即该点在缩放操作期间不会移动)
 - 使用预定义的“缩放 100%”和“适合窗口”命令。 它们可以从右键菜单或快捷键获得：
    分别为“1”和“W”。当前鼠标位置是 "缩放 100%" 命令的缩放中心点。
 - 使用 Ctrl-小键盘加号 或 Ctrl-小键盘减号 键。当前键盘光标是这些命令的缩放中心。
 - 使用 Ctrl-Shift-拖动。这样，你就可以绘制一个矩形，IDA 将对其进行缩放。
有两个选项链接到图表缩放：
 - 自动调整图表至窗口：将根据窗口大小调整当前图表。 默认值：off
 - 适合窗口最大缩放级别 100%:“适合窗口”命令不会使用高于 100% 的缩放级别。默认值：on
缩放级别从不大于 1000% 且小于 1%。IDA 会记住导航历史记录中每个位置的当前缩放级别。

返回到 图表视图 或 邻近视图