Classes Overview

ida_dbg

Contains functions to control the debugging of a process.

See Debugger functions for a complete explanation of these functions. These functions are inlined for the kernel. They are not inlined for the user-interfaces.

Constants

• dbg_null
• dbg_process_start
• dbg_process_exit
• dbg_process_attach
• dbg_process_detach
• dbg_thread_start
• dbg_thread_exit
• dbg_library_load
• dbg_library_unload
• dbg_information
• dbg_exception
• dbg_suspend_process: The process is now suspended.
• dbg_bpt: A user defined breakpoint was reached.
• dbg_trace: A step occurred (one instruction was executed). This event notification is only generated if step tracing is enabled.
• dbg_request_error: An error occurred during the processing of a request.
• dbg_step_into
• dbg_step_over
• dbg_run_to
• dbg_step_until_ret
• dbg_bpt_changed: Breakpoint has been changed.
• dbg_started_loading_bpts: Started loading breakpoint info from idb.
• dbg_finished_loading_bpts: Finished loading breakpoint info from idb.
• dbg_last: The last debugger notification code.
• BPTEV_ADDED: Breakpoint has been added.
• BPTEV_REMOVED: Breakpoint has been removed.
• BPTEV_CHANGED: Breakpoint has been modified.
• DSTATE_SUSP: process is suspended and will not continue
• DSTATE_NOTASK: no process is currently debugged
• DSTATE_RUN: process is running
• DBGINV_MEMORY: invalidate cached memory contents
• DBGINV_MEMCFG: invalidate cached process segmentation
• DBGINV_REGS: invalidate cached register values
• DBGINV_ALL: invalidate everything
• DBGINV_REDRAW: refresh the screen
• DBGINV_NONE: invalidate nothing
• MOVBPT_OK: moved ok
• MOVBPT_NOT_FOUND: source bpt not found
• MOVBPT_DEST_BUSY: destination location is busy (we already have such a bpt)
• MOVBPT_BAD_TYPE: BPLT_ABS is not supported.
• BPLT_ABS: absolute address: ea
• BPLT_REL: relative address: module_path, offset
• BPLT_SYM: symbolic: symbol_name, offset
• BPLT_SRC: source level: filename, lineno
• BPT_BRK: suspend execution upon hit
• BPT_TRACE: add trace information upon hit
• BPT_UPDMEM: refresh the memory layout and contents before evaluating bpt condition
• BPT_ENABLED: enabled?
• BPT_LOWCND: condition is calculated at low level (on the server side)
• BPT_TRACEON: enable tracing when the breakpoint is reached
• BPT_TRACE_INSN: instruction tracing
• BPT_TRACE_FUNC: function tracing
• BPT_TRACE_BBLK: basic block tracing
• BPT_TRACE_TYPES: trace insns, functions, and basic blocks. if any of BPT_TRACE_TYPES bits are set but BPT_TRACEON is clear, then turn off tracing for the specified trace types
• BPT_ELANG_MASK
• BPT_ELANG_SHIFT: index of the extlang (scripting language) of the condition
• BKPT_BADBPT: failed to write the bpt to the process memory (at least one location)
• BKPT_LISTBPT: include in bpt list (user-defined bpt)
• BKPT_TRACE: trace bpt; should not be deleted when the process gets suspended
• BKPT_ACTIVE: active?
• BKPT_PARTIAL: partially active? (some locations were not written yet)
• BKPT_CNDREADY: condition has been compiled
• BKPT_FAKEPEND: fake pending bpt: it is inactive but another bpt of the same type is active at the same address(es)
• BKPT_PAGE: written to the process as a page bpt. Available only after writing the bpt to the process.
• BPTCK_NONE: breakpoint does not exist
• BPTCK_NO: breakpoint is disabled
• BPTCK_YES: breakpoint is enabled
• BPTCK_ACT: breakpoint is active (written to the process)
• ST_OVER_DEBUG_SEG: step tracing will be disabled when IP is in a debugger segment
• ST_OVER_LIB_FUNC: step tracing will be disabled when IP is in a library function
• ST_ALREADY_LOGGED: step tracing will be disabled when IP is already logged
• ST_SKIP_LOOPS: step tracing will try to skip loops already recorded
• ST_DIFFERENTIAL: tracing: log only new instructions (not previously logged)
• ST_OPTIONS_MASK: mask of available options, to ensure compatibility with newer IDA versions
• ST_OPTIONS_DEFAULT
• IT_LOG_SAME_IP: specific options for instruction tracing (see set_insn_trace_options())
• FT_LOG_RET: specific options for function tracing (see set_func_trace_options())
• BT_LOG_INSTS: specific options for basic block tracing (see set_bblk_trace_options())
• tev_none: no event
• tev_insn: an instruction trace
• tev_call: a function call trace
• tev_ret: a function return trace
• tev_bpt: write, read/write, execution trace
• tev_mem: memory layout changed
• tev_event: debug event occurred
• tev_max: first unused event type
• SAVE_ALL_VALUES
• SAVE_DIFF
• SAVE_NONE
• DEC_NOTASK: process does not exist
• DEC_ERROR: error
• DEC_TIMEOUT: timeout
• WFNE_ANY: return the first event (even if it doesn't suspend the process)
• WFNE_SUSP: wait until the process gets suspended
• WFNE_SILENT: 1: be silent, 0:display modal boxes if necessary
• WFNE_CONT: continue from the suspended state
• WFNE_NOWAIT: do not wait for any event, immediately return DEC_TIMEOUT (to be used with WFNE_CONT)
• WFNE_USEC: timeout is specified in microseconds (minimum non-zero timeout is 40000us)
• DOPT_SEGM_MSGS: log debugger segments modifications
• DOPT_START_BPT: break on process start
• DOPT_THREAD_MSGS: log thread starts/exits
• DOPT_THREAD_BPT: break on thread start/exit
• DOPT_BPT_MSGS: log breakpoints
• DOPT_LIB_MSGS: log library loads/unloads
• DOPT_LIB_BPT: break on library load/unload
• DOPT_INFO_MSGS: log debugging info events
• DOPT_INFO_BPT: break on debugging information
• DOPT_REAL_MEMORY: do not hide breakpoint instructions
• DOPT_REDO_STACK: reconstruct the stack
• DOPT_ENTRY_BPT: break on program entry point
• DOPT_EXCDLG: exception dialogs:
• EXCDLG_NEVER: never display exception dialogs
• EXCDLG_UNKNOWN: display for unknown exceptions
• EXCDLG_ALWAYS: always display
• DOPT_LOAD_DINFO: automatically load debug files (pdb)
• DOPT_END_BPT: evaluate event condition on process end
• DOPT_TEMP_HWBPT: when possible use hardware bpts for temp bpts
• DOPT_FAST_STEP: prevent debugger memory refreshes when single-stepping
• DOPT_DISABLE_ASLR: disable ASLR
• SRCIT_NONE: unknown
• SRCIT_MODULE: module
• SRCIT_FUNC: function
• SRCIT_STMT: a statement (if/while/for...)
• SRCIT_EXPR: an expression (a+b*c)
• SRCIT_STTVAR: static variable/code
• SRCIT_LOCVAR: a stack, register, or register-relative local variable or parameter
• SRCDBG_PROV_VERSION
• move_bpt_to_grp

Classes Overview

• bpt_vec_t
• tev_reg_values_t
• tevinforeg_vec_t
• memreg_infos_t
• bptaddrs_t
• bpt_location_t
• bpt_t
• tev_info_t
• memreg_info_t
• tev_reg_value_t
• tev_info_reg_t
• eval_ctx_t
• DBG_Hooks

Functions Overview

• run_to(*args) -> bool: Execute the process until the given address is reached. If no process is active, a new process is started. Technically, the debugger sets up a temporary breakpoint at the given address, and continues (or starts) the execution of the whole process. So, all threads continue their execution! sq{Type, Asynchronous function - available as Request, Notification, dbg_run_to}
• request_run_to(*args) -> bool: Post a run_to() request.
• run_requests() -> bool: Execute requests until all requests are processed or an asynchronous function is called. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_running_request() -> ui_notification_t: Get the current running request. sq{Type, Synchronous function, Notification, none (synchronous function)}
• is_request_running() -> bool: Is a request currently running?
• get_running_notification() -> dbg_notification_t: Get the notification associated (if any) with the current running request. sq{Type, Synchronous function, Notification, none (synchronous function)}
• clear_requests_queue() -> None: Clear the queue of waiting requests. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_process_state() -> int: Return the state of the currently debugged process. sq{Type, Synchronous function, Notification, none (synchronous function)}
• is_valid_dstate(state: int) -> bool
• set_process_state(newstate: int, p_thid: thid_t *, dbginv: int) -> int: Set new state for the debugged process. Notifies the IDA kernel about the change of the debugged process state. For example, a debugger module could call this function when it knows that the process is suspended for a short period of time. Some IDA API calls can be made only when the process is suspended. The process state is usually restored before returning control to the caller. You must know that it is ok to change the process state, doing it at arbitrary moments may crash the application or IDA. sq{Type, Synchronous function, Notification, none (synchronous function)}
• invalidate_dbg_state(dbginv: int) -> int: Invalidate cached debugger information. sq{Type, Synchronous function, Notification, none (synchronous function)}
• start_process(path: str = None, args: str = None, sdir: str = None) -> int: Start a process in the debugger. sq{Type, Asynchronous function - available as Request, Notification, dbg_process_start}
• request_start_process(path: str = None, args: str = None, sdir: str = None) -> int: Post a start_process() request.
• suspend_process() -> bool: Suspend the process in the debugger. sq{ Type,
• request_suspend_process() -> bool: Post a suspend_process() request.
• continue_process() -> bool: Continue the execution of the process in the debugger. sq{Type, Synchronous function - available as Request, Notification, none (synchronous function)}
• request_continue_process() -> bool: Post a continue_process() request.
• continue_backwards() -> bool: Continue the execution of the process in the debugger backwards. Can only be used with debuggers that support time-travel debugging. sq{Type, Synchronous function - available as Request, Notification, none (synchronous function)}
• request_continue_backwards() -> bool: Post a continue_backwards() request.
• exit_process() -> bool: Terminate the debugging of the current process. sq{Type, Asynchronous function - available as Request, Notification, dbg_process_exit}
• request_exit_process() -> bool: Post an exit_process() request.
• get_processes(proclist: procinfo_vec_t) -> ssize_t: Take a snapshot of running processes and return their description. sq{Type, Synchronous function, Notification, none (synchronous function)}
• attach_process(*args) -> int: Attach the debugger to a running process. sq{Type, Asynchronous function - available as Request, Notification, dbg_process_attach}
• request_attach_process(pid: pid_t, event_id: int) -> int: Post an attach_process() request.
• detach_process() -> bool: Detach the debugger from the debugged process. sq{Type, Asynchronous function - available as Request, Notification, dbg_process_detach}
• request_detach_process() -> bool: Post a detach_process() request.
• is_debugger_busy() -> bool: Is the debugger busy?. Some debuggers do not accept any commands while the debugged application is running. For such a debugger, it is unsafe to do anything with the database (even simple queries like get_byte may lead to undesired consequences). Returns: true if the debugged application is running under such a debugger
• get_thread_qty() -> int: Get number of threads. sq{Type, Synchronous function, Notification, none (synchronous function)}
• getn_thread(n: int) -> thid_t: Get the ID of a thread. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_current_thread() -> thid_t: Get current thread ID. sq{Type, Synchronous function, Notification, none (synchronous function)}
• getn_thread_name(n: int) -> str: Get the NAME of a thread sq{Type, Synchronous function, Notification, none (synchronous function)}
• select_thread(tid: thid_t) -> bool: Select the given thread as the current debugged thread. All thread related execution functions will work on this thread. The process must be suspended to select a new thread. sq{Type, Synchronous function - available as request, Notification, none (synchronous function)}
• request_select_thread(tid: thid_t) -> bool: Post a select_thread() request.
• suspend_thread(tid: thid_t) -> int: Suspend thread. Suspending a thread may deadlock the whole application if the suspended was owning some synchronization objects. sq{Type, Synchronous function - available as request, Notification, none (synchronous function)}
• request_suspend_thread(tid: thid_t) -> int: Post a suspend_thread() request.
• resume_thread(tid: thid_t) -> int: Resume thread. sq{Type, Synchronous function - available as request, Notification, none (synchronous function)}
• request_resume_thread(tid: thid_t) -> int: Post a resume_thread() request.
• get_first_module(modinfo: modinfo_t) -> bool
• get_next_module(modinfo: modinfo_t) -> bool
• step_into() -> bool: Execute one instruction in the current thread. Other threads are kept suspended. sq{Type, Asynchronous function - available as Request, Notification, dbg_step_into}
• request_step_into() -> bool: Post a step_into() request.
• step_over() -> bool: Execute one instruction in the current thread, but without entering into functions. Others threads keep suspended. sq{Type, Asynchronous function - available as Request, Notification, dbg_step_over}
• request_step_over() -> bool: Post a step_over() request.
• step_into_backwards() -> bool: Execute one instruction backwards in the current thread. Other threads are kept suspended. sq{Type, Asynchronous function - available as Request, Notification, dbg_step_into}
• request_step_into_backwards() -> bool: Post a step_into_backwards() request.
• step_over_backwards() -> bool: Execute one instruction backwards in the current thread, but without entering into functions. Other threads are kept suspended. sq{Type, Asynchronous function - available as Request, Notification, dbg_step_over}
• request_step_over_backwards() -> bool: Post a step_over_backwards() request.
• run_to_backwards(*args) -> bool: Execute the process backwards until the given address is reached. Technically, the debugger sets up a temporary breakpoint at the given address, and continues (or starts) the execution of the whole process. sq{Type, Asynchronous function - available as Request, Notification, dbg_run_to}
• request_run_to_backwards(*args) -> bool: Post a run_to_backwards() request.
• step_until_ret() -> bool: Execute instructions in the current thread until a function return instruction is executed (aka "step out"). Other threads are kept suspended. sq{Type, Asynchronous function - available as Request, Notification, dbg_step_until_ret}
• request_step_until_ret() -> bool: Post a step_until_ret() request.
• set_resume_mode(tid: thid_t, mode: resume_mode_t) -> bool: How to resume the application. Set resume mode but do not resume process.
• request_set_resume_mode(tid: thid_t, mode: resume_mode_t) -> bool: Post a set_resume_mode() request.
• get_dbg_reg_info(regname: str, ri: register_info_t) -> bool: Get register information sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_sp_val() -> uint64 *: Get value of the SP register for the current thread. Requires a suspended debugger.
• get_ip_val() -> uint64 *: Get value of the IP (program counter) register for the current thread. Requires a suspended debugger.
• is_reg_integer(regname: str) -> bool: Does a register contain an integer value? sq{Type, Synchronous function, Notification, none (synchronous function)}
• is_reg_float(regname: str) -> bool: Does a register contain a floating point value? sq{Type, Synchronous function, Notification, none (synchronous function)}
• is_reg_custom(regname: str) -> bool: Does a register contain a value of a custom data type? sq{Type, Synchronous function, Notification, none (synchronous function)}
• set_bptloc_string(s: str) -> int
• get_bptloc_string(i: int) -> str
• get_bpt_qty() -> int: Get number of breakpoints. sq{Type, Synchronous function, Notification, none (synchronous function)}
• getn_bpt(n: int, bpt: bpt_t) -> bool: Get the characteristics of a breakpoint. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_bpt(ea: ida_idaapi.ea_t, bpt: bpt_t) -> bool: Get the characteristics of a breakpoint. sq{Type, Synchronous function, Notification, none (synchronous function)}
• exist_bpt(ea: ida_idaapi.ea_t) -> bool: Does a breakpoint exist at the given location?
• add_bpt(*args) -> bool: This function has the following signatures:
• request_add_bpt(*args) -> bool: This function has the following signatures:
• del_bpt(*args) -> bool: This function has the following signatures:
• request_del_bpt(*args) -> bool: This function has the following signatures:
• update_bpt(bpt: bpt_t) -> bool: Update modifiable characteristics of an existing breakpoint. To update the breakpoint location, use change_bptlocs() sq{Type, Synchronous function, Notification, none (synchronous function)}
• find_bpt(bptloc: bpt_location_t, bpt: bpt_t) -> bool: Find a breakpoint by location. sq{Type, Synchronous function - available as request, Notification, none (synchronous function)}
• enable_bpt(*args) -> bool
• disable_bpt(*args) -> bool
• request_enable_bpt(*args) -> bool
• request_disable_bpt(*args) -> bool
• check_bpt(ea: ida_idaapi.ea_t) -> int: Check the breakpoint at the specified address.
• set_trace_size(size: int) -> bool: Specify the new size of the circular buffer. sq{Type, Synchronous function, Notification, none (synchronous function)}
• clear_trace() -> None: Clear all events in the trace buffer. sq{Type, Synchronous function - available as request, Notification, none (synchronous function)}
• request_clear_trace() -> None: Post a clear_trace() request.
• is_step_trace_enabled() -> bool: Get current state of step tracing. sq{Type, Synchronous function, Notification, none (synchronous function)}
• enable_step_trace(enable: int = 1) -> bool
• disable_step_trace() -> bool
• request_enable_step_trace(enable: int = 1) -> bool
• request_disable_step_trace() -> bool
• get_step_trace_options() -> int: Get current step tracing options. sq{Type, Synchronous function, Notification, none (synchronous function)}
• set_step_trace_options(options: int) -> None: Modify step tracing options. sq{Type, Synchronous function - available as request, Notification, none (synchronous function)}
• request_set_step_trace_options(options: int) -> None: Post a set_step_trace_options() request.
• is_insn_trace_enabled() -> bool: Get current state of instruction tracing. sq{Type, Synchronous function, Notification, none (synchronous function)}
• enable_insn_trace(enable: bool = True) -> bool
• disable_insn_trace() -> bool
• request_enable_insn_trace(enable: bool = True) -> bool
• request_disable_insn_trace() -> bool
• get_insn_trace_options() -> int: Get current instruction tracing options. Also see IT_LOG_SAME_IP sq{Type, Synchronous function, Notification, none (synchronous function)}
• set_insn_trace_options(options: int) -> None: Modify instruction tracing options. sq{Type, Synchronous function - available as request, Notification, none (synchronous function)}
• request_set_insn_trace_options(options: int) -> None: Post a set_insn_trace_options() request.
• is_func_trace_enabled() -> bool: Get current state of functions tracing. sq{Type, Synchronous function, Notification, none (synchronous function)}
• enable_func_trace(enable: bool = True) -> bool
• disable_func_trace() -> bool
• request_enable_func_trace(enable: bool = True) -> bool
• request_disable_func_trace() -> bool
• get_func_trace_options() -> int: Get current function tracing options. Also see FT_LOG_RET sq{Type, Synchronous function, Notification, none (synchronous function)}
• set_func_trace_options(options: int) -> None: Modify function tracing options. sq{Type, Synchronous function - available as request, Notification, none (synchronous function)}
• request_set_func_trace_options(options: int) -> None: Post a set_func_trace_options() request.
• enable_bblk_trace(enable: bool = True) -> bool
• disable_bblk_trace() -> bool
• request_enable_bblk_trace(enable: bool = True) -> bool
• request_disable_bblk_trace() -> bool
• is_bblk_trace_enabled() -> bool
• get_bblk_trace_options() -> int: Get current basic block tracing options. Also see BT_LOG_INSTS sq{Type, Synchronous function, Notification, none (synchronous function)}
• set_bblk_trace_options(options: int) -> None: Modify basic block tracing options (see BT_LOG_INSTS)
• request_set_bblk_trace_options(options: int) -> None: Post a set_bblk_trace_options() request.
• get_tev_qty() -> int: Get number of trace events available in trace buffer. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_tev_info(n: int, tev_info: tev_info_t) -> bool: Get main information about a trace event. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_insn_tev_reg_val(n: int, regname: str, regval: regval_t) -> bool: Read a register value from an instruction trace event. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_insn_tev_reg_mem(n: int, memmap: memreg_infos_t) -> bool: Read the memory pointed by register values from an instruction trace event. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_insn_tev_reg_result(n: int, regname: str, regval: regval_t) -> bool: Read the resulting register value from an instruction trace event. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_call_tev_callee(n: int) -> ida_idaapi.ea_t: Get the called function from a function call trace event. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_ret_tev_return(n: int) -> ida_idaapi.ea_t: Get the return address from a function return trace event. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_bpt_tev_ea(n: int) -> ida_idaapi.ea_t: Get the address associated to a read, read/write or execution trace event. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_tev_memory_info(n: int, mi: meminfo_vec_t) -> bool: Get the memory layout, if any, for the specified tev object. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_tev_event(n: int, d: debug_event_t) -> bool: Get the corresponding debug event, if any, for the specified tev object. sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_trace_base_address() -> ida_idaapi.ea_t: Get the base address of the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• set_trace_base_address(ea: ida_idaapi.ea_t) -> None: Set the base address of the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_add_thread(tid: thid_t) -> None: Add a thread to the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_del_thread(tid: thid_t) -> None: Delete a thread from the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_add_tev(type: tev_type_t, tid: thid_t, address: ida_idaapi.ea_t) -> None: Add a new trace element to the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_add_many_tevs(new_tevs: tevinforeg_vec_t) -> bool: Add many new trace elements to the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_add_insn_tev(tid: thid_t, ea: ida_idaapi.ea_t, save: save_reg_values_t = SAVE_DIFF) -> bool: Add a new instruction trace element to the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_add_bpt_tev(tid: thid_t, ea: ida_idaapi.ea_t, bp: ida_idaapi.ea_t) -> bool: Add a new breakpoint trace element to the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_add_call_tev(tid: thid_t, caller: ida_idaapi.ea_t, callee: ida_idaapi.ea_t) -> None: Add a new call trace element to the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_add_ret_tev(tid: thid_t, ret_insn: ida_idaapi.ea_t, return_to: ida_idaapi.ea_t) -> None: Add a new return trace element to the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• dbg_add_debug_event(event: debug_event_t) -> None: Add a new debug event to the current trace. sq{Type, Synchronous function, Notification, none (synchronous function)}
• load_trace_file(filename: str) -> str: Load a recorded trace file in the 'Tracing' window. If the call succeeds and 'buf' is not null, the description of the trace stored in the binary trace file will be returned in 'buf'
• save_trace_file(filename: str, description: str) -> bool: Save the current trace in the specified file.
• is_valid_trace_file(filename: str) -> bool: Is the specified file a valid trace file for the current database?
• set_trace_file_desc(filename: str, description: str) -> bool: Change the description of the specified trace file.
• get_trace_file_desc(filename: str) -> str: Get the file header of the specified trace file.
• choose_trace_file() -> str: Show the choose trace dialog.
• diff_trace_file(NONNULL_filename: str) -> bool: Show difference between the current trace and the one from 'filename'.
• graph_trace() -> bool: Show the trace callgraph.
• set_highlight_trace_options(hilight: bool, color: bgcolor_t, diff: bgcolor_t) -> None: Set highlight trace parameters.
• set_trace_platform(platform: str) -> None: Set platform name of current trace.
• get_trace_platform() -> str: Get platform name of current trace.
• set_trace_dynamic_register_set(idaregs: dynamic_register_set_t &) -> None: Set dynamic register set of current trace.
• get_trace_dynamic_register_set(idaregs: dynamic_register_set_t *) -> None: Get dynamic register set of current trace.
• wait_for_next_event(wfne: int, timeout: int) -> dbg_event_code_t: Wait for the next event.
• get_debug_event() -> debug_event_t const *: Get the current debugger event.
• set_debugger_options(options: uint) -> uint: Set debugger options. Replaces debugger options with the specification combination Debugger options
• set_remote_debugger(host: str, _pass: str, port: int = -1) -> None: Set remote debugging options. Should be used before starting the debugger.
• get_process_options2() -> qstring *, qstring *, launch_env_t *, qstring *, qstring *, qstring *, int *
• retrieve_exceptions() -> excvec_t *: Retrieve the exception information. You may freely modify the returned vector and add/edit/delete exceptions You must call store_exceptions() after any modifications Note: exceptions with code zero, multiple exception codes or names are prohibited
• store_exceptions() -> bool: Update the exception information stored in the debugger module by invoking its dbg->set_exception_info callback
• define_exception(code: uint, name: str, desc: str, flags: int) -> str: Convenience function: define new exception code.
• create_source_viewer(out_ccv: TWidget **, parent: TWidget *, custview: TWidget *, sf: source_file_ptr, lines: strvec_t *, lnnum: int, colnum: int, flags: int) -> source_view_t *: Create a source code view.
• get_dbg_byte(ea: ida_idaapi.ea_t) -> uint32 *: Get one byte of the debugged process memory.
• put_dbg_byte(ea: ida_idaapi.ea_t, x: int) -> bool: Change one byte of the debugged process memory.
• invalidate_dbgmem_config() -> None: Invalidate the debugged process memory configuration. Call this function if the debugged process might have changed its memory layout (allocated more memory, for example)
• invalidate_dbgmem_contents(ea: ida_idaapi.ea_t, size: asize_t) -> None: Invalidate the debugged process memory contents. Call this function each time the process has been stopped or the process memory is modified. If ea == BADADDR, then the whole memory contents will be invalidated
• is_debugger_on() -> bool: Is the debugger currently running?
• is_debugger_memory(ea: ida_idaapi.ea_t) -> bool: Is the address mapped to debugger memory?
• get_tev_ea(n: int) -> ida_idaapi.ea_t
• get_tev_type(n: int) -> int
• get_tev_tid(n: int) -> int
• bring_debugger_to_front() -> None
• set_manual_regions(ranges: meminfo_vec_t) -> None
• edit_manual_regions() -> None
• enable_manual_regions(enable: bool) -> None
• handle_debug_event(ev: debug_event_t, rqflags: int) -> int
• add_virt_module(mod: modinfo_t) -> bool
• del_virt_module(base: ea_t const) -> bool
• internal_ioctl(fn: int, buf: void const *, poutbuf: void **, poutsize: ssize_t *) -> int
• get_dbg_memory_info(ranges: meminfo_vec_t) -> int
• set_bpt_group(bpt: bpt_t, grp_name: str) -> bool: Move a bpt into a folder in the breakpoint dirtree if the folder didn't exists, it will be created sq{Type, Synchronous function, Notification, none (synchronous function)}
• set_bptloc_group(bptloc: bpt_location_t, grp_name: str) -> bool: Move a bpt into a folder in the breakpoint dirtree based on the bpt_location find_bpt is called to retrieve the bpt and then set_bpt_group if the folder didn't exists, it will be created sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_bpt_group(bptloc: bpt_location_t) -> str: Retrieve the absolute path to the folder of the bpt based on the bpt_location find_bpt is called to retrieve the bpt sq{Type, Synchronous function, Notification, none (synchronous function)}
• rename_bptgrp(old_name: str, new_name: str) -> bool: Rename a folder of bpt dirtree sq{Type, Synchronous function, Notification, none (synchronous function)}
• del_bptgrp(name: str) -> bool: Delete a folder, bpt that were part of this folder are moved to the root folder sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_grp_bpts(bpts: bpt_vec_t, grp_name: str) -> ssize_t: Retrieve a copy the bpts stored in a folder sq{Type, Synchronous function, Notification, none (synchronous function)}
• enable_bptgrp(bptgrp_name: str, enable: bool = True) -> int: Enable (or disable) all bpts in a folder sq{Type, Synchronous function, Notification, none (synchronous function)}
• get_local_vars(prov: srcinfo_provider_t *, ea: ida_idaapi.ea_t, out: source_items_t *) -> bool
• srcdbg_request_step_into() -> bool
• srcdbg_request_step_over() -> bool
• srcdbg_request_step_until_ret() -> bool
• hide_all_bpts() -> int
• read_dbg_memory(ea: ida_idaapi.ea_t, buffer: void *, size: size_t) -> ssize_t
• get_module_info(ea: ida_idaapi.ea_t, modinfo: modinfo_t) -> bool
• dbg_bin_search(start_ea: ida_idaapi.ea_t, end_ea: ida_idaapi.ea_t, data: compiled_binpat_vec_t const &, srch_flags: int) -> str
• load_debugger(dbgname: str, use_remote: bool) -> bool
• collect_stack_trace(tid: thid_t, trace: call_stack_t) -> bool
• get_global_var(prov: srcinfo_provider_t *, ea: ida_idaapi.ea_t, name: str, out: source_item_ptr *) -> bool
• get_local_var(prov: srcinfo_provider_t *, ea: ida_idaapi.ea_t, name: str, out: source_item_ptr *) -> bool
• get_srcinfo_provider(name: str) -> srcinfo_provider_t *
• get_current_source_file() -> str
• get_current_source_line() -> int
• add_path_mapping(src: str, dst: str) -> None
• srcdbg_step_into() -> bool
• srcdbg_step_over() -> bool
• srcdbg_step_until_ret() -> bool
• set_debugger_event_cond(NONNULL_evcond: str) -> None
• get_debugger_event_cond() -> str
• set_process_options(*args) -> None: Set process options. Any of the arguments may be nullptr, which means 'do not modify'
• get_process_options() -> qstring *, qstring *, qstring *, qstring *, qstring *, int *: Get process options. Any of the arguments may be nullptr
• get_manual_regions(*args): Returns the manual memory regions
• dbg_is_loaded(): Checks if a debugger is loaded
• refresh_debugger_memory(): Refreshes the debugger memory
• list_bptgrps() -> List[str]: Retrieve the list of absolute path of all folders of bpt dirtree.
• internal_get_sreg_base(tid: int, sreg_value: int): Get the sreg base, for the given thread.
• write_dbg_memory(*args) -> ssize_t
• dbg_can_query(): This function can be used to check if the debugger can be queried:
• set_reg_val(*args) -> bool: Set a register value by name
• request_set_reg_val(regname: str, o: PyObject *) -> PyObject *: Post a set_reg_val() request.
• get_reg_val(*args): Get a register value.
• get_reg_vals(tid: int, clsmask: int = -1) -> ida_idd.regvals_t: Fetch live registers values for the thread
• get_tev_reg_val(tev, reg)
• get_tev_reg_mem_qty(tev)
• get_tev_reg_mem(tev, idx)
• get_tev_reg_mem_ea(tev, idx)
• send_dbg_command(command): Send a direct command to the debugger backend, and