Skip to main content

Crate idakit_sys

Crate idakit_sys 

Source
Expand description

Raw FFI bindings to IDA’s idalib runtime and the idakit C++ facade.

The declarations are split into per-domain source modules (runtime, function, bytes, hexrays, …) that mirror the facade’s translation units, but every item is re-exported flat at the crate root, so the public surface is a single namespace (idakit_sys::idakit_get_bytes, idakit_sys::EmitVtbl), not a module hierarchy. There are no safe wrappers here; those belong in idakit.

§Buffer conventions

Functions that accept (*mut c_char, cap: usize) copy the value into the caller-supplied buffer and NUL-terminate within cap bytes. The return value is the full source length, which may exceed cap when the output was truncated. A negative return value means the query failed (missing symbol, null handle, etc.).

§Owned handles

idakit_binpat_compile returns an opaque *mut c_void handle owned by the caller, released with its matching idakit_binpat_free. Passing a handle to any other function after release is undefined behaviour.

Structs§

BlockInfo
One basic block’s bounds and kind, returned by value from cfg_block.
CFunc
The SDK’s cfuncptr_t (qrefcnt_t<cfunc_t>), an opaque decompilation result handled only behind indirection (&CFunc or UniquePtr<CFunc>).
CaseDesc
One switch case, as passed to EmitVtbl::s_switch.
ChunkInfo
One function chunk: its index paired with its address range.
CtreeCounts
Statement, expression, and call-site counts of a decompiled function’s ctree, returned by value from cfunc_counts.
EmitVtbl
The callbacks the facade invokes while streaming a ctree walk. The consumer (idakit) builds owned nodes inside each callback and returns the handle the parent will reference; children are emitted before parents. #[repr(C)] and field order mirror idakit_emit_vtbl_t exactly, since the facade indexes by offset.
EnumConstInfo
One enum constant, a lifetime-generic shared struct with a borrowed name, the enum twin of MemberInfo.
ExprGap
The ctree extraction-fidelity diagnostic, returned by value from cfunc_expr_gap.
FlowChart
The SDK’s qflow_chart_t, an opaque control-flow graph handled only behind indirection (&FlowChart or UniquePtr<FlowChart>).
FrameVar
One stack-frame variable, an owned shared struct returned in a FrameWalk.
FrameWalk
A walked stack frame: its total byte size and its variables, returned by [frame_type_walk_visit].
ImportRec
One import-table row, returned inside the imports_build snapshot.
InstructionData
A decoded instruction, returned by value from decode_insn; status carries the raw result code and ops is right-sized to the populated operands.
IntVec
An Opaque cxx binding of the SDK container intvec_t.
LocPiece
One fragment of a scattered (ALOC_DIST) local’s location, as the facade passes it inside LvarLoc::pieces. atype is the fragment’s own ALOC_* (a register or stack slot).
LvarLoc
A local variable’s location, decoded from IDA’s argloc_t and passed to EmitVtbl::l_lvar. atype is the ALOC_* discriminant; only the fields it selects are meaningful: reg1 (REG1 / REG2 low / RREL reg), reg2 (REG2 high), sval (STACK offset / STATIC ea / RREL displacement). pieces/npieces describe a scattered location and are empty otherwise.
MemberInfo
One struct/union member, a lifetime-generic shared struct whose name borrows a C++ stack temporary for the duration of one fill_struct call.
OperandData
One decoded operand; which fields are meaningful depends on kind.
RangeT
A #[repr(C)] mirror of the SDK’s range_t, crossing the bridge by value as a Trivial ExternType.
RangeVec
An Opaque cxx binding of the SDK container rangevec_t.
RegisterData
One register reference in a decoded operand, nested by value in an OperandData.
SigWriteResult
The outcome of a signature-surgery call that also reports the function’s parameter count.
StrlistItem
One string-list entry: its address, octet length, and STRTYPE code.
TInfo
The SDK’s tinfo_t, an opaque type-info handle handled only behind indirection (&TInfo or UniquePtr<TInfo>).
TypeWalkVisitor
The cxx extern "Rust" opaque the C++ type walk drives by calling its &mut self methods, each forwarding into the TypeWalkSink it was built over.
TypeWriteResult
The outcome of a type-write call, returned by value from every type-write function except the two signature-surgery fns.
XrefRec
One cross-reference edge, returned inside the xrefs_build snapshot.

Constants§

BADADDR
The invalid-address sentinel (BADADDR); every Address-returning facade call uses it for “no address”.
BIN_SEARCH_BITMASK
BIN_SEARCH_BITMASK from bytes.hpp (IDA 9.3): match under a strict bit mask rather than byte-granular wildcards.
BIN_SEARCH_CASE
BIN_SEARCH_CASE from bytes.hpp (IDA 9.3): match "..." string literals case-sensitively (the default is case-insensitive).
FC_CALL_ENDS
FC_CALL_ENDS from gdl.hpp: call instructions terminate a basic block.
FC_NOEXT
FC_NOEXT from gdl.hpp: omit external blocks (jump targets outside the function).
FC_NOPREDS
FC_NOPREDS from gdl.hpp: skip predecessor-list computation.
FF_CODE
MS_CLS-masked flag value marking an address as the head of an instruction.
FF_DATA
MS_CLS-masked flag value marking an address as the head of a data item.
FF_LABL
FF_LABL (bytes.hpp): the address has a dummy (address-derived) name. See FF_NAME.
FF_NAME
FF_NAME (bytes.hpp): the address has an explicit or auto-generated name. With FF_LABL it forms IDA’s two-bit name classification. The SDK #undefs these at the end of the header, so the values are mirrored here and pinned to IDA’s own predicates by an alignment test in idakit.
FRAME_VAR_RETADDR
FrameVar flag: the return-address slot in the frame.
FRAME_VAR_SAVREGS
FrameVar flag: the saved-registers slot in the frame.
FUNC_LIB
FUNC_LIB from funcs.hpp: a library function.
FUNC_NORET
FUNC_NORET from funcs.hpp: the function does not return.
FUNC_THUNK
FUNC_THUNK from funcs.hpp: a thunk (jump) function.
IDAKIT_EXIT_TRAPPED
IDAKIT_FLOW_CALL
Control-flow bit flags for a decoded instruction.
IDAKIT_FLOW_INDIRECT
See IDAKIT_FLOW_CALL.
IDAKIT_FLOW_JUMP
See IDAKIT_FLOW_CALL.
IDAKIT_FLOW_RET
See IDAKIT_FLOW_CALL.
IDAKIT_FLOW_STOPS
See IDAKIT_FLOW_CALL.
IDAKIT_MAX_OPS
Maximum operands the instruction bridge fills, matching UA_MAXOP.
IDAKIT_MEMBER_APPEND
member_bit value that appends a new member at the end rather than a fixed offset.
IDAKIT_NONE
Absent optional child / sentinel, matching IDAKIT_NONE in the facade.
IDAKIT_OP_DTYPE_COUNT
Number of op_dtype_t values idakit mirrors (the op_dtype_ids alignment-source length).
IDAKIT_OP_FAR
See IDAKIT_OP_REG.
IDAKIT_OP_IMM
See IDAKIT_OP_REG.
IDAKIT_OP_MEM
See IDAKIT_OP_REG.
IDAKIT_OP_NEAR
See IDAKIT_OP_REG.
IDAKIT_OP_REG
Semantic operand kinds; the raw optype is folded into these.
IDAKIT_RECIPE_ARRAY
Recipe opcode: pop one type, push an array of it, followed by a u64 element count.
IDAKIT_RECIPE_BOOL
Recipe opcode: push the boolean type.
IDAKIT_RECIPE_CONST
Recipe opcode: pop one type, push its const-qualified form.
IDAKIT_RECIPE_DECL
Recipe opcode: push a parsed declaration, followed by a u32 length and that many decl bytes.
IDAKIT_RECIPE_FLOAT
Recipe opcode: push a float, followed by a u8 width in bytes.
IDAKIT_RECIPE_FUNCTION
Recipe opcode: build a function type. Followed by a u32 parameter count, a u8 varargs flag, a u16 calling convention (0 = default), then that many u32-length-prefixed parameter names; pops the parameter types then the return type (return pushed first) and pushes the function.
IDAKIT_RECIPE_INT
Recipe opcode: push an integer, followed by a u8 width in bytes and a u8 signedness flag.
IDAKIT_RECIPE_NAMED
Recipe opcode: push a named-type reference, followed by a u32 length and that many name bytes.
IDAKIT_RECIPE_PTR
Recipe opcode: pop one type, push a pointer to it.
IDAKIT_RECIPE_VOID
Recipe opcode: push the void type. Kept in lockstep with idakit_facade.h by hand.
IDAKIT_RECIPE_VOLATILE
Recipe opcode: pop one type, push its volatile-qualified form.
IDAKIT_REG_CLASS_COUNT
Number of idakit RegisterClass codes (the reg_class_ids alignment-source length).
IDAKIT_REG_NONE
Sentinel for an absent base/index register in a decoded operand.
IDAKIT_SIG_APPLY
create_func or apply_tinfo rejected the rebuilt signature.
IDAKIT_SIG_ARG_RANGE
A parameter index was past the last parameter.
IDAKIT_SIG_BUILD
A replacement-type recipe did not build.
IDAKIT_SIG_NO_PROTOTYPE
The address carries no function type to edit.
IDAKIT_SIG_OK
A prototype-surgery edit succeeded.
IDAKIT_TEDIT_BUILD
Member-edit pre-failure: a member-type recipe did not build.
IDAKIT_TEDIT_NO_MEMBER
Member-edit pre-failure: the member (by name or bit offset) did not resolve.
IDAKIT_TEDIT_NO_TYPE
Member-edit pre-failure: no such named type in the local til. A positive sentinel; a successful edit is 0 and a kernel rejection is a negative tinfo_code_t.
IDAKIT_TYPE_ERR_APPLY
apply_tinfo rejected the parsed/resolved/built type at the address.
IDAKIT_TYPE_ERR_INPUT
A bad input to a type apply: an unparseable declaration, a named type that does not exist, or a malformed recipe.
IDAKIT_TYPE_OK
Result of a successful type apply.
MS_CLS
Class mask over an address’s flags word (MS_CLS in bytes.hpp); the masked value equals FF_CODE for an instruction or FF_DATA for data.
SEGPERM_EXEC
SEGPERM_EXEC from segment.hpp: the segment is executable.
SEGPERM_READ
SEGPERM_READ from segment.hpp: the segment is readable.
SEGPERM_WRITE
SEGPERM_WRITE from segment.hpp: the segment is writable.
STRLYT_MASK
STRLYT_MASK from nalt.hpp: the STRTYPE bits selecting the layout (terminated vs Pascal).
STRLYT_SHIFT
STRLYT_SHIFT from nalt.hpp: right-shift applied to the STRLYT_MASK field.
STRWIDTH_MASK
STRWIDTH_MASK from nalt.hpp: the STRTYPE bits selecting bytes-per-character.

Traits§

TypeWalkSink
A walk target the type visitor drives inline, one method per tinfo node kind.

Functions§

apply_named_type
Resolve the existing named type name and apply it at ea. code distinguishes not-found (_ERR_INPUT) from an apply rejection (_ERR_APPLY); reason is empty (no error channel).
apply_type_decl
Parse decl against the local til and apply it at ea. code is IDAKIT_TYPE_OK, _ERR_INPUT (parse failed), or _ERR_APPLY.
apply_type_recipe
Build the tinfo the postfix recipe encodes and apply it at ea. Same codes as apply_type_decl; _ERR_INPUT is a malformed buffer or an unparseable embedded decl. An unknown named leaf builds a forward reference that fails later at apply, not here.
auto_wait⚠
bitness
Application bitness (inf_get_app_bitness): 16, 32, or 64.
cfg2_total_edges
Total number of successor edges across the whole graph (the sum of every block’s successor count). A free function over a &FlowChart built by the generated bridge.
cfg_block
Bounds and kind of block n; Err when n is out of range.
cfg_build
Build the flow chart for the function containing ea; Err when no function is there. Runs analysis, so it can also fail from a thrown SDK exception.
cfg_nblocks
Total number of basic blocks (external blocks included).
cfg_npred
Number of predecessors of block n (0 when n is out of range).
cfg_nproper
Number of blocks belonging to the function’s own range.
cfg_nsucc
Number of successors of block n (0 when n is out of range).
cfg_pred
The i-th predecessor block index of block n; Err when n/i is out of range.
cfg_preds
The whole predecessor edge list of block n as one owned Vec<u32>; Err when n is out of range.
cfg_succ
The i-th successor block index of block n; Err when n/i is out of range.
cfg_succ_vec
Borrow block n’s successor edge list (qbasic_block_t::succ, an intvec_t) out of the live flow chart; Err when n is out of range. The returned &IntVec borrows fc, so it cannot outlive it.
cfg_succs
The whole successor edge list of block n as one owned Vec<u32>; Err when n is out of range.
cfunc_counts
Statement, expression, and call-site counts of cf’s ctree.
cfunc_expr_gap
The extraction-fidelity diagnostic for cf: total expressions the SDK visitor sees vs how many the extraction walker should materialize.
cfunc_pseudocode
The rendered pseudocode of cf, tags stripped; Err if the SDK cannot produce it.
clear_type
Clear any type applied at ea. Idempotent: code is IDAKIT_TYPE_OK when there was nothing to clear; reason is empty (no error channel).
close_database⚠
decode_insn
Decode the instruction at ea, folding raw operands into semantic kinds with resolved register names and control-flow facts. Infallible at the boundary: the result code lands in InstructionData::status rather than throwing, since the -3/-4 failures carry structured payloads.
decompile
Decompile the function at ea into a heap cfuncptr_t owned by a UniquePtr (one owned ref); Err on any decompile failure. Wrapped in the facade trap, so a fatal exit() surfaces as a trapped Err the caller distinguishes via its own trap query. The UniquePtr’s cxx deleter runs ~cfuncptr_t (release()) on drop.
define_type
Parse the C declaration(s) in input into the local til. code is the parse-error count (0 = ok).
demangle_name
Fully demangled form of name; Err when name is not mangled.
enable_console_messages⚠
enum_add_member
Add an enum constant named member_name with value to the named enum type_name. Same IDAKIT_TEDIT_* codes as the udt_* fns.
enum_del_member
Delete the enum constant member_name from the named enum type_name.
enum_rename_member
Rename the enum constant member_name in the named enum type_name to new_name.
enum_set_member_value
Set the value of the enum constant member_name in the named enum type_name.
export_ea
Address of export idx, or BADADDR when the export is a pure forwarder.
export_forwarder
Forwarder target of export idx; Err when it has none (most exports do not).
export_name
Name of export idx; Err when it has none.
export_ordinal
Ordinal of export idx.
export_qty
Number of exported entry points in the database (get_entry_qty).
file_type_name
Human-readable input file format text; Err when unavailable.
func_chunk_qty
Number of chunks (entry plus tails) of the function at ea, or 0.
func_ea
Entry address of the n-th function, or BADADDR when n is out of range.
func_end
Entry-chunk end address of the function at ea, or BADADDR when not a function.
func_flags
func_t::flags of the function at ea, or 0 when ea is not a function.
func_name
Name of the function at ea; Err when it has none.
func_prepend_this
Insert an implicit this parameter of the recipe type at index 0, then rebuild and re-apply.
func_qty
Number of functions in the database (get_func_qty).
func_rename_arg
Rename parameter idx to name, then rebuild and re-apply. arity reports the current parameter count; IDAKIT_SIG_ARG_RANGE when idx is past it.
func_set_argtype
Replace parameter idx’s type with the recipe type, then rebuild and re-apply. arity reports the current parameter count; IDAKIT_SIG_ARG_RANGE when idx is past it.
func_set_cc
Set the calling convention of the function type at ea to the raw CM_CC_* code cc, then rebuild and re-apply.
func_set_rettype
Replace the return type of the function type at ea with the recipe type, then rebuild and re-apply. See the IDAKIT_SIG_* codes.
func_start
Entry address of the function containing ea, or BADADDR when there is none.
gen_seg_bitness
Address bits (16/32/64) of segment n, or 0 when out of range.
gen_seg_class
Class of segment n; Err when n is out of range or has no class.
gen_seg_end
End address of segment n, or BADADDR when n is out of range.
gen_seg_name
Visible name of segment n; Err when n is out of range.
gen_seg_perm
Permission bits (SEGPERM_*) of segment n, or 0 when out of range.
gen_seg_qty
Number of segments in the current database (get_segm_qty).
gen_seg_span_total
Total byte span across all segments (sum of end - start). Hand-written body.
gen_seg_start
Start address of segment n, or BADADDR when n is out of range.
get_bytes
The size bytes at ea as an owned Vec<u8>; Err when the range is not fully mapped.
get_cmt
The regular (or repeatable, when rptble) comment at ea; Err when there is none.
get_ea_name
Name at address ea; Err when the address has none.
get_flags
Flag word of the item at ea (get_flags).
get_item_end
Address just past the item covering ea (get_item_end).
get_item_head
Start address of the item covering ea (ea itself when it is an item head).
get_library_version⚠
get_name_ea
Address the symbol name resolves to, or BADADDR when it is unknown.
get_next_head
Next item head after ea, searching up to maxea, or BADADDR when none.
get_prev_head
Previous item head before ea, searching down to minea, or BADADDR when none.
get_qerrno⚠
get_strlit
The auto-detected string literal at ea (given its STRTYPE) decoded to UTF-8; Err when there is none or it cannot be decoded.
get_u8
The byte at ea; Err when it is uninitialized.
get_u16
The little-endian word at ea; Err when any covered byte is uninitialized.
get_u32
The little-endian dword at ea; Err when any covered byte is uninitialized.
get_u64
The little-endian qword at ea; Err when any covered byte is uninitialized.
has_auto_name
Whether a flags word marks an IDA-generated (auto) name.
has_dummy_name
Whether a flags word marks a dummy (address-derived) name.
has_user_name
Whether a flags word marks a user-given (explicit) name.
idakit_accept_eula⚠
idakit_bin_search⚠
idakit_binpat_compile⚠
idakit_binpat_free⚠
idakit_binpat_from_bytes⚠
idakit_binpat_stats⚠
idakit_cfunc_walk_ctree⚠
Walk cfunc’s ctree, driving vtbl (with ctx) per node and visitor (an opaque TypeWalkVisitor) per node type, writing the root statement handle to *root. Returns 0 on success, non-zero if any pointer argument is null.
idakit_func_type⚠
idakit_get_bytes⚠
idakit_guarded_auto_wait⚠
idakit_guarded_close⚠
idakit_guarded_open⚠
idakit_hexrays_init⚠
idakit_init_library⚠
Facade wrapper: force headless (TVHEADLESS) then init_library; returns its rc.
idakit_last_exit_code⚠
idakit_last_output⚠
idakit_patch_bytes⚠
idakit_reg_read_int⚠
idakit_set_batch⚠
Set IDA’s batch global: nonzero suppresses dialogs/auto-answers prompts, zero restores interactive behavior.
idakit_type_name_at⚠
Name of the type at ordinal into (buf, cap), returning its full length (0 for an anonymous type, negative if the ordinal holds no type).
idakit_type_ordinal_limit⚠
Exclusive upper bound on local-type ordinals: valid ordinals run 1..limit.
idakit_was_trapped⚠
image_base
Preferred load address of the input (get_imagebase).
imports_build
The whole import table as an owned, Send snapshot, built in one walk of every module’s enum_import_names.
init_library⚠
input_path
Full path of the analyzed input; Err when unknown.
intvec_copy
Copy an intvec_t into an owned Vec<i32> (the allocation/copy path).
intvec_len
Element count of an intvec_t, via its qvector::size().
intvec_slice
Borrow an intvec_t’s backing store as &[i32] (the zero-copy path). The slice borrows v, so it cannot outlive it.
is_main_thread⚠
max_ea
One past the highest mapped address in the database (inf_get_max_ea).
min_ea
Lowest mapped address in the database (inf_get_min_ea).
nlist_ea
Address of name-list entry idx.
nlist_name
Name of name-list entry idx; Err when idx is out of range.
nlist_size
Number of entries in the sorted name list (get_nlist_size).
op_dtype_ids
This SDK’s op_dtype_t (dt_*) values in idakit DataType’s discriminant order, an alignment source for a mirror test.
open_database⚠
proc_name
Processor module id, e.g. metapc; Err when none is set.
qstrerror⚠
Describe an error_t. The returned pointer borrows IDA’s static/thread-local storage: it must not be freed, and a later qstrerror call on the same thread may overwrite it. Copy it into a CStr/String before the next IDA call.
range_all_chunks
Every chunk (entry plus tails) of the function at ea as one owned Vec; Err when no function is there.
range_chunk_info
Chunk n of the function at ea as a ChunkInfo; Err when n is out of range.
range_entry_chunk
Entry chunk (index 0) of the function containing ea, returned by value; Err when no function is there.
range_size
Size (end - start) of a range_t passed by value.
rangevec_build_chunks
Build a rangevec_t of every chunk (entry plus tails) of the function at ea, owned by a UniquePtr; Err when no function is there.
rangevec_len
Element count of a rangevec_t, via its inherited qvector::size().
rangevec_slice
Borrow a rangevec_t’s backing store as &[RangeT] (the zero-copy path). The slice borrows v, so it cannot outlive it.
reg_class_ids
The facade’s RegisterClass codes in idakit’s discriminant order, an alignment source pinning the Rust mirror to this SDK build in a test.
root_filename
Base filename of the input; Err when unknown.
set_cmt⚠
set_name⚠
strlist_build
(Re)build IDA’s string list, an O(database) scan of the whole image.
strlist_item
The n-th string-list entry as a StrlistItem; Err when n is out of range.
strlist_qty
Number of entries in the current string list (get_strlist_qty).
strlit_contents
Decode the string literal at ea (given octet length and STRTYPE) to UTF-8; Err when it cannot be decoded.
tinfo_apply
Apply the built handle at ea (apply_tinfo, TINFO_DEFINITE | flags). code is IDAKIT_TYPE_OK/_ERR_APPLY; the handle is not consumed.
tinfo_array
An nelems-element array of inner as a fresh handle. inner is copied, not consumed; a null handle when nelems exceeds u32 or the array cannot be built.
tinfo_bool
The boolean type as a fresh UniquePtr handle.
tinfo_const
A const-qualified copy of inner as a fresh handle. inner is not consumed.
tinfo_decl
The type decl parses to against the local til, as a fresh handle; Err (with the captured parse diagnostic) on a parse failure.
tinfo_float
A bytes-wide float (4 or 8) as a fresh handle; a null handle when the width is not 4 or 8.
tinfo_int
A bytes-wide integer (1/2/4/8/16), signed when is_signed, as a fresh handle; a null handle when the width is unsupported.
tinfo_named
The named type name as a fresh handle, an unresolved typedef ref. Builds a non-null forward reference even for a name absent from the local til, so the caller checks existence separately.
tinfo_ptr
A pointer to inner as a fresh handle. inner is copied, not consumed; a null handle if the pointer type cannot be built.
tinfo_void
The void type as a fresh UniquePtr handle, freed by the cxx deleter (~tinfo_t) on drop.
tinfo_volatile
A volatile-qualified copy of inner as a fresh handle. inner is not consumed.
type_walk_visitor⚠
Wrap a raw sink pointer as a TypeWalkVisitor for a walk driven outside this crate.
udt_add_member
Add a member of the recipe type to the named struct/union type_name at bit offset member_bit (or appended when it is IDAKIT_MEMBER_APPEND). An empty member_name adds an anonymous member. See the IDAKIT_TEDIT_* codes.
udt_del_member
Delete the member selected by member_name (or, when it is empty, by bit offset member_bit) from type_name.
udt_rename_member
Rename the member selected by member_name (or, when it is empty, by bit offset member_bit) in type_name to new_name.
udt_set_member_type
Replace the type of the member selected by member_name (or, when it is empty, by bit offset member_bit) in type_name with the recipe type.
walk_frame_type
Walk the stack frame of the function at ea, interning each variable’s type into sink and returning the frame size and variables. None when there is no function or frame at ea. The returned FrameVar::ty handles index the table sink built.
walk_func_type
Walk the prototype of the function at ea into sink; the function-address twin of walk_type_named. None when the function has no type info.
walk_type_named
Walk the local type named name into sink via the cxx opaque visitor; returns the root handle, or None when no such type exists (or a name was not valid UTF-8, surfaced as a thrown Err).
walk_type_ordinal
Walk the local type at ordinal into sink; the ordinal twin of walk_type_named.
xrefs_build
Every cross-reference edge at ea as an owned, Send snapshot: xrefs to ea when is_to, else xrefs from it. Ordinary next-instruction flow edges are excluded (XREF_NOFLOW).

Type Aliases§

Address
IDA’s effective address (ea_t), compiled __EA64__.