Crate idakit_sys

Expand description

Raw FFI bindings to IDA’s idalib runtime and the idakit C++ facade.

idakit-sys is the unsafe foundation under idakit, which most users want instead: it wraps these bindings in a safe, idiomatic API. Reach here directly only to call a raw symbol the higher layer does not yet expose.

§Surface

The declarations are split into per-domain source modules (runtime, bytes, function_flags, instruction, bridge_visitors, …) that mirror the facade’s translation units, but every item is re-exported flat at the crate root, so the public surface is a single namespace (idakit_sys::guarded_open, idakit_sys::CtreeVisitor), not a module hierarchy. Three kinds of item live here:

Raw C bindings: extern "C" declarations of the facade’s own functions (guarded_open, get_bytes_into, …) sharing the flat namespace with the idalib/IDA symbols they sit beside (open_database, set_name), plus the #[repr(C)] structs and sentinel constants they exchange.
cxx bridges: the spec-generated bridge (from the idakit-sys-codegen engine) and its hand-written companions, returning structured values, owning handles as UniquePtr<T>, or driving a walk through an opaque visitor (CtreeVisitor, TypeWalkVisitor).
A typed flag layer: the one deliberate exception to “raw declarations only”. OR-able bit masks that also cross as FFI fields become bitflags types (SegmentPermissions, FlowFlags, FrameVarFlags, FlowChartFlags, BinSearchFlags), and closed return-code sets become validated num_enum enums (SigWriteCode, TypeApplyCode); both stay sound at the boundary and spare every caller a hand-rolled bit test. Safe idiomatic wrappers still belong in idakit.

§SDK-name aliases

Every binding carries #[doc(alias)] tags for its IDA SDK spelling, so a rustdoc search resolves a name like SEGPERM_READ, FC_NOEXT, or open_database to the binding. Aliases are per crate: idakit_sys carries the raw-binding and SDK names, idakit carries the idiomatic wrappers.

§Buffer conventions

Functions that accept (*mut c_char, cap: usize) copy the value into the caller-supplied buffer and NUL-terminate within cap bytes. The return value is the full source length, which may exceed cap when the output was truncated. A negative return value means the query failed (missing symbol, null handle, etc.).

§Owned handles

Opaque owned handles cross as cxx UniquePtr<T> (CompiledBinpat, CFunc, TInfo), freed by cxx’s deleter on drop. Any handle still passed as a raw *mut c_void is paired with an explicit dispose call; using one after disposal is undefined behaviour.

§License

MIT. The IDA SDK and runtime are proprietary to Hex-Rays; these bindings link against your own install and redistribute none of it.

Structs§

BinSearchFlags: bin_search flag bits from bytes.hpp (IDA 9.3): BIN_SEARCH_CASE/BIN_SEARCH_BITMASK.
BinpatStats: The compiled length and anchor count of a pattern, returned by value from binpat_stats.
BlockInfo: One basic block’s bounds and kind, returned by value from cfg_block.
CFunc: The SDK’s cfuncptr_t (qrefcnt_t<cfunc_t>), an opaque decompilation result handled only behind indirection (&CFunc or UniquePtr<CFunc>).
ChunkInfo: One function chunk: its index paired with its address range.
CompiledBinpat: A compiled binary-search pattern (compiled_binpat_vec_t), owned behind a UniquePtr and passed by & to a search.
CtreeCounts: Statement, expression, and call-site counts of a decompiled function’s ctree, returned by value from cfunc_counts.
CtreeVisitor: The cxx extern "Rust" opaque the C++ ctree walk drives by calling its &mut self methods, each forwarding into the CtreeSink it was built over.
EnumConstInfo: One enum constant, the enum twin of MemberInfo.
ExprGap: The ctree extraction-fidelity diagnostic, returned by value from cfunc_expr_gap.
FlowChart: The SDK’s qflow_chart_t, an opaque control-flow graph handled only behind indirection (&FlowChart or UniquePtr<FlowChart>).
FlowChartFlags: Flow-chart build flag bits from gdl.hpp (FC_NOEXT/FC_CALL_ENDS/FC_NOPREDS), passed to qflow_chart_t::qflow_chart_t.
FlowFlags: InstructionData::flow control-flow bits for a decoded instruction: crate::FLOW_CALL/ crate::FLOW_RET/crate::FLOW_JUMP/crate::FLOW_INDIRECT/crate::FLOW_STOPS.
FrameVar: One stack-frame variable, an owned shared struct returned in a FrameWalk.
FrameVarFlags: FrameVar::flags bits marking the reserved return-address and saved-registers slots.
FrameWalk: A walked stack frame: its total byte size and its variables, returned by frame_type_walk_visit.
FuncFlags: Function flag bits from funcs.hpp (func_t::flags).
ImportRec: One import-table row, returned inside the imports_build snapshot.
InstructionData: A decoded instruction, returned by value from decode_insn; status carries the raw result code and ops is right-sized to the populated operands.
LocPiece: One fragment of a scattered (ALOC_DIST) local’s location. atype is the fragment’s own ALOC_* (a register or stack slot); off/size give the byte range of the whole value this fragment covers.
MemberInfo: One struct/union member, crossed inside a slice for one fill_struct call. name is an owned String: the sink interns members into its own table, so the transient owned copy the walk allocates is copied on anyway.
NameFlags: get_ea_name’s gtn_flags bits (name.hpp), controlling substitution/demangling.
OperandAccess: OperandData::access bits for a decoded operand: bit0 read, bit1 written.
OperandData: One decoded operand; which fields are meaningful depends on kind.
RangeT: A #[repr(C)] mirror of the SDK’s range_t, crossing the bridge by value as a Trivial ExternType.
RegisterData: One register reference in a decoded operand, nested by value in an OperandData.
SegmentFlags: Segment flag bits from segment.hpp (SFL_*, segment_t::flags).
SegmentPermissions: Segment permission bits from segment.hpp (SEGPERM_EXEC/SEGPERM_WRITE/SEGPERM_READ).
SigWriteResult: The outcome of a signature-surgery call that also reports the function’s parameter count.
StrlistItem: One string-list entry: its address, octet length, and STRTYPE code.
TInfo: The SDK’s tinfo_t, an opaque type-info handle handled only behind indirection (&TInfo or UniquePtr<TInfo>).
TypeWalkVisitor: The cxx extern "Rust" opaque the C++ type walk drives by calling its &mut self methods, each forwarding into the TypeWalkSink it was built over.
TypeWriteResult: The outcome of a type-write call, returned by value from every type-write function except the two signature-surgery fns.
XrefRec: One cross-reference edge, returned inside the xrefs_build snapshot.

Enums§

SigWriteCode: The outcome of a signature-surgery call (func_set_rettype, func_set_argtype, func_rename_arg, func_set_cc, func_prepend_this).
TypeApplyCode: The outcome of a whole-item type apply (apply_type_decl, apply_named_type, clear_type, apply_type_recipe, tinfo_apply).

Constants§

BADADDR: The invalid-address sentinel (BADADDR); every Address-returning facade call uses it for “no address”.
EXIT_TRAPPED: Sentinel rc a guarded call returns when it trapped a fatal exit/abort instead of it tearing down the process.
FF_CODE: MS_CLS-masked flag value marking an address as the head of an instruction.
FF_DATA: MS_CLS-masked flag value marking an address as the head of a data item.
FF_LABL: FF_LABL (bytes.hpp): the address has a dummy (address-derived) name. See FF_NAME.
FF_NAME: FF_NAME (bytes.hpp): the address has an explicit or auto-generated name.
FLOW_CALL: InstructionData::flow bit: the instruction is a call.
FLOW_INDIRECT: InstructionData::flow bit: the transfer target is indirect, not statically known.
FLOW_JUMP: InstructionData::flow bit: the instruction jumps.
FLOW_RET: InstructionData::flow bit: the instruction returns.
FLOW_STOPS: InstructionData::flow bit: sequential flow stops after this instruction.
FPC_NONE: InstructionData::fp_control: no EVEX register-form FP control.
FPC_ROUNDING: InstructionData::fp_control: EVEX static rounding ({r?-sae}), mode in round_mode.
FPC_SAE: InstructionData::fp_control: EVEX suppress-all-exceptions only ({sae}), no rounding.
MAXSPECSIZE: The maximum byte length of one netnode value, sup, or hash object.
MAX_OPS: Maximum operands the instruction bridge fills, matching UA_MAXOP.
MEMBER_APPEND: member_bit value that appends a new member at the end rather than a fixed offset.
MS_CLS: Class mask over an address’s flags word (MS_CLS in bytes.hpp); the masked value equals FF_CODE for an instruction or FF_DATA for data.
NONE: Absent optional child / sentinel for the visitor bridge (ctree and tinfo walks).
OP_FAR: Semantic operand kind: far branch/call target.
OP_IMM: Semantic operand kind: immediate.
OP_MEM: Semantic operand kind: memory.
OP_NEAR: Semantic operand kind: near branch/call target.
OP_REG: Semantic operand kind: register.
RECIPE_ARRAY: Recipe opcode: pop one type, push an array of it, followed by a u64 element count.
RECIPE_BITFIELD: Recipe opcode: build a bitfield member type (u8 container width in bytes, u8 field width in bits, u8 signedness); struct-member-only, rejected in a union.
RECIPE_BOOL: Recipe opcode: push the boolean type.
RECIPE_CONST: Recipe opcode: pop one type, push its const-qualified form.
RECIPE_DECL: Recipe opcode: push a parsed declaration, followed by a u32 length and that many decl bytes.
RECIPE_FLOAT: Recipe opcode: push a float, followed by a u8 width in bytes.
RECIPE_FUNCTION: Recipe opcode: build a function type (u32 param count, u8 varargs, u16 cc, then that many u32-length-prefixed param names; pops the params then the return type, pushes the function).
RECIPE_INT: Recipe opcode: push an integer, followed by a u8 width in bytes and a u8 signedness flag.
RECIPE_NAMED: Recipe opcode: push a named-type reference, followed by a u32 length and that many name bytes.
RECIPE_PTR: Recipe opcode: pop one type, push a pointer to it.
RECIPE_VOID: Recipe opcode: push the void type.
RECIPE_VOLATILE: Recipe opcode: pop one type, push its volatile-qualified form.
REG_NONE: Sentinel for an absent base/index register in a decoded operand.
ROUND_DOWN: InstructionData::round_mode: round toward negative infinity.
ROUND_NEAREST: InstructionData::round_mode: round to nearest (even).
ROUND_UP: InstructionData::round_mode: round toward positive infinity.
ROUND_ZERO: InstructionData::round_mode: round toward zero (truncate).
SIG_APPLY: create_func or apply_tinfo rejected the rebuilt signature.
SIG_ARG_RANGE: A parameter index was past the last parameter.
SIG_BUILD: A replacement-type recipe did not build.
SIG_NO_PROTOTYPE: The address carries no function type to edit.
SIG_OK: A prototype-surgery edit succeeded.
STRLYT_MASK: STRLYT_MASK from nalt.hpp: the STRTYPE bits selecting the layout (terminated vs Pascal).
STRLYT_SHIFT: STRLYT_SHIFT from nalt.hpp: right-shift applied to the STRLYT_MASK field.
STRWIDTH_MASK: STRWIDTH_MASK from nalt.hpp: the STRTYPE bits selecting bytes-per-character.
TEDIT_BUILD: Member-edit pre-failure: a member-type recipe did not build.
TEDIT_NO_MEMBER: Member-edit pre-failure: the member (by name or bit offset) did not resolve.
TEDIT_NO_TYPE: Member-edit pre-failure: no such named type in the local til.
TYPE_ERR_APPLY: apply_tinfo rejected the parsed/resolved/built type at the address.
TYPE_ERR_INPUT: A bad input to a type apply: an unparseable declaration, a named type that does not exist, or a malformed recipe.
TYPE_OK: Result of a successful type apply.

Traits§

CtreeSink: A ctree walk target the visitor drives inline, one method per expression, statement, and local variable kind.
TypeWalkSink: A walk target the type visitor drives inline, one method per tinfo node kind.

Functions§

accept_eula^⚠: Accept the EULA programmatically, so headless bring-up never blocks on it.
apply_named_type: Resolve the existing named type name and apply it at ea. code distinguishes not-found (_ERR_INPUT) from an apply rejection (_ERR_APPLY); reason is empty (no error channel).
apply_type_decl: Parse decl against the local til and apply it at ea. code is TYPE_OK, _ERR_INPUT (parse failed), or _ERR_APPLY.
apply_type_recipe: Build the tinfo the postfix recipe encodes and apply it at ea. Same codes as apply_type_decl; _ERR_INPUT is a malformed buffer or an unparseable embedded decl. An unknown named leaf builds a forward reference that fails later at apply, not here.
assignop_ctype_ids: This SDK’s ctype_t (cot_asg*) values in idakit AssignmentOp’s discriminant order, an alignment source for a mirror test.
auto_wait^⚠: Block until the auto-analysis queue drains; returns whether it completed.
bin_search: First address in [start, end) matching pat, or BADADDR when absent (headless: NOBREAK | NOSHOW forced).
binop_ctype_ids: This SDK’s ctype_t (cot_*) values in idakit BinaryOp’s discriminant order, an alignment source pinning the Rust mirror to this SDK build in a test.
binpat_compile: Compile pattern via IDA’s own parser (byte width taken from ea); Err carries the parser’s rejection message.
binpat_from_bytes: Compile a pattern from raw bytes and a per-byte bit mask; an empty mask means every byte is concrete.
binpat_stats: The compiled length and anchor count of pat.
bitness: Application bitness (inf_get_app_bitness): 16, 32, or 64.
block_kind_ids: This SDK’s fc_block_type_t (fcb_*) values in idakit BasicBlockKind’s discriminant order, an alignment source pinning the Rust mirror to this SDK build in a test. Covers only the modelled in-function kinds; fcb_enoret/fcb_extern are deliberately absent.
cfg_block: Bounds and kind of block n; Err when n is out of range.
cfg_build: Build the flow chart for the function containing ea; Err when no function is there. Runs analysis, so it can also fail from a thrown SDK exception.
cfg_nblocks: Total number of basic blocks (external blocks included).
cfg_npred: Number of predecessors of block n (0 when n is out of range).
cfg_nproper: Number of blocks belonging to the function’s own range.
cfg_nsucc: Number of successors of block n (0 when n is out of range).
cfg_pred: The i-th predecessor block index of block n; Err when n/i is out of range.
cfg_preds: The whole predecessor edge list of block n as one owned Vec<u32>; Err when n is out of range.
cfg_succ: The i-th successor block index of block n; Err when n/i is out of range.
cfg_succs: The whole successor edge list of block n as one owned Vec<u32>; Err when n is out of range.
cfunc_counts: Statement, expression, and call-site counts of cf’s ctree.
cfunc_expr_gap: The extraction-fidelity diagnostic for cf: total expressions the SDK visitor sees vs how many the extraction walker should materialize.
cfunc_pseudocode: The rendered pseudocode of cf, tags stripped; Err if the SDK cannot produce it.
cfunc_refresh_text: Re-print cf’s pseudocode from its current ctree (refresh_func_ctext), then return it; Err if the SDK cannot produce it. Cheap compared to a re-decompile, since it walks the already-decompiled ctree, but reflects only what the ctree already encodes (a rename resolves fresh; a structural or type change needs a fresh decompile).
cfunc_walk_ctree^⚠: Walk cfunc’s ctree, minting nodes and locals through nodes and node types through the tinfo walker whose pointer is passed as an integer address in type_visitor (cxx has no c_void; the C++ side reinterprets it back to void* for the shared type walker). Returns the root statement handle.
clear_cached_cfuncs: Evict every cached decompilation; a no-op if the decompiler is not initialized.
clear_type: Clear any type applied at ea. Idempotent: code is TYPE_OK when there was nothing to clear; reason is empty (no error channel).
close_database^⚠: Close the current database, saving it first when save is set.
cm_cc_ids: This SDK’s CM_CC_* values in idakit CallingConvention’s discriminant order, an alignment source pinning the Rust mirror to this SDK build in a test. Emitted in the raw pre-shifted high-nibble space the SDK stores them in (CM_CC_CDECL is 0x30); covers only the modelled plain conventions.
cref_type_ids: This SDK’s cref_t (fl_*) values in idakit CodeXref’s discriminant order, an alignment source pinning the Rust mirror to this SDK build in a test.
decode_insn: Decode the instruction at ea, folding raw operands into semantic kinds with resolved register names and control-flow facts. Infallible at the boundary: the result code lands in InstructionData::status rather than throwing, since the -3/-4 failures carry structured payloads.
decompile: Decompile the function at ea into a heap cfuncptr_t owned by a UniquePtr (one owned ref); Err on any decompile failure. Wrapped in the facade trap, so a fatal exit() surfaces as a trapped Err the caller distinguishes via its own trap query. The UniquePtr’s cxx deleter runs ~cfuncptr_t (release()) on drop.
define_type: Parse the C declaration(s) in input into the local til. code is the parse-error count (0 = ok).
delete_type: Delete the named type type_name from the local til, the inverse of define_type. See the TEDIT_* codes.
demangle_name: Fully demangled form of name; Err when name is not mangled.
dref_type_ids: This SDK’s dref_t (dr_*) values in idakit DataXref’s discriminant order, an alignment source for a mirror test.
enable_console_messages^⚠: Enable or disable idalib’s console message output.
enum_add_member: Add an enum constant named member_name with value to the named enum type_name, in the explicit bitmask group bmask (DEFMASK64 lets a bitmask enum use value itself as the group mask; ignored by an ordinary enum), passing etf_flags (etf_flag_t, e.g. ETF_FORCENAME) to add_edm. Same TEDIT_* codes as the udt_* fns.
enum_del_member: Delete the enum constant member_name from the named enum type_name.
enum_del_member_by_value: Delete the enum constant carrying value from the named enum type_name (tinfo_t::del_edm_by_value), the value-keyed sibling of enum_del_member. Uses the default bitmask (DEFMASK64) and serial (0), so it targets the plain value match, not a specific bitmask group or serial. TERR_NOT_FOUND (TypeEditCode::NotFound) when no constant carries value.
enum_rename_member: Rename the enum constant member_name in the named enum type_name to new_name, passing etf_flags (etf_flag_t, e.g. ETF_FORCENAME) to rename_edm.
enum_set_bitmask: Set whether the named enum type_name is a bitmask (flag) enum (tinfo_t::set_enum_is_bitmask). Same TEDIT_* codes as the udt_*/enum_* fns.
enum_set_member_value: Set the value of the enum constant member_name in the named enum type_name.
enum_set_repr: Set the value representation on the named enum type_name (tinfo_t::set_enum_repr), the enum-level twin of udt_set_member_repr. vtype is a value_repr_t FRB_* value-type nibble; is_signed/leading_zeros set FRB_SIGNED/FRB_LZERO.
enum_set_width: Set the storage width in bytes of the named enum type_name’s underlying type (tinfo_t::set_enum_width); 0 means unspecified.
export_ea: Address of export idx, or BADADDR when the export is a pure forwarder.
export_forwarder: Forwarder target of export idx; Err when it has none (most exports do not).
export_name: Name of export idx; Err when it has none.
export_ordinal: Ordinal of export idx.
export_qty: Number of exported entry points in the database (get_entry_qty).
file_type_name: Human-readable input file format text; Err when unavailable.
forward_declare_type: Reserve type_name in the local til as an incomplete aggregate (tinfo_t::create_forward_decl), without a body. decl_type is a type_t (BTF_STRUCT/BTF_UNION/BTF_ENUM) selecting the aggregate kind. code is the raw tinfo_code_t (0 = ok); no TEDIT_* pre-failure, since there is no existing type to load first.
frb_vtype_ids: This SDK’s FRB_* value-type nibbles in idakit NumberFormat’s discriminant order, an alignment source for a mirror test. Covers only the modelled non-info-carrying subset.
func_bitness: Addressing width in bits of the function at ea: 16, 32, or 64, or 0 when not a function.
func_chunk_qty: Number of chunks (entry plus tails) of the function at ea, or 0.
func_cmt: Comment of the function at ea (repeatable if repeatable); Err when there is none.
func_does_return: Whether the function at callee is known to return (func_does_return).
func_ea: Entry address of the n-th function, or BADADDR when n is out of range.
func_end: Entry-chunk end address of the function at ea, or BADADDR when not a function.
func_flags: func_t::flags of the function at ea, or 0 when ea is not a function.
func_name: Name of the function at ea; Err when it has none.
func_prepend_this: Insert an implicit this parameter of the recipe type at index 0, then rebuild and re-apply.
func_qty: Number of functions in the database (get_func_qty).
func_rename_arg: Rename parameter idx to name, then rebuild and re-apply. arity reports the current parameter count; SIG_ARG_RANGE when idx is past it.
func_set_argtype: Replace parameter idx’s type with the recipe type, then rebuild and re-apply. arity reports the current parameter count; SIG_ARG_RANGE when idx is past it.
func_set_cc: Set the calling convention of the function type at ea to the raw CM_CC_* code cc, then rebuild and re-apply.
func_set_rettype: Replace the return type of the function type at ea with the recipe type, then rebuild and re-apply. See the SIG_* codes.
func_start: Entry address of the function containing ea, or BADADDR when there is none.
func_type: The prototype of the function at ea (one line, PRTYPE_1LINE); Err when it has no type.
gen_seg_align: Alignment code (sa*) of segment n, or 0 when n is out of range.
gen_seg_at: Index of the segment containing ea, or -1 when none does (get_segm_num).
gen_seg_bitness: Address bits (16/32/64) of segment n, or 0 when out of range.
gen_seg_class: Class of segment n; Err when n is out of range or has no class.
gen_seg_cmt: Comment of segment n (repeatable selects the repeatable channel); Err when n is out of range.
gen_seg_color: Background color (bgcolor_t) of segment n, or DEFCOLOR when n is out of range.
gen_seg_comb: Combination code (sc*) of segment n, or 0 when n is out of range.
gen_seg_end: End address of segment n, or BADADDR when n is out of range.
gen_seg_flags: Flag bits (SFL_*) of segment n, or 0 when n is out of range.
gen_seg_name: Visible name of segment n; Err when n is out of range.
gen_seg_perm: Permission bits (SEGPERM_*) of segment n, or 0 when out of range.
gen_seg_qty: Number of segments in the current database (get_segm_qty).
gen_seg_sel: Selector (sel_t) of segment n, or BADSEL when n is out of range.
gen_seg_start: Start address of segment n, or BADADDR when n is out of range.
gen_seg_type: Segment type code (SEG_*) of segment n, or SEG_NORM when n is out of range.
get_bytes: The size bytes at ea as an owned Vec<u8>; Err when the range is not fully mapped.
get_bytes_into^⚠: Read size bytes starting at address into buf; returns the count read, or negative on failure.
get_cmt: The regular (or repeatable, when rptble) comment at ea; Err when there is none.
get_ea_name: Name at address ea; Err when the address has none.
get_ea_name_flags: Name at address ea under gtn_flags (GN_* bits); Err when the address has none.
get_flags: Flag word of the item at ea (get_flags).
get_item_end: Address just past the item covering ea (get_item_end).
get_item_head: Start address of the item covering ea (ea itself when it is an item head).
get_library_version^⚠: Read the running IDA’s version into major/minor/build; returns whether it succeeded.
get_name_ea: Address the symbol name resolves to, or BADADDR when it is unknown.
get_next_head: Next item head after ea, searching up to maxea, or BADADDR when none.
get_prev_head: Previous item head before ea, searching down to minea, or BADADDR when none.
get_qerrno^⚠: The calling thread’s last error_t code.
get_strlit: The auto-detected string literal at ea (given its STRTYPE) decoded to UTF-8; Err when there is none or it cannot be decoded.
get_u8: The byte at ea; Err when it is uninitialized.
get_u16: The little-endian word at ea; Err when any covered byte is uninitialized.
get_u32: The little-endian dword at ea; Err when any covered byte is uninitialized.
get_u64: The little-endian qword at ea; Err when any covered byte is uninitialized.
guarded_auto_wait^⚠: Guarded auto_wait, trapped against a fatal exit/abort; returns its rc.
guarded_close^⚠: Guarded close_database, trapped against a fatal exit/abort; returns its rc.
guarded_open^⚠: Guarded open_database: same signature and rc, trapped against a fatal exit/abort.
has_auto_name: Whether a flags word marks an IDA-generated (auto) name.
has_cached_cfunc: Whether ea has a cached decompilation; false if none or not initialized.
has_dummy_name: Whether a flags word marks a dummy (address-derived) name.
has_external_refs: Whether ea has a reference from outside the function that contains it; false when ea is not inside any function.
has_jump_or_flow_xref: Whether ea has an incoming jump or ordinary-flow code cross-reference.
has_user_name: Whether a flags word marks a user-given (explicit) name.
hexrays_init: Initialize the Hex-Rays decompiler (loading the plugin if needed); true once ready.
image_base: Preferred load address of the input (get_imagebase).
imports_build: The whole import table as an owned, Send snapshot, built in one walk of every module’s enum_import_names.
init_headless^⚠: Force headless (TVHEADLESS), then initialize idalib; returns its rc.
init_library^⚠: Initialize idalib. argc/argv are forwarded from the process; returns 0 on success.
input_path: Full path of the analyzed input; Err when unknown.
is_main_thread^⚠: Whether the calling thread is IDA’s main (kernel) thread.
is_public_name: Whether the name at ea is public (linker-exported).
is_weak_name: Whether the name at ea is weak (may be overridden by another definition).
last_exit_code^⚠: The process exit code the most recent guarded call trapped, if any.
last_output^⚠: Copy the most recent guarded call’s captured output into buf/cap, snprintf-style.
mark_cfunc_dirty: Evict the cached decompilation for ea; true if an entry existed, false if none or the decompiler is not initialized.
max_ea: One past the highest mapped address in the database (inf_get_max_ea).
min_ea: Lowest mapped address in the database (inf_get_min_ea).
netnode_altdel: Delete the alt value at idx under tag.
netnode_altdel_all: Delete the entire alt array under tag.
netnode_altdel_ea: Delete the alt value keyed by address ea under tag.
netnode_altdel_idx8: Delete the alt value at 8-bit index idx under tag.
netnode_altfirst: Lowest populated alt index under tag, or BADNODE when the array is empty.
netnode_altfirst_idx8: Lowest populated 8-bit alt index under tag, or BADNODE when the array is empty.
netnode_altlast: Highest populated alt index under tag, or BADNODE when the array is empty.
netnode_altlast_idx8: Highest populated 8-bit alt index under tag, or BADNODE when the array is empty.
netnode_altnext: Next populated alt index after cur under tag, or BADNODE when none.
netnode_altnext_idx8: Next populated 8-bit alt index after cur under tag, or BADNODE when none.
netnode_altprev: Previous populated alt index before cur under tag, or BADNODE when none.
netnode_altprev_idx8: Previous populated 8-bit alt index before cur under tag, or BADNODE when none.
netnode_altset: Set the alt value at idx under tag to value.
netnode_altset_ea: Set the alt value keyed by address ea under tag to value.
netnode_altset_idx8: Set the alt value at 8-bit index idx under tag to value.
netnode_altshift: Shift the alt array under tag; the number of elements moved.
netnode_altval: Alt value at idx under tag, or 0 when unset.
netnode_altval_ea: Alt value keyed by address ea under tag, or 0 when unset.
netnode_altval_idx8: Alt value at 8-bit index idx under tag, or 0 when unset.
netnode_blobshift: Shift the blob array under tag; the number of elements moved.
netnode_blobsize: Byte length of the blob based at index start under tag, or 0 when absent.
netnode_blobsize_ea: Byte length of the blob based at address ea under tag, or 0 when absent.
netnode_by_name: Resolve the netnode named name, creating it when create; the node id, or BADNODE when it is absent and create is false.
netnode_chardel: Delete the char value at idx under tag.
netnode_chardel_ea: Delete the char value keyed by address ea under tag.
netnode_chardel_idx8: Delete the char value at 8-bit index idx under tag.
netnode_charset: Set the char value at idx under tag (low 8 bits of value).
netnode_charset_ea: Set the char value keyed by address ea under tag (low 8 bits of value).
netnode_charset_idx8: Set the char value at 8-bit index idx under tag (low 8 bits of value).
netnode_charshift: Shift the char array under tag; the number of elements moved.
netnode_charval: Char value at idx under tag (0..255), or 0 when unset.
netnode_charval_ea: Char value keyed by address ea under tag (0..255), or 0 when unset.
netnode_charval_idx8: Char value at 8-bit index idx under tag (0..255), or 0 when unset.
netnode_copyto: Copy (or move, when move_) count nodes starting at node onto target; the number of nodes affected.
netnode_del_value: Delete the node value of node.
netnode_delblob: Delete the blob based at index start under tag; the number of slots freed.
netnode_exists: Whether node has any information attached (a named or non-empty node).
netnode_exists_name: Whether a netnode named name exists, without creating it.
netnode_first: Lowest-id existing netnode, or BADNODE when the database has none.
netnode_get_name: Name of node; Err when it is unnamed.
netnode_getblob: The blob based at index start under tag as owned bytes; Err when absent.
netnode_getblob_ea: The blob based at address ea under tag as owned bytes; Err when absent.
netnode_hashdel: Delete the hash value for key under tag.
netnode_hashdel_all: Delete the entire hash array under tag.
netnode_hashfirst: Lexically first hash key under tag; Err when the hash is empty.
netnode_hashlast: Lexically last hash key under tag; Err when the hash is empty.
netnode_hashnext: Hash key after key under tag; Err when key is the last.
netnode_hashprev: Hash key before key under tag; Err when key is the first.
netnode_hashset: Set the hash value for key under tag (max MAXSPECSIZE bytes); false when value is empty or over the cap, either of which the SDK cannot store.
netnode_hashset_long: Set the hash value for key under tag to the integer value.
netnode_hashstr: Hash value for key under tag as a string; Err when the key is unset.
netnode_hashval: Hash value for key under tag as raw bytes; Err when the key is unset.
netnode_hashval_long: Hash value for key under tag decoded as an integer, or 0 when unset.
netnode_kill: Delete node and every array attached to it.
netnode_last: Highest-id existing netnode, or BADNODE when the database has none.
netnode_lower_bound: Lowest populated sup index >= cur under tag, or BADNODE when none.
netnode_lower_bound_idx8: Lowest populated 8-bit sup index at or after idx under tag, or BADNODE when none.
netnode_next: Next existing netnode after cur, or BADNODE when cur is the last.
netnode_prev: Previous existing netnode before cur, or BADNODE when cur is the first.
netnode_rename: Rename node to name (empty clears the name); false when name is taken.
netnode_set_value: Set the node value of node (max MAXSPECSIZE bytes).
netnode_setblob: Store value as the blob based at index start under tag.
netnode_setblob_ea: Store value as the blob based at address ea under tag.
netnode_supdel: Delete the sup value at idx under tag.
netnode_supdel_all: Delete the entire sup array under tag.
netnode_supdel_ea: Delete the sup value keyed by address ea under tag.
netnode_supdel_idx8: Delete the sup value at 8-bit index idx under tag.
netnode_supdel_range: Delete sup elements in [idx1, idx2) under tag; the number deleted.
netnode_supfirst: Lowest populated sup index under tag, or BADNODE when the array is empty.
netnode_supfirst_idx8: Lowest populated 8-bit sup index under tag, or BADNODE when the array is empty.
netnode_suplast: Highest populated sup index under tag, or BADNODE when the array is empty.
netnode_suplast_idx8: Highest populated 8-bit sup index under tag, or BADNODE when the array is empty.
netnode_supnext: Next populated sup index after cur under tag, or BADNODE when none.
netnode_supnext_idx8: Next populated 8-bit sup index after cur under tag, or BADNODE when none.
netnode_supprev: Previous populated sup index before cur under tag, or BADNODE when none.
netnode_supprev_idx8: Previous populated 8-bit sup index before cur under tag, or BADNODE when none.
netnode_supset: Set the sup value at idx under tag (max MAXSPECSIZE bytes); false when value is empty or over the cap, either of which the SDK cannot store.
netnode_supset_ea: Set the sup value keyed by address ea under tag (max MAXSPECSIZE bytes); false when value is empty or over the cap, either of which the SDK cannot store.
netnode_supset_idx8: Set the sup value at 8-bit index idx under tag (max MAXSPECSIZE bytes); false when value is empty or over the cap, either of which the SDK cannot store.
netnode_supshift: Shift the sup array under tag; the number of elements moved.
netnode_supstr: Sup value at idx under tag as a string; Err when unset.
netnode_supstr_ea: Sup value keyed by address ea under tag as a string; Err when unset.
netnode_supstr_idx8: Sup value at 8-bit index idx under tag as a string; Err when unset.
netnode_supval: Sup value at idx under tag as raw bytes; Err when unset.
netnode_supval_ea: Sup value keyed by address ea under tag as raw bytes; Err when unset.
netnode_supval_idx8: Sup value at 8-bit index idx under tag as raw bytes; Err when unset.
netnode_value: The node value of node as raw bytes; Err when no value is set.
netnode_value_str: The node value of node as a string; Err when no value is set.
nlist_ea: Address of name-list entry idx.
nlist_name: Name of name-list entry idx; Err when idx is out of range.
nlist_size: Number of entries in the sorted name list (get_nlist_size).
op_dtype_ids: This SDK’s op_dtype_t (dt_*) values in idakit DataType’s discriminant order, an alignment source for a mirror test.
open_database^⚠: Open the database at path, optionally queuing auto-analysis (run_auto) with args forwarded to it; returns its rc.
patch_bytes: Patch bytes over ea, or false without writing when any target byte is unmapped.
proc_name: Processor module id, e.g. metapc; Err when none is set.
qstrerror^⚠: Describe an error_t. The returned pointer borrows IDA’s static/thread-local storage: it must not be freed, and a later qstrerror call on the same thread may overwrite it. Copy it into a CStr/String before the next IDA call.
range_all_chunks: Every chunk (entry plus tails) of the function at ea as one owned Vec; Err when no function is there.
range_chunk_info: Chunk n of the function at ea as a ChunkInfo; Err when n is out of range.
range_entry_chunk: Entry chunk (index 0) of the function containing ea, returned by value; Err when no function is there.
range_size: Size (end - start) of a range_t passed by value.
reg_class_ids: The facade’s RegisterClass codes in idakit’s discriminant order, an alignment source pinning the Rust mirror to this SDK build in a test.
reg_read_int^⚠: Read IDA registry integer name, or defval when unset.
rename_type: Rename the named type type_name to new_name in place, preserving its ordinal. Same TEDIT_* codes as the udt_*/enum_* fns.
root_filename: Base filename of the input; Err when unknown.
seg_align_ids: This SDK’s sa* values in idakit SegmentAlignment’s discriminant order, an alignment source for a mirror test.
seg_comb_ids: This SDK’s sc* values in idakit SegmentCombination’s discriminant order, an alignment source for a mirror test.
seg_type_ids: This SDK’s SEG_* values in idakit SegmentType’s discriminant order, an alignment source pinning the Rust mirror to this SDK build in a test.
set_batch^⚠: Set IDA’s batch global: nonzero suppresses dialogs/auto-answers prompts, zero restores interactive behavior.
set_cmt^⚠: Set the comment at address (repeatable when rptble); returns whether it succeeded.
set_name^⚠: Set address’s name to name under flags (SN_* bits); returns whether it succeeded.
strlist_build: (Re)build IDA’s string list, an O(database) scan of the whole image.
strlist_item: The n-th string-list entry as a StrlistItem; Err when n is out of range.
strlist_qty: Number of entries in the current string list (get_strlist_qty).
strlit_contents: Decode the string literal at ea (given octet length and STRTYPE) semantically (STRCONV_REPLCHAR: undecodable units become U+FFFD); Err when it cannot be read.
strlit_escaped: Decode the string literal at ea to its C-escaped display form (STRCONV_ESCAPE, as the decompiler renders it); Err when it cannot be read.
structural_tag_ctype_ids: This SDK’s ctype_t values for the structural tags idakit’s ctree extraction dispatches on, in its StructuralTag discriminant order, an alignment source for a mirror test.
tinfo_apply: Apply the built handle at ea (apply_tinfo, TINFO_DEFINITE | flags). code is TYPE_OK/_ERR_APPLY; the handle is not consumed.
tinfo_array: An nelems-element array of inner as a fresh handle. inner is copied, not consumed; a null handle when nelems exceeds u32 or the array cannot be built.
tinfo_bool: The boolean type as a fresh UniquePtr handle.
tinfo_code_ids: This SDK’s tinfo_code_t (TERR_*) values in idakit TypeEditCode’s discriminant order, an alignment source for a mirror test. Signed: every code but TERR_OK is negative. The TERR_COUNT sentinel is not a code and is absent.
tinfo_const: A const-qualified copy of inner as a fresh handle. inner is not consumed.
tinfo_decl: The type decl parses to against the local til, as a fresh handle; Err (with the captured parse diagnostic) on a parse failure.
tinfo_float: A bytes-wide float (4 or 8) as a fresh handle; a null handle when the width is not 4 or 8.
tinfo_int: A bytes-wide integer (1/2/4/8/16), signed when is_signed, as a fresh handle; a null handle when the width is unsupported.
tinfo_named: The named type name as a fresh handle, an unresolved typedef ref. Builds a non-null forward reference even for a name absent from the local til, so the caller checks existence separately.
tinfo_ptr: A pointer to inner as a fresh handle. inner is copied, not consumed; a null handle if the pointer type cannot be built.
tinfo_void: The void type as a fresh UniquePtr handle, freed by the cxx deleter (~tinfo_t) on drop.
tinfo_volatile: A volatile-qualified copy of inner as a fresh handle. inner is not consumed.
type_name_at: Name of the local type at ordinal (empty for an anonymous type); Err when the ordinal holds no type.
type_ordinal_limit: Exclusive upper bound on local-type ordinals: valid ordinals run 1..limit.
udt_add_member: Add a member of the recipe type to the named struct/union type_name at bit offset member_bit (or appended when it is MEMBER_APPEND). An empty member_name adds an anonymous member. See the TEDIT_* codes.
udt_del_member: Delete the member selected by member_name (or, when it is empty, by bit offset member_bit) from type_name.
udt_rename_member: Rename the member selected by member_name (or, when it is empty, by bit offset member_bit) in type_name to new_name.
udt_set_member_comment: Set the comment on the member selected by member_name (or, when it is empty, by bit offset member_bit) in type_name to comment, a plain member comment (is_regcmt=false).
udt_set_member_repr: Set the value representation on the member selected by member_name (or, when it is empty, by bit offset member_bit) in type_name. vtype is a value_repr_t FRB_* value-type nibble; is_signed/leading_zeros set FRB_SIGNED/FRB_LZERO.
udt_set_member_type: Replace the type of the member selected by member_name (or, when it is empty, by bit offset member_bit) in type_name with the recipe type, passing etf_flags (etf_flag_t, e.g. ETF_COMPATIBLE) to set_udm_type.
unop_ctype_ids: This SDK’s ctype_t values in idakit UnaryOp’s discriminant order, an alignment source for a mirror test.
walk_frame_type: Walk the stack frame of the function at ea, interning each variable’s type into sink.
walk_func_type: Walk the prototype of the function at ea into sink; the function-address twin of walk_type_named. None when the function has no type info.
walk_type_named: Walk the local type named name into sink via the cxx opaque visitor; returns the root handle, or None when no such type exists (or a name was not valid UTF-8, surfaced as a thrown Err).
walk_type_ordinal: Walk the local type at ordinal into sink; the ordinal twin of walk_type_named.
was_trapped^⚠: Whether the most recent guarded call trapped a fatal exit/abort.
xrefs_build: Every cross-reference edge at ea as an owned, Send snapshot: xrefs to ea when is_to, else xrefs from it. Ordinary next-instruction flow edges are included only when flow (XREF_FLOW vs XREF_NOFLOW).

Type Aliases§

Address: IDA’s effective address (ea_t), compiled __EA64__.

Crate idakit_sys

Crate idakit_sys Copy item path

§Surface

§SDK-name aliases

§Buffer conventions

§Owned handles

§License

Structs§

Enums§

Constants§

Traits§

Functions§

Type Aliases§

Crate idakit_sys