| IDA SDK

Enumerations
idb_event Namespace Reference

## Detailed Description

IDB event group.

Some events are still in the processor group, so you will need to hook to both groups. These events do not return anything.

The callback function should return 0 but the kernel won't check it. Use the hook_to_notification_point() function to install your callback.

## Enumerations
enum | event_code_t { closebase , savebase , upgraded , auto_empty , auto_empty_finally , determined_main , extlang_changed , idasgn_loaded , kernel_config_loaded , loader_finished , flow_chart_created , compiler_changed , changing_ti , ti_changed , changing_op_ti , op_ti_changed , changing_op_type , op_type_changed , segm_added , deleting_segm , segm_deleted , changing_segm_start , segm_start_changed , changing_segm_end , segm_end_changed , changing_segm_name , segm_name_changed , changing_segm_class , segm_class_changed , segm_attrs_updated , segm_moved , allsegs_moved , func_added , func_updated , set_func_start , set_func_end , deleting_func , frame_deleted , thunk_func_created , func_tail_appended , deleting_func_tail , func_tail_deleted , tail_owner_changed , func_noret_changed , stkpnts_changed , updating_tryblks , tryblks_updated , deleting_tryblks , sgr_changed , make_code , make_data , destroyed_items , renamed , byte_patched , changing_cmt , cmt_changed , changing_range_cmt , range_cmt_changed , extra_cmt_changed , item_color_changed , callee_addr_changed , bookmark_changed , sgr_deleted , adding_segm , func_deleted , dirtree_mkdir , dirtree_rmdir , dirtree_link , dirtree_move , dirtree_rank , dirtree_rminode , dirtree_segm_moved , local_types_changed , lt_udm_created , lt_udm_deleted , lt_udm_renamed , lt_udm_changed , lt_udt_expanded , frame_created , frame_udm_created , frame_udm_deleted , frame_udm_renamed , frame_udm_changed , frame_expanded , idasgn_matched_ea , lt_edm_created , lt_edm_deleted , lt_edm_renamed , lt_edm_changed }
| IDB event codes. More...

## Enumeration Type Documentation

## ◆ event_code_t

enum idb_event::event_code_t

IDB event codes.

Enumerator
closebase | The database will be closed now.
savebase | The database is being saved.
  upgraded | The database has been upgraded and the receiver can upgrade its info as well. Parameters
  from | (int) - old IDB version
auto_empty | Info: all analysis queues are empty. This callback is called once when the initial analysis is finished. If the queue is not empty upon the return from this callback, it will be called later again.
auto_empty_finally | Info: all analysis queues are empty definitively. This callback is called only once.
  determined_main | The main() function has been determined. Parameters
  main | (::ea_t) address of the main() function
  extlang_changed | The list of extlangs or the default extlang was changed. Parameters
  kind | (int) 0: extlang installed 1: extlang removed 2: default extlang changed
  el | (extlang_t *) pointer to the extlang affected
  idx | (int) extlang index
  idasgn_loaded | FLIRT signature has been loaded for normal processing (not for recognition of startup sequences). Parameters
  short_sig_name | (const char *)
  kernel_config_loaded | This event is issued when ida.cfg is parsed. Parameters
  pass_number | (int)
  loader_finished | External file loader finished its work. Use this event to augment the existing loader functionality. Parameters
  li | (linput_t *)
  neflags | (uint16) Load file flags
  filetypename | (const char *)
  flow_chart_created | Gui has retrieved a function flow chart. Plugins may modify the flow chart in this callback. Parameters
  fc | (qflow_chart_t *)
  compiler_changed | The kernel has changed the compiler information. ( idainfo::cc structure; get_abi_name) Parameters
  adjust_inf_fields | (::bool) may change inf fields?
  changing_ti | An item typestring (c/c++ prototype) is to be changed. Parameters
  ea | (::ea_t)
  new_type | (const type_t *)
  new_fnames | (const p_list *)
  ti_changed | An item typestring (c/c++ prototype) has been changed. Parameters
  ea | (::ea_t)
  type | (const type_t *)
  fnames | (const p_list *)
  changing_op_ti | An operand typestring (c/c++ prototype) is to be changed. Parameters
  ea | (::ea_t)
  n | (int)
  new_type | (const type_t *)
  new_fnames | (const p_list *)
  op_ti_changed | An operand typestring (c/c++ prototype) has been changed. Parameters
  ea | (::ea_t)
  n | (int)
  type | (const type_t *)
  fnames | (const p_list *)
  changing_op_type | An operand type (offset, hex, etc...) is to be changed. Parameters
  ea | (::ea_t)
  n | (int) eventually or'ed with OPND_OUTER or OPND_ALL
  opinfo | (const opinfo_t *) additional operand info
  op_type_changed | An operand type (offset, hex, etc...) has been set or deleted. Parameters
  ea | (::ea_t)
  n | (int) eventually or'ed with OPND_OUTER or OPND_ALL
  segm_added | A new segment has been created. Parameters
  s | (segment_t *) See also adding_segm
  deleting_segm | A segment is to be deleted. Parameters
  start_ea | (::ea_t)
  segm_deleted | A segment has been deleted. Parameters
  start_ea | (::ea_t)
  end_ea | (::ea_t)
  flags | (int)
  changing_segm_start | Segment start address is to be changed. Parameters
  s | (segment_t *)
  new_start | (::ea_t)
  segmod_flags | (int)
  segm_start_changed | Segment start address has been changed. Parameters
  s | (segment_t *)
  oldstart | (::ea_t)
  changing_segm_end | Segment end address is to be changed. Parameters
  s | (segment_t *)
  new_end | (::ea_t)
  segmod_flags | (int)
  segm_end_changed | Segment end address has been changed. Parameters
  s | (segment_t *)
  oldend | (::ea_t)
  changing_segm_name | Segment name is being changed. Parameters
  s | (segment_t *)
  oldname | (const char *)
  segm_name_changed | Segment name has been changed. Parameters
  s | (segment_t *)
  name | (const char *)
  changing_segm_class | Segment class is being changed. Parameters
  s | (segment_t *)
  segm_class_changed | Segment class has been changed. Parameters
  s | (segment_t *)
  sclass | (const char *)
  segm_attrs_updated | Segment attributes has been changed. Parameters
  s | (segment_t *) This event is generated for secondary segment attributes (examples: color, permissions, etc)
  segm_moved | Segment has been moved. Parameters
  from | (::ea_t)
  to | (::ea_t)
  size | (::asize_t)
  changed_netmap | (bool) See also idb_event::allsegs_moved
  allsegs_moved | Program rebasing is complete. This event is generated after series of segm_moved events Parameters
  info | (::segm_move_infos_t *)
  func_added | The kernel has added a function. Parameters
  pfn | (func_t *)
  func_updated | The kernel has updated a function. Parameters
  pfn | (func_t *)
  set_func_start | Function chunk start address will be changed. Parameters
  pfn | (func_t *)
  new_start | (::ea_t)
  set_func_end | Function chunk end address will be changed. Parameters
  pfn | (func_t *)
  new_end | (::ea_t)
  deleting_func | The kernel is about to delete a function. Parameters
  pfn | (func_t *)
  frame_deleted | The kernel has deleted a function frame. Parameters
  pfn | (func_t *) idb_event::frame_created
  thunk_func_created | A thunk bit has been set for a function. Parameters
  pfn | (func_t *)
  func_tail_appended | A function tail chunk has been appended. Parameters
  pfn | (func_t *)
  tail | (func_t *)
  deleting_func_tail | A function tail chunk is to be removed. Parameters
  pfn | (func_t *)
  tail | (const range_t *)
  func_tail_deleted | A function tail chunk has been removed. Parameters
  pfn | (func_t *)
  tail_ea | (::ea_t)
  tail_owner_changed | A tail chunk owner has been changed. Parameters
  tail | (func_t *)
  owner_func | (::ea_t)
  old_owner | (::ea_t)
  func_noret_changed | FUNC_NORET bit has been changed. Parameters
  pfn | (func_t *)
  stkpnts_changed | Stack change points have been modified. Parameters
  pfn | (func_t *)
  updating_tryblks | About to update tryblk information. Parameters
  tbv | (const ::tryblks_t *)
  tryblks_updated | Updated tryblk information. Parameters
  tbv | (const ::tryblks_t *)
  deleting_tryblks | About to delete tryblk information in given range. Parameters
  range | (const range_t *)
  sgr_changed | The kernel has changed a segment register value. Parameters
  start_ea | (::ea_t)
  end_ea | (::ea_t)
  regnum | (int)
  value | (::sel_t)
  old_value | (::sel_t)
  tag | (uchar) Segment register range tags
  make_code | An instruction is being created. Parameters
  insn | (const insn_t*)
  make_data | A data item is being created. Parameters
  ea | (::ea_t)
  flags | (flags64_t)
  tid | (tid_t)
  len | (::asize_t)
  destroyed_items | Instructions/data have been destroyed in [ea1,ea2). Parameters
  ea1 | (::ea_t)
  ea2 | (::ea_t)
  will_disable_range | (bool)
  renamed | The kernel has renamed a byte. See also the rename event Parameters
  ea | (::ea_t)
  new_name | (const char *) can be nullptr
  local_name | (bool)
  old_name | (const char *) can be nullptr
  byte_patched | A byte has been patched. Parameters
  ea | (::ea_t)
  old_value | (uint32)
  changing_cmt | An item comment is to be changed. Parameters
  ea | (::ea_t)
  repeatable_cmt | (bool)
  newcmt | (const char *)
  cmt_changed | An item comment has been changed. Parameters
  ea | (::ea_t)
  repeatable_cmt | (bool)
  changing_range_cmt | Range comment is to be changed. Parameters
  kind | (range_kind_t)
  a | (const range_t *)
  cmt | (const char *)
  repeatable | (bool)
  range_cmt_changed | Range comment has been changed. Parameters
  kind | (range_kind_t)
  a | (const range_t *)
  cmt | (const char *)
  repeatable | (bool)
  extra_cmt_changed | An extra comment has been changed. Parameters
  ea | (::ea_t)
  line_idx | (int)
  cmt | (const char *)
  item_color_changed | An item color has been changed. Parameters
  ea | (::ea_t)
  color | (bgcolor_t) if color==DEFCOLOR, the the color is deleted.
  callee_addr_changed | Callee address has been updated by the user. Parameters
  ea | (::ea_t)
  callee | (::ea_t)
  bookmark_changed | Boomarked position changed. Parameters
  index | (uint32)
  pos | (::const lochist_entry_t *)
  desc | (::const char *)
  operation | (int) 0-added, 1-updated, 2-deleted if desc==nullptr, then the bookmark was deleted.
  sgr_deleted | The kernel has deleted a segment register value. Parameters
  start_ea | (::ea_t)
  end_ea | (::ea_t)
  regnum | (int)
  adding_segm | A segment is being created. Parameters
  s | (segment_t *)
  func_deleted | A function has been deleted. Parameters
  func_ea | (::ea_t)
  dirtree_mkdir | Dirtree: a directory has been created. Parameters
  dt | (dirtree_t *)
  path | (::const char *)
  dirtree_rmdir | Dirtree: a directory has been deleted. Parameters
  dt | (dirtree_t *)
  path | (::const char *)
  dirtree_link | Dirtree: an item has been linked/unlinked. Parameters
  dt | (dirtree_t *)
  path | (::const char *)
  link | (::bool)
  dirtree_move | Dirtree: a directory or item has been moved. Parameters
  dt | (dirtree_t *)
  from | (::const char *)
  to | (::const char *)
  dirtree_rank | Dirtree: a directory or item rank has been changed. Parameters
  dt | (dirtree_t *)
  path | (::const char *)
  rank | (::size_t)
  dirtree_rminode | Dirtree: an inode became unavailable. Parameters
  dt | (dirtree_t *)
  inode | (inode_t)
  dirtree_segm_moved | Dirtree: inodes were changed due to a segment movement or a program rebasing. Parameters
  dt | (dirtree_t *)
  local_types_changed | Local types have been changed. Parameters
  ltc | (local_type_change_t)
  ordinal | (uint32) 0 means ordinal is unknown
  name | (const char *) nullptr means name is unknown
  lt_udm_created | local type udt member has been added Parameters
  udtname | (::const char *)
  udm | (::const udm_t *)
Note udm_t::offset may not be calculated yet except of the fixed udt
  lt_udm_deleted | local type udt member has been deleted Parameters
  udtname | (::const char *)
  udm_tid | (tid_t)
  udm | (::const udm_t *)
  lt_udm_renamed | local type udt member has been renamed Parameters
  udtname | (::const char *)
  udm | (::const udm_t *)
  oldname | (::const char *)
  lt_udm_changed | local type udt member has been changed Parameters
  udtname | (::const char *)
  udm_tid | (tid_t)
  udmold | (::const udm_t *)
  udmnew | (::const udm_t *)
Note udm_t::offset may not be calculated yet except of the fixed udt
  lt_udt_expanded | A structure type has been expanded/shrank. Parameters
  udtname | (::const char *)
  udm_tid | (tid_t) the gap was added/removed before this member
  delta | (::adiff_t) number of added/removed bytes
  frame_created | A function frame has been created. Parameters
  func_ea | (::ea_t) idb_event::frame_deleted
  frame_udm_created | Frame member has been added. Parameters
  func_ea | (::ea_t)
  udm | (::const udm_t *)
  frame_udm_deleted | Frame member has been deleted. Parameters
  func_ea | (::ea_t)
  udm_tid | (tid_t)
  udm | (::const udm_t *)
  frame_udm_renamed | Frame member has been renamed. Parameters
  func_ea | (::ea_t)
  udm | (::const udm_t *)
  oldname | (::const char *)
  frame_udm_changed | Frame member has been changed. Parameters
  func_ea | (::ea_t)
  udm_tid | (tid_t)
  udmold | (::const udm_t *)
  udmnew | (::const udm_t *)
  frame_expanded | A frame type has been expanded/shrank. Parameters
  func_ea | (::ea_t)
  udm_tid | (tid_t) the gap was added/removed before this member
  delta | (::adiff_t) number of added/removed bytes
  idasgn_matched_ea | A FLIRT match has been found. Parameters
  ea | (::ea_t) the matching address
  name | (::const char *) the matched name
  lib_name | (::const char *) library name extracted from signature file
  lt_edm_created | local type enum member has been added Parameters
  enumname | (::const char *)
  edm | (::const edm_t *)
  lt_edm_deleted | local type enum member has been deleted Parameters
  enumname | (::const char *)
  edm_tid | (tid_t)
  edm | (::const edm_t *)
  lt_edm_renamed | local type enum member has been renamed Parameters
  enumname | (::const char *)
  edm | (::const edm_t *)
  oldname | (::const char *)
  lt_edm_changed | local type enum member has been changed Parameters
  enumname | (::const char *)
  edm_tid | (tid_t)
  edmold | (::const edm_t *)
  edmnew | (::const edm_t *)