| IDA SDK

Classes | Functions | Macros | Typedefs
fixup.hpp File Reference

## Detailed Description

Functions that deal with fixup information.

A loader should setup fixup information using set_fixup().

## Classes
struct | fixup_data_t
struct | fixup_handler_t
| Implements the core behavior of a custom fixup. More...
struct | fixup_info_t
| Collect fixup records for the specified range. More...

## Functions
THREAD_SAFE bool | is_fixup_custom (fixup_type_t type)
| Is fixup processed by processor module?
idaman bool ida_export | get_fixup (fixup_data_t *fd, ea_t source)
| Get fixup information.
bool | exists_fixup (ea_t source)
| Check that a fixup exists at the given address.
idaman void ida_export | set_fixup (ea_t source, const fixup_data_t &fd)
| Set fixup information. More...
idaman void ida_export | del_fixup (ea_t source)
| Delete fixup information.
idaman const fixup_handler_t *ida_export | get_fixup_handler (fixup_type_t type)
| Get handler of standard or custom fixup.
idaman bool ida_export | apply_fixup (ea_t item_ea, ea_t fixup_ea, int n, bool is_macro)
| Use fixup information for an address. More...
idaman uval_t ida_export | get_fixup_value (ea_t ea, fixup_type_t type)
| Get the operand value. More...
idaman bool ida_export | patch_fixup_value (ea_t ea, const fixup_data_t &fd)
| Patch the fixup bytes. More...
idaman const char *ida_export | get_fixup_desc (qstring *buf, ea_t source, const fixup_data_t &fd)
| Get FIXUP description comment.
idaman int ida_export | calc_fixup_size (fixup_type_t type)
| Calculate size of fixup in bytes (the number of bytes the fixup patches) More...
idaman bool ida_export | get_fixups (fixups_t *out, ea_t ea, asize_t size)
bool | contains_fixups (ea_t ea, asize_t size)
| Does the specified address range contain any fixup information?
idaman void ida_export | gen_fix_fixups (ea_t from, ea_t to, asize_t size)
| Relocate the bytes with fixup information once more (generic function). More...
idaman bool ida_export | handle_fixups_in_macro (refinfo_t *ri, ea_t ea, fixup_type_t other, uint32 macro_reft_and_flags)
| Handle two fixups in a macro. More...
Enumerate addresses with fixup information:
Get the first address with fixup information Returns the first address with fixup information, or BADADDR
idaman ea_t ida_export | get_first_fixup_ea (void)
idaman ea_t ida_export | get_next_fixup_ea (ea_t ea)
| Find next address with fixup information. More...
idaman ea_t ida_export | get_prev_fixup_ea (ea_t ea)
| Find previous address with fixup information. More...
std_get_value()
This internal function takes Tuning options to determine how to get the operand value. It is opposite in meaning to the std_patch_value(). 1) it gets the fixup_handler_t::size bytes at the given address, 2) it shifts the result left by fixup_handler_t::shift bits, 3) it returns the rightmost fixup_handler_t::width bits as a signed value. In details: b) size = 4, width = 28, shift = 2 it gets 4 bytes from the fixup address (the branch insn) then it shifts this dword left by 2 bits (shift=2) then the result is masked with 0xFFFFFFF (width=28) e.g. 0x10000017 the insn 0x4000005C the unshifted value 0x0000005C the masked result
idaman fixup_type_t ida_export | register_custom_fixup (const fixup_handler_t *cfh)
| Register a new custom fixup. More...
idaman bool ida_export | unregister_custom_fixup (fixup_type_t type)
| Unregister a new custom fixup format. More...
idaman fixup_type_t ida_export | find_custom_fixup (const char *name)
| Get id of a custom fixup handler. More...

## Macros
#define | FIXUPF_REL 0x0001
| fixup is relative to the linear address `base`. More...
#define | FIXUPF_EXTDEF 0x0002
| target is a location (otherwise - segment). More...
#define | FIXUPF_UNUSED 0x0004
| fixup is ignored by IDA More...
#define | FIXUPF_CREATED 0x0008
| fixup was not present in the input file
#define | FIXUPF_LOADER_MASK 0xF0000000
| additional flags. More...
#define | FHF_VERIFY 0x0001
| verify that the value fits into WIDTH bits. More...
#define | FHF_CODE 0x0002
| verify that ITEM_EA in std_apply() points to an instruction. More...
#define | FHF_FORCE_CODE 0x0004
| if ITEM_EA in std_apply() points to an unknown item, then convert it to code. More...
#define | FHF_ABS_OPVAL 0x0008
| create absolute refinfo in std_apply() because the operand also has the absolute value (usually for o_near operands)
#define | FHF_SIGNED 0x0010
| the operand value is signed. More...
Fixup standard types
#define | FIXUP_OFF8 13
| 8-bit offset
#define | FIXUP_OFF16 1
| 16-bit offset
#define | FIXUP_SEG16 2
| 16-bit base–logical segment base (selector)
#define | FIXUP_PTR16 3
| 32-bit long pointer (16-bit base:16-bit offset)
#define | FIXUP_OFF32 4
| 32-bit offset
#define | FIXUP_PTR32 5
| 48-bit pointer (16-bit base:32-bit offset)
#define | FIXUP_HI8 6
| high 8 bits of 16bit offset
#define | FIXUP_HI16 7
| high 16 bits of 32bit offset
#define | FIXUP_LOW8 8
| low 8 bits of 16bit offset
#define | FIXUP_LOW16 9
| low 16 bits of 32bit offset
#define | V695_FIXUP_VHIGH 10
| obsolete
#define | V695_FIXUP_VLOW 11
| obsolete
#define | FIXUP_OFF64 12
| 64-bit offset
#define | FIXUP_OFF8S 14
| 8-bit signed offset
#define | FIXUP_OFF16S 15
| 16-bit signed offset
#define | FIXUP_OFF32S 16
| 32-bit signed offset
#define | FIXUP_CUSTOM 0x8000
| start of the custom types range

## Typedefs
typedef uint16 | fixup_type_t
| Fixup information structure. More...
typedef qvector< fixup_info_t > | fixups_t

## Typedef Documentation

## ◆ fixup_type_t

typedef uint16 fixup_type_t

Fixup information structure.

see Types of fixups

## Function Documentation

## ◆ set_fixup()

idaman void ida_export set_fixup | ( | ea_t | source,
|  | const fixup_data_t & | fd
| ) |  |

Set fixup information.

You should fill fixup_data_t and call this function and the kernel will remember information in the database.

Parameters

  source | the fixup source address, i.e. the address modified by the fixup
  fd | fixup data

## ◆ get_next_fixup_ea()

idaman ea_t ida_export get_next_fixup_ea | ( | ea_t | ea | ) |

Find next address with fixup information.

Parameters

  ea | current address

Returns
  the next address with fixup information, or BADADDR

## ◆ get_prev_fixup_ea()

idaman ea_t ida_export get_prev_fixup_ea | ( | ea_t | ea | ) |

Find previous address with fixup information.

Parameters

  ea | current address

Returns
  the previous address with fixup information, or BADADDR

## ◆ apply_fixup()

idaman bool ida_export apply_fixup | ( | ea_t | item_ea,
|  | ea_t | fixup_ea,
|  | int | n,
|  | bool | is_macro
| ) |  |

Use fixup information for an address.

This function converts item_ea flags to offsets/segments. For undefined bytes, you may set item_ea == fixup_ea. In this case this function will create an item (byte, word, dword) there.

Parameters

  item_ea | start address of item to modify
  fixup_ea | address of fixup record
  n | 0..UA_MAXOP-1 operand number, OPND_ALL one of the operands
  is_macro | is the instruction at 'item_ea' a macro? if yes, then partial fixups (HIGH, LOW) won't be applied

Return values

  false | no fixup at fixup_ea or it has FIXUPF_UNUSED flag
  true | ok, the fixup information was applied

## ◆ get_fixup_value()

idaman uval_t ida_export get_fixup_value | ( | ea_t | ea,
|  | fixup_type_t | type
| ) |  |

Get the operand value.

This function get fixup bytes from data or an instruction at `ea` and convert them to the operand value (maybe partially). It is opposite in meaning to the `patch_fixup_value()`. For example, FIXUP_HI8 read a byte at `ea` and shifts it left by 8 bits, or AArch64's custom fixup BRANCH26 get low 26 bits of the insn at `ea` and shifts it left by 2 bits. This function is mainly used to get a relocation addend.

Parameters

  ea | address to get fixup bytes from, the size of the fixup bytes depends on the fixup type.

See also
  fixup_handler_t::size

Parameters

  type | fixup type

Return values

  operand | value

## ◆ patch_fixup_value()

idaman bool ida_export patch_fixup_value | ( | ea_t | ea,
|  | const fixup_data_t & | fd
| ) |  |

Patch the fixup bytes.

This function updates data or an instruction at `ea` to the fixup bytes. For example, FIXUP_HI8 updates a byte at `ea` to the high byte of `fd->off`, or AArch64's custom fixup BRANCH26 updates low 26 bits of the insn at `ea` to the value of `fd->off` shifted right by 2.

Parameters

  ea | address where data are changed, the size of the changed data depends on the fixup type.

See also
  fixup_handler_t::size

Parameters

  fd | fixup data

Return values

  false | the fixup bytes do not fit (e.g. `fd->off` is greater than 0xFFFFFFC for BRANCH26). The database is changed even in this case.

## ◆ calc_fixup_size()

idaman int ida_export calc_fixup_size | ( | fixup_type_t | type | ) |

Calculate size of fixup in bytes (the number of bytes the fixup patches)

Return values

  -1 | means error

## ◆ register_custom_fixup()

idaman fixup_type_t ida_export register_custom_fixup | ( | const fixup_handler_t * | cfh | ) |

Register a new custom fixup.

This function must be called by a processor module or plugin, but not by a file loader. File loaders should use find_custom_fixup() function to find the handler created by the processor module.

Returns
  id of the new custom fixup handler with FIXUP_CUSTOM bit set or 0 (e.g. when the custom fixup handler with the same name was already registered).

## ◆ unregister_custom_fixup()

idaman bool ida_export unregister_custom_fixup | ( | fixup_type_t | type | ) |

Unregister a new custom fixup format.

Should be called by the processor module before the database gets closed.

## ◆ find_custom_fixup()

idaman fixup_type_t ida_export find_custom_fixup | ( | const char * | name | ) |

Get id of a custom fixup handler.

Parameters

  name | name of the custom fixup handler

Returns
  id with FIXUP_CUSTOM bit set or 0

## ◆ gen_fix_fixups()

idaman void ida_export gen_fix_fixups | ( | ea_t | from,
|  | ea_t | to,
|  | asize_t | size
| ) |  |

Relocate the bytes with fixup information once more (generic function).

This function may be called from loader_t::move_segm() if it suits the goal. If loader_t::move_segm is not defined then this function will be called automatically when moving segments or rebasing the entire program. Special parameter values (from = BADADDR, size = 0, to = delta) are used when the function is called from rebase_program(delta).

## ◆ handle_fixups_in_macro()

idaman bool ida_export handle_fixups_in_macro | ( | refinfo_t * | ri,
|  | ea_t | ea,
|  | fixup_type_t | other,
|  | uint32 | macro_reft_and_flags
| ) |  |

Handle two fixups in a macro.

We often combine two instruction that load parts of a value into one macro instruction. For example:

ARM: ADRP X0, #var@PAGE
ADD X0, X0, #var@PAGEOFF --> ADRL X0, var
MIPS: lui $v0, %hi(var)
addiu $v0, $v0, %lo(var) --> la $v0, var

When applying the fixups that fall inside such a macro, we should convert them to one refinfo. This function does exactly that. It should be called from the apply() callback of a custom fixup.

Returns
  success ('false' means that RI was not changed)