5.13 标志

定义

idaman flags_t ida_export

getFlags(ea_t ea)

含义

返回地址 ea 处设置的标志。您可能需要用它来获取地址的标志，然后将结果用于 isHead()，isCoder() 等函数。

示例

#include <kernwin.hpp> // For get_screen_ea() definition

#include <bytes.hpp>

msg("Flags for %a are %08x\n",

get_screen_ea(),

getFlags(get_screen_ea()));

定义

idaman bool ida_export

isEnabled(ea_t ea)

含义

当前反汇编文件中，地址 ea 是否存在。

示例

#include <kernwin.hpp> // For askaddr() definition

#include <bytes.hpp>

ea_t addr;

askaddr(&addr, "Address to look for:");

if (isEnabled(addr))

msg("%a found within the currently opened file(s).",

addr);

else

msg("%a was not found.\n");

定义

inline bool idaapi

isHead(flags_t F)

含义

标志 F 是否为代码或数据的开头？

示例

#include <kernwin.hpp> // For get_screen_ea() definition

#include <bytes.hpp>

ea_t addr = get_screen_ea();

// Cycle through 20 bytes from the cursor position

// printing a message if the byte is a head byte.

for (int i = 0; i < 20; i++) {

flags_t flags = getFlags(addr);

if (isHead(flags))

msg("%a is a head (flags = %08x).\n",

addr, flags);

addr++;

}

定义

inline bool idaapi

isCode(flags_t F)

含义

标志 F 是否表示指令的开头？和 isHead() 相同，但对于代码则是返回 true，数据则不会。所以，如果用在不是头字节的代码字节，将返回 false。

示例

#include <segment.hpp> // For segment functions

#include <bytes.hpp>

for (int i = 0; i < get_segm_qty(); i++) {

segment_t *seg = getnseg(i);

if (seg->type == SEG_CODE) {

// Look for any bytes in the code segment that

// aren't code.

for (ea_t a = seg->startEA; a < seg->endEA; a++) {

flags_t flags = getFlags(a);

if (isHead(flags) && !isCode(flags))

msg("Non-code at %a in segment: %s.\n",

a,

get_segm_name(seg));

}

}

}

定义

inline bool idaapi

isData(flags_t F)

含义

标志 F 是否表示一些数据的开头？和 isHead() 相同，但对于数据则是返回 true，代码则不会。所以，如果用在不是头字节的数据字节，将返回 false。

示例

#include <segment.hpp> // For segment functions

#include <bytes.hpp>

for (int i = 0; i < get_segm_qty(); i++) {

segment_t *seg = getnseg(i);

if (seg->type == SEG_DATA) {

// Look for any bytes in the data segment that

// aren't data (possibly code).

for (ea_t a = seg->startEA; a < seg->endEA; a++) {

flags_t flags = getFlags(a);

if (isHead(flags) && !isData(flags))

msg("Non-data at %a in segment: %s.\n",

a,

get_segm_name(seg));

}

}

}

定义

inline bool idaapi

isUnknown(flags_t F)

含义

标志 F 是否为 IDA 没有成功分析出的一个字节？

示例

#include <segment.hpp> // For segment functions

#include <bytes.hpp>

// Loop through every segment

for (int i = 0; i < get_segm_qty(); i++) {

segment_t *seg = getnseg(i);

// Look for any unexplored bytes in this segment

for (ea_t a = seg->startEA; a < seg->endEA; a++) {

flags_t flags = getFlags(a);

if (isUnknown(flags))

msg("Unknown bytes at %a in segment: %s.\n",

a,

get_segm_name(seg));

}

}