Skip to content

AutoAnalysis

auto_analysis

Classes:

  • AutoAnalysis –

    Provides access to IDA's auto-analysis engine.

AutoAnalysis 

AutoAnalysis(database: Database)

Bases: DatabaseEntity

Provides access to IDA's auto-analysis engine.

Auto-analysis is queue based: the scheduling methods only insert work into the analysis queues and return immediately. When IDA runs as a library there is no background analysis thread, so the queues are processed synchronously inside wait() / wait_range() and is_idle() only becomes True after such a call drains them. When running inside the IDA GUI, the queues are also processed during the main loop idle time.

Parameters:

  • database (Database) –

    Reference to the active IDA database.

Methods:

  • cancel –

    Remove pending analysis work for the given range from the queues.

  • is_idle –

    Check whether all analysis queues are empty.

  • revert_decisions –

    Delete all analysis info that IDA generated for the given range.

  • schedule –

    Queue an address for (re)analysis.

  • schedule_code –

    Queue an address to be converted to code.

  • schedule_function –

    Queue an address to be converted to code and become a function.

  • schedule_range –

    Queue an address range for (re)analysis.

  • wait –

    Process all analysis queues and block until they are empty.

  • wait_range –

    Process all analysis queues for the given range and block until no

Attributes:

  • database (Database) –

    Get the database reference, guaranteed to be non-None when called from

  • enabled (bool) –

    Whether the auto-analyzer is enabled.

  • m_database –

database property 

database: Database

Get the database reference, guaranteed to be non-None when called from methods decorated with @check_db_open.

Returns:

  • Database –

    The active database instance.

Note

This property should only be used in methods decorated with @check_db_open, which ensures m_database is not None.

enabled property writable 

enabled: bool

Whether the auto-analyzer is enabled.

Note

This is only relevant when running inside the IDA GUI, where it stops the analyzer from processing the queues during the main loop idle time (e.g. around bulk modifications). In library (idalib) mode the queues are only ever processed by an explicit wait() / wait_range() call, and those process pending work regardless of this setting.

m_database instance-attribute 

m_database = database

cancel 

cancel(start_ea: ea_t, end_ea: ea_t) -> None

Remove pending analysis work for the given range from the queues.

Parameters:

  • start_ea (ea_t) –

    Start address of the range.

  • end_ea (ea_t) –

    End address of the range (exclusive).

Raises:

  • InvalidEAError –

    If an effective address is not in the database range.

  • InvalidParameterError –

    If start_ea is not less than end_ea.

is_idle 

is_idle() -> bool

Check whether all analysis queues are empty.

Returns:

  • bool –

    True if auto-analysis has finished (no pending work), False if

  • bool –

    analysis work is still queued. Note that in library mode pending

  • bool –

    work is only processed inside wait() / wait_range().

revert_decisions 

revert_decisions(start_ea: ea_t, end_ea: ea_t) -> None

Delete all analysis info that IDA generated for the given range.

Parameters:

  • start_ea (ea_t) –

    Start address of the range.

  • end_ea (ea_t) –

    End address of the range (exclusive).

Raises:

  • InvalidEAError –

    If an effective address is not in the database range.

  • InvalidParameterError –

    If start_ea is not less than end_ea.

schedule 

schedule(ea: ea_t) -> None

Queue an address for (re)analysis.

Parameters:

  • ea (ea_t) –

    The effective address to analyze.

Raises:

  • InvalidEAError –

    If the effective address is not in the database range.

schedule_code 

schedule_code(ea: ea_t) -> None

Queue an address to be converted to code.

Parameters:

  • ea (ea_t) –

    The effective address to convert.

Raises:

  • InvalidEAError –

    If the effective address is not in the database range.

schedule_function 

schedule_function(ea: ea_t) -> None

Queue an address to be converted to code and become a function.

Parameters:

  • ea (ea_t) –

    The effective address of the future function entry point.

Raises:

  • InvalidEAError –

    If the effective address is not in the database range.

schedule_range 

schedule_range(start_ea: ea_t, end_ea: ea_t) -> None

Queue an address range for (re)analysis.

Parameters:

  • start_ea (ea_t) –

    Start address of the range.

  • end_ea (ea_t) –

    End address of the range (exclusive).

Raises:

  • InvalidEAError –

    If an effective address is not in the database range.

  • InvalidParameterError –

    If start_ea is not less than end_ea.

wait 

wait() -> bool

Process all analysis queues and block until they are empty.

Returns:

  • bool –

    True if analysis completed, False if it was interrupted.

wait_range 

wait_range(start_ea: ea_t, end_ea: ea_t) -> int

Process all analysis queues for the given range and block until no pending work remains inside it.

Parameters:

  • start_ea (ea_t) –

    Start address of the range.

  • end_ea (ea_t) –

    End address of the range (exclusive).

Returns:

  • int –

    Number of analysis steps performed, or -1 if the user cancelled.

Raises:

  • InvalidEAError –

    If an effective address is not in the database range.

  • InvalidParameterError –

    If start_ea is not less than end_ea.