Skip to content

Events

Events 

Events(database: Optional[Database] = None)

Events handler class.

Provides decorators and methods for registering event handlers for various IDA Pro events. This class wraps the IDA SDK's IDB_Hooks, IDP_Hooks, and DBG_Hooks to provide a clean Python API.

Usage: events = Events(db) # or db.events()

@events.on_function_added
def handle_func_added(pfn):
    print(f"Function added at 0x{pfn.start_ea:X}")

events.hook()  # Start listening for events

Initialize the IDA Events handler.

Sets up all event handlers for IDB, IDP, and DBG events. Events are initially disabled until hook() is called.

Methods:

Attributes:

handlers instance-attribute 

handlers: Dict[str, EventHandler] = {}

hooked instance-attribute 

hooked = False

log_events instance-attribute 

log_events = False

m_database instance-attribute 

m_database = database

enable_logging 

enable_logging(enabled: bool = True)

Enable or disable event logging for debugging.

Args: enabled: True to enable logging, False to disable

hook 

hook()

Start listening for IDA events.

This creates and hooks the IDB, IDP, and DBG event handlers. Events will start being processed and callbacks will be triggered.

on_bookmark_changed 

on_bookmark_changed(
    func: Callable[[int, object, str, int], None],
)

Decorator for bookmark changed events.

Bookmarked position changed.

Args: func: Callback function that takes: - index: Bookmark index - pos: Position (lochist_entry_t) - desc: Description - operation: 0-added, 1-updated, 2-deleted

on_byte_patched 

on_byte_patched(func: Callable[[int, int], None])

Decorator for byte patched events.

A byte has been patched.

Args: func: Callback function that takes: - ea: Address - old_value: Previous byte value

on_comment_changed 

on_comment_changed(func: Callable[[int, bool], None])

Decorator for comment changed events.

An item comment has been changed.

Args: func: Callback function that takes: - ea: Address - repeatable_cmt: True if repeatable comment

on_compiler_changed 

on_compiler_changed(func: Callable[[bool], None])

Decorator for compiler changed events.

The kernel has changed the compiler information.

Args: func: Callback function that takes: - adjust_inf_fields: May change inf fields?

on_flow_chart_created 

on_flow_chart_created(func: Callable[[object], None])

Decorator for flow chart created events.

GUI has retrieved a function flow chart. Plugins may modify the flow chart in this callback.

Args: func: Callback function that takes fc (qflow_chart_t)

on_frame_created 

on_frame_created(func: Callable[[int], None])

Decorator for frame created events.

A function frame has been created.

Args: func: Callback function that takes func_ea (function address)

on_frame_expanded 

on_frame_expanded(func: Callable[[int, int, int], None])

Decorator for frame expanded events. Args: func_ea (ea_t), udm_tid (tid_t), delta (adiff_t)

on_frame_udm_changed 

on_frame_udm_changed(
    func: Callable[[int, int, object, object], None],
)

Decorator for frame user-defined member changed events. Args: func_ea (ea_t), udm_tid (tid_t), udmold (udm_t), udmnew (udm_t)

on_frame_udm_created 

on_frame_udm_created(func: Callable[[int, object], None])

Decorator for frame user-defined member created events. Args: func_ea (ea_t), udm (udm_t object)

on_frame_udm_deleted 

on_frame_udm_deleted(
    func: Callable[[int, int, object], None],
)

Decorator for frame user-defined member deleted events. Args: func_ea (ea_t), udm_tid (tid_t), udm (udm_t object)

on_frame_udm_renamed 

on_frame_udm_renamed(
    func: Callable[[int, object, str], None],
)

Decorator for frame user-defined member renamed events. Args: func_ea (ea_t), udm (udm_t object), oldname (str)

on_function_added 

on_function_added(func: Callable[[int], None])

Decorator for function added events.

The kernel has added a function.

Args: func: Callback function that takes pfn.start_ea (function start address)

on_function_deleted 

on_function_deleted(func: Callable[[int], None])

Decorator for function deleted events.

The kernel is about to delete a function.

Args: func: Callback function that takes pfn.start_ea (function start address)

on_item_color_changed 

on_item_color_changed(func: Callable[[int, int], None])

Decorator for item color changed events.

An item color has been changed.

Args: func: Callback function that takes: - ea: Address - color: New color (DEFCOLOR means color deleted)

on_local_types_changed 

on_local_types_changed(
    func: Callable[[int, int, str], None],
)

Decorator for local types changed events.

Local types have been changed.

Args: func: Callback function that takes: - ltc: Local type change (local_type_change_t) - ordinal: Ordinal (0 means unknown) - name: Name (None means unknown)

on_local_udm_changed 

on_local_udm_changed(
    func: Callable[[str, int, object, object], None],
)

Decorator for local type user-defined member changed events. Args: udtname (str), udm_tid (tid_t), udmold (udm_t), udmnew (udm_t)

on_local_udm_created 

on_local_udm_created(func: Callable[[str, object], None])

Decorator for local type user-defined member created events. Args: udtname (str), udm (udm_t object)

on_local_udm_deleted 

on_local_udm_deleted(
    func: Callable[[str, int, object], None],
)

Decorator for local type user-defined member deleted events. Args: udtname (str), udm_tid (tid_t), udm (udm_t object)

on_local_udm_renamed 

on_local_udm_renamed(
    func: Callable[[str, object, str], None],
)

Decorator for local type user-defined member renamed events. Args: udtname (str), udm (udm_t object), oldname (str)

on_make_code 

on_make_code(func: Callable[[int], None])

Decorator for make code events.

An instruction is being created.

Args: func: Callback function that takes insn.ea (instruction address)

on_make_data 

on_make_data(func: Callable[[int, int, int, int], None])

Decorator for make data events.

A data item is being created.

Args: func: Callback function that takes: - ea: Address - flags: Data flags - tid: Type ID - length: Data length

on_renamed 

on_renamed(func: Callable[[int, str, bool, str], None])

Decorator for rename events.

The kernel has renamed a byte. See also the rename event.

Args: func: Callback function that takes: - ea: Address - new_name: New name (can be None) - local_name: True if local name - old_name: Old name (can be None)

on_segment_added 

on_segment_added(func: Callable[[int, int], None])

Decorator for segment added events.

A new segment has been created.

Args: func: Callback function that takes: - start_ea: Segment start address - end_ea: Segment end address

register_handler 

register_handler(event_name: str, callback: Callable)

Register a callback for a specific event.

Args: event_name: Name of the event to register for callback: Function to call when event occurs

Raises: ValueError: If event_name is not a valid event

unhook 

unhook()

Stop listening for IDA events.

This unhooks all event handlers and stops processing events. Callbacks will no longer be triggered.

unregister_handler 

unregister_handler(event_name: str, callback: Callable)

Unregister a callback for a specific event.

Args: event_name: Name of the event to unregister from callback: Function to remove from callbacks