Skip to content

Functions

functions

Classes:

  • FunctionChunk –

    Represents a function chunk (main or tail).

  • FunctionFlags –

    Function attribute flags from IDA SDK.

  • FunctionMoveError –

    Raised when a function's start address could not be moved.

  • Functions –

    Provides access to function-related operations within the IDA database.

  • MoveFunctionResult –

    Result codes for moving a function chunk's start address (MOVE_FUNC_*).

  • StackPoint –

    Stack pointer change information.

  • TailInfo –

    Function tail chunk information.

FunctionChunk dataclass 

FunctionChunk(start_ea: ea_t, end_ea: ea_t, is_main: bool)

Represents a function chunk (main or tail).

Attributes:

  • end_ea (ea_t) –

    End address of the function chunk

  • is_main (bool) –

    True if is the function main chunk

  • start_ea (ea_t) –

    Start address of the function chunk

end_ea instance-attribute 

end_ea: ea_t

End address of the function chunk

is_main instance-attribute 

is_main: bool

True if is the function main chunk

start_ea instance-attribute 

start_ea: ea_t

Start address of the function chunk

FunctionFlags

Bases: Flag

Function attribute flags from IDA SDK.

Attributes:

  • BOTTOMBP –

    BP points to the bottom of the stack frame

  • CATCH –

    Function is an exception catch handler

  • FAR –

    Far function

  • FRAME –

    Function uses frame pointer (BP)

  • FUZZY_SP –

    Function changes SP in untraceable way

  • HIDDEN –

    A hidden function chunk

  • LIB –

    Library function

  • LUMINA –

    Function info is provided by Lumina

  • NORET –

    Function doesn't return

  • NORET_PENDING –

    Function 'non-return' analysis needed

  • OUTLINE –

    Outlined code, not a real function

  • PROLOG_OK –

    Prolog analysis has been performed

  • PURGED_OK –

    'argsize' field has been validated

  • REANALYZE –

    Function frame changed, request to reanalyze

  • SP_READY –

    SP-analysis has been performed

  • STATICDEF –

    Static function

  • TAIL –

    This is a function tail

  • THUNK –

    Thunk (jump) function

  • UNWIND –

    Function is an exception unwind handler

  • USERFAR –

    User has specified far-ness of the function

BOTTOMBP class-attribute instance-attribute 

BOTTOMBP = ida_funcs.FUNC_BOTTOMBP

BP points to the bottom of the stack frame

CATCH class-attribute instance-attribute 

CATCH = ida_funcs.FUNC_CATCH

Function is an exception catch handler

FAR class-attribute instance-attribute 

FAR = ida_funcs.FUNC_FAR

Far function

FRAME class-attribute instance-attribute 

FRAME = ida_funcs.FUNC_FRAME

Function uses frame pointer (BP)

FUZZY_SP class-attribute instance-attribute 

FUZZY_SP = ida_funcs.FUNC_FUZZY_SP

Function changes SP in untraceable way

HIDDEN class-attribute instance-attribute 

HIDDEN = ida_funcs.FUNC_HIDDEN

A hidden function chunk

LIB class-attribute instance-attribute 

LIB = ida_funcs.FUNC_LIB

Library function

LUMINA class-attribute instance-attribute 

LUMINA = ida_funcs.FUNC_LUMINA

Function info is provided by Lumina

NORET class-attribute instance-attribute 

NORET = ida_funcs.FUNC_NORET

Function doesn't return

NORET_PENDING class-attribute instance-attribute 

NORET_PENDING = ida_funcs.FUNC_NORET_PENDING

Function 'non-return' analysis needed

OUTLINE class-attribute instance-attribute 

OUTLINE = ida_funcs.FUNC_OUTLINE

Outlined code, not a real function

PROLOG_OK class-attribute instance-attribute 

PROLOG_OK = ida_funcs.FUNC_PROLOG_OK

Prolog analysis has been performed

PURGED_OK class-attribute instance-attribute 

PURGED_OK = ida_funcs.FUNC_PURGED_OK

'argsize' field has been validated

REANALYZE class-attribute instance-attribute 

REANALYZE = ida_funcs.FUNC_REANALYZE

Function frame changed, request to reanalyze

SP_READY class-attribute instance-attribute 

SP_READY = ida_funcs.FUNC_SP_READY

SP-analysis has been performed

STATICDEF class-attribute instance-attribute 

STATICDEF = ida_funcs.FUNC_STATICDEF

Static function

TAIL class-attribute instance-attribute 

TAIL = ida_funcs.FUNC_TAIL

This is a function tail

THUNK class-attribute instance-attribute 

THUNK = ida_funcs.FUNC_THUNK

Thunk (jump) function

UNWIND class-attribute instance-attribute 

UNWIND = ida_funcs.FUNC_UNWIND

Function is an exception unwind handler

USERFAR class-attribute instance-attribute 

USERFAR = ida_funcs.FUNC_USERFAR

User has specified far-ness of the function

FunctionMoveError 

FunctionMoveError(
    message: str,
    code: Optional[MoveFunctionResult] = None,
    errea: Optional[ea_t] = None,
)

Bases: IdaDomainError

Raised when a function's start address could not be moved.

Attributes:

  • code –

    The :class:MoveFunctionResult code (None if not available).

  • errea –

    The address where the error occurred (None if not available).

code instance-attribute 

code = code

errea instance-attribute 

errea = errea

Functions 

Functions(database: Database)

Bases: DatabaseEntity

Provides access to function-related operations within the IDA database.

This class handles function discovery, analysis, manipulation, and provides access to function properties like names, signatures, basic blocks, and pseudocode.

Can be used to iterate over all functions in the opened database.

Parameters:

  • database (Database) –

    Reference to the active IDA database.

Note

Since this class does not manage the lifetime of IDA kernel objects (func_t*), it is recommended to use these pointers within a limited scope. Obtain the pointer, perform the necessary operations, and avoid retaining references beyond the immediate context to prevent potential issues with object invalidation.

Methods:

Attributes:

database property 

database: Database

Get the database reference, guaranteed to be non-None when called from methods decorated with @check_db_open.

Returns:

  • Database –

    The active database instance.

Note

This property should only be used in methods decorated with @check_db_open, which ensures m_database is not None.

m_database instance-attribute 

m_database = database

apply_declaration 

apply_declaration(
    func: func_t,
    decl: str,
    flags: TypeApplyFlags = DEFINITE,
) -> bool

Parse and apply a C-style prototype to a function.

Note

This sets the prototype only; it does not rename the function (to rename use set_name).

Parameters:

  • func (func_t) –

    The function instance.

  • decl (str) –

    C prototype string (e.g. "int __fastcall f(int x)"). Any function name in the declaration is ignored.

  • flags (TypeApplyFlags, default: DEFINITE ) –

    Type apply flags. Defaults to DEFINITE.

Returns:

  • bool –

    True if the prototype was parsed and applied successfully, False otherwise.

Raises:

  • InvalidEAError –

    If the function start address is invalid.

  • InvalidParameterError –

    If the declaration cannot be parsed.

create 

create(ea: ea_t) -> bool

Creates a new function at the specified address.

Parameters:

  • ea (ea_t) –

    The effective address where the function should start.

Returns:

  • bool –

    True if the function was successfully created, False otherwise.

Raises:

  • InvalidEAError –

    If the effective address is invalid.

does_return 

does_return(func: func_t) -> bool

Check if function returns.

Parameters:

  • func (func_t) –

    Function object

Returns:

  • bool –

    True if function returns, False if it's noreturn

get_all 

get_all() -> Iterator[func_t]

Retrieves all functions in the database.

Returns:

  • Iterator[func_t] –

    An iterator over all functions in the database.

get_at 

get_at(ea: ea_t) -> Optional[func_t]

Retrieves the function that contains the given address.

Parameters:

  • ea (ea_t) –

    An effective address within the function body.

Returns:

  • Optional[func_t] –

    The function object containing the address,

  • Optional[func_t] –

    or None if no function exists at that address.

Raises:

  • InvalidEAError –

    If the effective address is invalid.

get_between 

get_between(
    start_ea: ea_t, end_ea: ea_t
) -> Iterator[func_t]

Retrieves functions within the specified address range.

Parameters:

  • start_ea (ea_t) –

    Start address of the range (inclusive).

  • end_ea (ea_t) –

    End address of the range (exclusive).

Yields:

  • func_t –

    Function objects whose start address falls within the specified range.

Raises:

  • InvalidEAError –

    If the start_ea/end_ea are specified but they are not in the database range.

get_by_name 

get_by_name(name: str) -> Optional[func_t]

Find a function by its name.

Parameters:

  • name (str) –

    Function name to search for

Returns:

  • Optional[func_t] –

    Function object if found, None otherwise

get_callees 

get_callees(func: func_t) -> List[func_t]

Gets all functions called by this function.

Parameters:

  • func (func_t) –

    The function instance.

Returns:

  • List[func_t] –

    List of called functions.

get_callers 

get_callers(func: func_t) -> List[func_t]

Gets all functions that call this function.

Parameters:

  • func (func_t) –

    The function instance.

Returns:

  • List[func_t] –

    List of calling functions.

get_chunk_at 

get_chunk_at(ea: int) -> Optional[func_t]

Get function chunk at exact address.

Parameters:

  • ea (int) –

    Address within function chunk

Returns:

  • Optional[func_t] –

    Function chunk or None

Raises:

  • InvalidEAError –

    If the effective address is invalid.

get_chunks 

get_chunks(func: func_t) -> Iterator[FunctionChunk]

Get all chunks (main and tail) of a function.

Parameters:

  • func (func_t) –

    The function to analyze.

Yields:

  • FunctionChunk –

    FunctionChunk objects representing each chunk.

get_comment 

get_comment(func: func_t, repeatable: bool = False) -> str

Get comment for function.

Parameters:

  • func (func_t) –

    The function to get comment from.

  • repeatable (bool, default: False ) –

    If True, retrieves repeatable comment (shows at all identical operands). If False, retrieves non-repeatable comment (shows only at this function).

Returns:

  • str –

    Comment text, or empty string if no comment exists.

get_data_items 

get_data_items(func: func_t) -> Iterator[ea_t]

Iterate over data items within the function.

This method finds all addresses within the function that are defined as data (not code). Useful for finding embedded data, jump tables, or other non-code items within function boundaries.

Parameters:

  • func (func_t) –

    The function object

Yields:

  • ea_t –

    Addresses of data items within the function

Example 
>>> func = db.functions.get_at(0x401000)
>>> for data_ea in db.functions.get_data_items(func):
...     size = ida_bytes.get_item_size(data_ea)
...     print(f"Data at 0x{data_ea:x}, size: {size}")

get_disassembly 

get_disassembly(
    func: func_t, remove_tags: bool = True
) -> List[str]

Retrieves the disassembly lines for the given function.

Parameters:

  • func (func_t) –

    The function instance.

  • remove_tags (bool, default: True ) –

    If True, removes IDA color/formatting tags from the output.

Returns:

  • List[str] –

    A list of strings, each representing a line of disassembly.

  • List[str] –

    Returns empty list if function is invalid.

get_flags 

get_flags(func: func_t) -> FunctionFlags

Get function attribute flags.

Parameters:

  • func (func_t) –

    Function object

Returns:

get_flowchart 

get_flowchart(
    func: func_t, flags: FlowChartFlags = NONE
) -> Optional[FlowChart]

Retrieves the flowchart of the specified function, which the user can use to retrieve basic blocks.

Parameters:

  • func (func_t) –

    The function instance.

Returns:

  • Optional[FlowChart] –

    An iterator over the function's basic blocks, or empty iterator if function is invalid.

get_function_by_name 

get_function_by_name(name: str) -> Optional[func_t]

get_instructions 

get_instructions(func: func_t) -> Iterator[insn_t]

Retrieves all instructions within the given function.

Parameters:

  • func (func_t) –

    The function instance.

Returns:

  • Iterator[insn_t] –

    An iterator over all instructions in the function,

  • Iterator[insn_t] –

    or empty iterator if function is invalid.

get_local_variable_by_name 

get_local_variable_by_name(
    func: func_t, name: str
) -> Optional[LocalVariable]

Find a local variable by name.

Parameters:

  • func (func_t) –

    The function instance.

  • name (str) –

    Variable name to search for.

Returns:

Raises:

  • PseudocodeError –

    If decompilation fails for the function.

  • KeyError –

    If the variable is not found

get_local_variable_references 

get_local_variable_references(
    func: func_t, lvar: LocalVariable
) -> List[LocalVariableReference]

Get all references to a specific local variable.

Convenience entry point that forwards to :meth:PseudocodeFunction.find_variable_references. Each returned :class:LocalVariableReference carries the wrapped ctree nodes (expr, parent, lazy assignment, walk_ancestors) so callers can perform deeper analyses — taint tracking, type inference, deobfuscation — without copying any visitor internals.

Parameters:

  • func (func_t) –

    The function instance.

  • lvar (LocalVariable) –

    The local variable to find references for.

Returns:

Raises:

  • PseudocodeError –

    If decompilation fails for the function.

get_local_variables 

get_local_variables(func: func_t) -> List[LocalVariable]

Get all local variables for a function.

Delegates to db.pseudocode.decompile() and reads the cfunc's lvar table.

Parameters:

  • func (func_t) –

    The function instance.

Returns:

  • List[LocalVariable] –

    List of local variables including arguments and local vars.

Raises:

  • PseudocodeError –

    If decompilation fails for the function.

get_microcode 

get_microcode(func: func_t) -> MicroBlockArray

Generates microcode for the given function.

Delegates to db.microcode.generate().

Parameters:

  • func (func_t) –

    The function instance.

Returns:

Raises:

  • MicrocodeError –

    If microcode generation fails for the function.

get_name 

get_name(func: func_t) -> str

Retrieves the function's name.

Parameters:

  • func (func_t) –

    The function instance.

Returns:

  • str –

    The function name as a string, or empty string if no name is set.

get_next 

get_next(ea: int) -> Optional[func_t]

Get the next function after the given address.

Parameters:

  • ea (int) –

    Address to search from

Returns:

  • Optional[func_t] –

    Next function after ea, or None if no more functions

Raises:

  • InvalidEAError –

    If the effective address is invalid.

get_pseudocode 

get_pseudocode(func: func_t) -> PseudocodeFunction

Decompiles the given function and returns the pseudocode result.

Delegates to db.pseudocode.decompile().

The returned object provides full ctree access. To get the pseudocode as plain text, call str() or to_text():

pseudo = db.functions.get_pseudocode(func)
print(str(pseudo))           # full text
print(pseudo.to_text())      # list of lines

Parameters:

  • func (func_t) –

    The function instance.

Returns:

Raises:

  • PseudocodeError –

    If decompilation fails for the function.

get_signature 

get_signature(func: func_t) -> Optional[str]

Retrieves the function's type signature.

Parameters:

  • func (func_t) –

    The function instance.

Returns:

  • Optional[str] –

    The function signature as a string, or None if no type

  • Optional[str] –

    is stored for this function.

get_stack_points 

get_stack_points(func: func_t) -> List[StackPoint]

Get function stack points for SP tracking.

Parameters:

  • func (func_t) –

    Function object

Returns:

  • List[StackPoint] –

    List of StackPoint objects showing where SP changes

get_tail_info 

get_tail_info(chunk: func_t) -> Optional[TailInfo]

Get information about tail chunk's owner function.

Parameters:

  • chunk (func_t) –

    Function chunk (must be tail chunk)

Returns:

  • Optional[TailInfo] –

    TailInfo with owner details, or None if not a tail chunk

get_tails 

get_tails(func: func_t) -> List[func_t]

Get all tail chunks of a function.

Parameters:

  • func (func_t) –

    Function object (must be entry chunk)

Returns:

  • List[func_t] –

    List of tail chunks, empty if not entry chunk

is_chunk_at 

is_chunk_at(ea: ea_t) -> bool

Check if the given address belongs to a function chunk.

Parameters:

  • ea (ea_t) –

    The address to check.

Returns:

  • bool –

    True if the address is in a function chunk.

is_entry_chunk 

is_entry_chunk(chunk: func_t) -> bool

Check if chunk is entry chunk.

Parameters:

  • chunk (func_t) –

    Function chunk to check

Returns:

  • bool –

    True if this is an entry chunk, False otherwise

is_far 

is_far(func: func_t) -> bool

Check if function is far.

Parameters:

  • func (func_t) –

    Function object

Returns:

  • bool –

    True if function is far, False otherwise

is_outlined 

is_outlined(func: func_t) -> bool

Check whether a function is outlined code.

Parameters:

  • func (func_t) –

    The function instance.

Returns:

  • bool –

    True if the function carries the outlined flag, False otherwise.

is_tail_chunk 

is_tail_chunk(chunk: func_t) -> bool

Check if chunk is tail chunk.

Parameters:

  • chunk (func_t) –

    Function chunk to check

Returns:

  • bool –

    True if this is a tail chunk, False otherwise

reanalyze 

reanalyze(func: func_t) -> None

Schedule re-analysis of a function.

Warning

This only queues the function for analysis. In headless (idalib) mode there is no analysis loop, so call ida_auto.auto_wait() afterward for the re-analysis to actually run.

Parameters:

  • func (func_t) –

    The function instance.

remove 

remove(ea: ea_t) -> bool

Removes the function at the specified address.

Parameters:

  • ea (ea_t) –

    The effective address of the function to remove.

Returns:

  • bool –

    True if the function was successfully removed, False otherwise.

Raises:

  • InvalidEAError –

    If the effective address is invalid.

set_comment 

set_comment(
    func: func_t, comment: str, repeatable: bool = False
) -> bool

Set comment for function.

Parameters:

  • func (func_t) –

    The function to set comment for.

  • comment (str) –

    Comment text to set.

  • repeatable (bool, default: False ) –

    If True, creates a repeatable comment (shows at all identical operands). If False, creates a non-repeatable comment (shows only at this function).

Returns:

  • bool –

    True if successful, False otherwise.

set_end 

set_end(func: func_t, new_end: ea_t) -> bool

Change the end address of a function.

Parameters:

  • func (func_t) –

    The function instance.

  • new_end (ea_t) –

    The new end address.

Returns:

  • bool –

    True if the end was successfully changed, False otherwise.

Raises:

  • InvalidEAError –

    If new_end is outside the database range.

set_name 

set_name(
    func: func_t, name: str, auto_correct: bool = True
) -> bool

Renames the given function.

Parameters:

  • func (func_t) –

    The function instance.

  • name (str) –

    The new name to assign to the function.

  • auto_correct (bool, default: True ) –

    If True, allows IDA to replace invalid characters automatically.

Returns:

  • bool –

    True if the function was successfully renamed, False otherwise.

Raises:

  • InvalidParameterError –

    If the name parameter is empty or invalid.

set_outlined 

set_outlined(func: func_t, outlined: bool = True) -> bool

Set or clear the outlined flag on a function.

Parameters:

  • func (func_t) –

    The function instance.

  • outlined (bool, default: True ) –

    True to mark the function as outlined, False to clear it.

Returns:

  • bool –

    True if the flag was successfully updated, False otherwise.

set_start 

set_start(func: func_t, new_start: ea_t) -> bool

Change the start address of a function.

The new start must begin an instruction and lie outside any other function.

Parameters:

  • func (func_t) –

    The function instance.

  • new_start (ea_t) –

    The new start address.

Returns:

  • bool –

    True if the start address was successfully changed.

Raises:

  • InvalidEAError –

    If new_start is not a valid address.

  • FunctionMoveError –

    If the start could not be moved. The reason is available as .code.

update 

update(func: func_t) -> bool

Persist in-place changes made to a function object back to the database.

Use this after modifying attributes on a func_t. Function boundaries must not be changed this way; use :meth:set_start / :meth:set_end instead.

Parameters:

  • func (func_t) –

    The function instance to update.

Returns:

  • bool –

    True if the function was successfully updated, False otherwise.

MoveFunctionResult

Bases: IntEnum

Result codes for moving a function chunk's start address (MOVE_FUNC_*).

Attributes:

  • BADSTART –

    Bad new start address

  • NOCODE –

    No instruction at the new start address

  • NOFUNC –

    No function at the given address

  • OK –

    Successfully moved the function

  • REFUSED –

    A plugin refused the operation

BADSTART class-attribute instance-attribute 

BADSTART = ida_funcs.MOVE_FUNC_BADSTART

Bad new start address

NOCODE class-attribute instance-attribute 

NOCODE = ida_funcs.MOVE_FUNC_NOCODE

No instruction at the new start address

NOFUNC class-attribute instance-attribute 

NOFUNC = ida_funcs.MOVE_FUNC_NOFUNC

No function at the given address

OK class-attribute instance-attribute 

OK = ida_funcs.MOVE_FUNC_OK

Successfully moved the function

REFUSED class-attribute instance-attribute 

REFUSED = ida_funcs.MOVE_FUNC_REFUSED

A plugin refused the operation

StackPoint dataclass 

StackPoint(ea: ea_t, sp_delta: int)

Stack pointer change information.

Attributes:

  • ea (ea_t) –

    Address where SP changes

  • sp_delta (int) –

    Stack pointer delta at this point

ea instance-attribute 

ea: ea_t

Address where SP changes

sp_delta instance-attribute 

sp_delta: int

Stack pointer delta at this point

TailInfo dataclass 

TailInfo(owner_ea: ea_t, owner_name: str)

Function tail chunk information.

Attributes:

  • owner_ea (ea_t) –

    Address of owning function

  • owner_name (str) –

    Name of owning function

owner_ea instance-attribute 

owner_ea: ea_t

Address of owning function

owner_name instance-attribute 

owner_name: str

Name of owning function