Overview

Welcome to the IDA Domain API reference documentation. This section provides comprehensive documentation for all modules and functions available in the IDA Domain library.

The IDA Domain API is organized around the following top level entities:

• Database - Main database operations and management
• Entries - Entry point management and analysis
• Segments - Memory segment operations
• Functions - Function analysis and manipulation
• Basic Blocks - Basic block operations
• Instructions - Instruction-level analysis
• Operands - Operand analysis and manipulation
• Bytes - Raw byte manipulation and analysis
• Strings - String detection and analysis
• Types - Type information and management
• Heads - Address head management
• XRefs - Xref analysis
• Events - Event handling
• Names - Symbol name management
• Comments - Comment management
• Signature Files - FLIRT signature file operations

Accessing the entities

The first thing that you will usually want to do is opening a Database.

Once the database is opened, you can access all other entities from the database handle itself through their respective property.

db = Database()
db.open('/path/to/your/database.idb')
db.functions.get_all()
db.segments.get_all()
db.entries.get_all()
...

Event handling

Using the events property on the Database you can register listener for specific events.

from ida_domain import Database

db = Database()
db.open('/path/to/your/database.idb')
events = db.events()

# Register event handlers
@events.on_function_added
def handle_func_added(func_ea):
    print(f"Function added at 0x{func_ea:X}")

@events.on_renamed
def handle_renamed(ea, new_name, is_local):
    print(f"Renamed 0x{ea:X} to {new_name}")

# Start listening for events
events.hook()

# ... perform operations

# Stop listening
events.unhook()
db.close()

Compatibility with IDA Python SDK

The IDA Domain API is fully compatible with the IDA Python SDK shipped with IDA. It means the while we are extending the coverage of IDA Domain API, you can always fallback to using the IDA Python SDK.

Here is an example:

import ida_domain
import ida_funcs

db = ida_domain.Database()
db.open('/path/to/your/database.idb')
for i, func in enumerate(db.functions.get_all()):
    print(ida_funcs.get_func_name(func.start_ea)) # <== this is calling IDA Python SDK