INativeCodeUnit

EXTERN_FUNCTION routine prefix

PTRFUNCTION routine prefix

Target routine prefix with named trampoline: '*'

Trampoline routines prefix: unicode RIGHTWARDS ARROW '→'

Get the principal code analyzer extension attached to this unit.

Convert a flexible native code unit address to a canonical memory address.

Unit addresses can be code labels, pseudo labels, string representations of physical addresses, etc.

Convert a flexible native code unit address to a canonical memory address.

Unit addresses can be code labels, pseudo labels, string representations of physical addresses, etc.

Convenience method used to retrieve a class by name.

Get a class by its internal index. Class indices are monotonously increasing, and gaps may exist as classes get destroyed and created. The caller should not assume that getClassByIndex(i)==getClasses().get(i).

Get the list of classes.

Get the code analyzer.

Life-cycle information: this method will return null until the unit is processed.

Retrieve the currently-set analyzer extensions manager. Life-cycle information: this method will return null until the unit is processed.

Note: third-party code should not use this for now.

Get the helper object used to format instructions into a sink.

Do not confuse the code formatter with the unit's formatter.

Get the code model.

Provide the parent code object container, if there is one. Typically, that would be an ELF, PE-COFF, or Mach-O unit accessible through the generic interface ICodeObjectUnit or any of the derived specialized interfaces.

Get the comment manager. This method is optional. When the unit is disposed, this method must return null. The default implementation returns null.

Get the native type of the data item located at the provided address.

Retrieve or create a decompiler for this unit. If a corresponding gendec plugin is not available with your JEB license, null is returned.

Convenience method to retrieve the text document representing the disassembly of this code unit.

The caller is responsible for disposing the returned document after usage.

Retrieve the endianness. This method is for convenience only; byte ordering can always be retrieved through the IProcessor.

Get the address of the entry-point of this unit, if any.

Convenience method used to retrieve a field by name.

Get a field by its internal index. Field indices are monotonously increasing, and gaps may exist as fields get destroyed and created. The caller should not assume that getFieldByIndex(i)==getFields().get(i).

Get the list of fields.

Get the address of the high-level entry-point of this unit, if any.

The high-level entry-point corresponds to a main() (or similar) routine. It is the routine executed after the compiler-generated initialization code is executed. Note that it might be set as a result of the initial analysis.

Convenience method used to retrieve the inline comment at the provided virtual address.

Retrieve an internal method by address (any address within the method). An internal method has an associated data item associated to it. If multiple methods share the provided address, the one with the lowest entry-point address is returned.

Retrieve an internal method by its entry-point address. An internal method has an associated data item associated to it. If multiple methods share the provided entry-point address, the first one is returned.

Retrieve all internal methods. An internal method has an associated data item associated to it.

Retrieve the internal methods spanning over the provided address

Retrieve all internal methods, ordered from the leaves to the roots. An internal method has an associated data item associated to it.

Retrieve all internal methods, ordered from their ascending byte size. An internal method has an associated data item associated to it.

Optionally provide an object associated with the given item. This method may return null, an opaque object, or an object defined by the contract of the implementing object or sub-interface. The SPI of sub-interfaces should specify the item id formats, if any, as well as types and semantics associated with the objects returned by this method.

Retrieve the model lock, used to request a full-access model lock or a partial, read-only, transactional lock. All plugin code accessing the native units and units relying on native units should use those locks to perform operations safely in a concurrent environment.

Retrieve the virtual memory managed used by this unit.

Convenience method used to retrieve a method by name.

Get a method by its internal index. Method indices are monotonously increasing, and gaps may exist as methods get destroyed and created. The caller should not assume that getMethodByIndex(i)==getMethods().get(i).

Get the list of methods.

Get the item located at the exact address.

Get the item spanning over the provided address.

Retrieve a read-only map of the native items located within the provided memory range.

Get the package/namespace manager used by this unit.

Get the list of code packages.

Retrieve the difference between Physical Image base as set by setPhysicalImageBase(long) and Virtual Image Base as retrieved by getVirtualImageBase(). This value should only be used for rendering.

Retrieve the machine code parser (pseudo-processor) managed by this unit.

Convenience method used to retrieve the processor's name. The processor value specifies, among other things, the underlying instruction set used by the instructions of this code unit.

Get the global signature manager used by this unit.

Retrieve a string by index. Careful, this is not the same as getStrings().get(index).

Get the list of code strings.

Retrieve the simplest symbol address that corresponds to the given physical address. Same as getSymbolicStringAddress(address, 0).

Retrieve a symbol address that corresponds to the given physical address.

Example: if address if at offset 10h inside method foo() (at address 401000h), querying this method with sspref=2 will return a label "foo+10h"; however, querying with sspref=0 would simply return "401010h".

Get the global type library service.

Get the global type manager used by this unit.

Get the list of types.

Determine whether a code analysis pass is ongoing.

Determine whether or not an initial analysis pass has been done.

Start an analysis.

Perform the initial analysis pass. This method should be called once, after successful unit processing. The initial analysis pass parameters, such as synchronicity, the inclusion of global or advanced analysis, etc. are determined automatically.

Quickly process the unit. Be careful that the IUnit is not analyzed while performInitialAnalysis() was not called.

Set the principal code analyzer extension for this unit.

Parse and create an instruction at the provided address.

Set a hint. This method may be called optionally, before process(). The hint may be disregarded.

Create or update a data item at the provided address.

Note: to create String items, see setStringAt(long, long, StringEncoding, int, int).

Create or update a data item at the provided address. Overlapping items may be deleted.

Note: to create String items, see setStringAt(long, long, StringEncoding, int, int).

Convenience method to set the native type of a data item located at the provided address. If no item exists at the provided address, one will be created. Overlapping items may be deleted.

Note: to create String items, see setStringAt(long, long, StringEncoding, int, int).

Convenience method used to set the inline comment at the provided virtual address.

Optionally set the current optional virtual memory (VM) used by this unit. This method should be called at most once (typically done in the unit's identifier), before processing the unit. It is optional; the VM object set may be overridden during unit processing if it is deemed inappropriate to handle the code object. Therefore, after processing, client code should always retrieve the actual VM object via getMemory().

Set the real (physical) image base for this piece of code. That address is the real address of the first loaded byte on a target device. The existence of this method implies that at most one physical address can be used at any time. (Typically, debuggers use this method to let code units know of where they are currently mapped, which in turn is used to better render assembly output.) Generally, the physical image address changes across different launches.

Set the code parser (processor) used by this unit. This method should be called at most once (typically done in the unit's identifier), before processing the unit.

Parse and attempt to create a routine at the provided address. The processor mode used will be the default one, and the analysis will be done forcefully.

Parse and attempt to create a routine at the provided address.

Parse and attempt to create a routine at the provided address. The analysis is done forcefully.

Set a routine prototype. This method uses non-standard prototype declarations and should be avoided. Use setRoutineSignature(INativeMethodItem, String, boolean) instead.

Create a special data item representing a reference to a method. Those items are similar to function pointer items (pointer to prototypes), except that they refer specifically to routine objects managed by this unit.

Set a routine signature or protytpe.

Create a string data item. Overlapping items may be deleted.

Create a string data item.

Set a hint. This method may be called optionally, before process(). The hint may be disregarded.

Set preferred image base

Undefine the memory item starting at the provided address. Careful, this method may have unintended side effects. Example: deleting an instruction item that's part of a routine body will also discard that routine, which in turn may discard other items or references, within this unit or other units.