functions
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseThis skill is a comprehensive catalog of every idasql SQL function. Use it to look up any function signature, parameters, and usage.
本技能是一份包含所有idasql SQL函数的综合目录。可用于查询任意函数的签名、参数及用法。
Disassembly
反汇编
| Function | Description |
|---|---|
| Canonical listing line for containing head (works for code/data) |
| Canonical listing line with +/- |
| Single disassembly line at address |
| Next N instructions from address (count-based, not boundary-aware) |
| All disassembly lines in address range [start, end) |
| Full disassembly of function containing address |
| Create instruction at address (returns 1 if already code or created) |
| Create instructions in [start, end), returns number created |
sql
SELECT disasm_at(0x401000);
SELECT disasm_at(0x401000, 2);
SELECT disasm_func(address) FROM funcs WHERE name = '_main';
SELECT disasm_range(0x401000, 0x401100);
SELECT disasm(0x401000);
SELECT disasm(0x401000, 5);
SELECT make_code(0x401000);
SELECT make_code_range(0x401000, 0x401100);Function creation is table-driven (not a SQL function):
sql
INSERT INTO funcs (address) VALUES (0x401000);| 函数 | 描述 |
|---|---|
| 包含头部的标准列表行(适用于代码/数据) |
| 包含头部的标准列表行及前后 |
| 地址处的单行反汇编内容 |
| 从地址开始的后续N条指令(基于计数,不识别边界) |
| 地址范围[start, end)内的所有反汇编行 |
| 包含该地址的函数的完整反汇编内容 |
| 在地址处创建指令(若已为代码或创建成功则返回1) |
| 在[start, end)范围内创建指令,返回创建的数量 |
sql
SELECT disasm_at(0x401000);
SELECT disasm_at(0x401000, 2);
SELECT disasm_func(address) FROM funcs WHERE name = '_main';
SELECT disasm_range(0x401000, 0x401100);
SELECT disasm(0x401000);
SELECT disasm(0x401000, 5);
SELECT make_code(0x401000);
SELECT make_code_range(0x401000, 0x401100);函数创建基于表驱动(并非SQL函数):
sql
INSERT INTO funcs (address) VALUES (0x401000);Byte Access and Patching
字节访问与补丁
| Function | Description |
|---|---|
| Read |
| Read |
| Load bytes from a host file into IDB memory/file image |
| Patch one byte at |
| Patch 2 bytes at |
| Patch 4 bytes at |
| Patch 8 bytes at |
| Revert one patched byte to original |
| Read original (pre-patch) byte |
sql
SELECT bytes(0x401000, 16);
SELECT patch_byte(0x401000, 0x90) AS ok;
SELECT bytes(0x401000, 1) AS current, get_original_byte(0x401000) AS original;
SELECT revert_byte(0x401000) AS reverted;load_file_bytes(...)10For composable row-shaped reads or patching, use the pure table:
.
Use for item size/type metadata.
bytesSELECT ea, value FROM bytes WHERE ea >= :start AND ea < :end ORDER BY eaheads| 函数 | 描述 |
|---|---|
| 读取 |
| 读取 |
| 将主机文件中的字节加载到IDB内存/文件镜像中 |
| 在 |
| 在 |
| 在 |
| 在 |
| 将已补丁的字节恢复为原始值 |
| 读取原始(补丁前)字节 |
sql
SELECT bytes(0x401000, 16);
SELECT patch_byte(0x401000, 0x90) AS ok;
SELECT bytes(0x401000, 1) AS current, get_original_byte(0x401000) AS original;
SELECT revert_byte(0x401000) AS reverted;load_file_bytes(...)10如需组合式行状读取或补丁操作,请使用纯表:
。
使用获取项的大小/类型元数据。
bytesSELECT ea, value FROM bytes WHERE ea >= :start AND ea < :end ORDER BY eaheadsBinary Search
二进制搜索
Use the table for raw bytes/opcodes. It is table-shaped so results can be filtered, joined, grouped, and limited directly.
byte_search| Column | Description |
|---|---|
| Match address |
| Matched bytes rendered as hex text |
| Matched bytes as a BLOB |
| Match size in bytes |
| Hidden required input: IDA byte pattern |
| Hidden optional inclusive lower bound |
| Hidden optional exclusive upper bound |
| Hidden optional generator cap |
Pattern syntax (IDA native):
- - Exact bytes (hex, space-separated)
"48 8B 05" - or
"48 ? 05"-"48 ?? 05"= any byte wildcard (whole byte only)? - - Alternatives (match any of these bytes)
"(01 02 03)"
sql
SELECT address, matched_hex, size
FROM byte_search
WHERE pattern = '48 8B ? 00'
LIMIT 10;
SELECT printf('0x%llX', address) AS addr
FROM byte_search
WHERE pattern = 'CC CC CC'
ORDER BY address
LIMIT 1;Optimization Pattern:
sql
-- Count unique functions containing RDTSC (opcode: 0F 31)
SELECT COUNT(DISTINCT f.address) as count
FROM byte_search b
JOIN funcs f ON b.address >= f.address AND b.address < f.end_ea
WHERE b.pattern = '0F 31';使用表进行原始字节/操作码搜索。该表为表结构,因此结果可直接进行过滤、连接、分组和限制。
byte_search| 列 | 描述 |
|---|---|
| 匹配地址 |
| 匹配字节的十六进制文本形式 |
| 匹配字节的BLOB格式 |
| 匹配结果的字节大小 |
| 隐藏必填输入:IDA字节模式 |
| 隐藏可选参数:包含性下界 |
| 隐藏可选参数:排他性上界 |
| 隐藏可选参数:结果数量上限 |
模式语法(IDA原生):
- - 精确字节(十六进制,空格分隔)
"48 8B 05" - 或
"48 ? 05"-"48 ?? 05"= 任意字节通配符(仅适用于完整字节)? - - 可选值(匹配其中任意一组字节)
"(01 02 03)"
sql
SELECT address, matched_hex, size
FROM byte_search
WHERE pattern = '48 8B ? 00'
LIMIT 10;
SELECT printf('0x%llX', address) AS addr
FROM byte_search
WHERE pattern = 'CC CC CC'
ORDER BY address
LIMIT 1;优化模式:
sql
-- 统计包含RDTSC(操作码:0F 31)的唯一函数数量
SELECT COUNT(DISTINCT f.address) as count
FROM byte_search b
JOIN funcs f ON b.address >= f.address AND b.address < f.end_ea
WHERE b.pattern = '0F 31';Names & Functions
名称与函数
Use table lookups for address and containing-function metadata. Resolve symbol names to integer EAs before using these patterns.
| Pattern | Description |
|---|---|
| Name at address |
| Function containing address |
| Start of containing function |
| End of containing function |
Function count and index lookup are table-driven:
sql
SELECT COUNT(*) AS function_count FROM funcs;
SELECT address FROM funcs WHERE rowid = 0;使用表查询获取地址和所属函数的元数据。在使用这些模式前,请将符号名称解析为整数EA。
| 模式 | 描述 |
|---|---|
| 地址处的名称 |
| 包含该地址的函数 |
| 所属函数的起始地址 |
| 所属函数的结束地址 |
函数计数和索引查询基于表驱动:
sql
SELECT COUNT(*) AS function_count FROM funcs;
SELECT address FROM funcs WHERE rowid = 0;Cross-References
交叉引用
Cross-reference edge queries are table-driven:
sql
SELECT from_ea, to_ea, type, is_code, from_func
FROM xrefs
WHERE to_ea = 0x401000;
SELECT from_ea, to_ea, type, is_code, from_func
FROM xrefs
WHERE from_ea = 0x401000;
SELECT from_ea, to_ea, type, is_code, from_func
FROM xrefs
WHERE from_func = 0x401000;交叉引用边查询基于表驱动:
sql
SELECT from_ea, to_ea, type, is_code, from_func
FROM xrefs
WHERE to_ea = 0x401000;
SELECT from_ea, to_ea, type, is_code, from_func
FROM xrefs
WHERE from_ea = 0x401000;
SELECT from_ea, to_ea, type, is_code, from_func
FROM xrefs
WHERE from_func = 0x401000;Navigation
导航
Use ordering for defined-item navigation and SQLite formatting functions for display strings. Address equality/range filters are optimized; or is consumed for next/previous-item lookups.
headsORDER BY addressORDER BY address DESCsql
SELECT address
FROM heads
WHERE address > 0x401000
ORDER BY address
LIMIT 1;
SELECT address
FROM heads
WHERE address < 0x401000
ORDER BY address DESC
LIMIT 1;
SELECT printf('0x%llx', address) AS address_hex
FROM heads
LIMIT 10;Segment lookup is table-driven:
sql
SELECT name
FROM segments
WHERE 0x401000 >= start_ea
AND 0x401000 < end_ea
LIMIT 1;使用排序进行已定义项导航,使用SQLite格式化函数生成显示字符串。地址相等/范围查询已优化;或可用于查找下一个/上一个项。
headsORDER BY addressORDER BY address DESCsql
SELECT address
FROM heads
WHERE address > 0x401000
ORDER BY address
LIMIT 1;
SELECT address
FROM heads
WHERE address < 0x401000
ORDER BY address DESC
LIMIT 1;
SELECT printf('0x%llx', address) AS address_hex
FROM heads
LIMIT 10;段查询基于表驱动:
sql
SELECT name
FROM segments
WHERE 0x401000 >= start_ea
AND 0x401000 < end_ea
LIMIT 1;Comments
注释
Read comments through the table:
commentssql
SELECT COALESCE(NULLIF(comment, ''), NULLIF(rpt_comment, '')) AS comment
FROM comments
WHERE address = 0x401000
LIMIT 1;Write comments through the table:
sql
INSERT INTO comments(address, comment) VALUES (0x401000, 'regular comment');
INSERT INTO comments(address, rpt_comment) VALUES (0x401000, 'repeatable comment');通过表读取注释:
commentssql
SELECT COALESCE(NULLIF(comment, ''), NULLIF(rpt_comment, '')) AS comment
FROM comments
WHERE address = 0x401000
LIMIT 1;通过表写入注释:
sql
INSERT INTO comments(address, comment) VALUES (0x401000, 'regular comment');
INSERT INTO comments(address, rpt_comment) VALUES (0x401000, 'repeatable comment');Modification
修改
| Function | Description |
|---|---|
| Read type declaration applied at address |
| Apply C declaration/type at address (empty decl clears type; |
| Import C declarations (struct/union/enum/typedef) into local types |
Preferred SQL write surface for function metadata:
UPDATE funcs SET name = '...', prototype = '...' WHERE address = ...- or
INSERT INTO names(address, name) VALUES (..., '...')UPDATE names SET name = '...' WHERE address = ... - maps to
prototypebehavior and invalidates decompiler cache.type_at/set_type - For per-call indirect-call typing, use from the decompiler surface.
apply_callee_type(call_ea, decl)
| 函数 | 描述 |
|---|---|
| 读取地址处应用的类型声明 |
| 在地址处应用C语言声明/类型(空声明会清除类型; |
| 将C语言声明(结构体/联合体/枚举/类型定义)导入本地类型 |
函数元数据的首选SQL写入方式:
UPDATE funcs SET name = '...', prototype = '...' WHERE address = ...- 或
INSERT INTO names(address, name) VALUES (..., '...')UPDATE names SET name = '...' WHERE address = ... - 与
prototype行为关联,并会使反编译器缓存失效。type_at/set_type - 如需为每个调用的间接调用设置类型,请使用反编译器接口中的。
apply_callee_type(call_ea, decl)
Python Execution
Python执行
| Function | Description |
|---|---|
| Execute Python snippet and return captured output text |
| Execute Python file and return captured output text |
Runtime guard:
sql
PRAGMA idasql.enable_idapython = 1;sql
SELECT idapython_snippet('print("hello from idapython")');
SELECT idapython_file('C:/temp/script.py');
SELECT idapython_snippet('counter = globals().get("counter", 0) + 1; print(counter)', 'alpha');| 函数 | 描述 |
|---|---|
| 执行Python代码片段并返回捕获的输出文本 |
| 执行Python文件并返回捕获的输出文本 |
运行时防护:
sql
PRAGMA idasql.enable_idapython = 1;sql
SELECT idapython_snippet('print("hello from idapython")');
SELECT idapython_file('C:/temp/script.py');
SELECT idapython_snippet('counter = globals().get("counter", 0) + 1; print(counter)', 'alpha');Context Awareness (Plugin UI)
上下文感知(插件UI)
| Function | Description |
|---|---|
| Return current UI/widget/context JSON for context-aware prompts (plugin-only) |
sql
SELECT get_ui_context_json();| 函数 | 描述 |
|---|---|
| 返回当前UI/组件/上下文的JSON数据(仅插件可用) |
sql
SELECT get_ui_context_json();Item Analysis
项分析
Use for item classification, size, and raw flags:
headssql
SELECT address, size, type, flags, disasm
FROM heads
WHERE address = 0x401000;使用进行项分类、大小和原始标志的查询:
headssql
SELECT address, size, type, flags, disasm
FROM heads
WHERE address = 0x401000;Instruction Details
指令详情
Use and for decoded instruction facts. exposes one row per non-void operand.
instructionsinstruction_operandsinstruction_operandssql
SELECT address, itype, mnemonic
FROM instructions
WHERE func_addr = 0x401000
LIMIT 10;
SELECT opnum, text, type_code, type_name, value
FROM instruction_operands
WHERE address = 0x401000
ORDER BY opnum;
SELECT i.address, i.itype, i.mnemonic, i.size, o.opnum, o.text, o.type_name, o.value
FROM instructions i
LEFT JOIN instruction_operands o
ON o.address = i.address AND o.address = 0x401000
WHERE i.address = 0x401000
ORDER BY o.opnum;使用和获取解码后的指令信息。为每个非空操作数提供一行数据。
instructionsinstruction_operandsinstruction_operandssql
SELECT address, itype, mnemonic
FROM instructions
WHERE func_addr = 0x401000
LIMIT 10;
SELECT opnum, text, type_code, type_name, value
FROM instruction_operands
WHERE address = 0x401000
ORDER BY opnum;
SELECT i.address, i.itype, i.mnemonic, i.size, o.opnum, o.text, o.type_name, o.value
FROM instructions i
LEFT JOIN instruction_operands o
ON o.address = i.address AND o.address = 0x401000
WHERE i.address = 0x401000
ORDER BY o.opnum;Decompilation
反编译
| Function | Description |
|---|---|
| PREFERRED — Full pseudocode with line prefixes |
| Force re-decompilation (use after writes/renames) |
| Apply a prototype to one indirect/dynamic call site |
| Read explicit call-site prototype when present |
| JSON array of persisted argument-loader instruction EAs |
| Set/clear union selection path at EA |
| Set/clear union selection path by |
| PREFERRED call-arg targeting helper |
| Resolve call-arg coordinate to explicit |
| Resolve generic expression coordinate to |
| Set/clear union selection via expression coordinate |
| Read union selection path JSON at EA |
| Read union selection path JSON by |
| Read union selection JSON via call-arg coordinate |
| Read union selection JSON via expression coordinate |
| Set/clear numform by EA + operand index |
| Read numform JSON by EA + operand index |
| Set/clear numform by ctree item id |
| Read numform JSON by ctree item id |
| Set/clear numform via call-arg coordinate |
| Read numform JSON via call-arg coordinate |
| Set/clear numform via expression coordinate |
| Read numform JSON via expression coordinate |
Decompiler local and label mutation is table-driven:
- List locals with .
SELECT idx, name, type, comment, size, is_arg, is_result, stkoff, mreg FROM ctree_lvars WHERE func_addr = ... ORDER BY idx - Rename or comment locals with or
UPDATE ctree_lvars SET name = ...usingcomment = ...plus a selectedfunc_addr.idx - Rename labels with .
UPDATE ctree_labels SET name = ... WHERE func_addr = ... AND label_num = ...
| 函数 | 描述 |
|---|---|
| 推荐使用 — 带行前缀的完整伪代码 |
| 强制重新反编译(在写入/重命名后使用) |
| 为单个间接/动态调用点应用原型 |
| 读取调用点处的显式原型(若存在) |
| 持久化参数加载指令EA的JSON数组 |
| 在EA处设置/清除联合体选择路径 |
| 通过 |
| 推荐使用 调用参数定位助手 |
| 将调用参数坐标解析为明确的 |
| 将通用表达式坐标解析为 |
| 通过表达式坐标设置/清除联合体选择路径 |
| 读取EA处的联合体选择路径JSON数据 |
| 通过 |
| 通过调用参数坐标读取联合体选择路径JSON数据 |
| 通过表达式坐标读取联合体选择路径JSON数据 |
| 通过EA + 操作数索引设置/清除数字格式 |
| 通过EA + 操作数索引读取数字格式JSON数据 |
| 通过ctree项ID设置/清除数字格式 |
| 通过ctree项ID读取数字格式JSON数据 |
| 通过调用参数坐标设置/清除数字格式 |
| 通过调用参数坐标读取数字格式JSON数据 |
| 通过表达式坐标设置/清除数字格式 |
| 通过表达式坐标读取数字格式JSON数据 |
反编译器本地变量和标签修改基于表驱动:
- 使用列出本地变量。
SELECT idx, name, type, comment, size, is_arg, is_result, stkoff, mreg FROM ctree_lvars WHERE func_addr = ... ORDER BY idx - 使用或
UPDATE ctree_lvars SET name = ...,结合comment = ...和选中的func_addr来重命名或注释本地变量。idx - 使用来重命名标签。
UPDATE ctree_labels SET name = ... WHERE func_addr = ... AND label_num = ...
File Generation
文件生成
| Function | Description |
|---|---|
| Generate a full-database listing file (LST) |
sql
SELECT gen_listing('C:/tmp/full.lst');| 函数 | 描述 |
|---|---|
| 生成完整数据库列表文件(LST格式) |
sql
SELECT gen_listing('C:/tmp/full.lst');Graph Generation
图生成
| Function | Description |
|---|---|
| Generate CFG as DOT graph string |
| Write CFG DOT to file |
| Generate database schema as DOT |
sql
SELECT gen_cfg_dot(0x401000);
SELECT gen_schema_dot();| 函数 | 描述 |
|---|---|
| 生成控制流图(CFG)的DOT格式字符串 |
| 将CFG的DOT格式内容写入文件 |
| 生成数据库模式的DOT格式内容 |
sql
SELECT gen_cfg_dot(0x401000);
SELECT gen_schema_dot();Entity Search (grep)
实体搜索(grep)
Canonical workflow guidance lives in .
../grep/SKILL.md| Surface | Description |
|---|---|
| Structured rows for composable SQL search |
sql
SELECT name, kind, address FROM grep WHERE pattern = 'sub%' LIMIT 10;
SELECT name, kind, address FROM grep WHERE pattern = 'init' LIMIT 50 OFFSET 0;标准工作流指南位于中。
../grep/SKILL.md| 接口 | 描述 |
|---|---|
| 结构化行数据,用于组合式SQL搜索 |
sql
SELECT name, kind, address FROM grep WHERE pattern = 'sub%' LIMIT 10;
SELECT name, kind, address FROM grep WHERE pattern = 'init' LIMIT 50 OFFSET 0;String List Functions
字符串列表函数
| Function | Description |
|---|---|
| Rebuild with ASCII + UTF-16, minlen 5 (default) |
| Rebuild with custom minimum length |
| Rebuild with custom length and type mask |
Type mask: =ASCII, =UTF-16, =UTF-32, =ASCII+UTF-16 (default), =all.
Use for the current string-list count without materializing string rows.
12437COUNT(*) FROM stringssql
SELECT COUNT(*) AS strings FROM strings;
SELECT rebuild_strings();
SELECT rebuild_strings(4);
SELECT rebuild_strings(5, 7);| 函数 | 描述 |
|---|---|
| 使用ASCII + UTF-16、最小长度5(默认值)重建字符串列表 |
| 使用自定义最小长度重建字符串列表 |
| 使用自定义长度和类型掩码重建字符串列表 |
类型掩码:=ASCII,=UTF-16,=UTF-32,=ASCII+UTF-16(默认),=所有类型。
使用获取当前字符串列表的数量,无需实例化字符串行。
12437COUNT(*) FROM stringssql
SELECT COUNT(*) AS strings FROM strings;
SELECT rebuild_strings();
SELECT rebuild_strings(4);
SELECT rebuild_strings(5, 7);