VERY basic descriptor init function, sets many fields to user space sane defaults

Not certain this is necessary, but included to provide for message printing from the unicorn thread

IDA only runs on little-endian platforms

Read thread registers. This function is called from debthread. \param tid thread id \param clsmask bitmask of register classes to read \param re

This function is called from within the unicorn thread We do all checking for debugger related events at each instruction here

Unicorn is broken in 16-bit mode and may return an offset OR a linear address when querying EIP depending on the context from which reg_read is called

VERY basic descriptor init function, sets many fields to user space sane defaults

//Unicorn permissions are the same as Linux permissions #define PROT_READ 0x1 // page can be read #define PROT_WRITE 0x2 // page can be w

* Register new IDC functions for use with the debugger */

Call application function. This function calls a function from the debugged application. This function is called from debthread \param func_ea ad

Cleanup after appcall(). The debugger module must keep the stack blob in the memory until this function is called. It will be called by the kernel for

Continue after handling the event. This function is called from debthread. \retval 1 ok \retval 0 failed \retval -1 network error

Enable/Disable tracing. "trace_flags" can be a set of STEP_TRACE, INSN_TRACE, BBLK_TRACE or FUNC_TRACE. See thread_t::trace_mode in debugger.h. This f

Detach from the debugged process. May be called while the process is running or suspended. Must detach from the process in any case. The kernel will r

Evaluate a low level breakpoint condition at 'ea'. Other evaluation errors are displayed in a dialog box. This call is rarely used by IDA when the pro

Stop the process. May be called while the process is running or suspended. Must terminate the process in any case. The kernel will repeatedly call get

Get (store to out_pattrs) process/debugger-specific runtime attributes. This function is called from main thread.

Get a pending debug event and suspend the process. This function will be called regularly by IDA. This function is called from debthread. IMPORTANT: c

Get information on the memory areas. The debugger module fills 'areas'. The returned vector MUST be sorted. This function is called from debthread. \r

Return information about the n-th "compatible" running process. If n is 0, the processes list is reinitialized. This function is called from the main

Initialize debugger. This function is called from the main thread. \return success

Is it possible to set breakpoint?. This function is called from debthread or from the main thread if debthread is not running yet. It is called to ver

Is tracing enabled? ONLY used for tracers. "trace_bit" can be one of the following: STEP_TRACE, INSN_TRACE, BBLK_TRACE or FUNC_TRACE

Map process address. This function may be absent. This function is called from debthread. \param off offset to map \param regs current regist

\name Remote file Open/close/read a remote file. These functions are called from the main thread -1-error

Prepare to pause the process. Normally the next get_debug_event() will pause the process If the process is sleeping then the pause will not occur unti

Read process memory. Returns number of read bytes. This function is called from debthread. \retval 0 read error \retval -1 process does not exist any

Rebase database if the debugged program has been rebased by the system. This function is called from the main thread.

Execute a command on the remote computer. \return exit code

Perform a debugger-specific function. This function is called from debthread

Set exception handling. This function is called from debthread or the main thread.

Start an executable to debug. This function is called from debthread. \param path path to executable \param args arguments t

This function will be called by the kernel each time it has stopped the debugger process and refreshed the database. The debugger module may add infor

Terminate debugger. This function is called from the main thread. \return success

Get information about the base of a segment register. Currently used by the IBM PC module to resolve references like fs:0. This function is called fro

\name Threads The following functions manipulate threads. These functions are called from debthread. \retval 1 ok \retval 0 failed \retval -1 net

Add/del breakpoints. bpts array contains nadd bpts to add, followed by ndel bpts to del. This function is called from debthread. \return number of suc

Calculate the call stack trace. This function is called when the process is suspended and should fill the 'trace' object with the information about th