INativeCodeUnit

Convert a flexible native code unit address to a canonical memory address.

Unit addresses can be code labels, pseudo labels, string representations of physical addresses, etc.

Convenience method used to retrieve a class by name.

Get the list of classes.

Get the code analyzer. Life-cycle information: this method will return null until the unit is processed.

Retrieve the currently-set analyzer extensions manager. Life-cycle information: this method will return null until the unit is processed.

Note: third-party code should not use this for now.

Get the helper object used to format instructions into a sink.

Do not confuse the code formatter with the unit's formatter.

Get the code model.

Provide the parent code object container, if there is one. Typically, that would be an ELF, PE-COFF, or Mach-O unit accessible through the generic interface ICodeObjectUnit or any of the derived specialized interfaces.

Provide the disassembly document. This is a convenience method that returns an INativeDisassemblyDocument instead of a generic ITextDocument (provided by getFormatter()).

Retrieve the endianness. This method is for convenience only; byte ordering can always be retrieved through the IProcessor.

Convenience method used to retrieve a field by name.

Get the list of fields.

Retrieve the size of the image

Retrieve an internal method by address (any address within the method). An internal method has an associated data item associated to it. If multiple methods share the provided address, the one with the lowest entry-point address is returned.

Retrieve all internal methods. An internal method has an associated data item associated to it.

Retrieve the internal methods spanning over the provided address

Optionally provide an object associated with the given item. This method may return null, an opaque object, or an object defined by the contract of the implementing object or sub-interface. The SPI of sub-interfaces should specify the item id formats, if any, as well as types and semantics associated with the objects returned by this method.

Retrieve the model lock, used to request a full-access model lock or a partial, read-only, transactional lock. All plugin code accessing the native units and units relying on native units should use those locks to perform operations safely in a concurrent environment.

Retrieve the virtual memory managed used by this unit.

Convenience method used to retrieve a method by name.

Get the list of methods.

Get the list of code packages.

Retrieve the difference between Physical Image base as set by #setPhysicalImageBase(Long) and Virtual Image Base as retrieved by getVirtualImageBase(). This value should only be used for rendering.

Retrieve the machine code parser (pseudo-processor) managed by this unit.

Get the list of code strings.

Retrieve the simplest symbol address that corresponds to the given physical address. Same as getSymbolicStringAddress(address, 0).

Retrieve a symbol address that corresponds to the given physical address.

Example: if address if at offset 10h inside method foo() (at address 401000h), querying this method with sspref=2 will return a label "foo+10h"; however, querying with sspref=0 would simply return "401010h".

Get the global type library service.

Get the global type manager used by this unit.

Get the list of types.

Retrieve the virtual image base, indicated in the code container (most of the time a PE, ELF, or MachO container). This virtual address is the reference for every memory access.

Start an analysis.

Optionally set the current optional virtual memory (VM) used by this unit. This method should be called at most once (typically done in the unit's identifier), before processing the unit. It is optional; the VM object set may be overridden during unit processing if it is deemed inappropriate to handle the code object. Therefore, after processing, client code should always retrieve the actual VM object via getMemory().

Set the real (physical) image base for this piece of code. That address is the real address of the first loaded byte on a target device. The existence of this method implies that at most one physical address can be used at any time. (Typically, debuggers use this method to let code units know of where they are currently mapped, which in turn is used to better render assembly output.) Generally, the physical image address changes across different launches.

Set the code parser (processor) used by this unit. This method should be called at most once (typically done in the unit's identifier), before processing the unit.

Parse and attempt to create a routine at the provided address. The processor mode used will be the default one, and the analysis will be done forcefully.

Parse and attempt to create a routine at the provided address.

Parse and attempt to create a routine at the provided address. The analysis is done forcefully.

Preferred image base for raw binary files. Will be disregarded and set to a proper value for managed binaries.