Examples | Using matchers for imports, exports, functions, structures, names, strings, types - arizvisa/ida-minsc GitHub Wiki

Listing random things for random reasons

Need to list all functions that the disassembler failed at calculating the stack pointer for? Perhaps you're a decompiler perfectionist and want to see how much work is left? Want to check how much damage Lumina did when applying it to your database? Maybe you have a module and a list of ordinal numbers that you want to see the imports for.

db.functions.list(problems=True)
db.functions.list(decompiled=False)
db.functions.list(lumina=True)
db.imports.list(module='*.ocx', ordinal=range(100,200))
db.types.list(name='*::*', defined=False)
db.types.list(enumeration=True)
db.names.list(function=False, imports=False, typed=True)

Tagging all exports

Not too useful, but at least you know all functions that are exported by hovering over it.

for i, ea in enumerate(db.exports.iterate()):
    func.tag(ea, 'export', i)

Tagging all exports that are not functions

Ah, but then you realize that not all things exported are functions. So we'll reassign the tag for "export" to "export.data" and filter the exports for things that are not functions.

for ea in db.exports.iterate(function=False):
    db.tag(ea, 'export.data', db.tag(ea, 'export', None))

Tagging all exports that are not functions where the tags are incomplete

Turns out that you made an assumption that every export is at a different address. Your disassembler, however, might create a structure that results in more than one export being at the same address. This results in that db.tag(ea, 'export', None) call raising an exception, interrupting the work we've done. This is fine, we'll just go back through our exports that are not functions, and iterate through the ones where we haven't changed the tag from "export" to "export.data".

for ea in db.exports.iterate(tagged='export', function=False):
    db.tag(ea, 'export.data', db.tag(ea, 'export', None))

db.exports.list(tagged={'export', 'export.data'})