IDA协作插件/IDA Undo Point实验 & 技术细节/
IDA Undo 运行时信息

IDA Undo 运行时信息

记录了执行操作中的不同时刻数据的变化
  • 在每次cancel_undo_point 返回0 ，即新的undo_point形成时输出全部undo point的信息
 
注意到：
  1. cancel_undo_point后，undo point中仅有少量数据，而实际上操作对应数据量有好几倍
    1. 第一次的MakeCode，cancel_undo_point时为183，最终有7475
    2. 第二次的MakeCode则为183/1008
    3. 第三次的为319/1742
    4. 第四次的FunctionEnd则为380/22478
  1. 可以很明显的看出cancel_undo_point时IDA完全没有展开自动分析
create_undo_point: pointDescLen 41 b'\x08MakeCode\x04Code\x02'
create_undo_point ret: 1
cancel_undo_point: flag 0
cancel_undo_point ret: 0
Got dbctx_qty_funptr: 0x581a61a0
Got dbctx: 0x197f5f980e0
(True, <UndoPoint totalsize=183, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xd4\x00\x01\xff\xff\xff\xff\xff\\\x1a'>>)
create_undo_point: pointDescLen 41 b'\x08MakeCode\x04Code\x02'
create_undo_point ret: 1
cancel_undo_point: flag 0
cancel_undo_point ret: 0
(True, <UndoPoint totalsize=183, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xc0\x00\x01\xff\xff\xff\xff\xff-\x1b'>>)
(False, <UndoPoint totalsize=7475, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xd4\x00\x01\xff\xff\xff\xff\xff\\\x1a'>>)
create_undo_point: pointDescLen 41 b'\x08MakeCode\x04Code\x02'
create_undo_point ret: 1
cancel_undo_point: flag 0
cancel_undo_point ret: 0
(True, <UndoPoint totalsize=319, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\x84\x00\x01\xff\xff\xff\xff\xff-\x16'>>)
(False, <UndoPoint totalsize=1008, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xc0\x00\x01\xff\xff\xff\xff\xff-\x1b'>>)
(False, <UndoPoint totalsize=7475, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xd4\x00\x01\xff\xff\xff\xff\xff\\\x1a'>>)
create_undo_point: pointDescLen 56 b'\x0bFunctionEnd\x10Set functio'
create_undo_point ret: 1
cancel_undo_point: flag 0
cancel_undo_point ret: 0
(True, <UndoPoint totalsize=380, <UNDO_RECORD_START opName=b'FunctionEnd' opDesc=b'Set function end' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x95s\x00\x01\xff\xff\xff\xff\xff-\x1a'>>)
(False, <UndoPoint totalsize=1742, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\x84\x00\x01\xff\xff\xff\xff\xff-\x16'>>)
(False, <UndoPoint totalsize=1008, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xc0\x00\x01\xff\xff\xff\xff\xff-\x1b'>>)
(False, <UndoPoint totalsize=7475, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xd4\x00\x01\xff\xff\xff\xff\xff\\\x1a'>>)
create_undo_point: pointDescLen 43 b'\x08MakeName\x06Rename\x02'
create_undo_point ret: 1
cancel_undo_point: flag 0
cancel_undo_point ret: 1
create_undo_point: pointDescLen 43 b'\x08MakeName\x06Rename\x02'
create_undo_point ret: 1
cancel_undo_point: flag 0
cancel_undo_point ret: 0
(True, <UndoPoint totalsize=151, <UNDO_RECORD_START opName=b'MakeName' opDesc=b'Rename' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x942\x00\x01\xff\xff\xff\xff\xff1\x1d'>>)
(False, <UndoPoint totalsize=22478, <UNDO_RECORD_START opName=b'FunctionEnd' opDesc=b'Set function end' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x95s\x00\x01\xff\xff\xff\xff\xff-\x1a'>>)
(False, <UndoPoint totalsize=1742, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\x84\x00\x01\xff\xff\xff\xff\xff-\x16'>>)
(False, <UndoPoint totalsize=1008, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xc0\x00\x01\xff\xff\xff\xff\xff-\x1b'>>)
(False, <UndoPoint totalsize=7475, <UNDO_RECORD_START opName=b'MakeCode' opDesc=b'Code' q1=2 q2=0 view=b'IDA View-A' pos=b'\x00\x94\xd4\x00\x01\xff\xff\xff\xff\xff\\\x1a'>>)
Copyright 2026 Misty