I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see this stuff in the code section:

.text:100A1424     aInternetfreepr db 'InternetFreeProxyInfoList',0
.text:100A1424                                             ; DATA XREF: .text:10038688o
.text:100A143E                     align 10h
.text:100A1440     aInternetfreeco db 'InternetFreeCookies',0 ; DATA XREF: .text:10038680o
.text:100A1454     aInternetfortez db 'InternetFortezzaCommand',0
.text:100A1454                                             ; DATA XREF: .text:10038678o

is there a method I can call to defer between code and data using only the EA?

Thanks in advance.


IDA utilizes flags for checking the properties of locations.

Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code.

You can find the exact definitions of the flags in IDC.IDC. A small excerpt:

#define isCode(F)       ((F & MS_CLS) == FF_CODE) // is code byte?
#define isData(F)       ((F & MS_CLS) == FF_DATA) // is data byte?
#define isTail(F)       ((F & MS_CLS) == FF_TAIL) // is tail byte?
#define isUnknown(F)    ((F & MS_CLS) == FF_UNK)  // is unexplored byte?
#define isHead(F)       ((F & FF_DATA) != 0)      // is start of code/data?

You can use this from Python like so:

ea = ScreenEA()
flags = GetFlags(ea)

if isData(flags):
    print("It's data!")

elif isCode(flags):
    print("It's code!")

Additionally, you can use Sark to get it done:

import sark

# For current line

# For specific line

Note: I am the creator of Sark.

  • Sark is a great and well written library. However, it is much slower than using the "native" IDAPython functions (the speed using Sark was unbearable and improved significantly after rewriting some of its functionality) – Aviv Sep 8 '16 at 9:03
  • The performance is indeed an issue. I still prefer it in most cases as it easier to write in, and performance can be improved later by replacing the relevant code. – tmr232 Sep 8 '16 at 11:36
  • Well said. I'm enjoying much of your code projects, keep going bro – Aviv Sep 8 '16 at 12:07
  • I don't want this come off as being rude, but it is good etiquette and a SE requirement to fully disclose your affiliation to solutions you advertise in your answers. See reverseengineering.stackexchange.com/help/behavior – NirIzr Sep 9 '16 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.