P1: Code/data repair (define function|code|data, undefine)

[mahaloz]

What & why

Auto-analysis misses functions and mislabels code/data — routine on obfuscated or hand-written binaries. This adds the repair primitives IDALib exposes.

New capabilities

• decompiler define function|code|data <addr> and decompiler undefine <addr>.
• Interface define_function/define_code/define_data/undefine (base raises NotImplementedError) with per-backend implementations:

  Backend	define function	define code	define data	undefine
  IDA	add_func	create_insn	create_data/SetType	del_func+del_items
  Ghidra	createFunction	disassemble	createData	removeFunction+clearListing
  Binary Ninja	create_user_function	(via function)	define_user_data_var	remove_user_function
  angr	—	—	—	—

• undefine removes a function if one starts at the address, then clears the requested span.

Example

$ decompiler undefine 0x664 --size 137     # clear authenticate
undefined: True
$ decompiler define code 0x664
$ decompiler define function 0x664          # re-create it
defined: function
success: True
$ decompiler define data 0x4040 --type int

Tests

test_undefine_and_define_function (round-trip: define function reporting success is the strong signal that undefine truly removed the function — add_func/createFunction only succeed when none is there) and test_define_data.

• IDA: pass. Ghidra: pass. angr: asserts the unsupported (exit 2) path.

Note: list_functions uses the light-artifact path, which lags IDA's del_func by a query (while get_func is immediately consistent), so the test verifies via the define-success signal rather than the transient list state.

---

Sixth PR in the IDALib-parity series. Based on feat/cli-search (#208).

🤖 Generated with Claude Code

https://claude.ai/code/session_01HfZHdprXg38re1XyKxzGg5

[mahaloz]

Integrated into main as commit 99f15a7. The stack got tangled when the bottom PRs (#204/#205) were squash-merged (#205 landed on feat/cli-persistence instead of main), so I reconciled by cherry-picking the whole series onto main linearly. The exact reviewed content of this PR is on main — closing this stacked PR as its changes are shipped.