Reverse Engineering Asked on March 2, 2021
Hello all and sorry for my bad English
I am trying to test an example for developping plugin in C++ with IDA from the book :
http://www.binarypool.com/idapluginwriting/idapw.pdf
I am using Visual c++ 2019.
The plugin example source is :
#include <ida.hpp>
#include <idp.hpp>
#include <loader.hpp>
int IDAP_init(void)
{
// Do checks here to ensure your plug-in is being used within
// an environment it was written for. Return PLUGIN_SKIP if the
// checks fail, otherwise return PLUGIN_KEEP.
return PLUGIN_KEEP;
}
void IDAP_term(void)
{
// Stuff to do when exiting, generally you'd put any sort
// of clean-up jobs here.
return;
}
// The plugin can be passed an integer argument from the plugins.cfg
// file. This can be useful when you want the one plug-in to do
// something different depending on the hot-key pressed or menu
// item selected.
void IDAP_run(int arg)
{
// The "meat" of your plug-in
msg("Hello world!");
return;
}
// There isn't much use for these yet, but I set them anyway.
char IDAP_comment[] = "This is my test plug-in";
char IDAP_help[] = "My plugin";
// The name of the plug-in displayed in the Edit->Plugins menu. It can
// be overridden in the user's plugins.cfg file.
char IDAP_name[] = "My plugin";
// The hot-key the user can use to run your plug-in.
char IDAP_hotkey[] = "Alt-X";
// The all-important exported PLUGIN object
plugin_t PLUGIN =
{
IDP_INTERFACE_VERSION, // IDA version plug-in is written for
0, // Flags (see below)
IDAP_init, // Initialisation function
IDAP_term, // Clean-up function
IDAP_run, // Main plug-in body
IDAP_comment, // Comment – unused
IDAP_help, // As above – unused
IDAP_name, // Plug-in name shown in
// Edit->Plugins menu
IDAP_hotkey // Hot key to run the plug-in
};
When compiling, I got 2 errors :
Error C2440 'initializing': cannot convert from 'int (__cdecl *)(void)' to 'plugmod_t *(__cdecl *)(void)' Sdk75Project1 F:DeveloppementIDASdk75ProjectSdk75Project1Sdk75Project1main.cpp 48
Error C2440 'initializing': cannot convert from 'void (__cdecl *)(int)' to 'bool (__cdecl *)(size_t)' Sdk75Project1 F:DeveloppementIDASdk75ProjectSdk75Project1Sdk75Project1main.cpp 50
I found nothing about that on the Net… Can someone give me an idea of what is going wrong ?
Thanks you very much.
I have used the informations given in the readme.txt to configure VC++ :
How to set up Visual C++ 2017 for IDA Plugins
---------------------------------------------
This guide will help you set up a Visual C++ project that targets both ida32 and ida64 plugins.
Remember that, even though ida32 is used to work on 32-bit files, it is also an x64 application.
Therefore, both plugins (ida32 and ida64) must be built for the x64 platform.
1. File | New | Project From Existing Code...
2. What type of project would you like to create: Visual C++
<next>
3. Project file location: <folder where you have your files>
Project name: <your plugin's name>
<finish>
Once the project is initialized, right-click on the project name and pick Properties.
4. Configuration Manager...
Active solution platform: select "x64"
<Close>
5. General | Project Defaults | Configuration Type
Dynamic Library (.dll)
<apply>
6. C/C++ | General | Additional Include Directories
Enter the SDK's include folder in "Include search paths (/I)": eg. C:idasdkinclude;
<apply>
7. C/C++ | Code Generation | Runtime library (visible only after you add one .cpp file to the project)
Multi-threaded DLL (/MD)
<apply>
8. Linker | Command Line | Additional options
- for processor modules: /EXPORT:LPH
- for plugins: /EXPORT:PLUGIN
- for loaders: /EXPORT:LDSC
<apply>
The steps above constituted the common configuration for both ida32 and ida64 configurations.
We will now create the separate configurations.
9. Still under "Configuration Manager..."
- under the "Configuration" column, click on "Debug"
- click "<Edit...>"
- click "Rename"
- add an "ida32" prefix to the configuration name, such as "ida32 Debug"
- <Enter>
- <Yes>
- <Close>
- under "Active solution configuration", click on "Debug"
- click "<Edit...>"
- click "Rename"
- add an "ida32" prefix to the configuration name, such as "ida32 Debug"
- <Enter>
- <Yes>
- <Close>
- under "Active solution configuration", click on the new configuration name "ida32 Debug"
- click "<New...>"
- use a similar name, but with the "ida64" prefix, such as "ida64 Debug"
- Copy settings from: "ida32 Debug"
- <Ok>
- <Close>
In the "Property Page", under "Configuration", select "ida32 Debug".
10. Debugging | Command
- for ida32: C:Program FilesIDA 7.2ida.exe
- for ida64: C:Program FilesIDA 7.2ida64.exe
<apply>
11. C/C++ | Preprocessor | Preprocessor Definitions
- for ida32: __NT__;
- for ida64: __NT__;__EA64__;
<apply>
12. Linker | General | Output File:
- for ida32: $(OutDir)$(ProjectName).dll
- for ida64: $(OutDir)$(ProjectName)64.dll
<apply>
13. Linker | Input | Additional Dependencies
- for ida32: C:idasdklibx64_win_vc_32ida.lib
- for ida64: C:idasdklibx64_win_vc_64ida.lib
<apply>
In the "Property Page", under "Configuration", select "ida64 Debug" and repeat the last three steps.
You should now be capable to easily switch between the "ida32 Debug" and "ida64 Debug" configurations and build your project.
Ok I change the retourned values and now I got other errors :
Error LNK2001 unresolved external symbol LDSC Sdk75Project1 F:DeveloppementIDASdk75ProjectSdk75Project1Sdk75Project1LINK 1
Error LNK2001 unresolved external symbol LPH Sdk75Project1 F:DeveloppementIDASdk75ProjectSdk75Project1Sdk75Project1LINK 1
My modified code is :
#include <ida.hpp>
#include <idp.hpp>
#include <loader.hpp>
plugmod_t* IDAP_init(void)
{
// Do checks here to ensure your plug-in is being used within
// an environment it was written for. Return PLUGIN_SKIP if the
// checks fail, otherwise return PLUGIN_KEEP.
return PLUGIN_KEEP;
}
void IDAP_term(void)
{
// Stuff to do when exiting, generally you'd put any sort
// of clean-up jobs here.
return;
}
// The plugin can be passed an integer argument from the plugins.cfg
// file. This can be useful when you want the one plug-in to do
// something different depending on the hot-key pressed or menu
// item selected.
bool IDAP_run(size_t arg)
{
// The "meat" of your plug-in
msg("Hello world!");
return true;
}
// There isn't much use for these yet, but I set them anyway.
char IDAP_comment[] = "This is my test plug-in";
char IDAP_help[] = "My plugin";
// The name of the plug-in displayed in the Edit->Plugins menu. It can
// be overridden in the user's plugins.cfg file.
char IDAP_name[] = "My plugin";
// The hot-key the user can use to run your plug-in.
char IDAP_hotkey[] = "Alt-X";
// The all-important exported PLUGIN object
plugin_t PLUGIN =
{
IDP_INTERFACE_VERSION, // IDA version plug-in is written for
0, // Flags (see below)
IDAP_init, // Initialisation function
IDAP_term, // Clean-up function
IDAP_run, // Main plug-in body
IDAP_comment, // Comment – unused
IDAP_help, // As above – unused
IDAP_name, // Plug-in name shown in
// Edit->Plugins menu
IDAP_hotkey // Hot key to run the plug-in
};
PS : It's ok now, I removed the EXPORTs..
Answered by rdpdo on March 2, 2021
For decades, IDA's plugin interface remained the same. Your plugin had to export a plugin_t
structure named PLUGIN
, which contained function pointers to its init
, run
, and optional term
functions. You can see that in your snippets above.
IDA 7.5 introduced a new plugin interface for C++ plugins, based on inheritance from the plugmod_t
interface, seemingly because future versions of IDA will support multiple databases being loaded at the same time. Download the IDA SDK and look in its plugins
subdirectory. All of the existing example plugins have been updated to use the new interface.
TL;DR plugin source code developed for versions less than 7.5 is not going to work anymore for 7.5 and above; it needs to be modified to use the new plugmod_t
interface.
P.S. don't add updates to your post as comments and don't make major edits to your original post. Ask one question at a time. Make a new post if you have a different question.
Answered by Rolf Rolles on March 2, 2021
Get help from others!
Recent Answers
Recent Questions
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP