### Execute IDA SDK Build Command Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt An example command to initiate the IDA SDK build process using 'mo.bat' with 12 parallel jobs, typically executed from a shell environment like Cygwin. ```Shell /cygdrive/c/idasdk $ mo.bat -j 12 ``` -------------------------------- ### Configure Cygwin and PATH for IDA SDK Build on Windows Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt These commands demonstrate how to start the Cygwin shell or add Cygwin's binary directory to the system PATH in a Windows Command Prompt, which is essential for building the IDA SDK on Windows. ```Batch set PATH=C:\cygwin64\bin;%PATH% ``` ```Shell C:\cygwin\cygwin.bat ``` -------------------------------- ### Add IDA SDK Bin Directory to System PATH Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt These commands illustrate how to add the IDA SDK's `bin` directory to the system's PATH environment variable, enabling direct execution of SDK tools from any directory. Examples are provided for Windows Command Prompt, Cygwin, and Linux/macOS shells. ```Batch set PATH=C:\idasdk\bin;%PATH% ``` ```Shell export PATH=/cygdrive/c/idasdk/bin:$PATH ``` ```Shell export PATH=~/idasdk/bin:$PATH ``` -------------------------------- ### Generate IDA SDK Configuration File on Windows Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt These commands show how to generate the SDK's configuration file, which is required before building. This can be done from either the Windows Command Prompt or a Cygwin shell. ```Batch bin\m.bat env ``` ```Shell bin\m.bat env ``` -------------------------------- ### Set Visual C++ Installation Directory for IDA SDK Build Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt This command sets the VCINSTALLDIR environment variable, pointing to the Visual C++ installation path. This is crucial for the SDK build process to locate the necessary compiler tools on Windows. ```Batch set VCINSTALLDIR=C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\ ``` -------------------------------- ### Build IDA SDK Components on Windows using Batch Files Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt On MS Windows, specific batch files located in the `bin/` directory are used to build different IDA SDK components. These commands show how to invoke them, including the option to parallelize the build process using the `-j` argument. ```Batch mo.bat ``` ```Batch mso.bat ``` ```Batch mso32.bat ``` ```Batch mo.bat -j 12 ``` -------------------------------- ### Build IDA SDK on Linux and macOS using Make Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt These commands demonstrate how to compile the IDA SDK on Linux and macOS using the `make` utility. They cover basic builds, specifying target platforms, building for IDA, and building 32-bit debug servers. ```Makefile make ``` ```Makefile make __LINUX__=1 ``` ```Makefile make __MAC__=1 __ARM__=1 ``` ```Makefile make ``` ```Makefile make __EA32__=1 __X86__=1 ``` -------------------------------- ### Define Target Platform for IDA SDK Build Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt These environment variables specify the target operating system for the IDA SDK build process. Setting these ensures the correct platform-specific compilation. Examples show how to set them in a .bashrc file for persistent configuration. ```Shell export __NT__=1 ``` ```Shell export __LINUX__=1 ``` ```Shell export __MAC__=1\nexport __ARM__=1 # if needed (for Apple Silicon) ``` -------------------------------- ### Filter IDA SDK Build Output with idamake.pl Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt The `idamake.pl` script can be used as a post-processing tool for `make` to filter out non-critical compiler warnings. This snippet provides examples of its usage, including enabling command line filtering with IDAMAKE_SIMPLIFY. ```Shell make __LINUX__=1 ``` ```Shell make NDEBUG=1 __MAC__=1 __ARM__=1 ``` ```Shell make NDEBUG=1 __NT__=1 ``` ```Shell IDAMAKE_SIMPLIFY=1 idamake.pl [...] ``` -------------------------------- ### Specify Microsoft Windows SDK v7.1 Path for Debug Servers Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt This command sets the MSSDK71_PATH environment variable, which is necessary if you intend to build the debug servers for the IDA SDK on Windows. Ensure the path is enclosed in quotes. ```Batch set MSSDK71_PATH="C:\Program Files\Microsoft SDKs\Windows\v7.1" ``` -------------------------------- ### Install IDA Python Module Source: https://github.com/shefben/ida_sdk_91/blob/main/idalib/README.txt Instructions to install the `idapro` Python package using pip from the `idalib/python` directory within the IDA Pro installation. ```bash pip install . ``` -------------------------------- ### Activate IDA Python Module Source: https://github.com/shefben/ida_sdk_91/blob/main/idalib/README.txt Command to run the `py-activate-idalib.py` script to inform the `idapro` module about the IDA Pro installation. The `-d` option can specify the installation path. ```bash python /path/to/IDA/installation/py-activate-idalib.py [-d /path/to/active/IDA/installation] ``` -------------------------------- ### Install Visual Studio Templates Source: https://github.com/shefben/ida_sdk_91/blob/main/plugins/vcsample/VSTemplates/readme.md Executes the `devenv /installvstemplates` command from a Visual Studio Command Prompt as Administrator to force Visual Studio to update its cache and install VSTemplates. This step is crucial if new project templates are not appearing after installation. ```Batch devenv /installvstemplates ``` -------------------------------- ### Define Bash Aliases for IDA SDK Build Commands Source: https://github.com/shefben/ida_sdk_91/blob/main/install_make.txt This snippet provides 'bashrc' configurations to set environment variables and create convenient aliases ('m' and 'mo') for IDA SDK build commands, improving workflow efficiency. It exports '__LINUX__', adds the SDK bin directory to PATH, and defines 'm' for 'idamake.pl' and 'mo' for a debug-disabled build. ```Shell export __LINUX__=1 export PATH=~/idasdk/bin:$PATH alias m='idamake.pl 2>&1' alias mo='NDEBUG=1 m' ``` -------------------------------- ### Set Debugging Command to IDA Executable Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Configures the debugger to launch the IDA Pro executable when starting a debug session, allowing direct debugging of the plugin within IDA. ```Visual C++ Configuration Properties -> Debugging -> Command: C:\Program Files\IDA 9.0\ida.exe ``` -------------------------------- ### Debugging Assertion Failure Call Example Source: https://github.com/shefben/ida_sdk_91/blob/main/readme_decompilers.txt Demonstrates a call to an internal debugging assertion failure function, showing the fastcall convention and string arguments as they might appear in decompiler output or debugger logs. ```IDA Pseudocode call !DbgRaiseAssertionFailure .0 ``` -------------------------------- ### Update Visual Studio Configuration Source: https://github.com/shefben/ida_sdk_91/blob/main/plugins/vcsample/VSTemplates/readme.md Executes the `devenv /updateconfiguration` command if Visual Studio still does not show the new template after attempting to install VSTemplates. This command updates the Visual Studio configuration to ensure all changes are recognized. ```Batch devenv /updateconfiguration ``` -------------------------------- ### IDA Decompiler Inter-Block Optimization Rule Source: https://github.com/shefben/ida_sdk_91/blob/main/readme_decompilers.txt This plugin installs a custom inter-block optimization rule to fix goto targets that point to a chain of gotos, improving decompiler output by simplifying control flow. It transforms chained gotos into a direct jump to the final target. ```IDA Decompiler Rule goto L1 => goto L@ ... L1: goto L2 ``` -------------------------------- ### IDA Decompiler Instruction Optimization Rule Source: https://github.com/shefben/ida_sdk_91/blob/main/readme_decompilers.txt This plugin installs a custom instruction optimization rule to propagate values, specifically demonstrating how a `mov` followed by an `xor` can be optimized into a single `mov` operation. This rule is necessary when the decompiler cannot propagate specific byte values into subsequent instructions, improving the accuracy of decompiled code. ```IDA Decompiler Rule mov #N, var.4 mov #N, var.4 xor var@1.1, #M, var@1.1 => mov #NM, var@1.1 where NM == (N>>8)^M ``` -------------------------------- ### Create New Project From Existing Code Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Initiates the project creation process in Visual Studio by selecting the 'Project From Existing Code' option. ```Visual C++ Configuration File | New | Project From Existing Code... ``` -------------------------------- ### Add IDA SDK Include Directories Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Specifies the path to the IDA SDK's include folder, allowing the compiler to find necessary header files. ```Visual C++ Configuration Properties -> C/C++ -> General -> Additional Include Directories: Include search paths (/I): C:\idasdk\include; ``` -------------------------------- ### Select Project Type as Visual C++ Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Specifies that the new project will be a Visual C++ project. ```Visual C++ Configuration What type of project would you like to create: Visual C++ ``` -------------------------------- ### Define Project Location and Name Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Sets the directory where project files will be stored and assigns a name to the new plugin project. ```Visual C++ Configuration Project file location: Project name: ``` -------------------------------- ### Configure Custom DLLs in Bochs Debugger startup.idc Source: https://github.com/shefben/ida_sdk_91/blob/main/dbg/bochs/sdk/readme.txt Demonstrates various commands for the `startup.idc` script to load custom DLLs, redirect API calls, and specify ring0 entry points for kernel-level enhancements within the Bochs debugger environment. ```IDC load bxtest.dll ``` ```IDC func=MessageBoxA entry=bxtest.MyMessageBox ``` ```IDC load bxtest.dll R0UserEntry=MyR0Entry ``` -------------------------------- ### Configure Solution Platform to x64 Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Accesses the Configuration Manager to ensure the project targets the x64 platform, removing the x86 platform if present. ```Visual C++ Configuration Configuration Manager... Active solution platform: Remove "x86" Active solution platform: Select "x64" ``` -------------------------------- ### IDA SDK Library Linking and Build Information Source: https://github.com/shefben/ida_sdk_91/blob/main/readme.txt This section details the import and stub libraries provided by the IDA SDK for linking against the IDA kernel across different operating systems. It specifies library paths for Visual C++ on Windows, and LLVM/GCC on Linux and Mac OS X, including notes on building debugger servers and Qt plugin samples. ```APIDOC LIBRARIES --------- This SDK provides import and stub libraries to link against the IDA kernel. For MS Windows targets, import libraries are provided in: x64_win_vc_64/ida.lib Visual C++ import libraries for IDA For Linux and Mac OS X targets, you may link directly to the shared library of the IDA kernel (libida.so or libida.dylib), but stub libraries are also provided to simplify building of the SDK. For Linux targets, stub libraries are provided in: x64_linux_gcc_64/libida.so LLVM/GCC stub libraries for IDA For Mac OS X targets, stub libraries are provided in: x64_mac_gcc_64/libida.dylib LLVM/GCC stub libraries for IDA To build the debugger servers, the 'dumb' object are needed. These files are provided for the following architectures: x86_win_vc_32 Visual C++ libraries for building 32-bit Windows debugger server x86_win_vc_64 Visual C++ libraries for building 64-bit Windows debugger server x86_linux_gcc_32 GCC libraries for building 32-bit Linux debugger server x86_linux_gcc_64 GCC libraries for building 64-bit Linux debugger server x86_mac_gcc_32 GCC libraries for building 32-bit Mac debugger server x86_mac_gcc_64 GCC libraries for building 64-bit Mac debugger server NOTE: To build the debug servers for MS Windows targets, Microsoft Windows SDK v7.1A must be used. If you want to compile the Qt plugin sample, you will also need the libQt* libraries. For MS Windows targets, the import libraries for Qt are available in the x64_win_qt directory. For Linux and Mac OS X targets, you should link against the Qt libraries from the IDA directory. ``` -------------------------------- ### Add IDA SDK Linker Dependencies Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Includes the IDA SDK's ida.lib file as an additional dependency for the linker, enabling the plugin to resolve IDA API calls. ```Visual C++ Configuration Properties -> Linker -> Input -> Additional Dependencies: C:\idasdk\lib\x64_win_vc_64\ida.lib ``` -------------------------------- ### Add Preprocessor Definitions for IDA Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Defines __NT__ and __EA64__ preprocessor macros, which are essential for compiling IDA plugins for Windows (NT) and x64 (EA64) architectures. ```Visual C++ Configuration Properties -> C/C++ -> Preprocessor -> Preprocessor Definitions: __NT__;__EA64__; ``` -------------------------------- ### IDA SDK Header Files Reference Source: https://github.com/shefben/ida_sdk_91/blob/main/readme.txt This section provides a quick tour and detailed descriptions of the core header files included in the IDA SDK, outlining their purpose and the functionalities they expose for module development. These headers define interfaces for various aspects of IDA Pro, from low-level database access to UI interaction and debugging. ```APIDOC pro.h: This is the first header included in the IDA project. It defines the most common types, functions, and data. It also contains compiler- and platform-related definitions. ``` ```APIDOC ida.hpp: In this file the 'inf' structure is defined: it keeps all parameters of the disassembled file. ``` ```APIDOC idp.hpp: The 'main' header file for IDP modules. Contains definition of the interface to IDP modules. The interface consists of 2 structures: processor_t - description of processor asm_t - description of assembler Each IDP has one processor_t and several asm_t structures. ``` ```APIDOC loader.hpp: Definitions of IDP, LDR, and PLUGIN module interfaces. This file also contains: - functions to load files into the database - functions to generate output files - high level functions to work with the database (open, save, close) ``` ```APIDOC ua.hpp: Functions that deal with the disassembling of program instructions. Disassembly of an instruction is made in three steps: - analysis - emulation - conversion to text ``` ```APIDOC kernwin.hpp: Defines the interface between the kernel and the UI. Some string processing functions are also kept in this header. ``` ```APIDOC idd.hpp: Debugger plugin API for debugger module writers. Contains definition of the interface to IDD modules. ``` ```APIDOC bytes.hpp: Functions and definitions used to describe and manipulate each byte of the disassembled program. Information about the byte includes associated features (comments, names, references, etc), data types (dword, qword, string literal, etc), instruction operands, status (mapped, loaded, patched, etc), among others. ``` ```APIDOC netnode.hpp: Functions that provide the lowest level public interface to the database. Modules can use this to keep some private information in the database. A description of the concept is available in the header file itself. ``` ```APIDOC allins.hpp: List of instructions available from all processor modules. ``` ```APIDOC auto.hpp: Auto-analysis related functions. ``` ```APIDOC compress.hpp: Data compression functions. ``` ```APIDOC config.hpp: Functions that deal with configuration options and files. ``` ```APIDOC dbg.hpp: Contains functions to control the debugging of a process. ``` ```APIDOC diskio.hpp: File I/O functions for IDA. You should not use standard C file I/O functions in modules. Use functions from this header, pro.h, and fpro.h instead. ``` ```APIDOC entry.hpp: Functions that deal with entry points to the program being disassembled. ``` ```APIDOC err.h: Thread safe functions that deal with error codes. ``` ```APIDOC expr.hpp: Functions that deal with C-like expressions, external languages, and the built-in IDC language. ``` ```APIDOC fixup.hpp: Functions that deal with fixup (relocation) information. ``` ```APIDOC fpro.h: System independent counterparts of file I/O functions. These functions do check errors but never exit even if an error occurs. They return extended error code in qerrno variable. NOTE: You must use these functions instead of the C standard I/O functions. ``` ```APIDOC frame.hpp: Routines to manipulate function stack frames, stack variables, register variables and local labels. ``` ```APIDOC funcs.hpp: Routines for working with functions within the disassembled program. This file also contains routines for working with library signatures (e.g. FLIRT). ``` -------------------------------- ### Import idapro Python Module Source: https://github.com/shefben/ida_sdk_91/blob/main/idalib/README.txt Guidance on importing the `idapro` package as the first statement in a Python script to utilize IDA Python APIs. ```python import idapro ``` -------------------------------- ### Set Configuration Type to Dynamic Library Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Configures the project to build a Dynamic Link Library (.dll), which is required for IDA plugins. ```Visual C++ Configuration Properties -> General -> Project Defaults -> Configuration Type: Dynamic Library (.dll) ``` -------------------------------- ### IDA SDK Processor Module File Structure Source: https://github.com/shefben/ida_sdk_91/blob/main/readme.txt An overview of the essential files comprising an IDA processor module, detailing the purpose of each C++ source file, header, makefile, and definition file required for module development. ```General makefile - makefile for a processor module stub - MSDOS stub for the module ana.cpp - analysis of an instruction: fills the insn structure. emu.cpp - emulation: creates xrefs, plans to analyse subsequent instructions ins.cpp - table of instructions. out.cpp - generate source lines. reg.cpp - description of processor, assemblers, and notify() function. This function is called when certain events occur. You may want to have some additional processing of those events. idp.def - the module description for the linker. i51.hpp - local header file. you may have another header file for you module. ins.hpp - list of instructions. ``` -------------------------------- ### IDA SDK 9.1 Header File Reference Source: https://github.com/shefben/ida_sdk_91/blob/main/readme.txt This section provides a reference for the core header files included in the IDA SDK 9.1, outlining the primary functionality provided by each. It highlights key components for graph drawing, help, library usage, floating point operations, C-like parsing, signature management, disassembled text generation, netnode information, location history, name and offset handling, problem lists, file system access, network functions, range definitions, registry interactions, program segmentation, segment registers, string lists, type information, undo operations, and cross-references. ```APIDOC gdl.hpp: Low level graph drawing operations. graph.hpp: Graph view management. help.h: Help subsystem. This subsystem is not used in IDP files. We put it just in case. idalib.hpp: Functions that allow you to use with IDA as a library ieee.h: IEEE floating point functions. intel.hpp: Header file from the IBM PC module. For information only. It will not compile because it contains references to internal files! lex.hpp: Tools for parsing C-like input. libfuncs.hpp: Routines and data structures for working with library signatures. lines.hpp: High level functions that deal with the generation of the disassembled text lines. nalt.hpp: Definitions of various information kept in netnodes. These functions should not be used directly since they are very low level. moves.hpp: Functions and classes related to location history. name.hpp: Functions that deal with names (setting, deleting, getting, validating, etc). offset.hpp: Functions that deal with offsets. problems.hpp: Functions that deal with the list of problems. prodir.h: Low level functions to find files in the file system. It is better to use enumerate_files2() from diskio.hpp. pronet.h: Network related functions. range.hpp: Contains the definition of the 'range_t' class. This is a base class used by many parts of IDA, such as the 'segment_t' and 'segreg_range_t' (segment register) classes. registry.hpp: Registry related functions. IDA uses the registry to store global configuration options that must persist after IDA has been closed. segment.hpp: Functions that deal with program segmentation. segregs.hpp: Functions that deal with the segment registers. If your processor doesn't use segment registers, then you don't need this file. strlist.hpp: Functions that deal with the strings list. typeinf.hpp: Describes the type information records in IDA. undo.hpp: Undo related functions xref.hpp: Functions that deal with cross-references. ``` -------------------------------- ### Define Linker Output File Name Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Sets the output file name for the linked DLL to be $(ProjectName).dll within the output directory, ensuring proper naming for the plugin. ```Visual C++ Configuration Properties -> Linker -> General -> Output File: $(OutDir)\$(ProjectName).dll ``` -------------------------------- ### Compile IDA SDK Processor Modules on Windows Source: https://github.com/shefben/ida_sdk_91/blob/main/module/readme.txt Instructions to compile the IDA SDK processor modules specifically for Windows environments using the `make` utility. To enable 64-bit compilation, the `__EA64__` environment symbol must be defined for `make`. ```Makefile make -D__NT__ ``` -------------------------------- ### Set Runtime Library to Multi-threaded DLL Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Configures the runtime library to 'Multi-threaded DLL (/MD)', which is crucial for linking with the IDA SDK. ```Visual C++ Configuration Properties -> C/C++ -> Code Generation -> Runtime library: Multi-threaded DLL (/MD) ``` -------------------------------- ### Specify Linker Export Options Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Adds specific export options to the linker command line, determining the type of module being built (plugin, processor module, or loader). ```Visual C++ Configuration Properties -> Linker -> Command Line -> Additional options: /EXPORT:PLUGIN (for plugins) /EXPORT:LPH (for processor modules) /EXPORT:LDSC (for loaders) ``` -------------------------------- ### Rename Debug Configurations to 'ida Debug' Source: https://github.com/shefben/ida_sdk_91/blob/main/install_visual.txt Renames both the project-level and solution-level 'Debug' configurations to 'ida Debug' for better organization and clarity when working with IDA projects. ```Visual C++ Configuration Configuration Manager: Rename 'Debug' configuration to 'ida Debug' (under 'Configuration' column). Rename 'Debug' active solution configuration to 'ida Debug' (under 'Active solution configuration'). ``` -------------------------------- ### Compile IDA SDK Processor Modules on Linux Source: https://github.com/shefben/ida_sdk_91/blob/main/module/readme.txt Instructions to compile the IDA SDK processor modules for Linux environments using the `idamake.pl` script. To enable 64-bit compilation, the `__EA64__` environment symbol must be defined for `make`. ```Perl idamake.pl ``` -------------------------------- ### IDA SDK Exported Functions Usage Guidelines Source: https://github.com/shefben/ida_sdk_91/blob/main/readme.txt This section provides guidelines for using functions marked with the "ida_export" keyword in the IDA SDK. It advises caution for certain low-level functions, such as set_nalt_cmt() and others from nalt.hpp, recommending the use of higher-level counterparts when available. Inline functions from header files are also usable. ```APIDOC All functions usable in the modules are marked by the "ida_export" keyword. There are some exported functions that should be not used except very cautiously. For example, set_nalt_cmt() and many functions from nalt.hpp should be avoided. In general, try to find a high-level counterpart of the function in these cases. Naturally, all inline functions from the header files can be used too. ``` -------------------------------- ### Microcode (mba_t, mblock_t, minsn_t) Structure and Manipulation API Source: https://github.com/shefben/ida_sdk_91/blob/main/readme_decompilers.txt Describes the core classes for representing microcode in IDA Pro (mba_t, mblock_t, minsn_t), their attributes, and functions for traversing, searching, and modifying microcode. It also covers microcode verification. ```APIDOC Classes: mba_t: Purpose: Represents global microcode information and a list of basic blocks. Methods: get_mblock(): Access basic blocks by index. verify(bool always): Verifies the consistency of the microcode. mblock_t: Purpose: Represents a basic block within the microcode. Attributes: block type: (1way, 2way, nway, etc) serial: block index (>=0) head/tail: pointers to double linked list of instructions predset/succset: predecessors and successors in control flow graph various lists: (use-list, def-list, etc) Methods: blk->nextb: Access next block in double linked list. blk->prevb: Access previous block in double linked list. find_first_use(): Data-based search inside a basic block. build_use_list(): Builds use-list for an entire instruction. build_def_list(): Builds def-list for an entire instruction. append_use_list(): Appends to use-list for one operand. append_def_list(): Appends to def-list for one operand. insert_into_block(): Adds an instruction to the block. remove_from_block(): Removes an instruction from the block. minsn_t: Purpose: Represents a microcode instruction. Attributes: opcode: Instruction operation code. l: Left operand. r: Right operand. d: Destination operand. ea: Address of the instruction. properties: Various instruction-specific bits. Global Search Functions: mbl_graph_t::is_accessed_globally(): Purpose: Performs a global data-based search. ``` -------------------------------- ### Configure IDA SDK Message Log File Source: https://github.com/shefben/ida_sdk_91/blob/main/readme.txt Instructions to set the IDALOG environment variable, enabling the saving of all messages displayed in the IDA messages window to a specified file for later review and debugging. ```Shell set IDALOG=ida.log ``` -------------------------------- ### IDA SDK Debugging Functions Reference Source: https://github.com/shefben/ida_sdk_91/blob/main/readme.txt Reference for debugging and logging functions available in the IDA SDK, including methods for displaying messages conditionally, general messages, warnings, and a macro for setting breakpoints during module initialization. ```APIDOC deb(): - description: Display a line in the messages window if -z command line switch is specified. - usage: May use debug one of: IDA_DEBUG_IDP, IDA_DEBUG_LDR, IDA_DEBUG_PLUGIN msg(): - description: Display a line in the messages window. warning(): - description: Display a dialog box with the message. BPT macro: - description: Use in the module initialization code to stop in the debugger when the module is loaded. ``` -------------------------------- ### Ctree Modification Guidelines and Verification API Source: https://github.com/shefben/ida_sdk_91/blob/main/readme_decompilers.txt Provides rules for modifying the ctree (canonical tree) representation in IDA Pro, emphasizing consistency. It also details functions for recalculating parent types and verifying ctree integrity. ```APIDOC Ctree Consistency Rules: - cot_add operator requires 2 operands. - Expression types must be consistent. - If an expression's type changes, recalc_parent_types() must be called. Functions: recalc_parent_types(): Purpose: Recalculates types of parent expressions after a child's type changes. Return: bool (true if current ctree traversal must be terminated). cfunc_t::verify(): Purpose: Verifies the consistency of the ctree. Behavior: Stops with an interr if anything is wrong. ctree_t::verify(allow_unused_labels_t aul, bool even_without_debugger): Purpose: Verifies the consistency of the ctree. Parameters: aul: allow_unused_labels_t even_without_debugger: bool Usage: Should be called after modifying the ctree. ``` -------------------------------- ### Hex-Rays Decompiler Ctree Data Structure API Documentation Source: https://github.com/shefben/ida_sdk_91/blob/main/readme_decompilers.txt Detailed documentation of the Ctree data structure, which represents the decompilation result in a tree-like format. It covers the `cfunc_t` class (function attributes, local variables, body), the progressive construction of the ctree, maturity levels, and core elements like `citem_t` (abstract base for `cinsn_t` statements and `cexpr_t` expressions). It also explains how ctree items are referenced, the importance of using addresses for stability, expression typing, and the utility of `ctree_visitor_t` for traversal. ```APIDOC Ctree is a data structure that keeps the decompilation result. As the name implies, it is a tree-like structure. At the top level, we have the cfunc_t class. This class describes the function and gives access to its attributes: its type, local variables, maturity level, and body. The ctree class is not created in one transaction but built progressively: it starts with an empty class, then a rough function body is created, then it is modified in several steps. You can intercept control at any intermediate stage (maturity level) but be prepared that the ctree does not look quite normal. Only at the final stage the ctree is syntactically correct and has non-trivial type information. The most interesting part of the cfunc_t class is the function body (this part of the data structure is called ctree). The function body consists of citem_t elements. In fact, citem_t is an abstract class and its pure instances must never be created. There are two citem_t flavors (derived classes): - cinsn_t: a statement - cexpr_t: an expression Please look up the class definitions in the header file. citem_t elements can be reference each other. For example "x+y*3" is represented as: cot_add / \ / \ cot_var:x cot_mul / \ / \ cot_var:y cot_num:3 This is a very simplified diagram but hopefully it gives an idea how the tree is organized. Each ctree item may have a label. Each ctree item is mapped to an address in the program. Please note that in some cases several items may have the same address. If we want to denote a citem_t, we cannot store a pointer to it because at the next moment (as soon as we yield control) another plugin or the decompiler itself might shuffle the tree. We recommend to denote ctree items by their addresses and types. Addresses can be safely stored in the database (in fact, it is better to store offsets from the function entry point; this will make the information relocatable) and reused in subsequent IDA sessions. Expressions (cexpr_t) have a type string attached to them. By type here we mean a C language type (int, char *, etc). The expression types must be consistent. For example, if in the above example "x" is a pointer, then the type of the whole expression must be the same pointer. y cannot be a pointer because it is an operand of the multiplication operation. To facilitate ctree processing, you can use the ctree_visitor_t class or any of its derived classes. These classes make ctree traversal really easy. However, if ctree gets modified during the traversal, ``` -------------------------------- ### IDA Processor Module Architecture Source: https://github.com/shefben/ida_sdk_91/blob/main/readme.txt This section describes the internal architecture of IDA processor modules, which disassemble instructions in a three-step process: analysis (ana.cpp), emulation (emu.cpp), and output (out.cpp). It emphasizes that the analyser should be fast, simple, and decode instructions into an 'insn' structure, returning the instruction length or zero if no instruction is found. ```APIDOC DESCRIPTION OF PROCESSOR MODULES -------------------------------- The module disassembles an instruction in several steps: - analysis (decoding) file ana.cpp - emulation file emu.cpp - output file out.cpp The analyser (ana.cpp) should be fast and simple: just decode an instruction into an 'insn' structure. The analyser will always be called before calling emulator and output functions. If the current address can't contain an instruction, it should return 0. Otherwise, it returns the length of the instruction in bytes. ``` -------------------------------- ### Setting Bitness for 32-bit Loaders in IDA64 Source: https://github.com/shefben/ida_sdk_91/blob/main/ldr/readme.txt When developing or using 32-bit application loaders within IDA64, it is crucial to explicitly set the application's bitness to 32-bit. This overrides IDA64's default assumption of 64-bit applications, ensuring correct interpretation and loading of the file. ```C/C++ inf_set_64bit(false); ``` -------------------------------- ### Accessing Bochs Debugger Extensions in C/C++ Source: https://github.com/shefben/ida_sdk_91/blob/main/dbg/bochs/sdk/readme.txt Illustrates how to retrieve and utilize extended debugger functionalities provided by the Bochs plugin. It shows how to obtain the `bochsext_t` structure via `get_debmod_extensions()` and send commands to the debugger, such as dumping physical memory. ```C #include "bochsext.h" void idaapi run(int) { if ( dbg == NULL ) { msg("dbg == NULL\n"); return; } const bochsext_t *ext = (const bochsext_t *)dbg->get_debmod_extensions(); if ( ext == NULL ) { msg("no debugger extensions!\n"); return; } // dump 10 bytes from physical memory at 0x0 qstring out; if ( !ext->send_command("xp /10mb 0x0\r\n", &out) ) { msg("failed to send command!\n"); return; } msg("->result=%s\n", out.c_str()); } ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.