3

I have made a plugin (using IDA Python) that requires the Hex-Rays plugin.

As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after Hex-Rays is done loading. However, IDA decides to load my plugin earlier, and hence, it never is able to get True for idaapi.init_hexrays_plugin().

I've tried renaming my plugin in multiple ways, but still cannot seem to get the plugin to load after Hex-Rays.

BTW, I think the issue might be related to the fact that I am storing my plugin in %IDAUSR%/plugins rather than %IDADIR%/plugins since I do not want to modify %IDADIR%.

Is there any kind of workaround to make the plugin load later? Or can I force IDA to load Hex-Rays earlier?

2 Answers 2

4

When loading plugins, IDA goes through them alphabetically, and tries to load all the plugins. When loading a plugin, the loader check the plugin flags (idaapi.PLUGIN_PROC, idaapi.PLUGIN_FIX, and so on) to determine if the plugin should be loaded at the current time. If it is to be loaded, the init method is called. A plugin can return PLUGIN_KEEP to remain loaded, or PLUGIN_SKIP to avoid loading. As long as a plugin is not in memory (not yet loaded, or already unloaded,) IDA will try and load it again and again. This is how my plugin loader works.

So the first thing you need to be sure of, is that you flag your plugin idaapi.PLUGIN_PROC, as this is when Hex-Rays loads (only when a processor module is active.) Hopefully, this will solve it. If not - you can use idaapi.load_plugin('hexrays') to explicitly load the Hex-Rays plugin. Again, this can only be done when a processor module is active, so be sure to use PLUGIN_PROC.

1
  • Or idaapi.load_plugin('hexx64')
    – Ed McMan
    Commented Aug 16, 2018 at 14:19
0
def init():
    if not idaapi.init_hexrays_plugin():
        return idaapi.PLUGIN_SKIP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.