Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There seem to be few projects that have accomplished this. Specifically, how do you make a plugin in IDA which registers itself as one of the available debuggers and allows stepping through the IDA database while controlling a target?
None of the answers so far answer the actual question so here goes.
A debugger plugin differs from a "normal" one in two points:
- it has
PLUGIN_DBGin the plugin's flags.
- in init(), it must set the global variable
dbgto a pointer to an implementation of
idd.hppfor the definition.
For examples, see
plugins/debugger in the SDK, and also the recently updated
idados plugin. Warning: making debugger plugins is not for the faint of heart.
The debughook.py example script from the idapython suite illustrates all debug events that can be processed by a debugger plugin.
Here's a very simple script that colorizes all instructions as you trace them with the debugger.
# Simple script that colorizes all instruction the debugger halts at or # the user traces with the debugger in yellow. Instruction that are hit # a ssecond time are colored in red. from idaapi import * from idc import * class Colorizer(DBG_Hooks): def __init__(self): DBG_Hooks.__init__(self) self.locations_ = set() def colorize(self, ea): if ea in self.locations_: SetColor(ea, CIC_ITEM, 0x2020c0) else: SetColor(ea, CIC_ITEM, 0x80ffff) self.locations_.add(ea) def dbg_bpt(self, tid, ea): self.colorize(ea) return 0 def dbg_step_into(self): self.colorize(GetRegValue("eip")) try: if debughook: print("Removing previous hook ...") debughook.unhook() except: pass colorizer = Colorizer() colorizer.hook()
If you read from process memory in one of your debugger callbacks, you need to call refresh_debugger_memory() first (see file comment for RefreshDebuggerMemory() in idc.py). If you can, avoid that call since it is somewhat expensive.
You can easily access all register via the cpu instance from the idautils package:
print "EAX has the value: %X" % cpu.Eax
To read the current value from the top of the stack, use something like
print "TOS: %X" % Dword(cpu.Esp)
The IDA Pro Book 2nd edition from Chris Eagle has a little info in chapter 24 on interacting with the debugger through IDC and the SDK, but is more automation focused. Other than that maybe reading the source of other plugins that are doing this such as the ARM debugger plugin referenced in the question and digging through dbg.hpp in the SDK to see what it exposes. It also appears the source for IDA's debugger plugins is available in plugins/debugger in the SDK. I haven't seen writing a debugger plugin specifically documented.