0

I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows:

00000000 SomeClass struc
00000000 __vftable dd ?  ; SomeClass_vtbl*
00000004 __members SomeClass_members ?
00000084 SomeClass ends
00000084
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 SomeClass_vtbl struc
00000000 ; ... several function pointers ....
00000048 SomeClass_vtbl ends
00000048
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 SomeClass_members struc
00000000 ; ... some members ....
00000020 SomeClass_members ends

Creating the structs works fine, but I have trouble defining the 2 fields in SomeClass:

  • the pointer to SomeClass_vtbl for the first field, and
  • referencing SomeClass_members for the second field.

Not finding a sample in the SDK on how to define structs detailedly programmatically (is there one?), I checked the raw documentation and found add_struct_member to be doing what I want to do, using it as follows:

#include <bytes.hpp>
// ... other typical IDA SDK includes ...

bool idaapi run(size_t arg)
{
    qstring className = "SomeClass";

    // Create the structs.
    tid_t classType = add_struc(BADADDR, className.c_str());
    tid_t vftableType = add_struc(BADADDR, (className + "_vtbl").c_str());
    tid_t membersType = add_struc(BADADDR, (className + "_members").c_str());
    struc_t* classStruct = get_struc(classType);
    struc_t* vftableStruct = get_struc(vftableType);
    struc_t* membersStruct = get_struc(membersType);

    // Create vftable field.
    opinfo_t vftableField{ vftableStruct->id };
    add_struc_member(classStruct, "__vftable", 0, FF_STRUCT, &vftableField, 4);

    // Create members field.
    opinfo_t membersField{ membersStruct->id };
    add_struc_member(classStruct, "__members", 4, FF_STRUCT, &membersField, 4);

    return true;
}

I'm not sure if setting the types of those struct fields like this is the right way to go:

  • FF_* #defines from bytes.hpp are not found by my compiler, even though I included that header right at the start in the only main.cpp file in my project (and they appear in IntelliSense...).
  • Even if I could use those #defines now, I did not see how that would allow me to differentiate between a pointer to a struct or simply referencing a struct.
  • After all, I'm not even sure if using the FF_* #defines for the flag parameter of add_struc_member is correct; the documentation only states "type + representation bits".

So, dumbly asked, ignoring my probably faulty tries above, what are the methods to set known types of struct fields?

  • Are you making a plug-in for IDA? There is an alternative way to convert/visualise vtable into struct using simple header file without IDA SDK. – Biswapriyo Dec 10 '18 at 7:21
  • @Biswapriyo Yeah, it should be part of a C++ plugin later on. I clarified the text. – Ray Koopa Dec 10 '18 at 7:32

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.