0

I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows:

00000000 SomeClass struc
00000000 __vftable dd ?  ; SomeClass_vtbl*
00000004 __members SomeClass_members ?
00000084 SomeClass ends
00000084
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 SomeClass_vtbl struc
00000000 ; ... several function pointers ....
00000048 SomeClass_vtbl ends
00000048
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 SomeClass_members struc
00000000 ; ... some members ....
00000020 SomeClass_members ends

Creating the structs works fine, but I have trouble defining the 2 fields in SomeClass:

  • the pointer to SomeClass_vtbl for the first field, and
  • referencing SomeClass_members for the second field.

Not finding a sample in the SDK on how to define structs detailedly programmatically (is there one?), I checked the raw documentation and found add_struct_member to be doing what I want to do, using it as follows:

#include <bytes.hpp>
// ... other typical IDA SDK includes ...

bool idaapi run(size_t arg)
{
    qstring className = "SomeClass";

    // Create the structs.
    tid_t classType = add_struc(BADADDR, className.c_str());
    tid_t vftableType = add_struc(BADADDR, (className + "_vtbl").c_str());
    tid_t membersType = add_struc(BADADDR, (className + "_members").c_str());
    struc_t* classStruct = get_struc(classType);
    struc_t* vftableStruct = get_struc(vftableType);
    struc_t* membersStruct = get_struc(membersType);

    // Create vftable field.
    opinfo_t vftableField{ vftableStruct->id };
    add_struc_member(classStruct, "__vftable", 0, FF_STRUCT, &vftableField, 4);

    // Create members field.
    opinfo_t membersField{ membersStruct->id };
    add_struc_member(classStruct, "__members", 4, FF_STRUCT, &membersField, 4);

    return true;
}

I'm not sure if setting the types of those struct fields like this is the right way to go:

  • FF_* #defines from bytes.hpp are not found by my compiler, even though I included that header right at the start in the only main.cpp file in my project (and they appear in IntelliSense...).
  • Even if I could use those #defines now, I did not see how that would allow me to differentiate between a pointer to a struct or simply referencing a struct.
  • After all, I'm not even sure if using the FF_* #defines for the flag parameter of add_struc_member is correct; the documentation only states "type + representation bits".

So, dumbly asked, ignoring my probably faulty tries above, what are the methods to set known types of struct fields?

  • Are you making a plug-in for IDA? There is an alternative way to convert/visualise vtable into struct using simple header file without IDA SDK. – Biswapriyo Dec 10 '18 at 7:21
  • @Biswapriyo Yeah, it should be part of a C++ plugin later on. I clarified the text. – Ray Dec 10 '18 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.