8

I am trying to write a plugin for IDA PRO, mainly because I want to use the nifty graphing feature on a custom intermediate language. After the first look at the IDA plugin system, I am a little lost.

Before I dig deeper, I have some generic understanding questions, which put me at unease:

  1. Does the SDK enforce a struct alignment? If not, how can I receive or supply pointers to structs compatible across compilers?

  2. Why do plugins export a data strcut (PLUGIN), and not standard exported functions? What is the advantage? Again, I would fear for alignment issues across compilers.

  3. Even more surprising, at least the HexRays part of the sdk seems to offer class ABI compatibility, meaning I can derive from a supplied class definition and use the result with the SDK (virtual functions and all)! How does that work?

  4. Additionally, the SDK can return pointers to classes that I am supposed to destroy with the "delete" keyword. Isnt that bound to end in trouble?

All that makes me a little nervous. Does anyone know how this is done?

1

1 Answer 1

5

1. Does the SDK enforce a struct alignment? If not, how can I receive or supply pointers to structs compatible across compilers?

IDA SDK headers do specify their alignment. It is split between 1-byte and 4-bytes.

There are also interesting comments like this:

/*
 *      Due to the use of STL and virtual functions, some parts of this
 *      interface might be incompatible with compilers other than BCB v6.0 
 */

But given the age of Borland C++ Builder 6, I am not sure they are still relevant.

2. Why do plugins export a data struct (PLUGIN), and not standard exported functions? What is the advantage? Again, I would fear for alignment issues across compilers.

plugin_t uses 1-byte alignment. As long as you follow that, there should not be any alignment problems. I guess the struct is used just for convenience, as then the loader only needs to find and keep track of only one exported symbol instead of several.

3. Even more surprising, at least the HexRays part of the sdk seems to offer class ABI compatibility, meaning I can derive from a supplied class definition and use the result with the SDK (virtual functions and all)! How does that work?

HexRays lets you inspect/modify the decompiled source tree representation, and uses the visitor pattern to do it.

It's much easier to pass one pointer to a class holding multiple pointers than it is to pass a ton of separate callback pointers for different operations. Also, a class lets you capture/track local state, doing that with separate callback pointers would require extra work with functors.

4. Additionally, the SDK can return pointers to classes that I am supposed to destroy with the "delete" keyword. Isnt that bound to end in trouble?

What are you worried about? The fact that you're freeing memory allocated by another module, or the fact that you are responsible for the object's lifetime?

The former should not be an issue, pro.h contains a DEFINE_MEMORY_ALLOCATION_FUNCS macro that overrides memory management for each such class so deleting it will go through IDA's memory management routines.

The latter is just something you have to live with.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.