2

I'm wondering whether it is possible to write a plugin for IDA and/or Hex-Rays which would use Python callbacks to perform certain tasks.

In particular I am wondering if there is an official way to reuse the loaded Python version and IDAPython in light of the Python GIL (global interpreter lock), because obviously attempting anything like that outside of the trodden path could easily to hard-to-debug deadlock situations.

So the question is: how would I go about to write a C/C++-based plugin for IDA, which is able to (re)use the Python interpreter used by IDA for IDAPython -- and if possible even tap into IDAPython?

1 Answer 1

2
+100

You can register IDC functions from IDAPython plugins. See the %IDADIR%\python\examples\core\extend_idc.py for the following snippet:

from __future__ import print_function

import ida_expr

if ida_expr.add_idc_func(
        "pow",
        lambda n, e: n ** e,
        (ida_expr.VT_LONG, ida_expr.VT_LONG)):
    print("The pow() function is now available in IDC")
else:
    print("Failed to register pow() IDC function")

Next, your C/C++ plugin code can invoke IDC functions. See %IDASDK%\plugins\ex_debidc\ex_debidc.cpp for an example of how to use expr.hpp::exec_idc_script, whose prototype is as follows:

/// Compile and execute IDC function(s) from file.
/// \param result       ptr to idc_value_t to hold result of the function.
///                     If execution fails, this variable will contain
///                     the exception information.
///                     You may pass nullptr if you are not interested in the returned
///                     value.
/// \param path         text file containing text of IDC functions
/// \param func         function name to execute
/// \param args         array of parameters
/// \param argsnum      number of parameters to pass to 'fname'
///                     This number should be equal to number of parameters
///                     the function expects.
/// \param[out] errbuf  buffer for the error message
/// \retval true   ok
/// \retval false  error, see errbuf

THREAD_SAFE inline bool exec_idc_script(
        idc_value_t *result,
        const char *path,
        const char *func,
        const idc_value_t args[],
        size_t argsnum,
        qstring *errbuf=nullptr)
3
  • Oh, so do I understand you correctly, that your suggestion is to use IDC as a sort of mediator between the C/C++ plugin and IDAPython? Thanks, this sounds like it could be doable. Not quite what I had in mind, but it may get me closer.
    – 0xC0000022L
    Feb 4, 2023 at 21:08
  • 1
    Yes, your description is accurate. What I suggested above was to expose IDAPython functionality through IDC and then call it from C++. There's a variety of ways to think about and approach your question; this is just one of them. I have a feeling that expr.hpp probably holds a more direct solution to your problem; you can probably run an IDAPython script directly somehow, but I couldn't tell you exactly how. Feb 4, 2023 at 21:46
  • Well, thanks for your insights. This was exactly what I was looking for at this point.
    – 0xC0000022L
    Feb 4, 2023 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.