Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the occasional juicy tidbit in the blogs of Ilfak, Igorsk, Daniele and the others.
But by and large there's mostly Google, reversing IDA.WLL, and copious experimentation. Which means that it's often much slower going than we would like, and quite often things require a lot more effort than necessary because we're unaware of some trick, twist or workaround that somebody else has already discovered.
The perfect solution would be a community wiki. So, is there a wiki for all things IDA?
If so then all serious spelunkers needs to know about it: it ought to be linked from here, from IDA's home site and major RCE gathering places...
If there's no wiki yet then we ought to do something about it (like badgering Ilfak).
set_idc_getattr
with the result of a previous call - or that of a call toget_idc_getattr
- will fail and crash IDA when your plugin is unloaded (it's because IDA returns""
for an empty method but you have to pass 0 to reset, not""
which fails and leaves things as they are)try ... catch
and the fact that objects are associative arrays that are indexed with strings using the.
operator instead of[]
, and for any object o,o.foo == getattr(o, "foo")
ando[n] == getattr(o, n) == getattr(o, ltoa(n,10))
, buto["foo"]
is not accepted. Or thatltoa()
is reallyultoa()
(i.e.,ltoa(-1,10)
is not "-1" but "4294967295" or "18446744073709551615").