2

Is there a tutorial somewhere on how to make plugins work with IDA 5.0 free?

Plugins built against the normal SDK libs don't work because the WLL of free IDA exports everything by ordinal and not by name. I wrangled with Microsoft's LIB tool to make a suitable import lib from a .def file for a few functions but now IDA says 'not IDA DLL file'...

Also, is there a .DEF file or a VC++ import lib for IDA 5.0 free?

  • 1
    Would the people who keep voting down this question please indicate what the problem is that they're having with it? I have done due diligence by Googling high and wide, and the question is clearly on topic (both because IDA is the reversing tool par excellence, and because reverse engineering is required to build plugins for free IDA). – DarthGizka Jan 23 '15 at 18:34
3

I found the reason why the plugin didn't work: the PLUGIN symbol wasn't exported from the dll (.plw).

In headers prior to version 5.1 the symbol isn't declared __declspec(dllexport), meaning it has to be exported via a .DEF file or a workaround has to be used so that the symbol definition can be made __declspec(dllexport) despite the wrong declaration in the header:

#define PLUGIN  sCaPeGoAt_PLUGIN
#include "loader.hpp"             // plugin_t, PLUGIN_KEEP etc.
#undef  PLUGIN

extern "C"                        
__declspec(dllexport)
plugin_t PLUGIN = 
{
   IDP_INTERFACE_VERSION,
   ...
};

With the scapegoat soaking up the wrong declaration, VC++ accepts the __declspec(dllexport) on the definition and compiles it. Now the plugin works perfectly fine in IDA 5.0 free... Without the fix, the build stops with the following message:

error C2370: 'PLUGIN' : redefinition; different storage class

The problem of obtaining a decent .DEF or .LIB still remains, though. Reversing the WLL to identify the functions behind the ordinals is a bit cumbersome and slow going... There are plugins for IDA free around, so the libs must be out there somewhere (unless they were got under a gag agreement).

UPDATE: for VC++ there's a much easier way to accomplish the same thing, without evil macro trickery:

#pragma comment (linker, "/export:PLUGIN=_PLUGIN")

or simply

#pragma comment (linker, "/export:_PLUGIN")

since the leading underscore seems to get stripped automatically.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.