So far we have presented plug-ins designed primarily to manipulate or extract information from a database. In this section, we present an example of extending the capabilities of the IDC scripting language.^[117] As mentioned in Chapter 16, IDC is implemented on top of the IDA API, so it should come as no surprise that the API can be used to enhance IDC when the need arises.

In Chapter 15 and Chapter 16, you learned that IDC global arrays are actually a somewhat restricted abstraction of netnodes. Recall that in IDC you create global arrays by supplying a name and receiving an array ID in return. Internally your name gets prefixed with the string “$ idc_array ”, and the array ID that you receive is actually a netnode index value. How could we go about extending IDC in order to enable access to any netnode in an IDA database? We can already access any netnode whose index we happen to know by using the index as the array ID in IDC, so what we need is the ability to access any netnode whose name we happen to know. IDC currently prevents us from doing this because it prepends “$ idc_array ” to every netnode name we supply. Enter the SDK and the set_idc_func_ex function.

Defined in expr.hpp, set_idc_func_ex may be used to create a new IDC function and map its behavior to C++ implementation. The prototype for set_idc_func_ex is shown here:

typedef error_t (idaapi *idc_func_t)(idc_value_t *argv, idc_value_t *res);
bool set_idc_func_ex(const char *idc_name, idc_func_t idc_impl,
                     const char *args, int extfunc_flags);

Note that we have introduced the idc_func_t datatype here in order to simplify the code somewhat. This datatype is not defined within the SDK. The arguments to set_idc_func_ex specify the name of the new IDC function that we are introducing (idc_name), a pointer to the C++ function that implements our new IDC behavior (idc_impl), a null-terminated array of characters that specify the argument types and sequence for the new IDC function (args), and flags (extfunc_flags) indicating whether an open database is required or whether the function never returns.

The following function, used as the initialization function for a plug-in, completes the process by creating the new IDC function we are designing:

int idaapi init(void) {
    static const char idc_str_args[] = { VT_STR2, 0 };
    set_idc_func_ex("CreateNetnode", idc_create_netnode, idc_str_args, 0);
      return PLUGIN_KEEP;
  }

This function creates the new IDC function CreateNetnode and maps it to our implementation function idc_create_netnode . The arguments to the new IDC function are specified as being a single parameter of type string (VT_STR2) .

The function that actually implements the behavior of CreateNetnode is shown here:

/*
   * native implementation of CreateNetnode.  Returns the id of the new netnode
   * this id can be used with all of the existing IDC Array functions.
   */
  static error_t idaapi idc_create_netnode(idc_value_t *argv, idc_value_t *res) {
   res->vtype = VT_LONG;           //result type is a netnode index
   if (argv[0].vtype == VT_STR2) {  //verify we have the proper input type
      netnode n(argv[0].c_str(), 0, true);  //create the netnode
      res->num = (nodeidx_t)n;          //set the result value
     }
     else {
      res->num = −1;         //If the user supplies a bad argument we fail
     }
     return eOk;
  }

The two arguments to this function represent the input argument array (argv) containing all of the parameters to CreateNetnode (there should be only one in this case) and an output parameter (res) used to receive the result of the IDC function we are implementing. The SDK datatype idc_value_t represents a single IDC value. Fields within this datatype indicate the current type of data represented by the value and the current contents of the value. The function begins by specifying that CreateNetnode returns a long (VT_LONG) value . Since IDC variables are untyped, we must indicate internally what type of value the variable is holding at any given moment. Next, the function verifies that the caller of CreateNetnode has supplied an argument of type string (VT_STR2) . If a valid argument has been supplied, a netnode is created with the supplied name . The resulting netnode index number is returned to the caller as the result of the CreateNetnode function . In this example, the result type is an integer value, so the result is stored into the res->num field. Had the result type been a string, we would have needed to call res->set_string to set the string value of the result. If the user fails to supply a string argument, the function fails and returns the invalid netnode index −1 .

We complete the plug-in with the following functions and PLUGIN structure:

void idaapi term(void) {}   //nothing to do on termination
  void idaapi run(int arg) {} //nothing to do and no way to activate

  plugin_t PLUGIN = {
    IDP_INTERFACE_VERSION,
    //this plugin loads at IDA startup, does not get listed on the Edit>Plugins menu
    //and modifies the database
   PLUGIN_FIX | PLUGIN_HIDE | PLUGIN_MOD,  // plugin flags
    init,                 // initialize
    term,                 // terminate. this pointer may be NULL.
    run,                  // invoke plugin
    "",                   // long comment about the plugin
    "",                   // multiline help about the plugin
    "",                   // the preferred short name of the plugin
    ""                    // the preferred hotkey to run the plugin
  };

The trick to this plug-in is that it loads on IDA startup (PLUGIN_FIX) and remains hidden from the user because it is not added to the Edit ▸ Plugins menu (PLUGIN_HIDE) . The plug-in is kept in memory for all databases, and all of the initialization takes place in the plug-in’s init function. As a result, the plug-in has nothing to do in its run method.

Once this plug-in is installed, an IDC programmer may access any named netnode in an IDA database using the netnode’s name, as in the following example:

auto n, val;
n = CreateNetnode("$ imports");       //no $ idc_array prefix will be added
val = GetArrayElement(AR_STR, n, 0);  //get element zero

More information for using the SDK to interact with IDC is contained in the expr.hpp header file.