IDA’s functionality can easily be extended by the use of programmable plug-ins. Plugins may be written to automate routine tasks, for example to enhance the analysis of hostile code or to add specific functionality to our disassembler. Plugins should be written in C++. They may be linked to hot keys or menu items and have full access to the IDA database and may examine or modify the program or use I/O functions. Our SDK contains

• 4 sample plugins

  • a simple “hello world” type plugin.

  • a sample processor extension plugin (adds 2 NEC V20 specific instructions to the 80×86 processor module).

  • a sample pdb file loader ( as used by IDA itself ).

  • a sample executable decryption plugin.

  • a sample graphing plugin.

• the source code to a 30+ processor modules!

• the source code to a 20+ loaders

• header files (almost 19.000 lines of heavily commented documentation to IDA’s exported interface).

• import libraries for Borland C/C++ (32 & 64 bits), Microsoft Visual C++ 6 (32 & 64 bits), GNU C/C++ (32 & 64 bits), Watcom 11

• if you received IDA as a download, the SDK download information can be found in the e-mail you have received.

Additional free plugins, from Ilfak’s blog:

The -O command line switch allows the user to pass options to the plugins. A plugin which uses options should call the get_plugin_options() function to get them.

Since there may be many plugins written by independent programmers, each options will have a prefix -O in front of the plugin name.

For example, a plugin named "decomp" should expect its parameters to be in the following format:

In this case, get_plugin_options("decomp") will return the "option1:option2:option3" part of the options string.

If there are several -O options in the command line, they will be concatenated with ':' between them.

List of plugins recognizing '-O' switch

IDA natively is shipped with repository of plugins, that are inside your IDA folder. You do not need to install them separately, but in this section you'll find guides on how to use their basic features.

List of plugins shipped with IDA:

Do you want to create custom plugins and wonder where to start? Check our tutorials based on the language of your choice:

Analyzing software in general and reverse-engineering in specifically are difficult. It is challenging even with a first-class tool like IDA: quite frequently, the limitations of the tool reveal themselves. That's why IDA can be programmed in multiple ways: with the built-in scriptable language, with Python 3, and plugins in C/C++.

Plugin contest in a nutshell:

• Create an innovative and useful extension of our products and win the contest!

• Three cash prizes are on the stake: The first place is 3000 USD, the second place is 2000 USD, and the third place is 1000 USD.

• Who can participate: all IDA license holders.

Want to know more? Check our contest rules

Demangling

The swift plugin uses libSwiftDemangle to demangle Swift names. Note that IDA already had a built-in swift demangler, but it was becoming difficult to maintain. In the long-term we hope to fully deprecate IDA's custom swift demangler in favor of libSwiftDemangle.

However, the new approach still hasn't been fully integrated into IDA, so there may be times when IDA's old swift demangler produces more desirable results.

'cfg/swift.cfg' file presents all the options

'-Oswift' command line switches can be used to enable or disable some plugin options.

The binaries produced by the Rust compiler have some peculiarities which make them difficult to analyze, such as:

  - non-standard calling conventions
  - non-terminated string literals
  - unusual name mangling scheme

By default, Rust plugin is enabled if one of the following condition is true

  - one address is named 'rust_begin_unwind'
  - the string 'rustc-' can be found somewhere in the program
    If the segment '.rodata' exists, the search is limited to this segment

String literal analysis

Rust plugin walks to all addresses in segment with name ending in "__const", ".rodata" or ".rdata" and creates string literals on xref

  - on dref, the string literal is set up to the next dref
  - on cref, Rust tries to retrieve length from nearby instructions
    Arm, Risc-V and pc proc module benefit from this

To force the string literal detection:

  idaapi.load_and_run_plugin("rust", 1)

Demangling name

Rust plugin also offers the possibility to configure a demangler library for rust. By default the plugin will use the librustdemangle library that is shipped with IDA. You can disable this feature in 'Edit>Plugin>Rust language helper' or specify another library to use.

See cfg/rust.cfg for the possible options

List of '-Orust' options

Example

This disable the plugin for this session of IDA.

Golang binaries are by default statically linked and full of metadata therefore a lot can be gained from annotating a Golang binary's contents using recovered metadata.

Detection

The golang plugin's analysis only happens by default if the input file is detected as a Golang file. There are multiple mechanisms in place to detect that:

DWARF plugin

The DWARF plugin will search for DWARF-encoded debug information either in the input file, or a "companion" file (using a strategy similar to that of GDB), when some is found, will extract the following:

In addition, the DWARF plugin provides source-level debugging.

picture_search is a plugin that allows you to search for, and inspect pictures that are embedded in the binary.

The key feature of the plugin is the "Search for pictures" action, available in the menu, that will scan the entire binary (or the selection if there is one) for so-called "magic" numbers of well-known image types (PNG, JPEG, ...), and present the results in a tabular fashion:

Note: at this point, pictures have not been decoded yet; the plugin has merely spotted what looks like the start of pictures. Decoding will only happen when triggering any of the following actions.

Double-clicking any row of that list will show the picture directly in IDA. Opening the context menu will reveal even more possibilities: open the picture in the OS's default viewer, save it, jump to its start address...

In addition to this very handy scanning feature, the plugin will add the "Open picture" action to the disassembly listing's context menu when the current position happens to be near data that matches the well-known image types' magic numbers.

IDA Feeds

Starting with IDA 9.0, we introduced IDA Feeds (aka FLIRT Signature Manager), the tool designed to ease the application of new signatures through updatable libraries, (known as IDA FLIRT Signature Bundles), shipped alongside other IDA plugins just out-of-the-box.

What is IDA Feeds?

Ida Feeds helps you identify which signatures to apply when analyzing binary files, especially when you don't know which static libraries were linked to them. Rather than manually applying signatures, IDA Feeds automatically scans and applies many signatures in seconds. Just open the signature folder, allow IDA to scan and find the possible matches, and then bulk apply the suggested signatures.

IDA Feeds uses the , which are going to be regularly updated and released to keep you up to date with the newest recognizable signatures.

IDA Feeds configuration and setup

The proper configuration of the plugin is required to start using IDA Feeds and make it visible in the plugins list under Edit -> Plugins submenu.

Prerequisites

• idalib configured properly (check and )

• Downloaded the latest IDA FLIRT Signature Bundle. You can get it from our under SDK and utilities.

Install and activate your virtual environment

We recommend using IDA Feeds from within your Python virtual environment (venv). To do so, ensure you have created and activated your virtual environment before proceeding.

Linux & macOS

1. Create a Python virtual environment at your preferred location

   Replace ~/.idapro/venv with your path.

2. Activate your virtual environment

Windows

1. Create a Python virtual environment at your preferred location

   Replace .idapro\venv with your path.

2. Activate your virtual environment

Installing requirements/dependencies

Install requirements for Python modules from within your virtual environment.

1. Navigate to the plugin/ida_feeds folder within the IDA Pro installation directory and install the requirements.

1. Create symbolic link (optional)

Linux & OSX

Windows

After successfully performing these steps, IDA Feeds plugin should be visible in the Edit -> Plugins submenu and ready to try.

How to use IDA Feeds?

To use IDA Feeds, you need to first.

1. Go to the Edit -> Plugins -> IDA Feeds. IDA Feeds will open in a new Signature Tools subview.

2. In the Signature Tools window, click Open signatures folder and select the folder with the downloaded FLIRT signature bundle (1), or leave the preloaded signatures already provided with your IDA instance.

1. Select all or chosen signature files, and then click Run multi-core analysis (2).

2. Check the results and click Apply signatures to bulk apply (3) correct matches.

Borland RTTI descriptors plugin

This plugin allows you to create/delete/view Borland RTTI descriptors.

These descriptors appear in programs written on BCC++ or Borland C++ Builder or Borland Delphi.

The plugin is available for 32 bits binaries for PE or OMF format.

Dialog box

Configuration

This plugin (nicknamed "dscu" for brevity) is essentially just an extension of the Mach-O loader. It allows you to manually load modules from a dyldcache that were not loaded when first opening the cache in IDA (the plugin is only activated after using the "single module" option for a dyldcache).

For a quick overview of the dscu functionality, see menu File>Load file>DYLD Shared Cache Utils.

Loading Modules

There are a few ways to manually load a module from the cache:

1) Use File>Load file>DYLD Shared Cache Utils>Load module... and choose which module to load

FLIRT Signature Bundle

With FLIRT Signature Bundle, designed to be used with IDA Feeds (aka FLIRT Signature Manager), you can analyze thousands of signatures and bulk apply them to your binary.

The bundle contains signatures for modern languages like Golang and Rust, as well as updates for classic compilers. The latest version of the FLIRT Signature Bundle can be downloaded from My Hex-Rays portal under SDK and utilities.

Flirt Signature Bundles will be regularly updated and released independently whenever there is a new compiler, language, or library release.

Released versions

2024/09/12 FLIRT Signature Bundle

Golang

• Versions: stable versions from 1.10.0 to 1.23

• Operating Systems: Linux, Windows, MacOS

• Architectures: arm64 (Windows, Linux, MacOS), arm (Windows, Linux, MacOS), x86 (Windows, Linux) , x86-64 (Windows, Linux)

C/C++

• Windows (MSVC):

  • Architectures: arm, arm64, i386, amd64

  • Packages: ATL, CTL, MFC, Windows SDK 10, Windows SDK 11

The objc plugin performs Objective-C specific analysis on the database.

For an overview of what the plugin can do, see the menu options in Edit>Other>Objective-C, or the config options in objc.cfg.

Type Information

The bulk of the plugin's work is done at file load time, when it will parse all Objective-C type information embedded in the binary, and use this to create tinfo_t structures for all known classes and construct prototypes for all known methods.

This analysis can be invoked manually at any time with:

Or:

You can also disable objc analysis at load time with command line option:

Patfind plugin

Patfind plugin makes it possible to automatically find functions in binary files.

It relies on bit pattern definitions for typical function starts and function ends.

Those bit patterns are defined in XML files, based on Ghidra's function patterns format. A collection of bit pattern files is provided for the commonly used CPU architectures.

It is possible to add new architectures by simply adding a new XML file, just like the other XML files.

It's also possible to add, remove or change existing patterns for better matching.

Configuration

'cfg/patfind.cfg' file presents all the options

The config file also contains the documentation on how to use or change the XML pattern files.

If desired, new XML files can be added to the 'cfg/ghidra_patterns/' directory.

'-Opatfind' command line switches can be used to select the type of run differently for this session of IDA.

List of options

Examples