When a plug-in is loaded into
IDA, IDA examines the exported PLUGIN variable to locate several function pointers
that IDA uses to initialize, execute, and terminate each plug-in. The plug-in structure is
defined as follows:
class plugin_t {
public:
int version; // Set this to IDP_INTERFACE_VERSION
int flags; // plugin attributes often set to 0
// refer to loader.hpp for more info
int (idaapi* init)(void); // plugin initialization function, called once for
// each database that is loaded. Return value
// indicates how Ida should treat the plugin
Gray Hat Hacking: The Ethical Hacker??™s Handbook
330
void (idaapi* term)(void); // plugin termination function. called when a
// plugin is unloaded. Can be used for plugin
// cleanup or set to NULL if no cleanup required.
void (idaapi* run)(int arg); // plugin execution function. This is the function
// that is called when a user activates the plugin
// using the Edit menu or assigned plugin hotkey
char *comment; // Long description of the plugin. Not terribly
// important.
char *help; // Multiline help about the plugin
char *wanted_name; // The name that will appear on the
// Edit/Plugins submenu
char *wanted_hotkey; // The hotkey sequence to activate the plugin
// "Alt-" or "Shift-F9" for example
};
An absolutely minimal plug-in that does nothing other than print a message to IDA??™s
message window appears next.
Pages:
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592