9

In my previous question I had originally asked for this, but since this aspect of the question was completely disregarded, I feel compelled to ask it separately.

There are certain events apparently not covered in the IDA SDK. I learned in the above linked question that anterior and posterior comments are supported, but what about other events such as when I press h (e.g. 2Ah becomes 42) to change the number to base 10 (and back) or r to show it as character (e.g. 2Ah becomes *).

How would I go about to catch these?

NB: in general this question would also relate to IDA versions prior to the ones supporting a particular event notification. E.g. the IDA SDK 6.4, according to Igor, introduced notifications for anterior and posterior comments. How can I get older versions and 6.4 to co-operate w.r.t. those events in conjunction with collabREate?

I know that it is allowed to reverse engineer IDA itself, so what I am looking for are pointers.

Community
  • 1
0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
  • In case you haven't seen it Dumpinfo.idc might be a good start. Here is a link for the IDC script created by J.C. Roberts. I'm unsure if it answers your questions so adding as a comment. – alexanderh Apr 29 '13 at 19:32
  • @alexanderh: no, I hadn't known about this one. Thanks for the pointer. It certainly looks like a starting point. – 0xC0000022L Apr 29 '13 at 21:54
  • 1
    I think the only possible answer to this question is "reverse engineering". Discover the mechanism by which the action in which you are interested is triggered, and then patch IDA (or use DLL injection etc) to send some sort of custom notification. However, I doubt it will be that easy; you could expect, perhaps, multiple code paths responsible for the same action. I expect if it were that easy, Hex-Rays would add the notifications themselves. – Rolf Rolles Apr 29 '13 at 23:37

1 Answers1

4

When I needed to do a similar task I ended up hooking the IDB save event and then scanned the IDB for modifications using the IDA API before each user save. it took about a few seconds to scan the entire function list, aggregating most information for both functions and data elements.

To me, that sounds like a more practical approach than trying to reverse engineer IDA and patching these hooks in, especially when trying to catch UI events such as user hotkeys.

one point to note though, is that aggregating structure/enum data might be difficult if you choose not to rely on IDA's id numbers if you're doing to handle more than one IDB file.

If you do wish to reverse engineer IDA, it'll be very interesting to join a discussion on the topic somewhere. since IDA now uses Qt for most of it's UI (though I'll guess the migration to Qt wasn't as smooth as one could hope), a great starting point into Qt will be Daniel Pistelli's Qt Internals and Reversing article, which also includes an IDAPython script at the end (yet reading the entire article is highly recommended).

it's somewhat outdated but assuming IDA uses Qt 4.8.x there aren't many differences (if you'd like I can list the ones I know of).

basically, since Qt is very event-driven (and with some luck IDA 6.0 was designed with that in mind) it might be the case that you just need to listen, in Qt-dialect this is called connect-ing a slot (event handler) to a signal (event), for at-least some of the specific events you wish to hook.

I previously did some moderate Qt-IDA hacks as I call them, using Qt and PyQt to manipulate Qt objects under IDA's application. In the same manner I managed to add and edit menu items and tool bars manually, it is definitely possible to look up the context menu popup when right-clicking in IDA's disassembly view or hooking the hotkeys.

This RE.SE answer of mine might be a good place to start.

Community
  • 1
NirIzr
  • 11,765
  • 1
  • 37
  • 87
  • Thanks for taking the time to answer. It's a good start in the direction Rolf holds will be the only feasible method. – 0xC0000022L May 31 '13 at 22:50