Passing arguments to "Load DWARF" plugin

Plugins
1

I’m working on a script that incorporates some DWARF debug information into an existing IDB. As part of this, I rely on the builtin DWARF plugin, however I can’t seem to find how to invoke this plugin with an argument - a path to an existing .dSYM - using IDAPython.

The most I have is load_and_run_plugin(‘dwarf’, 0), but that just creates an open-file prompt. I’ve seen other plugins, like dscu, use netnode, but there’s hardly any documentation around it that I could find.

2

if your dSYM is next to the file or in a parallel directory to the .app bundle, normally it should be picked up automatically by the mach-O loader.

E.g. for my.app/subdir/my2.app/subdir2/exec, the plugin will check:

  • my.app/subdir/my2.app/subdir2/.dSYM/Contents/Resources/DWARF/exec
  • my.app/subdir/my2.app/.dSYM/Contents/Resources/DWARF/exec
  • my.app/subdir/.dSYM/Contents/Resources/DWARF/exec
  • my.app/.dSYM/Contents/Resources/DWARF/exec

You should see the paths being checked by passing -z400010to IDA.

3

Yeah that functions as it should, however my use case is a bit different. My plugin is creating and loading DWARF files into IDBs like the shared library cache.

Take Swift for example. It’s open source so I can build it myself and create a dSYM bundle containing all of the rich type information that Apple (and clang to a minor extent) strips from the shipped versions in the shared cache. I would like for my plugin to load those generated dSYM bundles programmatically instead of telling the user to manually go to a directory and Edit → Plugins → Load DWARF for each of the different dSYM bundles that the plugin generates. E.g. libswiftCore.dylib.dSYM, libswift_Concurrency.dylib.dSYM, etc.

4

Thank you for the update. I’m afraid there is currently no option for this use case. Perhaps you can somehow intercept the ui_ask_file event and return your file name.

5

So, how to load a dwarf file in idapython(via headless ida)?

6

Well, I tried intercept ida_kernwin.ask_file api after calling ida_kernwin.process_ui_actionEdit/Plugins/Load DWARF file“) for running the DWARF plugin in ida64. It did work! But I want to decompile multi files in idat, there’s no ui_action or ask_file.

In a word, how to load specific dwarf file in idat?