Few weeks ago, I saw somewhere on the Internet question about IDA Freeware compatibility with the Fluorescence plugin. And because this plugin is written in IDAPython and IDAPython isn’t officially supported by IDA Freeware, also this plugin isn’t compatible.

However, when I checked what this plugin does, it turns out that it is very simple - its purpose is to highlight call instructions. So as an exercise I re-created IDC script with similar feature, and moreover, I also created plugin version of IDC Fluorescence.

Fluorescence IDC Script

The idea of the Call Highlighter is very simple, all I need is just to find all call instructions and highlight them. The original Fluorescence IDAPython plugin uses idaapi.is_call_insn(ea) function for determining whether the instruction is call or not. However, in IDC language this function is not available (as a footnote I can mention that this IDAPython function calls the native is_call_insn function exported by IDA Pro version of libida library).

Thus I bypassed this restriction with simple check if instruction mnemonic is call. Also, I checked the features of decoded instruction, if it includes CF_CALL feature. Moreover, I also checked if there is another call-like behavior consisting of push instruction followed by ret instruction. Of course, this script currently supports only x86 and x86-64 instruction set for calls (without support for ARM branches). However, it has one advantage in comparison with few others call-highlighters scripts I saw in the past - for example they checked if there are xrefs from the current instruction, but this check will not cover for example the case of indirect calls, when destination address is referenced by register, such as call [eax+8].

Useful IDC functions are FindCode, DecodeInstruction, and GetMnem, or their snake_case versions.

Fig. 1: Statistics printed by Fluorescence to the Output windows

Highlighting is pretty simple, it consists of checking the current value of color and if it is default color, then the script changes it to the highlight color and vice versa. This could be done by get_color and set_color, or GetColor/SetColor IDC functions).

Fig. 2: Call Instructions highlighted by Fluorescence IDC script

IDA Scriptable Plugins

Actually, this is my first IDC plugin. Yes, the real plugin which will appear in IDA menu together with other plugins. For long time I thought that IDA plugins could be only native, compiled against appropriate IDA SDK, or plugins written in IDA Python, because they could benefit from lot of IDA features which are exported and available in IDA Pro versions.

Because of my assumption when I developed something for IDA, I usually created only IDC scripts for my personal projects (or, IDA Python stuff for work-related cases). But this time when I quickly finished Fluorescence IDC script, I tried to dive into IDC deeper and I found 10-years old, but still valid post at Hex-Rays blog about Scriptable plugins. This was exactly what I was looking for and provided with source code for sample IDC Scriptable plugin I was able to create also plugin version of Fluorescence Call Highlighter.

Just for reference, I added here my example of Hello World plugin, which actually does nothing useful except printing the “Hello World” message:

#include <idc.idc>

class hello_t {
    hello_t() {
        this.flags = 0;
        this.comment = "Hello World";
        this.help = "Hello Help";
        this.wanted_name = "Hello World";
        this.wanted_hotkey = "";
    }

    init() {
        return PLUGIN_OK;
    }
    
    run(arg) {
        Message("Hello World\n");
    }

    term() {
    }
}

static PLUGIN_ENTRY() {
    return hello_t();
}
Fig. 3: Fluorescence and Hello World IDC Plugins in IDA Edit->Plugins menu

References