ida-plugin-development

name	ida-plugin-development
description	Develop plugins for IDA Pro in Python, using idiomatic patterns, lessons, and tricks, including the Python Domain API (ida-domain). Use when creating both GUI (Qt) and background plugins for inspecting and rendering things program structure, functions, disassembly, cross-references, and strings.

Resource Map

基准路径: .claude/skills/scraping-specialist/references/domains/ida-pro-skills/ida-plugin-development/

ida-plugin-development/
├── scripts/
│   └── hcli-package.py
└── SKILL.md

Developing IDA Pro plugins

Use this skill when developing plugins for IDA Pro using Python.

IDA's UI and analysis passes can be almost completely replaced through plugins. There's a lot of power (and a lot of complexity), so its important to follow known patterns. This document lists tips and tricks for creating new plugins for modern versions of IDA.

Key concepts covered in this document:

• Use the IDA Domain API - prefer the high-level Pythonic interface
• Plugin Manager Integration - packaging and distribution
• Plugin Entry Point - version checking and conditional loading
• Hook Registration - pairwise register/unregister pattern
• Cross-Plugin Communication via IDC Functions - invoke plugin functionality from scripts/other plugins
• Save/Load state from netnodes - persist plugin data in IDB
• Respond to current address and selection change - UI location hooks
• Find widgets by prefix - managing multiple widget instances
• Context Menu Entries - "Send to Foo" patterns
• User Defined Prefix - add contextual markers in disassembly
• Viewer Hints - hover popups with context
• Overriding rendering - custom colors and mnemonics
• Custom Viewers - tagged lines with clickable addresses

Use the IDA Domain API

Always prefer the IDA Domain API over the legacy low-level IDA Python SDK. The Domain API provides a clean, Pythonic interface that is easier to use and understand. However, there will be some things that the Domain API doesn't cover, especially around plugin registration and GUI handling.

Right now: read this intro guide: https://ida-domain.docs.hex-rays.com/getting_started/index.md

Always refer to the documentation rather than doing introspection, because the documentation explains concepts, not just symbol names. To fetch specific API documentation, use URLs like:

• https://ida-domain.docs.hex-rays.com/ref/functions/index.md - Function analysis API
• https://ida-domain.docs.hex-rays.com/ref/xrefs/index.md - Cross-reference API
• https://ida-domain.docs.hex-rays.com/ref/strings/index.md - String analysis API

Available API modules: bytes, comments, database, entries, flowchart, functions, heads, hooks, instructions, names, operands, segments, signature_files, strings, types, xrefs URL pattern: https://ida-domain.docs.hex-rays.com/ref/{module}/index.md

You can always ask a subagent to answer a question by exploring the documentation and summarizing its findings.

Key Database Properties

with Database.open(path, ida_options) as db:
    db.minimum_ea      # Start address
    db.maximum_ea      # End address
    db.metadata        # Database metadata
    db.architecture    # Target architecture

    db.functions       # All functions (iterable)
    db.strings         # All strings (iterable)
    db.segments        # Memory segments
    db.names           # Symbols and labels
    db.entries         # Entry points
    db.types           # Type definitions
    db.comments        # All comments
    db.xrefs           # Cross-reference utilities
    db.bytes           # Byte manipulation
    db.instructions    # Instruction access

Common Analysis Tasks

List Functions

func: func_t
for func in db.functions:
    name = db.functions.get_name(func)
    print(f"{hex(func.start_ea)}: {name} ({func.size} bytes)")

Interesting func_t properties:

class func_t:
    name: str
    flags: int
    start_ea: int
    end_ea: int
    size: int
    does_return: bool
    referers: list[int]  # function start addresses
    addresses: list[int]
    frame_object: tinfo_t
    prototype: tinfo_t

Cross-references

for xref in db.xrefs.to_ea(target_addr):
    print(f"Referenced from {hex(xref.from_ea)} (type: {xref.type.name})")

for xref in db.xrefs.from_ea(source_addr):
    print(f"References {hex(xref.to_ea)}")

for xref in db.xrefs.calls_to_ea(func_addr):
    print(f"Called from {hex(xref.from_ea)}")

XrefInfo type:

XrefInfo(
    from_ea: int,
    to_ea: int,
    is_code: bool,
    type: XrefType,
    user: bool,
)

Read data

db.bytes.get_byte_at(addr)
db.bytes.get_bytes_at(addr)
db.bytes.get_cstring_at(addr)
db.bytes.get_word_at(addr)
db.bytes.get_dword_at(addr)
db.bytes.get_qword_at(addr)
db.bytes.get_disassembly_at(addr)
db.bytes.get_flags_at(addr)

Plugin Manager Integration

Plugins must be compatible with the Hex-Rays Plugin Manager.

Making your plugin available via Plugin Manager offers several benefits:

• simplified plugin installation
• improved plugin discoverability through the central index
• easy Python dependency management

The key points to make your IDA plugin available via Plugin Manager are:

• Add ida-plugin.json
• Package your plugin into a ZIP archive (via source archives or GitHub Actions)
• Publish releases on GitHub

A complete ida-plugin.json example:

{
  "IDAMetadataDescriptorVersion": 1,
  "plugin": {
    "name": "ida-terminal-plugin",
    "entryPoint": "index.py",
    "version": "1.0.0",
    "idaVersions": ">=9.2",
    "platforms": [
      "windows-x86_64",
      "linux-x86_64",
      "macos-x86_64",
      "macos-aarch64",
    ],
    "description": "A lightweight terminal integration for IDA Pro that lets you open a fully functional terminal within the IDA GUI.\nQuickly access shell commands, scripts, or tooling without leaving your reversing environment.",
    "license": "MIT",
    "logoPath": "ida-plugin.png",
    "categories": [
      "ui-ux-and-visualization"
    
     
      
      
      
    
     
      
    
     
       
    
     
       
       
    
     
      
         
         
         
         
         
         
      
    
  

Before completing your work, review the following resources for packaging hints:

• https://hcli.docs.hex-rays.com/reference/plugin-repository-architecture/
• https://hcli.docs.hex-rays.com/reference/plugin-packaging-and-format/
• https://hcli.docs.hex-rays.com/reference/packaging-your-existing-plugin/

Use the script ./scripts/hcli-package.py to invoke HCLI in a consistent way and lint the current plugin.

Use ida-settings for configuration values

ida-settings is a Python library used by IDA Pro plugins to fetch configuration values from the shared settings infrastructure.

During plugin installation, the plugin manager prompts users for the configuration values and stores them in ida-config.json. Subsequently, users can invoke HCLI (or later, the IDA Pro GUI) to update their configuration. ida-settings is the library that plugins use to fetch the configuration values.

For example:

import ida_settings
api_key = ida_settings.get_current_plugin_setting("openai_key")

Note that this must be called from within the plugin (plugin_t or plugmod_t), not a callback or hook; capture an instance of the plugin settings and pass it around as necessary:

class Hooks(idaapi.IDP_Hooks):
    def __init__(self, settings):
        super().__init__()
        self.settings = settings
        
    def ev_get_bg_color(self, color, ea):
        mnem = ida_ua.print_insn_mnem(ea)

        if mnem == "call" or mnem == "CALL":
            bgcolor = ctypes.cast(int(color), ctypes.POINTER(ctypes.c_int))
            bgcolor[0] = int(settings.get_setting("bg_color"))
            return 1

        else:
            return 0

class FooPluginMod(ida_idaapi.plugmod_t):
    def run(self, arg):
        settings = ida_settings.get_current_plugin_settings()
        self.hooks = Hooks(settings)
        self.hooks.hook()

Available APIs are:

• del(_current)_plugin_setting
• get(_current)_plugin_setting
• has(_current)_plugin_setting
• set(_current)_plugin_setting
• list(_current)_plugin_settings

Use standard logging module

Don't use print for status messages - use logging.* routines. Do not configure logging from within a plugin - its up to the user to configure which levels and sources they want to see in their output window.

Plugin Entry Point

The entrypoint of the plugin should be foo_entry.py which imports from foo.py only if the environment is correct.

If the plugin runs in all IDA environments (assuming dependencies are present, which is reasonable), then you don't need a special wrapper like this.

For example, if the plugin requires Qt and/or IDA to be running graphically, you could do something like:

foo_entry.py:

import logging
import os

import ida_kernwin

logger = logging.getLogger(__name__)

def should_load():
    """Returns True if IDA 9.2+ is running interactively."""
    if not ida_kernwin.is_idaq():
        # https://community.hex-rays.com/t/how-to-check-if-idapythonrc-py-is-running-in-ida-pro-or-idalib/297/4
        return False

    if os.environ.get("IDA_IS_INTERACTIVE") != "1":
        # https://community.hex-rays.com/t/how-to-check-if-idapythonrc-py-is-running-in-ida-pro-or-idalib/297/2
        return False

    kernel_version: tuple[int, ...] = tuple(
        int(part) for part in ida_kernwin.get_kernel_version().split(".") if part.isdigit()
    ) or (0,)
    if kernel_version < (9, 2):  # type: ignore
        logger.warning("IDA too old (must be 9.2+): %s", ida_kernwin.get_kernel_version())
        return False

    return True


if should_load():
    # only attempt to import the plugin once we know the required dependencies are present.
    # otherwise we'll hit ImportError and other problems
    from foo import foo_plugin_t

    def PLUGIN_ENTRY():
         foo_plugin_t()

:
    :
         ida_idaapi
     ImportError:
         idaapi  ida_idaapi

     (ida_idaapi.plugin_t):
        flags = ida_idaapi.PLUGIN_HIDE | ida_idaapi.PLUGIN_UNL
        wanted_name = 
        comment = 
         = 
        wanted_hotkey = 

         ():
             ida_idaapi.PLUGIN_SKIP
    
    
     ():
        
         foo_nop_plugin_t()

foo.py:

class foo_plugmod_t(ida_idaapi.plugmod_t):
    def __init__(self):
        # IDA doesn't invoke this for plugmod_t, only plugin_t
        self.init()

    def init(self):
        # do things here that will always run,
        #  and don't require the menu entry (edit > plugins > ...) being selected.
        #
        # note: IDA doesn't call init, we do in __init__

        if not ida_auto.auto_is_ok():
            # don't capture events before auto-analysis is done, or we get all the system events.
            #
            # note:
            # - when we first load a program, this plugin will be run before auto-analysis is complete
            #   (actually, before auto-analysis even starts).
            #   so auto_is_ok() returns False
            # - when we load an existing IDB, auto_is_ok() return True.
            # so we can safely use this to wait until auto-analysis is complete for the first time.
            logger.debug("waiting for auto-analysis to complete before subscribing to events")
            ida_auto.auto_wait()
            logger.debug("auto-analysis complete, now subscribing to events")

        ...

    def run(self, arg):
        # do things here that users invoke via the menu entry (edit > plugins > ...)
        ...

    def term(self):
        # cleanup resources, unhook handlers, etc.
        ...

class foo_plugin_t(ida_idaapi.plugin_t):
    flags = ida_idaapi.PLUGIN_MULTI
     = 
    comment = 
    wanted_name = 
    wanted_hotkey = 

     ():
         foo_plugmod_t()

Hook Registration

Create pairwise helper functions for registering/unregistering hooks, and call these from init/term

class oplog_plugmod_t(ida_idaapi.plugmod_t):
    def __init__(self):
        self.idb_hooks: IDBChangedHook | None = None
        self.location_hooks: UILocationHook | None = None
        ...

    def register_idb_hooks(self):
        assert self.events is not None
        self.idb_hooks = IDBChangedHook(self.events)
        self.idb_hooks.hook()

    def unregister_idb_hooks(self):
        if self.idb_hooks:
            self.idb_hooks.unhook()

    def register_location_hooks(self):
        assert self.events is not None
        self.location_hooks = UILocationHook(self.events)
        self.location_hooks.hook()

    def unregister_location_hooks(self):
        if self.location_hooks:
            self.location_hooks.unhook()

    def ():
        ...
        .register_idb_hooks()
        .register_location_hooks()

     ():
        ...

     ():
        
        .unregister_location_hooks()
        .unregister_idb_hooks()
        ...

Cross-Plugin Communication via IDC Functions

Python plugins can import shared libraries, and two plugins may even have the same dependencies. One plugin can import code from another plugin's module. However, to invoke functionality on a specific instance of a running plugin (accessing its state, calling methods that depend on instance data), you need a different mechanism.

Use ida_expr.add_idc_func to register a callable with a well-known name, and idc.eval_idc to invoke it from scripts or other plugins.

Key constraints:

• The function name must be globally unique - only one plugin should register a given name
• There's only a single provider for that name (no multiple instances registering the same name)
• The registering plugin must unregister the function during term()

import ida_expr

class foo_plugmod_t(ida_idaapi.plugmod_t):
    def __init__(self):
        self.data: list[str] = []
        self.init()

    def register_idc_func(self):
        data = self.data

        def foo_get_data(index: int) -> str:
            if 0 <= index < len(data):
                return data[index]
            return ""

        def foo_add_data(value: str) -> int:
            data.append(value)
            return len(data)

        if ida_expr.add_idc_func("foo_get_data", foo_get_data, (ida_expr.VT_LONG,)):
            logger.debug("registered foo_get_data IDC function")
        else:
            logger.warning("failed to register foo_get_data IDC function")

        if ida_expr.add_idc_func("foo_add_data", foo_add_data, (ida_expr.VT_STR,)):
            logger.debug("registered foo_add_data IDC function")
        else:
            logger.warning("failed to register foo_add_data IDC function")

    def unregister_idc_func(self):
        ida_expr.del_idc_func()
        ida_expr.del_idc_func()

     ():
        .register_idc_func()

     ():
        .unregister_idc_func()

Callers invoke the function via idc.eval_idc:

import idc

idc.eval_idc('foo_add_data("hello")')
result = idc.eval_idc('foo_get_data(0)')

Parameter types for add_idc_func:

• ida_expr.VT_STR - string parameter
• ida_expr.VT_LONG - integer parameter
• ida_expr.VT_FLOAT - floating point parameter

This pattern is useful for:

• Exporting plugin data to external scripts (headless testing, automation)
• Allowing one plugin to trigger actions in another
• Providing a stable API for plugin functionality that doesn't depend on Python imports

Save/Load state from netnodes

Use netnodes to store data within the IDB. Serialize the current plugin state during shutdown, saving it to a netnode. Reload the state upon startup.

import pydantic

OUR_NETNODE = "$ com.williballenthin.idawilli.foo"


class State(pydantic.BaseModel):
    ...

    def to_json(self):
        return self.model_dump_json()

    @classmethod
    def from_json(cls, json_str: str):
        return cls(State.model_validate_json(json_str))


def save_state(state: State):
    buf = zlib.compress(state.to_json().encode("utf-8"))

    node = ida_netnode.netnode(OUR_NETNODE)
    node.setblob(buf, 0, "I")

    logger.info("saved state")


def load_state() -> State:
    node = ida_netnode.netnode(OUR_NETNODE)
    if not node:
        logger.info("no existing state")
        return State()

    buf = node.getblob(0, "I")
    if not buf:
        logger.info("no existing state (no data)")
        return State()

    state = State.from_json(zlib.decompress(buf).decode("utf-8"))
    logger.info("loaded state")
    return state


class UI_Closing_Hooks(ida_kernwin.UI_Hooks):
    """Respond to UI events and save the events into the database."""

    # we could also use IDB_Hooks, but I found it less reliable:
    # - closebase: "the database will be closed now", however, I couldn't figure out when its actually triggered.
    
    

     ():
        ().__init__(*args, **kwargs)
        .events = events

     ():
         action == :
            
            save_events(.events)
             
         action == :
            
            save_events(.events)
             
         action == :
            
            save_events(.events)
             
        :
             

Respond to current address and selection change

class UILocationHook(ida_kernwin.UI_Hooks):
    def handle_current_address_change(self, ea: int):
        ...

    def handle_current_selection_change(self, start: int, end: int):
        ...

    def screen_ea_changed(self, ea: ida_idaapi.ea_t, prev_ea: ida_idaapi.ea_t) -> None:
        if ea == prev_ea:
            return

        v = ida_kernwin.get_current_viewer()

        if ida_kernwin.get_widget_type(v) not in (
            ida_kernwin.BWN_HEXVIEW,
            ida_kernwin.BWN_DISASM,
            # BWN_PSEUDOCODE
            # BWN_CUSTVIEW
            # BWN_OUTPUT the text area, in the output window
            # BWN_CLI the command-line, in the output window
            # BWN_STRINGS
            # ...
        ):
            return

        if ida_kernwin.get_viewer_place_type(v) != ida_kernwin.TCCPT_IDAPLACE:
            # other viewers might have other place types, when not address-oriented
            return

        has_range, start, end = ida_kernwin.read_range_selection(v)
        if not has_range:
            return self.handle_current_address_change(ea)

        if ida_idaapi.BADADDR in (start, end):
            return

        return self.handle_current_selection_change(start, end)

Find widgets by prefix

def list_widgets(prefix: str) -> list[str]:
    """Probe A-Z for existing widgets, return found captions.

    Args:
        prefix: Caption prefix to search for

    Returns: List of found widget captions (e.g., ["Foo-A", "Foo-C"])
    """
    if not prefix.endswith("-"):
        raise ValueError("prefix must end with dash")
    found = []
    for letter in "ABCDEFGHIJKLMNOPQRSTUVWXYZ":
        caption = f"{prefix}{letter}"
        if ida_kernwin.find_widget(caption) is not None:
            found.append(caption)
    return found


def find_next_available_caption(prefix: str) -> str:
    """Find first gap or next letter for widget caption.

    Args:
        prefix: Caption prefix to use

    Returns: First available caption (e.g., "Foo-B")

    Raises:
        RuntimeError: If all 26 instances are in use
    """
    if not prefix.endswith("-"):
        raise ValueError("prefix must end with dash")
    for letter in "ABCDEFGHIJKLMNOPQRSTUVWXYZ":
        caption = f"{prefix}{letter}"
        if ida_kernwin.find_widget(caption) is None:
            return caption
     RuntimeError()

Context Menu Entries, "Send to Foo" and "Send to Foo-A"

When creating custom views, especially when there might be more than one, name them like "Foo-A", "Foo-B", etc. And, as appropriate, add context menu items for "sending" addresses/selections to the new views.

The new view is an instance of ida_kernwin.PluginForm and may have arbitrary Qt widgets. The plugin instance maintains a registry of created views, and registers the action handlers for opening new views, as well as notifying the views of events from a central place. Action handlers encapsulate the code that's invoked during an event.

class FooForm(ida_kernwin.PluginForm):
    def __init__(
        self,
        caption: str = "Foo-A",
        form_registry: dict[str, "FooForm"] | None = None,
    ) -> None:
        super().__init__()
        self.TITLE = caption
        self.form_registry = form_registry

    def OnCreate(self, form):
        self.parent = self.FormToPyQtWidget(form)
        self.w = FooWidget(parent=self.parent, show_ida_buttons=True)

        ... # other Qt stuff here

        if self.form_registry is not None:
            self.form_registry[self.TITLE] = self

    def OnClose(self, form):
        if self.form_registry is not None:
            self.form_registry.pop(self.TITLE, None)


class create_foo_widget_action_handler_t(ida_kernwin.action_handler_t):
    def () -> :
        ().__init__(*args, **kwargs)
        .plugmod = plugmod

     ():
        .plugmod.create_viewer()

     ():
         ida_kernwin.AST_ENABLE_ALWAYS


 (ida_kernwin.action_handler_t):
    

     () -> :
        ().__init__(*args, **kwargs)
        .plugmod = plugmod

     ():
        
        v = ida_kernwin.get_current_viewer()

         ida_kernwin.get_widget_type(v)   (
            ida_kernwin.BWN_HEXVIEW,
            ida_kernwin.BWN_DISASM,
        ):
            
             

        form = .plugmod.create_viewer()

         form  form.w:
            ... 

         

     ():
        
        v = ida_kernwin.get_current_viewer()

         ida_kernwin.get_widget_type(v)   (
            ida_kernwin.BWN_HEXVIEW,
            ida_kernwin.BWN_DISASM,
        ):
            
             ida_kernwin.AST_DISABLE
         ida_kernwin.AST_ENABLE


 (ida_kernwin.action_handler_t):
    

     () -> :
        ().__init__(*args, **kwargs)
        .form_registry = form_registry
        .caption = caption

     ():
        
        v = ida_kernwin.get_current_viewer()

        widget = ida_kernwin.find_widget(.caption)
         widget  :
            logger.warning()
             

        ida_kernwin.activate_widget(widget, )

        form = .form_registry.get(.caption)
         form  (form, ):
            
            ...
        :
            logger.warning()

         

     ():
        
        v = ida_kernwin.get_current_viewer()

         ida_kernwin.get_widget_type(v)   (
            ida_kernwin.BWN_HEXVIEW,
            ida_kernwin.BWN_DISASM,
        ):
            
             ida_kernwin.AST_DISABLE
         ida_kernwin.AST_ENABLE


 (ida_idaapi.plugmod_t):
    ACTION_NAME = 
    SEND_ACTION_NAME = 
    MENU_PATH = 

     ():
        ().__init__()
        .form_registry: [, FooForm] = {}
        ...

     ():
        
        existing = list_widgets()

         caption  existing:
            action_name = 

             ida_kernwin.unregister_action(action_name):
                

            ida_kernwin.register_action(
                ida_kernwin.action_desc_t(
                    action_name,
                    ,
                    send_to_specific_widget_action_handler_t(
                        .form_registry, caption
                    ),
                    ,
                    ,
                    -,
                )
            )

     () -> FooForm:
         caption  :
            caption = find_next_available_caption()
        form = FooForm(caption, .form_registry)
        form.Show(form.TITLE)
         form

     ():
        ida_kernwin.register_action(
            ida_kernwin.action_desc_t(
                .ACTION_NAME,
                ,
                create_foo_widget_action_handler_t(),
            )
        )

        
        ida_kernwin.attach_action_to_menu(
            .MENU_PATH, .ACTION_NAME, ida_kernwin.SETMENU_APP
        )

     ():
        ida_kernwin.unregister_action(.ACTION_NAME)
        ida_kernwin.detach_action_from_menu(.MENU_PATH, .ACTION_NAME)


     ():
        .register_open_action()
        ...

     ():
        .create_viewer()

     ():
        ...
        .unregister_open_action()

User Defined Prefix

A user defined prefix is a great way to add some contextual data before each disassembly line. Put symbols or numbers here to indicate there's more context available somewhere.

def refresh_disassembly():
    ida_kernwin.request_refresh(ida_kernwin.IWID_DISASM)

class FooPrefix(ida_lines.user_defined_prefix_t):
    ICON = " β "

    def __init__(self, marks: set[int]):
        super().__init__(len(self.ICON))
        self.marks = marks

    def get_user_defined_prefix(self, ea, insn, lnnum, indent, line):
        if ea in self.marks:
            # wrap the icon in color tags so its easy to identify.
            # otherwise, the icon may merge with other spans, which
            # makes checking for equality more difficult.
            return ida_lines.COLSTR(self.ICON, ida_lines.SCOLOR_SYMBOL)

        return " " * len(self.ICON)

class FooPrefixPluginMod(ida_idaapi.plugmod_t):
    def __init__(self):
        self.marks: set[int] = {1, 2, 3}
        self.prefixer: FooPrefix | None = None

    def run(self, arg):
        
        .prefixer = FooPrefix(.marks)

        
        
        refresh_disassembly()

     ():
        
        .prefixer = 

        
        refresh_disassembly()

Viewer Hints

A view hint is a really good way to display complex information in a popup hover pane that displays when mousing over particular regions of an IDA view. Use this to show context about a symbol or address, for example: MSDN documentation for API functions.

Use this in combination with User Defined Prefixes that indicate context is available and show the context in the viewer hint (possibly when hovering over the prefix).

class FooHints(ida_kernwin.UI_Hooks):
    def __init__(self, notes: dict[int, str], *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.notes = notes

    def get_custom_viewer_hint(self, viewer, place):
        if not place:
            return

        ea = place.toea()
        if not ea:
            return

        if ea not in self.notes:
            return

        curline = ida_kernwin.get_custom_viewer_curline(viewer, True)
        curline = ida_lines.tag_remove(curline)
        _, x, _ = ida_kernwin.get_custom_viewer_place(viewer, True)

        # example: show on first column
        # more advanced: inspect the symbol, and if it matches a query, then show some data
        if x == 1:
            note = self.notes.get(ea)
            if not note:
                return

            return (f"note: {note}", 1)


class FooHintsPluginMod(ida_idaapi.plugmod_t):
    def __init__(self):
        self.notes: dict[, ] = {}
        .hinter: FooHints |  = 

     ():
        .hinter = FooHints(.notes)
        .hinter.hook()

     ():
         .hinter   :
            .hinter.unhook()

        .hinter = 

Overriding rendering

class ColorHooks(idaapi.IDP_Hooks):
    def ev_get_bg_color(self, color, ea):
        """
        Get item background color.
        Plugins can hook this callback to color disassembly lines dynamically

            // background color in RGB
            typedef uint32 bgcolor_t;

        ref: https://hex-rays.com/products/ida/support/sdkdoc/pro_8h.html#a3df5040891132e50157aee66affdf1de

        args:
            color: (bgcolor_t *), out
            ea: (::ea_t)

        returns:
            retval 0: not implemented
            retval 1: color set
        """
        mnem = ida_ua.print_insn_mnem(ea)

        if mnem == "call" or mnem == "CALL":
            bgcolor = ctypes.cast(int(color), ctypes.POINTER(ctypes.c_int))
            bgcolor[0] = 0xDDDDDD
            return 1

        else:
            return 0

    def ev_out_mnem(self, ctx) -> int:
        """
        Generate instruction mnemonics.
        This callback should append the colored mnemonics to ctx.outbuf 
        Optional notification, if absent, out_mnem will be called.

        args:
            ctx: (outctx_t *)

        returns:
            retval 1: if appended the mnemonics
            retval 0: not implemented
        """
        mnem = ctx.insn.get_canon_mnem()
        if mnem == "call":
            # you can manipulate this, but note that it affects `ida_ua.print_insn_mnem` which is inconvenient for formatting.
            # also, you only have access to theme colors, like COLOR_PREFIX, not arbitrary control.
            ctx.out_custom_mnem("CALL")
            return 1

        else:
            return 


 (ida_idaapi.plugmod_t):
     ():
        .hooks: ColorHooks |  = 

     ():
        .hooks = ColorHooks()
        .hooks.hook()

     ():
         .hooks   :
            .hooks.unhook()

        .hooks = 

Custom Viewers

Use a custom viewer to show text data, optionally with tags, and respond to basic events (clicks). Use the tagged line concepts to embed and parse metadata about the symbols in a line, such as which address it refers to.

def addr_from_tag(raw: bytes) -> int:
    assert raw[0] == 0x01  # ida_lines.COLOR_ON
    assert raw[1] == ida_lines.COLOR_ADDR
    addr_hex = raw[2 : 2 + ida_lines.COLOR_ADDR_SIZE].decode("ascii")

    try:
        # Parse as hex address (IDA uses qsscanf with "%a" format)
        return int(addr_hex, 16)
    except ValueError:
        raise


def get_tagged_line_section_byte_offsets(section: ida_kernwin.tagged_line_section_t) -> tuple[int, int]:
    # tagged_line_section_t.byte_offsets is not exposed by swig
    # so we parse directly from the string representation (puke)
    s = str(section)
    text_start_index = s.index("text_start=")
    text_end_index = s.index("text_end=")

    text_start_s = s[text_start_index + len("text_start=") :].partition(",")[0]
    text_end_s = s[text_end_index + len("text_end=") :].partition("}")[0]

    return int(text_start_s), int(text_end_s)


@dataclass
class TaggedLineSection:
    tag: 
    string: 
    
    address:  | 


 () -> TaggedLineSection:
    ret = TaggedLineSection(ida_lines.COLOR_DEFAULT, line, )

    tls = ida_kernwin.tagged_line_sections_t()
      ida_kernwin.parse_tagged_line_sections(tls, line):
         ret

    
    current_section = tls.nearest_at(x, )  
      current_section:
        
        
         ret

    ret.tag = current_section.tag
    boring_line = ida_lines.tag_remove(line)
    ret.string = boring_line[current_section.start : current_section.start + current_section.length]

    
    current_section_start, _ = get_tagged_line_section_byte_offsets(current_section)
    addr_section = tls.nearest_before(current_section, x, ida_lines.COLOR_ADDR)
     addr_section:
        addr_section_start, _ = get_tagged_line_section_byte_offsets(addr_section)
        
        
        addr_tag_start = addr_section_start - (ida_lines.COLOR_ADDR_SIZE + )
         addr_tag_start >= 

        
        
        
        
         current_section_start == addr_tag_start:
            raw = line.encode()
            addr = addr_from_tag(raw[addr_tag_start : addr_tag_start + ida_lines.COLOR_ADDR_SIZE + ])
            ret.address = addr

     ret


 (ida_kernwin.simplecustviewer_t):
    TITLE = 

     ():
        ().__init__()

        .timer: QtCore.QTimer = QtCore.QTimer()
        .timer.timeout.connect(.on_timer_timeout)

     ():
          ().Create(.TITLE):
             

        .render()

         

     ():
          ().Show(*args):
             

        ida_kernwin.attach_action_to_popup(.GetWidget(), , some_action_handler_t.ACTION_NAME)
         

     ():
        .render()

     ():
        .timer.stop()

     ():
        .ClearLines()
        .AddLine(datetime.datetime.now.isoformat())
        .AddLine(ida_lines.COLSTR(ida_lines.tag_addr() + , ida_lines.SCOLOR_CNAME))

     ():
        line = .GetCurrentLine()
          line:
             

        _linen, x, _y = .GetPos()

        section = get_current_tag(line, x)
         section.address   :
            ida_kernwin.jumpto(section.address)

        item_address = ida_name.get_name_ea(, section.string)
         item_address != ida_idaapi.BADADDR:
            logger.debug()
            ida_kernwin.jumpto(item_address)