feat: IDA Pro plugin for MBA deobfuscation

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: CI
 on:
   push:
     branches: [master]
+    tags: ['v*']
   pull_request:
     branches: [master]
 
@@ -80,6 +81,7 @@ jobs:
             -DCMAKE_C_COMPILER="${CC:-${{ matrix.cc }}}" \
             -DCMAKE_CXX_COMPILER="${CXX:-${{ matrix.cxx }}}" \
             -DCMAKE_BUILD_TYPE=Release \
+            -DCOBRA_ENABLE_LLVM=ON \
             -DUSE_EXTERNAL_LLVM=ON \
             -DCOBRA_BUILD_TESTS=ON
           cmake --build build-deps
@@ -117,3 +119,141 @@ jobs:
         run: |
           find include lib tools \( -name '*.h' -o -name '*.cpp' \) -print0 \
             | xargs -0 clang-format-22 --dry-run --Werror
+
+  ida-plugin:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            cc: gcc-14
+            cxx: g++-14
+            name: Linux
+          - os: macos-15
+            cc: clang
+            cxx: clang++
+            name: macOS
+          - os: windows-latest
+            name: Windows
+
+    name: IDA Plugin (${{ matrix.name }})
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Clone IDA SDK
+        run: >
+          git clone --depth 1 --branch v9.3.0-sdk.3
+          https://github.com/HexRaysSA/ida-sdk.git ida-sdk
+
+      - name: Install Ninja (Linux)
+        if: runner.os == 'Linux'
+        run: sudo apt-get install -y -qq ninja-build
+
+      - name: Install Ninja (macOS)
+        if: runner.os == 'macOS'
+        run: brew install ninja
+
+      - name: Install Ninja (Windows)
+        if: runner.os == 'Windows'
+        run: choco install ninja -y
+
+      - name: Cache dependencies
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: build-deps/install
+          key: deps-ida-${{ matrix.os }}-${{ hashFiles('dependencies/*.cmake') }}
+
+      - name: Build dependencies (Unix)
+        if: runner.os != 'Windows'
+        run: |
+          cmake -S dependencies -B build-deps -G Ninja \
+            -DCMAKE_C_COMPILER="${CC:-${{ matrix.cc }}}" \
+            -DCMAKE_CXX_COMPILER="${CXX:-${{ matrix.cxx }}}" \
+            -DCMAKE_BUILD_TYPE=Release
+          cmake --build build-deps
+
+      - name: Build dependencies (Windows)
+        if: runner.os == 'Windows'
+        run: |
+          cmake -S dependencies -B build-deps -G Ninja `
+            -DCMAKE_C_COMPILER=clang-cl `
+            -DCMAKE_CXX_COMPILER=clang-cl `
+            -DCMAKE_BUILD_TYPE=Release
+          cmake --build build-deps
+
+      - name: Build IDA plugin (Unix)
+        if: runner.os != 'Windows'
+        run: |
+          cmake -S . -B build -G Ninja \
+            -DCMAKE_C_COMPILER="${CC:-${{ matrix.cc }}}" \
+            -DCMAKE_CXX_COMPILER="${CXX:-${{ matrix.cxx }}}" \
+            -DCMAKE_PREFIX_PATH="$(pwd)/build-deps/install" \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCOBRA_BUILD_IDA_PLUGIN=ON \
+            -DIDA_SDK_DIR="$(pwd)/ida-sdk/src"
+          cmake --build build --target ida-cobra
+
+      - name: Build IDA plugin (Windows)
+        if: runner.os == 'Windows'
+        run: |
+          cmake -S . -B build -G Ninja `
+            -DCMAKE_C_COMPILER=clang-cl `
+            -DCMAKE_CXX_COMPILER=clang-cl `
+            -DCMAKE_PREFIX_PATH="$(Resolve-Path build-deps/install)" `
+            -DCMAKE_BUILD_TYPE=Release `
+            -DCOBRA_BUILD_IDA_PLUGIN=ON `
+            -DIDA_SDK_DIR="$(Resolve-Path ida-sdk/src)"
+          cmake --build build --target ida-cobra
+
+      - name: Upload plugin artifact
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ida-cobra-${{ matrix.name }}
+          path: |
+            build/lib/ida/ida-cobra.*
+            lib/ida/ida-cobra.cfg
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [build, lint, ida-plugin]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download all IDA plugin artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdceab917 # v4.3.0
+        with:
+          pattern: ida-cobra-*
+          path: release-artifacts/
+
+      - name: Rename artifacts with version and platform
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          mkdir -p release
+          cp lib/ida/ida-cobra.cfg "release/ida-cobra.cfg"
+          for dir in release-artifacts/ida-cobra-*; do
+            platform="$(echo "$(basename "$dir" | sed 's/ida-cobra-//')" | tr '[:upper:]' '[:lower:]')"
+            for bin in "$dir"/build/lib/ida/ida-cobra.*; do
+              ext="${bin##*.}"
+              cp "$bin" "release/ida-cobra-${platform}-${version}.${ext}"
+            done
+          done
+
+      - name: Upload to GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --title "${{ github.ref_name }}" \
+            --generate-notes \
+            release/*

CMakeLists.txt

@@ -59,6 +59,7 @@ option(COBRA_BUILD_LLVM_PASS "Build the LLVM pass plugin (requires LLVM 19-22)"
 option(COBRA_BUILD_TESTS "Build tests (requires GoogleTest in prefix)" OFF)
 option(COBRA_ENABLE_TRACE "Enable detailed pipeline tracing to stderr (debug builds)" OFF)
 option(COBRA_ENABLE_TRACY "Enable Tracy profiler instrumentation" OFF)
+option(COBRA_BUILD_IDA_PLUGIN "Build IDA Pro plugin (requires IDA_SDK_DIR)" OFF)
 
 if(COBRA_BUILD_LLVM_PASS)
     find_package(LLVM REQUIRED CONFIG)
@@ -93,6 +94,10 @@ if(COBRA_BUILD_LLVM_PASS)
     add_subdirectory(lib/llvm)
 endif()
 
+if(COBRA_BUILD_IDA_PLUGIN)
+    add_subdirectory(lib/ida)
+endif()
+
 if(COBRA_BUILD_TESTS)
     enable_testing()
     add_subdirectory(test)

dependencies/CMakeLists.txt

@@ -6,6 +6,7 @@
 #   cmake --build build-deps
 #
 # Options:
+#   COBRA_ENABLE_LLVM       (default OFF) - Enable LLVM dependency
 #   USE_EXTERNAL_LLVM       (default ON)  - Use system LLVM vs build from source
 #   USE_EXTERNAL_HIGHWAY    (default OFF) - Use system highway vs build from source
 #   COBRA_BUILD_TESTS       (default OFF) - Build GoogleTest for tests
@@ -16,6 +17,7 @@
 cmake_minimum_required(VERSION 3.20)
 project(cobra-dependencies LANGUAGES C CXX)
 
+option(COBRA_ENABLE_LLVM "Enable LLVM dependency" OFF)
 option(USE_EXTERNAL_LLVM "Use system LLVM instead of building from source" ON)
 option(USE_EXTERNAL_ABSEIL "Use system abseil instead of building from source" OFF)
 option(USE_EXTERNAL_HIGHWAY "Use system highway instead of building from source" OFF)
@@ -28,7 +30,10 @@ include(superbuild.cmake)
 
 include(abseil.cmake)
 include(highway.cmake)
-include(llvm.cmake)
+
+if(COBRA_ENABLE_LLVM)
+    include(llvm.cmake)
+endif()
 
 if(COBRA_BUILD_TESTS)
     include(googletest.cmake)

include/cobra/core/ExtensionLowering.h

@@ -0,0 +1,24 @@
+#pragma once
+
+#include "cobra/core/Expr.h"
+
+#include <cstdint>
+#include <memory>
+
+namespace cobra {
+
+    // Scalar helpers — used by frontend evaluators.
+    // Precondition: 1 <= source_bits <= 64.
+    uint64_t EvalZeroExtend(uint64_t val, uint32_t source_bits, uint64_t result_mask);
+    uint64_t EvalSignExtend(uint64_t val, uint32_t source_bits, uint64_t result_mask);
+
+    // Expr helpers — used by frontend AST builders.
+    // Return ordinary fixed-width Expr; no new Expr::Kind values.
+    // Precondition: 1 <= source_bits <= 64.
+    // When source_bits == 64, returns inner unchanged (identity).
+    std::unique_ptr< Expr >
+    LowerZeroExtend(std::unique_ptr< Expr > inner, uint32_t source_bits);
+    std::unique_ptr< Expr >
+    LowerSignExtend(std::unique_ptr< Expr > inner, uint32_t source_bits);
+
+} // namespace cobra

lib/core/CMakeLists.txt

@@ -34,6 +34,7 @@ target_sources(cobra-core PRIVATE
     SignatureEval.cpp
     MixedProductRewriter.cpp
     ExprCost.cpp
+    ExtensionLowering.cpp
     SignatureSimplifier.cpp
     BitwiseDecomposer.cpp
     HybridDecomposer.cpp

lib/core/ExtensionLowering.cpp

@@ -0,0 +1,57 @@
+#include "cobra/core/ExtensionLowering.h"
+
+#include "cobra/core/BitWidth.h"
+
+#include <cassert>
+
+namespace cobra {
+    namespace {
+
+        struct ExtMasks
+        {
+            uint64_t low_mask;
+            uint64_t sign_bit;
+        };
+
+        ExtMasks ComputeExtMasks(uint32_t source_bits) {
+            assert(source_bits >= 1 && source_bits <= 64);
+            return ExtMasks{
+                .low_mask = Bitmask(source_bits),
+                .sign_bit = 1ULL << (source_bits - 1),
+            };
+        }
+
+    } // anonymous namespace
+
+    uint64_t EvalZeroExtend(uint64_t val, uint32_t source_bits, uint64_t result_mask) {
+        auto [low_mask, sign_bit] = ComputeExtMasks(source_bits);
+        return (val & low_mask) & result_mask;
+    }
+
+    uint64_t EvalSignExtend(uint64_t val, uint32_t source_bits, uint64_t result_mask) {
+        auto [low_mask, sign_bit] = ComputeExtMasks(source_bits);
+        uint64_t masked           = val & low_mask;
+        return ((masked ^ sign_bit) - sign_bit) & result_mask;
+    }
+
+    std::unique_ptr< Expr >
+    LowerZeroExtend(std::unique_ptr< Expr > inner, uint32_t source_bits) {
+        assert(source_bits >= 1 && source_bits <= 64);
+        if (source_bits == 64) { return inner; }
+
+        auto [low_mask, sign_bit] = ComputeExtMasks(source_bits);
+        return Expr::BitwiseAnd(std::move(inner), Expr::Constant(low_mask));
+    }
+
+    std::unique_ptr< Expr >
+    LowerSignExtend(std::unique_ptr< Expr > inner, uint32_t source_bits) {
+        assert(source_bits >= 1 && source_bits <= 64);
+        if (source_bits == 64) { return inner; }
+
+        auto [low_mask, sign_bit] = ComputeExtMasks(source_bits);
+        auto masked = Expr::BitwiseAnd(std::move(inner), Expr::Constant(low_mask));
+        auto xored  = Expr::BitwiseXor(std::move(masked), Expr::Constant(sign_bit));
+        return Expr::Add(std::move(xored), Expr::Negate(Expr::Constant(sign_bit)));
+    }
+
+} // namespace cobra

lib/ida/CMakeLists.txt

@@ -0,0 +1,64 @@
+if(NOT DEFINED IDA_SDK_DIR)
+    message(FATAL_ERROR
+        "IDA_SDK_DIR must be set when COBRA_BUILD_IDA_PLUGIN is ON.\n"
+        "  cmake -DIDA_SDK_DIR=/path/to/ida-sdk/src ...")
+endif()
+
+# Detect platform-specific IDA stub library directory
+if(APPLE)
+    if(CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64")
+        set(_ida_lib_suffix "arm64_mac_64")
+    else()
+        set(_ida_lib_suffix "x64_mac_64")
+    endif()
+    set(_ida_lib_name "libida.dylib")
+elseif(WIN32)
+    set(_ida_lib_suffix "x64_win_64")
+    set(_ida_lib_name "ida.lib")
+else()
+    if(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64")
+        set(_ida_lib_suffix "arm64_linux_64")
+    else()
+        set(_ida_lib_suffix "x64_linux_64")
+    endif()
+    set(_ida_lib_name "libida.so")
+endif()
+
+set(_ida_lib_path "${IDA_SDK_DIR}/lib/${_ida_lib_suffix}/${_ida_lib_name}")
+if(NOT EXISTS "${_ida_lib_path}")
+    message(FATAL_ERROR "IDA stub library not found: ${_ida_lib_path}")
+endif()
+
+add_library(ida-cobra MODULE
+    ida-cobra.cpp
+    MicrocodeDetector.cpp
+    MicrocodeConverter.cpp
+    Verifier.cpp
+)
+
+target_link_libraries(ida-cobra PRIVATE cobra-core "${_ida_lib_path}")
+
+target_include_directories(ida-cobra PRIVATE
+    ${IDA_SDK_DIR}/include
+    ${CMAKE_CURRENT_SOURCE_DIR}
+)
+
+# IDA SDK platform defines
+target_compile_definitions(ida-cobra PRIVATE
+    __EA64__=1
+    $<$<PLATFORM_ID:Windows>:__NT__>
+    $<$<PLATFORM_ID:Linux>:__LINUX__>
+    $<$<PLATFORM_ID:Darwin>:__MAC__>
+)
+
+set_target_properties(ida-cobra PROPERTIES
+    PREFIX ""
+    SUFFIX "${CMAKE_SHARED_LIBRARY_SUFFIX}"
+)
+
+install(TARGETS ida-cobra
+    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}/cobra
+)
+install(FILES ida-cobra.cfg
+    DESTINATION ${CMAKE_INSTALL_DATADIR}/cobra
+)