IDA Exec Functions Importer

IDA plugin for importing Unreal Engine symbols and types from the CppSDK and IDAMappings output generated by Dumper-7.

What it imports

• Every Unreal exec function that has a native implementation
• The complete generated C++ SDK, including its classes, structs, functions, and other types
• Every discovered VTable
• Non-inlined UClass* USomeType::StaticClass() functions
• Statically constructed FName values, named as NAME_<StringContent>
• Supported global symbols:
  • GObjects
  • GNames
  • FName::AppendString
  • UObject::ProcessEvent

Exec functions	Virtual function tables

Exec-function implementation recovery

The imported mappings associate exec functions with their native implementations. Place the cursor on the implementation call inside an exec function and press Ctrl+Alt+Q. The plugin resolves the call target and applies its mapped name and prototype.

Imported exec function

Native implementation called by the exec function

Imported types and global symbols

The C++ SDK import adds Unreal classes, structs, fields, and function declarations. The mapping import names supported global symbols like GObjects.

VTables and class hierarchies

The plugin names all VTables present in the mappings. IDA-VTable-Utility adds inheritance-aware virtual-function navigation, hierarchy views, and propagation of names and prototypes across overrides.

The utility is required for the hierarchy window shown below and is used automatically by the Ctrl+Alt+Q action when the selected target is a virtual call.

Requirements

• IDA Pro 9.2 or newer
• Hex-Rays Decompiler
• A Dumper-7 output directory containing CppSDK, IDAMappings, or both
• idaclang when importing types from CppSDK/SDK.hpp (recommended)
• IDA-VTable-Utility for inheritance-aware virtual-call handling

Installation

Download the artifact matching your IDA version from the latest GitHub Actions run, or build the solution locally with the matching official IDA SDK.

Copy IDAExecFunctions64.dll into the plugins directory of your latest IDA installation, for example:

C:\Program Files\IDA Professional 9.3\plugins\

Restart IDA after copying the plugin.

Usage

1. Open the target Unreal Engine binary in IDA and allow initial analysis to finish.
2. Press Ctrl+Alt+D to run the importer.
3. Select the top-level Dumper-7 output directory containing CppSDK and IDAMappings.
4. Choose a type source:
   • idaclang parses CppSDK/SDK.hpp.
   • Mappings creates types from the .idmap data.
   • Don't import types imports names and symbols only.
5. To recover a native implementation from an exec thunk, place the cursor on the wrapped function call and press Ctrl+Alt+Q.

The importer accepts modern V2 .idmap files and legacy V1 identifier streams.

Building

Clone the official SDK into IDA-SDK using the tag that matches your target IDA version:

git clone --recursive --branch v9.3.1-release https://github.com/HexRaysSA/ida-sdk.git IDA-SDK

The expected layout is:

IDAExecFunctionsImporter\
+-- IDA-SDK\
|   +-- src\
|       +-- include\
|       +-- lib\
+-- IDAExecFunctions64\
+-- IDAExecFunctions64.sln

Visual Studio

1. Open IDAExecFunctions64.sln in Visual Studio.

2. Select Release and x64 in the solution configuration toolbar.

3. If Visual Studio asks to retarget the project, select an installed MSVC toolset.

4. Open Project > Properties > General > Output Directory and set it to the plugins directory of the IDA installation you are building for, for example:

   C:\Program Files\IDA Professional 9.3\plugins\
   

5. Select Build > Build Solution or press Ctrl+Shift+B.

The resulting IDAExecFunctions64.dll is written to the configured output directory. Restart IDA after building if it was already open.

Command line

From a Visual Studio Developer PowerShell prompt:

msbuild IDAExecFunctions64.sln /m /p:Configuration=Release /p:Platform=x64

Use the SDK tag matching the IDA version you intend to support. The included GitHub Actions workflow builds separate artifacts for IDA 9.2, 9.3, and 9.4/latest.

.idmap V1 record format

Legacy mapping files contain a stream of variable-length identifier records:

struct Identifier
{
    uint32 Offset; // Relative to image base
    uint16 NameLength;
    const char Name[NameLength]; // Not null-terminated
};

IDMap visualizer

The repository also includes a standard-library-only Python/Tkinter visualizer for modern .idmap files and legacy identifier streams:

python tools\idmap_visualizer.py path\to\file.idmap

For parser-only inspection without opening the GUI:

python tools\idmap_visualizer.py path\to\file.idmap --dump-json