Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Faild to execute plugin in IDA 7.1 #2

Open
confile opened this issue Oct 19, 2018 · 5 comments
Open

Faild to execute plugin in IDA 7.1 #2

confile opened this issue Oct 19, 2018 · 5 comments

Comments

@confile
Copy link

confile commented Oct 19, 2018

When running the plugin I get the following error:

malware-windows_10_pro_x64

@ghost
Copy link

ghost commented Feb 8, 2020

Same problem in IDA 7.0

@ThaFurther
Copy link

Same problem in 7.2

@ThaFurther
Copy link

ThaFurther commented May 5, 2020

ok --- @confile @Orzubek I figured it out.. if you are still wondering.

  • First, make sure you have LLVM toolset: https://releases.llvm.org/. Download and install. (this installs clang, and needed libraries)
  • Thenpip install clang to get the clang bindings for python.

Make sure you use the pip.exe located in c:\python27\Scripts or wherever you have python installed for IDA.

The author does point out that you need these to correctly work with plugin. The only thing that caught me off guard was the lack of errors showing the console. So to see what was going on I modified is Python init slightly to print the error since for some reason the import error was not giving me all these details.

@ThaFurther
Copy link

@ax330d you can probably close this.

@cw2k
Copy link

cw2k commented Nov 3, 2020

Okay two steps are needed to fix that error:

  1. Get python clang. That's easy open cmd.exe and run:
    c:\python27\Scripts\pip.exe install clang
  2. Get that libclang.dll and copy it into c:\Program Files\IDA 7.3
    Take care for ida64.exe requires a 64-bit version while ida.exe needs a 32-bit version.
    Use Everything or some other search tool - maybe it's already somewhere hidden on your harddisk.
    Else well there is llvm but it's f**king big. So llvm 11 installation is 1,5 GB. but all you need from it is that libclang.dll that is just 70MB. So don't install it instead open LLVM-11.0.0-win64.exe in 7-Zip. Go to /bin and extract
    libclang.dll to the IDA folder. And you are done.
    To elaborated that 32-bit vs 64-bit thing. Extract 32-bit version to C:\Windows\SysWOW64 and 64-bit version to C:\Windows\System32.

Use an old version like https://releases.llvm.org/download.html#3.7.0. Smaller and works as well.
To get over that "Please ensure that your python bindings are compatible with your libclang.so version." Error
Open C:\python27-x64\lib\site-packages\clang\cindex.py
search for 'compatibility_check' and chance
compatibility_check = True to compatibility_check = False
and ya done.

Well since there is no doc so far - there is some config file:
c:\Program Files\IDA 7.3\plugins\hrdev_plugin\data\config.ini

The shortcut Alt-F5 is not well chosen - it is very close to Alt+F4 that will just close IDA. And also clashes with
Repeat_RTTI_command bdescr Alt-F5 of the standard plugins.cfg
I changed it to Alt+F6 by editing hrdev.py

Okay finally seeing hrdev in action I was a little disappointed. All that interactivity got lost. :(
Click on a function to open it doesn't work anymore. Rename stuff also got lost.
So what is the point of that plugin? A little bit sugar candy in syntax highlighting?
Copy and paste the actual function to your favorite editor will probably accomplish the same.

Despite the hex number all the time and highlighting probably exploitable string functions like strcpy it won't make it into my toolkit because it is just decreasing usability.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants