search

ax330d / hrdev

Hex-Rays Decompiler Enhanced View
MIT License
176 stars 50 forks source link

Faild to execute plugin in IDA 7.1 #2

Open confile opened 6 years ago

confile commented 6 years ago

When running the plugin I get the following error:

malware-windows_10_pro_x64
ghost commented 4 years ago

Same problem in IDA 7.0

ThaFurther commented 4 years ago

Same problem in 7.2

ThaFurther commented 4 years ago

ok --- @confile @orzubek I figured it out.. if you are still wondering.

Make sure you use the pip.exe located in c:\python27\Scripts or wherever you have python installed for IDA.

The author does point out that you need these to correctly work with plugin. The only thing that caught me off guard was the lack of errors showing the console. So to see what was going on I modified is Python init slightly to print the error since for some reason the import error was not giving me all these details.

ThaFurther commented 4 years ago

@ax330d you can probably close this.

cw2k commented 3 years ago

Okay two steps are needed to fix that error:

  1. Get python clang. That's easy open cmd.exe and run: c:\python27\Scripts\pip.exe install clang
  2. Get that libclang.dll and copy it into c:\Program Files\IDA 7.3\ Take care for ida64.exe requires a 64-bit version while ida.exe needs a 32-bit version. Use Everything or some other search tool - maybe it's already somewhere hidden on your harddisk. Else well there is llvm but it's f**king big. So llvm 11 installation is 1,5 GB. but all you need from it is that libclang.dll that is just 70MB. So don't install it instead open LLVM-11.0.0-win64.exe in 7-Zip. Go to /bin and extract libclang.dll to the IDA folder. And you are done. To elaborated that 32-bit vs 64-bit thing. Extract 32-bit version to C:\Windows\SysWOW64 and 64-bit version to C:\Windows\System32.

Use an old version like https://releases.llvm.org/download.html#3.7.0. Smaller and works as well. To get over that "Please ensure that your python bindings are compatible with your libclang.so version." Error Open C:\python27-x64\lib\site-packages\clang\cindex.py search for 'compatibility_check' and chance compatibility_check = True to compatibility_check = False and ya done.

Well since there is no doc so far - there is some config file: c:\Program Files\IDA 7.3\plugins\hrdev_plugin\data\config.ini

The shortcut Alt-F5 is not well chosen - it is very close to Alt+F4 that will just close IDA. And also clashes with Repeat_RTTI_command bdescr Alt-F5 of the standard plugins.cfg I changed it to Alt+F6 by editing hrdev.py

Okay finally seeing hrdev in action I was a little disappointed. All that interactivity got lost. :( Click on a function to open it doesn't work anymore. Rename stuff also got lost. So what is the point of that plugin? A little bit sugar candy in syntax highlighting? Copy and paste the actual function to your favorite editor will probably accomplish the same.

Despite the hex number all the time and highlighting probably exploitable string functions like strcpy it won't make it into my toolkit because it is just decreasing usability.