search

blackberry / pe_tree

Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump in-memory PE files and reconstruct imports.
Apache License 2.0
1.3k stars 170 forks source link

Cannot see data in the PETree window - IDAPython #11

Closed ribbs closed 3 years ago

ribbs commented 3 years ago

MACHINE: OS: Windows 10 Education OS Build: 19042.631 Version: 20H2 IDA PRO: Version: 7.6

I am using Petree as an IDA Python plugin. When I run the Petree under plugins, it loads and there are no errors. Inside the Petree window, there are colorful sections on the left but no data on the right of it. When I do click on one of the colorful section headers, it seems like there is data being shown on the right because the scroll bars get bigger and smaller. Also if I click in the white space where the text it's supposed to be, it sometimes will take me to an address. Please let me know if I am doing something wrong. Thanks!

ribbs commented 3 years ago

FIX

Found on: https://github.com/fireeye/capa/blob/master/capa/ida/plugin/README.md

" IDA 7.6 caveat: IDA 7.6sp1 or patch required

As described here:

A rather nasty issue evaded our testing and found its way into IDA 7.6: using the PyQt5 modules that are shipped with IDA, QTreeView (or QTreeWidget) instances will always fail to display contents.

Therefore, in order to use capa under IDA 7.6 you need the Service Pack 1 for IDA 7.6. Alternatively, you can download and install the fix corresponding to your IDA installation, replacing the original QtWidgets DLL with the one contained in the .zip file (links to Hex-Rays):

Windows: https://www.hex-rays.com/wp-content/uploads/2021/04/pyqt5_qtwidgets_win.zip 
Linux: https://www.hex-rays.com/wp-content/uploads/2021/04/pyqt5_qtwidgets_linux.zip
MacOS (Intel): https://www.hex-rays.com/wp-content/uploads/2021/04/pyqt5_qtwidgets_mac_x64.zip
MacOS (AppleSilicon): https://www.hex-rays.com/wp-content/uploads/2021/04/pyqt5_qtwidgets_mac_arm.zip

"

tombonner commented 3 years ago

This is good to know, thanks for sharing!