keystone-engine / keypatch

Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
http://www.keystone-engine.org/keypatch
GNU General Public License v2.0
1.47k stars 355 forks source link

Fixed the form cannot be shown for ida pro 7.2 release version #55

Closed fjh658 closed 5 years ago

fjh658 commented 5 years ago

Fixed the form(Patcher, Search, Fill Range) cannot be shown for ida pro 7.2 release version.

Please see the picture below: image

fjh658 commented 5 years ago

Please review PR. @aquynh Thank you.

aquynh commented 5 years ago

sorry for very late reply!

this looks good, but please confirm that this works for v6.x

aquynh commented 5 years ago

also, would you mind verifying the pull req https://github.com/keystone-engine/keypatch/pull/36, to confirm it works for v7.x?

thanks!

fjh658 commented 5 years ago

sorry for very late reply!

this looks good, but please confirm that this works for v6.x

It works that I tested for v6.x. @aquynh

fjh658 commented 5 years ago

also, would you mind verifying the pull req #36, to confirm it works for v7.x?

thanks!

This pull req #36 is not recommended for merging, there are some problems.

  1. idaapi.get_name_value(address, sym) -> idaapi.get_name_ea(address, sym) For jmp xxx case is good, but this will cause a lot of problems. https://github.com/keystone-engine/keypatch/commit/b8b0f79060d34ff35e6b3b6dd60a755d2ab0e8e7 eg:
    • "Memory" variable image
Python>(type, value) = idaapi.get_name_value(here(), "Memory")
Python>print(hex(value))
0xffffffffffffffe0L

Correct result: image

In other words, the result of name is not ea will be incorrect.

About the current situation of this function get_name_value image

  1. The following code is not seen to have any problems, no need to modify. https://github.com/keystone-engine/keypatch/pull/36/commits/36cdc9497644f68b887fff41d31bf0002129d06e

    # ask IDA to re-analyze the patched area
    if orig_func_end == idc.BADADDR:
    # only analyze patched bytes, otherwise it would take a lot of time to re-analyze the whole binary
    idaapi.analyze_area(address, address + patched_len + 1)
    else:
    idaapi.analyze_area(address, orig_func_end)
    
    # try to fix IDA function re-analyze issue after patching
    idaapi.func_setend(address, orig_func_end)

@aquynh

aquynh commented 5 years ago

merged, thanks!