Skip to main content
added info about the repo with a working IDAPython plugin for IDA free (proof of concept)
Source Link
DarthGizka
  • 2k
  • 1
  • 14
  • 30

IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.

This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction.

Porting the old IDAPython 1.0.0 should be almost as simple as rebuilding against an implib for IDA 5.0 free, but it does require some minor tweaks to deal with IDA 5.1 functions that are not available in IDA 5.0. Testing might turn up problems that due to changes that go beyond the availability of exported names, though. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work.

P.S.: simply rewriting the import table of an IDAPython 1.0.0 plugin built for IDA 5.1 is not an option, since it uses 32 IDA.WLL exports that are not available version 5.0. This means that the plugin source has to be modified - either to implement the missing functions or to remove all references to them.

UPDATE: I put a set of patches for IDAPython-1.0.0 and for the IDA 5.0 SDK headers in a github repo (IDAPython-free). The repo also contains a .def file for creating an implib for IDA 5.0 free (only the imports needed by the plugin) and a .csv file giving all ordinals for all exports of the IDA 5.0 free ida.wll, in case someone wants to add more exports to the lib. Last but not least, the file idapython-1.0.0_ida5.0_py2.7_win32.zip contains the result of the build, ready to be extracted into an IDA 5.0 free installation. That's the .py files, the plugin (with .pdb), and the examples.

I tested the whole shebang with python 2.7.9, and the examples ran fine. IDAPython-1.0.0 was written for python 2.5.x or thereabouts, though, which means that some serious testing is indicated. Another thing is that this version of IDAPython is some seven years old; there's some serious catching up to be done in terms of advances and bug fixes. I'm neither a snake charmer (I prefer IDC and C++) nor a user of IDA free (having forked over $$$$ for IDA Pro), but I would be willing to lend a hand if someone wants to take point on an 'IDAPython free' project.

IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.

This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction.

Porting the old IDAPython 1.0.0 should be almost as simple as rebuilding against an implib for IDA 5.0 free, but it does require some minor tweaks to deal with IDA 5.1 functions that are not available in IDA 5.0. Testing might turn up problems that due to changes that go beyond the availability of exported names, though. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work.

P.S.: simply rewriting the import table of an IDAPython 1.0.0 plugin built for IDA 5.1 is not an option, since it uses 32 IDA.WLL exports that are not available version 5.0. This means that the plugin source has to be modified - either to implement the missing functions or to remove all references to them.

IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.

This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction.

Porting the old IDAPython 1.0.0 should be almost as simple as rebuilding against an implib for IDA 5.0 free, but it does require some minor tweaks to deal with IDA 5.1 functions that are not available in IDA 5.0. Testing might turn up problems that due to changes that go beyond the availability of exported names, though. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work.

P.S.: simply rewriting the import table of an IDAPython 1.0.0 plugin built for IDA 5.1 is not an option, since it uses 32 IDA.WLL exports that are not available version 5.0. This means that the plugin source has to be modified - either to implement the missing functions or to remove all references to them.

UPDATE: I put a set of patches for IDAPython-1.0.0 and for the IDA 5.0 SDK headers in a github repo (IDAPython-free). The repo also contains a .def file for creating an implib for IDA 5.0 free (only the imports needed by the plugin) and a .csv file giving all ordinals for all exports of the IDA 5.0 free ida.wll, in case someone wants to add more exports to the lib. Last but not least, the file idapython-1.0.0_ida5.0_py2.7_win32.zip contains the result of the build, ready to be extracted into an IDA 5.0 free installation. That's the .py files, the plugin (with .pdb), and the examples.

I tested the whole shebang with python 2.7.9, and the examples ran fine. IDAPython-1.0.0 was written for python 2.5.x or thereabouts, though, which means that some serious testing is indicated. Another thing is that this version of IDAPython is some seven years old; there's some serious catching up to be done in terms of advances and bug fixes. I'm neither a snake charmer (I prefer IDC and C++) nor a user of IDA free (having forked over $$$$ for IDA Pro), but I would be willing to lend a hand if someone wants to take point on an 'IDAPython free' project.

added 433 characters in body
Source Link
DarthGizka
  • 2k
  • 1
  • 14
  • 30

IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.

This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction.

Porting the old IDAPython 1.0.0 mightshould be almost as simple as rebuilding against an implib for IDA 5.0 free, but updating it from Python 2.5does require some minor tweaks to a more recent incarnation (2.7deal with IDA 5.8 or 21 functions that are not available in IDA 5.70.9) could require some Testing might turn up problems that due to changes that go beyond the availability of exported names, though. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work.

P.S.: simply rewriting the import table of an IDAPython 1.0.0 plugin built for IDA 5.1 is not an option, since it uses 32 IDA.WLL exports that are not available version 5.0. This means that the plugin source has to be modified - either to implement the missing functions or to remove all references to them.

IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.

This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction.

Porting the old IDAPython 1.0.0 might be as simple as rebuilding against an implib for IDA 5.0 free but updating it from Python 2.5 to a more recent incarnation (2.7.8 or 2.7.9) could require some changes. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work.

IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.

This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction.

Porting the old IDAPython 1.0.0 should be almost as simple as rebuilding against an implib for IDA 5.0 free, but it does require some minor tweaks to deal with IDA 5.1 functions that are not available in IDA 5.0. Testing might turn up problems that due to changes that go beyond the availability of exported names, though. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work.

P.S.: simply rewriting the import table of an IDAPython 1.0.0 plugin built for IDA 5.1 is not an option, since it uses 32 IDA.WLL exports that are not available version 5.0. This means that the plugin source has to be modified - either to implement the missing functions or to remove all references to them.

Source Link
DarthGizka
  • 2k
  • 1
  • 14
  • 30

IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.

This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction.

Porting the old IDAPython 1.0.0 might be as simple as rebuilding against an implib for IDA 5.0 free but updating it from Python 2.5 to a more recent incarnation (2.7.8 or 2.7.9) could require some changes. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work.