5

I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can share the built version for either Windows or Linux platform.

P.S.: The building process from the scratch requires tools which are not provided for free by https://www.hex-rays.com/index.shtml

Improve this question
1
  • A pre-built version of IDAPython-1.0.0 for IDA 5.0 free (Windows) is available at my IDAPython-free repo. It works, but the IDAPython source distro does not contain any test suites whatsoever and so there's no easy way to verify proper operation. This means it's a proof-of-concept thing, not a reliable tool that has been hammered on and thoroughly debugged. Still, it's a lot more than nothing at all and could serve as a starting point for an IDAfreePython project.
    – DarthGizka
    Commented Feb 20, 2015 at 12:11

2 Answers 2

Reset to default
2

IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.

This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction.

Porting the old IDAPython 1.0.0 should be almost as simple as rebuilding against an implib for IDA 5.0 free, but it does require some minor tweaks to deal with IDA 5.1 functions that are not available in IDA 5.0. Testing might turn up problems that due to changes that go beyond the availability of exported names, though. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work.

P.S.: simply rewriting the import table of an IDAPython 1.0.0 plugin built for IDA 5.1 is not an option, since it uses 32 IDA.WLL exports that are not available version 5.0. This means that the plugin source has to be modified - either to implement the missing functions or to remove all references to them.

UPDATE: I put a set of patches for IDAPython-1.0.0 and for the IDA 5.0 SDK headers in a github repo (IDAPython-free). The repo also contains a .def file for creating an implib for IDA 5.0 free (only the imports needed by the plugin) and a .csv file giving all ordinals for all exports of the IDA 5.0 free ida.wll, in case someone wants to add more exports to the lib. Last but not least, the file idapython-1.0.0_ida5.0_py2.7_win32.zip contains the result of the build, ready to be extracted into an IDA 5.0 free installation. That's the .py files, the plugin (with .pdb), and the examples.

I tested the whole shebang with python 2.7.9, and the examples ran fine. IDAPython-1.0.0 was written for python 2.5.x or thereabouts, though, which means that some serious testing is indicated. Another thing is that this version of IDAPython is some seven years old; there's some serious catching up to be done in terms of advances and bug fixes. I'm neither a snake charmer (I prefer IDC and C++) nor a user of IDA free (having forked over $$$$ for IDA Pro), but I would be willing to lend a hand if someone wants to take point on an 'IDAPython free' project.

Improve this answer
0

You say yourself that the build process requires tools which are not free. In which case:

  • You would need to break some terms of service

and

  • You would need to do some reverse engineering of your own.

I think to fully, and justly answer this question you would need to open a small github project.

Improve this answer
1
  • No need for reversing. Here's a .csv with the IDA 5.0 free exports that gives .dll export name, .lib export name (VC++), the ordinal and export type (e.g. DATA). The .lib export name is the one you would stuff into a .def file to make an implib for VC++. I haven't published a .lib or .def because I have no desire to write unit tests for the 1111 exported functions and data items; I'm adding exports to my own .def file only as needed (which also makes the writing of tests easier).
    – DarthGizka
    Commented Feb 15, 2015 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.