rdist

June 10, 2010

Don’t use included version of IDAPython

Filed under: Reverse engineering,Security — Nate Lawson @ 10:28 am

I ran into a problem the other day with IDAPython. It’s a great tool but the version that comes by default with IDA is often out-of-date. Lesson: always update your version of IDAPython after installing or upgrading IDA.

The problem I saw was that the idautils.Functions() generator would never return any functions. I added lots of debugging prints and found that Segments() worked but Functions() never found a function, no matter what the range of addresses was. I then found that the Functions() routine would never location any functions if the first address was not the exact EA of a function.

This was in IDA 5.5 with its default IDAPython. Here’s the commit that fixed the bug. Since there are other bugs in older releases, I recommend updating to 1.3.2 (Windows binary or SVN source).

2 Comments

  1. Hi Nate,

    You are right it is always a good idea to get the newest version of IDAPython.

    When we ship the plugin with IDA Pro, our users get the latest compiled version at the time of the release. If the project contributors (or us) fix some bugs after our release then of course the shipped version will look buggy.

    Comment by Elias Bachaalany — June 11, 2010 @ 3:21 am

    • Yes, the IDAPython bugfix appeared a week after IDA 5.5 was released. Since IDAPython is being actively developed and fixed much faster than the IDA release schedule, I think it is best to update IDAPython manually and not use the included version. This raises the question: why include IDAPython with IDA if it is not updated immediately when major bugs are found?

      This will always be a problem with a third-party developed plugin. I assume the Hex Rays regression tests don’t cover all the IDAPython features. Perhaps the best thing for everyone would be if IDAPython became an official part of IDA, not just distributed by but actively tested by Hex Rays also, with stable releases synchronized with the IDA schedule.

      Comment by Nate Lawson — June 12, 2010 @ 1:05 pm


RSS feed for comments on this post.

Blog at WordPress.com.