Skip to content

Instantly share code, notes, and snippets.

@S-trace
Forked from 2igosha/idafix.md
Last active June 4, 2024 13:00
Show Gist options
  • Save S-trace/e20785d5ea286e0a3fbdc1e5115f9719 to your computer and use it in GitHub Desktop.
Save S-trace/e20785d5ea286e0a3fbdc1e5115f9719 to your computer and use it in GitHub Desktop.
Fix IDA 7.5/7.6/7.7SP1 crashing on idapython3.dll in Wine

Description

For some reason IDA executes FreeLibrary() to the plugin immediately after getting its PLUGIN structure's address, so later invocations of the plugin lead to calls to nowhere (that was supposed to be python3.dll). Simply patching the location of the FreeLibrary() call fixes the issue. The location is easy to find: go by cross-references to a place where the call to FreeLibrary is followed by a reference to the string "%s: incompatible plugin version..." and NOP it away.

7.5

ida.dll

+001c1d20  15 9b e6 e3 ff 48 8b 4d  88 48 85 c9 74 0e 90 90  |.....H.M.H..t...|
+001c1d30  90 90 90 90 48 c7 45 88  00 00 00 00 48 8b 4c 24  |....H.E.....H.L$|

ida64.dll

+001cb050  15 83 53 e3 ff 48 8b 4d  88 48 85 c9 74 0e 90 90  |..S..H.M.H..t...|
+001cb060  90 90 90 90 48 c7 45 88  00 00 00 00 48 8b 4c 24  |....H.E.....H.L$|

7.6

ida.dll

+001cb6f0  15 03 4d e3 ff 48 8b 4d  88 48 85 c9 74 0e 90 90  |..M..H.M.H..t...|
+001cb700  90 90 90 90 48 c7 45 88  00 00 00 00 48 8b 4c 24  |....H.E.....H.L$|

ida64.dll

+001d53f0  15 0b b0 e2 ff 48 8b 4d  88 48 85 c9 74 0e 90 90  |.....H.M.H..t...|
+001d5400  90 90 90 90 48 c7 45 88  00 00 00 00 48 8b 4c 24  |....H.E.....H.L$|

7.7SP1

ida.dll Patching not required.

-EAA2A     00 48 85 c9 74 0a ff 15  ea 0d
+EAA2A     00 48 85 c9 eb 0a ff 15  ea 0d

ida64.dll

-EEC80     ff 15 9a 5b 26 00 48 89  7d 00
+EEC80     90 90 90 90 90 90 90 90  90 90
@iAmG-r00t
Copy link

Thank you, it worked 😅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment