Python ida pro keypatch by Key stone engine

Storm Shadow · Aug 4, 2016

Keypatch

Keypatch is a IDA Pro plugin for Keystone Assembler Engine.
Keypatch consists of 2 tools inside.

Patcher: this allows you to type in assembly to directly patch your binary.
Assembler: this interactive tool let you enter assembly & get back instruction encoding.

Keypatch is confirmed to work on IDA Pro version 6.4, 6.8 & 6.9, but should work flawlessly on older versions. If you find any issues, please report.
1. Why Keypatch?

Sometimes we want to patch the binary while analyzing it in IDA, but unfortunately the built-in asssembler of IDA Pro is not adequate.

Only X86 assembler is available. Support for all other architectures is totally missing.
The X86 assembler is not in a good shape, either: it cannot understand many modern Intel instructions.

Keypatch was developed to solve this problem. Thanks to the power of Keystone, our plugin offers some nice features.

Cross-architecture: support Arm, Arm64 (AArch64/Armv8), Hexagon, Mips, PowerPC, Sparc, SystemZ & X86 (include 16/32/64bit).
Cross-platform: work everywhere that IDA works, which is on Windows, MacOS, Linux.
Based on Python, so it is easy to install as no compilation is needed.
Open source under GPL v2.

Keypatch can be the missing piece in your toolset of reverse engineering.

2. Install

Install Keystone core & Python binding for Python 2.7 from keystone-engine.org/download. Or follow the steps in theappendix section.
Copy file keypatch.py to IDA Plugin folder, then restart IDA Pro to use Keypatch.
- On Windows, the folder is at C:\Program Files (x86)\IDA 6.9\plugins
- On MacOS, the folder is at /Applications/IDA\ Pro\ 6.9/idaq.app/Contents/MacOS/plugins
- On Linux, the folder may be at /opt/IDA/plugins/

NOTE

On Windows, if you get an error message from IDA about "fail to load the dynamic library", then your machine may miss the VC++ runtime library. Fix that by downloading & installing it from https://www.microsoft.com/en-gb/download/details.aspx?id=40784
On other *nix platforms, the above error message means you do not have 32-bit Keystone installed yet. See appendix section below for more instructions to fix this.

3. Usage

To patch your binary, press hotkey CTRL+ALT+K inside IDA to open Keypatch Patcher dialog.
- The original assembly, encode & instruction size will be displayed in 3 controls at the top part of the form.
- Choose the syntax, type new assembly instruction in the Assembly box (you can use IDA symbols).
- Keypatch would automatically update the encoding in the Encode box while you are typing, without waiting forENTER keystroke.
  - Note that you can type IDA symbols, and the raw assembly will be displayed in the Fixup control.
- Press ENTER or click Patch to overwrite the current instruction with the new code, then automatically advance to the the next instruction.
  - Note that when the new code is shorter than the original code, the extra bytes will be filled in with NOPs by default. Uncheck the choice Padding extra bytes with NOPs if this is not desired.
- By default, the modification you made is only recorded in the IDA database. To apply these changes to the original binary (thus overwrite it), choose menu Edit | Patch program | Apply patches to input file.

To do some code assembling (without overwritting binary), open Keypatch Assembler from menu Edit | Keypatch | Assembler.
- Choose the architecture, address, endian mode & syntax, then type assembly instruction in the Assembly box.
- Keypatch would automatically update the encoding in the Encode box while you are typing, without waiting forENTER keystroke.

4. Contact

Email keystone.engine@gmail.com for any questions.
For future update of Keypatch, follow our Twitter @keystone_engine for announcement.
Appendix. Install Keystone for IDA Pro

IDA Pro's Python is 32-bit itself, so it can only loads 32-bit libraries. For this reason, we have to build & install Keystone 32-bit. This section details the steps towards that goal.
A1. Windows

It is easiest to just download & install Python 2.7 module for Windows from http://www.keystone-engine.org/download. Be sure to get the 32-bit version, regardless of your Windows edition.
If you prefer to compile from source, just use MSVC 32-bit & follow the instructions in Windows documentation to buildkeystone.dll. After that, install Python module as in Python documentation. Then copy keystone.dll to the directory of Keystone Python module.
A2. MacOS

Since version 0.9.1, by default Keystone is built in universal format, so you just need to follow the instruction in Unix documentation to compile & install it. After that, install Python module as in Python documentation.
In short, you can simply run the following commands in the source directory of Keystone to do all the above.

Code:

$ mkdir build
$ cd build
$ ../make-share.sh
$ sudo make install
$ cd bindings/python
$ sudo make install

A3. Linux

If your system is Linux 32-bit, you can do the same steps as in MacOS above.
In case you are on 64-bit Linux, you need to cross compile Keystone to 32-bit. Since version 0.9.1, Keystone supports lib32option to make this easy. After building the core, install Python module as in Python documentation.
Note that to cross-compile on Linux, you need to install some multilib libraries. For example, on Ubuntu 14.04 64-bit, do this with:

Code:

$ sudo apt-get install lib32stdc++-4.8-dev libc6-dev-i386

After having multilib dependencies, run the following commands in the source directory of Keystone.

Code:

$ mkdir build
$ cd build
$ ../make-share.sh lib32 lib_only
$ cd bindings/python
$ sudo make install

Finally, copy the 32-bit binaries at build/llvm/lib/libkeystone.so.* to the Python directory of IDA Pro, for example at/opt/IDAPro6.4/python/.
Done? Now go back to section 2 & install Keypatch for IDA Pro. Enjoy!

source
https://github.com/keystone-engine/keypatch

Storm Shadow · Sep 15, 2016

Keypatch 2.0

September 14, 2016
We are very excited to release Keypatch 2.0, a better assembler for IDA Pro!
This new version of Keypatch brings some important features, as follows.

Fix some issues with ARM architecture (including Thumb mode)
Better support for Python 2.6 & older IDA versions (confirmed to work on IDA 6.4)
Save original instructions (before patching) in IDA comments.
NOP padding also works when new instruction is longer than original instruction.
You can fill a range of selected code via a new function “Fill Range”
It is now possible to “undo” (revert) the last modification.
All the functions are now available via a popup menu (right-mouse click)

Get full list of new features & source code of Keypatch at keystone-engine.org/keypatch
A quick tutorial for Keypatch is available.

m4n0w4r · Sep 16, 2016

Version 2.0.1

Fix an off-by-one bug in Fill-Range function.
Log more information when padding NOP

samoray · Oct 20, 2018

Hello guys,
I'm trying to install Keypatch on my IDA 7.0 pro, but I got this error:

Code:

Labeless::Labeless
Labeless: Python initialized... OK
C:\Program Files\IDA 7.0\plugins\keypatch.py: No module named keystone
Traceback (most recent call last):
  File "C:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
	execfile(script, g)
  File "C:/Program Files/IDA 7.0/plugins/keypatch.py", line 23, in <module>
	from keystone import *
ImportError: No module named keystone

OS: win10 1809 ent X64
I already have Pythin 27 (both x86 and x64) installed and linked to sys PATH (see picture)
Python-keystone 0.9.1 x32 installed as well

Any Idea would be appreciated

Storm Shadow · Oct 21, 2018

it could be that you have to use the Python-keystone x64 bit one, remember that ida 7.0 + is only 64 bit, even the x32 ida version.

Also that said, you wouldent need the python 2.7 x86 anymore.

Also tested it with 7.0 + and the code in the plugin is not compatible with 7.0, even when it says in the readme.

Storm Shadow · Oct 21, 2018

For it to work , we would need to write ida menu action handlers.
I can take a look.

Storm Shadow · Oct 21, 2018

if you save the raw python code https://raw.githubusercontent.com/keystone-engine/keypatch/master/keypatch.py

then save raw code as /idafolder/plugins/keypatch.py and use the x64 version of keypatch all is working.

samoray · Oct 21, 2018

Ok, for now I deleted all links for the Python 32bit version in system PATH, that should get it away .
so far no error log onthe keystone dll but I get this insted:

Code:

"""
 
Failed while executing plugin_t.init():
 
Traceback (most recent call last):
 
File "C:/Program Files/IDA 7.0/plugins/keypatch.py", line 1449, in init
 
menu = idaapi.add_menu_item("Edit/Keypatch/", "Patcher (Ctrl-Alt-K)", "", 1, self.patcher, None)
 
AttributeError: 'module' object has no attribute 'add_menu_item'
 
""""

is this a problem with hot key setting or what?
Thanks

Storm Shadow · Oct 21, 2018

samoray said:
is this a problem with hot key setting or what?
Thanks

see last post i made about raw github code.

m4n0w4r · Oct 21, 2018

samoray said:
Ok, for now I deleted all links for the Python 32bit version in system PATH, that should get it away .
so far no error log onthe keystone dll but I get this insted:

Code:

""" Failed while executing plugin_t.init(): Traceback (most recent call last): File "C:/Program Files/IDA 7.0/plugins/keypatch.py", line 1449, in init menu = idaapi.add_menu_item("Edit/Keypatch/", "Patcher (Ctrl-Alt-K)", "", 1, self.patcher, None) AttributeError: 'module' object has no attribute 'add_menu_item' """"

is this a problem with hot key setting or what?
Thanks

You can use both python 32-bit (for IDA 6.8) and python 64-bit (for IDA 7.0).
Create a .bat file to set env for python x64 like this:

Code:

@ECHO off
set PYTHONHOME=C:\Python27x64
set PYTHON=%PYTHONHOME%\python.exe
set PYTHONPATH=%PYTHONHOME%\Lib\site-packages
set PYTHONSCRIPT=%PYTHONHOME%\Scripts
set PATH=%PATH%;%PYTHON%
set QT_QPA_PLATFORM_PLUGIN_PATH=%PYTHONPATH%\PyQt5\plugins\platforms
REM set QT_QPA_PLATFORM_PLUGIN_PATH=C:\Program Files\IDA 7.0\platforms

After that, if you want to use IDA 7.0, must run the .bat file first and then ida.exe / ida64.exe .. All from command line!!

Regards,

samoray · Oct 21, 2018

storm shadow said:
see last post i made about raw github code.

Thank you for the tip. that works perfectly. saving the raw code to keypatch.py in IDA plugins folder did the job

.
but how does the already compiled one did not work. I dont understand??

Storm Shadow · Oct 21, 2018

samoray said:
but how does the already compiled one did not work. I dont understand??

some sort of error when downloading the code
when downloading the latest release , you would see that in line 1552 it uses idaapi witch is deprecicated. and version check is missing

Code:

if idaapi.IDA_SDK_VERSION >= 700:

so it jumps to the old

Code:

idaapi.add_menu_item

Storm Shadow · Oct 21, 2018

https://github.com/keystone-engine/keypatch/issues/54

Python ida pro keypatch by Key stone engine

Storm Shadow

Administrator

Attachments

Storm Shadow

Administrator

Attachments

m4n0w4r

New member

Attachments

samoray

New member

Storm Shadow

Administrator

Storm Shadow

Administrator

Storm Shadow

Administrator

samoray

New member

Storm Shadow

Administrator

m4n0w4r

New member

samoray

New member

Storm Shadow

Administrator

Storm Shadow

Administrator