Fentanyl + WWCD for better IDA View & Patcher

[computerline]

I modified some in Fentanyl to support Assemble Patch with Keystone Assembler
This can patch any instruction if it is valid IDA instruction or keystone instruction (Context Menu : Patch > Assemble)

Example:
In x64, IDA instruction

48 8D 0D 71 D1 00 00					lea	 rcx, off_14000E370

This is not a valid instruction, it reminder only, instead

48 8D 0D 71 D1 00 00					lea	 rcx, qword ptr [rip + 0xD171]

is valid with keystone, so could use the keystone to assemble it and patch it to IDA

 

[Storm Shadow]

cool

 

[mayl8822]

thanks

 

[computerline]

Update build https://mega.nz/#!AF9HRRDQ!QNtLjgC_FrrYokgxc6NIiraO8UPI-A7GhBTqBl4quSc

 

[steve007iii]

We need support for IDA version 7.0 Fentanyl + Keystone it's an excellent combination...

 

[computerline]

wwcd for ida7.0, hope it will be useful

 

[gavz]

Thanks !!!

 

[steve007iii]

C:\Program Files\IDA 7.0\plugins\fentanyl.py: 'module' object has no attribute 'GetIdaDirectory'
Traceback (most recent call last):
  File "C:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
	execfile(script, g)
  File "C:/Program Files/IDA 7.0/plugins/fentanyl.py", line 180, in <module>
	icons_path = os.path.join(idc.GetIdaDirectory(), 'plugins', 'FentanylCore', 'icons')
AttributeError: 'module' object has no attribute 'GetIdaDirectory'

Var Sistem, I have this defined...
IDADIR = C:\Program Files\IDA 7.0
No reference "GetIdaDirectory" in: IDA 7.0 SDK: Porting from IDA 4.9-6.x API to IDA 7.0 API

any ideas?

 

[computerline]

C:\Program Files\IDA 7.0\plugins\fentanyl.py: 'module' object has no attribute 'GetIdaDirectory'
Traceback (most recent call last):
  File "C:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
	execfile(script, g)
  File "C:/Program Files/IDA 7.0/plugins/fentanyl.py", line 180, in <module>
	icons_path = os.path.join(idc.GetIdaDirectory(), 'plugins', 'FentanylCore', 'icons')
AttributeError: 'module' object has no attribute 'GetIdaDirectory'

Var Sistem, I have this defined...
IDADIR = C:\Program Files\IDA 7.0
No reference "GetIdaDirectory" in: IDA 7.0 SDK: Porting from IDA 4.9-6.x API to IDA 7.0 API

any ideas?

idc.GetIdaDirectory could be replace by idaapi.idadir(None)

https://transfer.sh/T7plt/fentanyl_ida7_plugins.7z

You could try my minor fixup

 

[steve007iii]

Computerline, as always, you did an excellent job

Something strange happens, I had this error

In: FentanylCore/AssembleForm.py """ Initialize form elements """ line: 246 It says

		self.ui_cntls = {
			'inp':idaapi.Form.MultiLineTextControl('', idaapi.textctrl_info_t.TXTF_FIXEDFONT),
			#'inp': idaapi.Form.StringInput(tp=None, width=1024, swidth=40, hlp=None, value='', size=None),
			'opt_chk':idaapi.Form.ChkGroupControl(('fixup', 'nopout')),
			'form_cb':idaapi.Form.FormChangeCb(self._form_cb),
		}
		self.ui_form = idaapi.Form("""STARTITEM {id:inp}

I had to make the next change

		self.ui_cntls = {
			'inp':ida_kernwin.Form.MultiLineTextControl('', ida_kernwin.textctrl_info_t.TXTF_FIXEDFONT),
			#'inp': idaapi.Form.StringInput(tp=None, width=1024, swidth=40, hlp=None, value='', size=None),
			'opt_chk':ida_kernwin.Form.ChkGroupControl(('fixup', 'nopout')),
			'form_cb':ida_kernwin.Form.FormChangeCb(self._form_cb),
		}
		self.ui_form = ida_kernwin.Form("""STARTITEM {id:inp}

This is a Temporary Solution...

Strangely IDA 7.0 does not address well the API "idaapi" and I had to point directly to "ida_kernwin"

Any idea why this happens?

 

[Storm Shadow]

Strangely IDA 7.0 does not address well the API "idaapi" and I had to point directly to "ida_kernwin"

Any idea why this happens?

Yes !
They have split up idaapi to mutible modules, where idaa_kernwin is the main module in ida 7.+

 

[steve007iii]

Fentanyl for IDA 7.+ Updated Libraries in Fentanyl.py and FentanylCore/*.py

 

[Nihilus]

wwcd for ida7.0, hope it will be useful

Do you mind sharing the source for your plugins so I can builld them on OS X ?

 

[Storm Shadow]

Do you mind sharing the source for your plugins so I can builld them on OS X

the code is in pyhton, so it is open source.

 

[computerline]

Do you mind sharing the source for your plugins so I can builld them on OS X ?

Yes, because the license changed by wwcd so I don't upload source with the binary, the code only craft, so it buggy, help it will be usefull.

wwcd2: https://drive.google.com/uc?id=1clTteyumMJAh9cH40y0FQglEuMhG7iyk&export=download
zydecode : https://drive.google.com/uc?id=14U8WY13UpBJ9Ru2kZEKGgEvZMEza75Rw&export=download

I'm try to update zydecode to the lastest zydis version, but their change allot, I couldn't build the binary, so I used the stable version.
wwcd2 use capstone, today their release v4.0, so that better to update.

And I don't known though I rename the action in source, but wwcd2 and zydecode can't work to gether

 

[Nihilus]

Thx, now I don't have to port it myself.

 

[computerline]

Update wwcd2 + capstone 4

 

[maskelilincoln]

cmp rcx,rax and mov rax,rcx

Assembler failed

What x64 support ?

 

[computerline]

I't not support x64, but you could try keypatch

 

[steve007iii]

Some things changed for ida pro 7.5
this is a small fix in the plugin to make it run on ida pro 7.5