Use plugins on arch linux

Question

Use plugins on arch linux

dummys opened this issue 8 years ago · comments

Hello,

Trying to make it work under arch linux with latest 6.9 ida without luck.
Using the pre-built binary and puting libunicorn.so.1 in /usr/lib, also trying to put libida.so/libida64.so to /usr/lib, then ldconfig.
log:

-> $ sudo ldd libunicorn.so.1
linux-gate.so.1 (0xf77c8000)
libglib-2.0.so.0 => /usr/lib32/libglib-2.0.so.0 (0xf6dcf000)
libm.so.6 => /usr/lib32/libm.so.6 (0xf6d7a000)
libc.so.6 => /usr/lib32/libc.so.6 (0xf6bc5000)
libpcre.so.1 => /usr/lib32/libpcre.so.1 (0xf6b50000)
libpthread.so.0 => /usr/lib32/libpthread.so.0 (0xf6b32000)
/usr/lib/ld-linux.so.2 (0x565e5000)

-> $ ldd sk3wldbg.plx64
linux-gate.so.1 (0xf7730000)
libida64.so => /usr/lib/libida64.so (0xf73e3000)
libunicorn.so.1 => /usr/lib/libunicorn.so.1 (0xf6b40000)
libstdc++.so.6 => /usr/lib32/libstdc++.so.6 (0xf69c9000)
libm.so.6 => /usr/lib32/libm.so.6 (0xf6974000)
libgcc_s.so.1 => /usr/lib32/libgcc_s.so.1 (0xf6959000)
libc.so.6 => /usr/lib32/libc.so.6 (0xf67a4000)
libdl.so.2 => /usr/lib32/libdl.so.2 (0xf679f000)
librt.so.1 => /usr/lib32/librt.so.1 (0xf6796000)
libpthread.so.0 => /usr/lib32/libpthread.so.0 (0xf6779000)
libglib-2.0.so.0 => /usr/lib32/libglib-2.0.so.0 (0xf6650000)
/usr/lib/ld-linux.so.2 (0x56620000)
libpcre.so.1 => /usr/lib32/libpcre.so.1 (0xf65db000)

Is there any message when the plugin successfuly loaded in IDA ? I can't see any debugger called sk3wldbg on an arm binary.

What can I do to debug it ?
Thanks

Chris Eagle · Answer 1 · Wed May 04 2016 05:27:36 GMT+0800 (China Standard Time)

The plugin usually spits messages to IDA's output window, Can you paste the contents of your output windows following opening an ARM binary? Are you running idaq or idaq64?

dummys · Answer 2 · Wed May 04 2016 05:39:49 GMT+0800 (China Standard Time)

There is no weird message in the output.
idaq.
On 3 May 2016 23:27, "Chris Eagle" notifications@github.com wrote:

The plugin usually spits messages to IDA's output window, Can you paste
the contents of your output windows following opening an ARM binary? Are
you running idaq or idaq64?

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub
#3 (comment)

Chris Eagle · Answer 3 · Wed May 04 2016 07:02:22 GMT+0800 (China Standard Time)

If you are using idaq, you need sk3wldbg.plx, NOT sk3wldbg.plx64 (which is what you reference in your original message). Has sk3wldbg.plx also been copied into your IDA plugins directory?

dummys · Answer 4 · Wed May 04 2016 14:02:28 GMT+0800 (China Standard Time)

yes exactly the same as the 64 one. Using pre built bins.

Chris Eagle · Answer 5 · Wed May 04 2016 14:28:15 GMT+0800 (China Standard Time)

If you strace the launch of ida, what "open" calls are being made and do any of them fail with EEXIST?

dummys · Answer 6 · Thu May 05 2016 14:10:41 GMT+0800 (China Standard Time)

No there is no EEXIST in the log.
And I can't find any reference of "sk3wldbg" in the log too

dummys · Answer 7 · Thu May 12 2016 23:20:15 GMT+0800 (China Standard Time)

Any idea then ? Still stuck...

Chris Eagle · Answer 8 · Fri May 13 2016 12:27:23 GMT+0800 (China Standard Time)

No ideas without additional info. Are you willing to share a complete strace of launching idaq on your system?

dummys · Answer 9 · Fri May 13 2016 13:51:45 GMT+0800 (China Standard Time)

there you go: https://bpaste.net/show/b3229c0cfd2b

dummys · Answer 10 · Sat May 14 2016 14:20:35 GMT+0800 (China Standard Time)

didn't know what I give you more... Ida is making logs too ?

Chris Eagle · Answer 11 · Sat May 14 2016 22:14:40 GMT+0800 (China Standard Time)

IDA does logging if you set the environment variable IDALOG=<filepath> before launching IDA. In your pastebin beginning at line 2648, continuing through line 2682, you can see IDA iterate over your installed plugins. None of these seem to be sk3wldbg.plx. There is no evidence that sk3wldbg is installed in /opt/ida-6.9/plugins on your system.

dummys · Answer 12 · Sat May 14 2016 23:33:36 GMT+0800 (China Standard Time)

omfg... I just looked and in fact i've keep the folder with the two plugins inside. Removing the folder and puting the plugins seems to load it. Sorry for such big mistake...