« Locating Dangerous Functions with IDA Pro | Main
Friday
Mar182011

RE-Google and IDA 6.0

During the course of doing a black box security audit on a COTS application, we noticed that RE-Google had been broken.  A lot of changes have been happening in the IDA Python API over the last several revisions causing a lot of breakage of our old and familiar tools.  I found someone who had made it work on IDA 5.7 at this link here. But even using the script linked there, we were still getting this weird error:

Traceback (most recent call last):

  File "<string>", line 1, in <module>

  File "D:\share\regoogle\regoogle.py", line 721, in <module>

    re_google(SEARCH_ALL_FUNCTIONS)

  File "D:\share\regoogle\regoogle.py", line 347, in re_google

    if query4function(func):

  File "D:\share\regoogle\regoogle.py", line 293, in query4function

    res = search4files( l )

  File "D:\share\regoogle\regoogle.py", line 206, in search4files

    results = client.GetSnippetsFeed( query )

  File "D:\Python26\lib\site-packages\gdata\codesearch\service.py", line 84, in GetSnippetsFeed

    feed = self.Query(query.ToUri())

  File "D:\Python26\lib\site-packages\gdata\codesearch\service.py", line 71, in Query

    return self.Get(uri, converter=converter)

  File "D:\Python26\lib\site-packages\gdata\service.py", line 1074, in Get

    return converter(result_body)

  File "D:\Python26\lib\site-packages\gdata\codesearch\__init__.py", line 136, in CodesearchFeedFromString

    return atom.CreateClassFromXMLString(CodesearchFeed, xml_string)

  File "D:\Python26\lib\site-packages\atom\__init__.py", line 93, in optional_warn_function

    return f(*args, **kwargs)

  File "D:\Python26\lib\site-packages\atom\__init__.py", line 128, in CreateClassFromXMLString

    return _CreateClassFromElementTree(target_class, tree)

  File "D:\Python26\lib\site-packages\atom\__init__.py", line 164, in _CreateClassFromElementTree

    target._HarvestElementTree(tree)

  File "D:\Python26\lib\site-packages\atom\__init__.py", line 186, in _HarvestElementTree

    self._ConvertElementTreeToMember(child)

  File "D:\Python26\lib\site-packages\atom\__init__.py", line 295, in _ConvertElementTreeToMember

    _CreateClassFromElementTree(member_class, child_tree))

  File "D:\Python26\lib\site-packages\atom\__init__.py", line 164, in _CreateClassFromElementTree

    target._HarvestElementTree(tree)

  File "D:\Python26\lib\site-packages\atom\__init__.py", line 194, in _HarvestElementTree

    self.text = tree.text.encode(MEMBER_STRING_ENCODING)

  File "D:\Python26\Lib\encodings\utf_8.py", line 18, in decode

    return codecs.utf_8_decode(input, errors, True)

AttributeError: 'NoneType' object has no attribute 'utf_8_decode'

 

I was able to fix this error by modifying \Python26\Lib\encodings\utf_8.py and the decode() function.

I essentially changed it to the following:

def decode(input, errors='strict'):

    import codecs

    return codecs.utf_8_decode(input, errors, True)

Adding the line 'import codecs' appears to fix any RE-Google issues and make it work with IDA Pro 6.0.  Not sure why this problem exists.  I tried to do some basic checking in gdata to ensure usage of the API was correct.  Everything looked right.  I even tried to use gdata 2.0.4 which the RE-Google author stated in the README file he used for development: same error.

 

Anyhow, you may download my version of RE-Google here which has been tested and confirmed to work with IDA Pro 6.0.

Sha256: 9a01eb0743964b9aed9aa77a20ce3b69f6871309a5e4d5fa1a01bb9c22f9ac34

MD5: bfb59c1f5d846f49a9afc4e13f76721a 

 

I'd like to offer my thanks to Felix Leder for writing RE-Google, Elias Bachaalany for porting RE-Google to IDA 5.7, and of course hex rays for writing IDA Pro in the first place.

Reader Comments (2)

Hello Zack,

Thanks for porting to 6.0, I will add a link to the same page were you found 5.7.

March 22, 2011 | Unregistered CommenterElias

Elias,

My pleasure. Let me know if you have any problems with it.

Thank you,
Z

March 25, 2011 | Registered CommenterZack Payton

PostPost a New Comment

Enter your information below to add a new comment.

My response is on my own website »
Author Email (optional):
Author URL (optional):
Post:
 
Some HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>