ida pro plugin labeless, sync IDA with OllyDbg by a1ext

a1ext

New member
Developer
Ida Pro Expert
I used the plugin for 6.8 build above SHA256: 0B8C8FF153A079C66E4F82D62A1C1F9C4994DE1128A61F4E9A2358C59DFE7435 , I copy it to IDA plugins dir, and run ida. After close IDA, the dump is create in C:\Users\<user>\AppData\Local\CrashDumps, or could be create by use debugdiag & application verifier as the guid in here http://blogs.msdn.com/b/lagdas/arch...-with-application-verifier-and-debugdiag.aspx, track Access Violation exception. The above info is output of windbg, I use command !analyze -v
Can you test this build?
 

Storm Shadow

Administrator
Staff member
Developer
Ida Pro Expert
Elite Cracker
if you build the build as debug.

then load crash dump in windbg.

first
Code:
!analyze -v
then exeption record

Code:
.ecxr
then
stack trace of the crash
Code:
kb
when crash dump is debug it will jump strait to source code and line where the error is.
remember to put pdb file from build in same folder as dump
 

a1ext

New member
Developer
Ida Pro Expert
if you build the build as debug.

then load crash dump in windbg.

first
Code:
!analyze -v
then exeption record

Code:
.ecxr
then
stack trace of the crash
Code:
kb
when crash dump is debug it will jump strait to source code and line where the error is.
rember to put pdb file in same folder as dump
IDA crashes inside Qt5Core.dll/Qt5Gui.dll near QFontCache interaction when labeless plugin is currently unloaded from memory.
 

Storm Shadow

Administrator
Staff member
Developer
Ida Pro Expert
Elite Cracker
Maybe runtime error. Ida 6.98 use vs2010
Ida 6.9 needs vs2015.
And the same for Qt build.
So you cant use the same for both build.
 
Last edited:

a1ext

New member
Developer
Ida Pro Expert
Maybe runtime error. Ida 6.98 use vs2010
Ida 6.9 needs vs2015.
And the same for Qt build
Yes, I know.
I spent weekend on that. Qt 5.4.1 isn't support msvc2015 out of the box. I made some changes in mkspec and in configurator tool to build it.
I noticed, IDA crashes only if I open view with custom text edit (I written one for syntax highlighing & auto-completion).
I have one idea why that is appears - may be Qt5 built incorrectly. I asked hex-rays support about Qt configuration instructions.
I hope I fix that before my support plan get expired (31.12.2015), lol.
 

Storm Shadow

Administrator
Staff member
Developer
Ida Pro Expert
Elite Cracker
Im pretty sure it is the runtime.

text box uses lowlevel code when usin auto completion.there for it crash.Also computerline got acces violation in hes dump.

but basiclly you have to rebuild everything with QT namespace.
http://www.techbliss.org/threads/ida-pro-ultimate-qt-build-guide-by-storm-shadow.762/ jump to chapter "Building windows QT"
in your readme
you build a minimalistic build of QT,
Code:
-no-webkit -opensource -no-qt3support -no-phonon -no-phonon-backend -opengl desktop -nomake demos -nomake examples -nomake tools -no-script -no-scripttools -no-declarative -qtnamespace QT
that is a very bad idea since you proberly run in to some problems after
better to build a full package.
but you should use newest Qt5 http://download.qt.io/official_releases/qt/5.5/5.5.1/ wich is for vs 2015
also if the code on github the latest i can build it for 6.8
 
Last edited:

a1ext

New member
Developer
Ida Pro Expert
Im pretty sure it is the runtime.

text box uses lowlevel code when usin auto completion.there for it crash.Also computerline got acces violation in hes dump.

but basiclly you have to rebuild everything with QT namespace.
http://www.techbliss.org/threads/ida-pro-ultimate-qt-build-guide-by-storm-shadow.762/ jump to chapter "Building windows QT"
but you should use newest Qt5 http://download.qt.io/official_releases/qt/5.5/5.5.1/ wich is for vs 2015
also if the code on github the latest i can build it for 6.8
but you should use newest Qt5
No, I should use Qt5 version on which built IDA PRO 6.9 (5.4.1). Your instruction here is deprected :(
@computerline got access violation in IDA 6.8 because of another bug, these two bugs are not related.
 

a1ext

New member
Developer
Ida Pro Expert
Hmmm... I'll try to make pluging with latest version, let's check that :). Thanks
So, there is a problem.
  • I tried to build Labeless with Qt 5.5.1 - linking with IDA SDK's Qt5* libraries and have the following linker errors:
    Code:
     link /NOLOGO /DYNAMICBASE /NXCOMPAT /INCREMENTAL:NO /DEBUG /INCREMENTAL:NO /DLL /SUBSYSTEM:WINDOWS /OUT:..\..\labeless_qmake\bin\labeless_ida_690.plw @C:\Windows\Temp\nmAE61.tmp
       Creating library ..\..\labeless_qmake\bin\labeless_ida_690.lib and object ..\..\labeless_qmake\bin\labeless_ida_690.exp
    choosememorydialog.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::toUpper(void)const & " (__imp_?toUpper@QString@QT@@QGBE?AV12@XZ) referenced in function "class QT::QString __cdecl `anonymous namespace'::ollyStyleFormatHex(unsigned long)" (?ollyStyleFormatHex@?A0x45c3efd8@@YA?AVQString@QT@@K@Z)
    pyollyview.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::toLower(void)&& " (__imp_?toLower@QString@QT@@QHAE?AV12@XZ) referenced in function "public: void __thiscall PyOllyView::onColorSchemeChanged(void)" (?onColorSchemeChanged@PyOllyView@@QAEXXZ)
    pythonpalettemanager.obj : error LNK2001: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::toLower(void)&& " (__imp_?toLower@QString@QT@@QHAE?AV12@XZ)
    settingsdialog.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::toUpper(void)&& " (__imp_?toUpper@QString@QT@@QHAE?AV12@XZ) referenced in function "public: __thiscall SettingsDialog::SettingsDialog(struct Settings const &,unsigned int,class QT::QWidget *)" (??0SettingsDialog@@QAE@ABUSettings@@IPAVQWidget@QT@@@Z)
    settingsdialog.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::trimmed(void)&& " (__imp_?trimmed@QString@QT@@QHAE?AV12@XZ) referenced in function "public: __thiscall SettingsDialog::SettingsDialog(struct Settings const &,unsigned int,class QT::QWidget *)" (??0SettingsDialog@@QAE@ABUSettings@@IPAVQWidget@QT@@@Z)
    ..\..\labeless_qmake\bin\labeless_ida_690.plw : fatal error LNK1120: 4 unresolved externals
  • The second try is to link with Qt 5.5.1's libraries, then i have missing imports:
    Clipboard198.png
:(
 

Storm Shadow

Administrator
Staff member
Developer
Ida Pro Expert
Elite Cracker
I never link with sdk qt libs, always error.link with rebuilded Qt libs insted.
 

a1ext

New member
Developer
Ida Pro Expert
I never link with sdk qt libs, always error.link with rebuilded Qt libs insted.
Above i have mentioned your case, i tried that. See the second step.
May be, this solution will work if I replace dll's in IDA home. But this isn't right. This will decrease whole IDA stability (if I require usage of my dll's instead of dll's provided with IDA).
 

Storm Shadow

Administrator
Staff member
Developer
Ida Pro Expert
Elite Cracker
but did you rebuild Qt5 5.1 with Qt namspace els you defently would get a error when building .

you have error on namespace.

class QT::QString __cdecl `anonymous namespace'
 

a1ext

New member
Developer
Ida Pro Expert
but did you rebuild Qt5 5.1 qith Qt namspace els you defently would get a error when building .
Code:
link /NOLOGO /DYNAMICBASE /NXCOMPAT /INCREMENTAL:NO /DEBUG /INCREMENTAL:NO /DLL /SUBSYSTEM:WINDOWS /OUT:..\..\labeless_qmake\bin\labeless_ida_690.plw @C:\Windows\Temp\nmAE61.tmp
   Creating library ..\..\labeless_qmake\bin\labeless_ida_690.lib and object ..\..\labeless_qmake\bin\labeless_ida_690.exp
choosememorydialog.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::toUpper(void)const & " (__imp_?toUpper@QString@QT@@QGBE?AV12@XZ) referenced in function "class QT::QString __cdecl `anonymous namespace'::ollyStyleFormatHex(unsigned long)" (?ollyStyleFormatHex@?A0x45c3efd8@@YA?AVQString@QT@@K@Z)
pyollyview.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::toLower(void)&& " (__imp_?toLower@QString@QT@@QHAE?AV12@XZ) referenced in function "public: void __thiscall PyOllyView::onColorSchemeChanged(void)" (?onColorSchemeChanged@PyOllyView@@QAEXXZ)
pythonpalettemanager.obj : error LNK2001: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::toLower(void)&& " (__imp_?toLower@QString@QT@@QHAE?AV12@XZ)
settingsdialog.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::toUpper(void)&& " (__imp_?toUpper@QString@QT@@QHAE?AV12@XZ) referenced in function "public: __thiscall SettingsDialog::SettingsDialog(struct Settings const &,unsigned int,class QT::QWidget *)" (??0SettingsDialog@@QAE@ABUSettings@@IPAVQWidget@QT@@@Z)
settingsdialog.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) public: class QT::QString __thiscall QT::QString::trimmed(void)&& " (__imp_?trimmed@QString@QT@@QHAE?AV12@XZ) referenced in function "public: __thiscall SettingsDialog::SettingsDialog(struct Settings const &,unsigned int,class QT::QWidget *)" (??0SettingsDialog@@QAE@ABUSettings@@IPAVQWidget@QT@@@Z)
I was built Qt 5.5.1 succesfully. These linker errors are from labeless.
Dont worry, the support of hex-rays answered me, they have slightly patched Qt 5.4.1 (they are changed ABI (added some virtual method somewhere) and from that I have crashes). I'll rebuild the Qt 5.4.1 with patch provided by support and re-chech is IDA still crashes.
Thanks
 

Storm Shadow

Administrator
Staff member
Developer
Ida Pro Expert
Elite Cracker
Glad you got it working.
on 6.8 i had one crash yesterday , however today i cannot reproduce it.Working like a charm.:)
 
Top