VoidSec/DriverBuddyReloaded

[BUG] module 'idaapi' has no attribute 'compiled_binpat_vec_t'

neobenedict opened this issue · 14 comments

neobenedict commented 
Traceback (most recent call last):
  File "C:/Program Files/IDA 7.0/plugins/DriverBuddyReloaded.py", line 465, in run
    driver_type = utils.get_driver_id(driver_entry_addr, log_file)
  File "C:/Program Files/IDA 7.0/plugins\DriverBuddyReloaded\utils.py", line 209, in get_driver_id
    populate_wdf()
  File "C:/Program Files/IDA 7.0/plugins\DriverBuddyReloaded\wdf.py", line 102, in populate_wdf
    binpat = idaapi.compiled_binpat_vec_t()
AttributeError: module 'idaapi' has no attribute 'compiled_binpat_vec_t'

Version 7.5.201028 Windows x64 (64-bit address size)

7.6 minimum required?

VoidSec commented

It was tested starting from IDA 7.6 but shouldn't be mandatory. Which version of python you're on?

neobenedict commented

3.8.3

I'll try a later version of IDA in a few days.

  • 👍1
zeze-zeze commented

Same issue in IDA 7.5 and Python 3.9.4

VoidSec commented

would you mind sharing the driver causing the error?

zeze-zeze commented

Sure, it is not rare to find such driver.
NVSWCFilter64.zip

VoidSec commented

Tested on IDA 7.6 on Python 3.10.4, fixed in https://github.com/VoidSec/DriverBuddyReloaded/releases/tag/1.6

rjt-gupta commented

Sorry to remention, but Im facing this on latest release. However, I'm on IDA v7.2. Any resolution for this?

VoidSec commented

@rjt-gupta would you mind sharing the driver causing the error? You can send me an email at voidsec[at]voidsec.com if you'd like to keep it private.

HongThatCong commented

compiled_binpat_vec_t struct/class still did not existed in IDA SDK <= 7.5
image

  • 👍1
VoidSec commented

@HongThatCong thank you very much for pointing that out! I'll update the readme in order to reflect that requirement

rjt-gupta commented

@HongThatCong @VoidSec Thanks for the clarification. Unfortunately, I can't share the driver since its proprietary. But, please let me know if there is a workaround for this issue for IDA < v7.5

HongThatCong commented

Yes, @VoidSec can rewrite the binary search function with code in picture above and this picture:
If IDA <= 7.5 uses idaapi.find_binary function else uses idaapi_binsearch function.
image
Best regards,
TQN

  • 👍1
rjt-gupta commented

@VoidSec Do you plan to fix this anytime soon?

VoidSec commented

I'll probably take some time next week to patch some of these bugs.

  • 👍1