cisco-talos / first Goto Github PK

When opening the management tab in the FIRST view, I get the following exception:

Traceback (most recent call last):
File "C:/Program Files (x86)/IDA 6.95/plugins/first.py", line 519, in view_clicked
layout = self.views_uikey
File "C:/Program Files (x86)/IDA 6.95/plugins/first.py", line 385, in view_applied
data = FIRST.Metadata.get_functions_with_applied_metadata()
File "C:/Program Files (x86)/IDA 6.95/plugins/first.py", line 820, in get_functions_with_applied_metadata
for segment in FIRST.Metadata.get_segments_with_functions():
TypeError: 'NoneType' object is not iterable

I like to add additional code I find during the analysis of a sample as additional segment to my code. Thus I can have > 10 segments in my database. In this case, the submit multiple functions dialog tries to display all segments on the vertical width of the window, and each scrollable list will show only one item. It is very cumbersome scrolling through each list one (visible) item at a time.

FIRST crashes with the latest IDA version 7.0.171130

Traceback (most recent call last):
File "C:/Program Files/IDA 7.0/plugins/first.py", line 3412, in ev_auto_queue_empty
return self.auto_queue_empty(arg, before7=False)
File "C:/Program Files/IDA 7.0/plugins/first.py", line 3455, in auto_queue_empty
return super(self.class, self).ev_auto_queue_empty(arg)
File "C:\Program Files\IDA 7.0\python\ida_ida.py", line 770, in __wrapper
rc = do_call(cb, *args)
File "C:\Program Files\IDA 7.0\python\ida_idp.py", line 2389, in __call_IDP_Hooks_auto_queue_empty
old_rc = cb(qtype)
File "C:/Program Files/IDA 7.0/plugins/first.py", line 3454, in auto_queue_empty
return super(self.class, self).auto_queue_empty(arg)
AttributeError: 'super' object has no attribute 'auto_queue_empty'
Exception in IDP Hook function: SWIG director method error. Error detected when calling 'IDP_Hooks.ev_auto_queue_empty'
Traceback (most recent call last):
File "C:/Program Files/IDA 7.0/plugins/first.py", line 3412, in ev_auto_queue_empty
return self.auto_queue_empty(arg, before7=False)
File "C:/Program Files/IDA 7.0/plugins/first.py", line 3455, in auto_queue_empty
return super(self.class, self).ev_auto_queue_empty(arg)
File "C:\Program Files\IDA 7.0\python\ida_ida.py", line 770, in __wrapper
rc = do_call(cb, *args)
File "C:\Program Files\IDA 7.0\python\ida_idp.py", line 2389, in __call_IDP_Hooks_auto_queue_empty
old_rc = cb(qtype)
File "C:/Program Files/IDA 7.0/plugins/first.py", line 3454, in auto_queue_empty
return super(self.class, self).auto_queue_empty(arg)
AttributeError: 'super' object has no attribute 'auto_queue_empty'
Exception in IDP Hook function: SWIG director method error. Error detected when calling 'IDP_Hooks.ev_auto_queue_empty'

tested with:
VERSION = 'BETA'
DATE = 'August 2017'
BEGIN = 2014
END = 2017

Seems to be related to HexRays removing an API from their IDP hook class

Hi,

I searched in your documentation and didn't found this information...
Is ARM and MIPS supported ?
Thanks.

https://github.com/googleprojectzero/functionsimsearch

https://googleprojectzero.blogspot.com/2018/12/searching-statically-linked-vulnerable.html

I got the plugin working on Linux using virtualenv + this plugin. I'm writing this because I read here that you still are looking for a solution then I thought to create this ticket.

If you need more information about the setup feel free to ask me.

This would be similar to how IDA Pro handles duplicate function names. Right now it skips duplicates when applying function names with the following message:

": can't rename byte as 'Reset7API' because the name is already used in the program."

The user should be offered the chance to apply the name with an added numerical suffix. This number could be incremented each time the same name is applied to a function.

FIRST was getting stuck during a function upload, probably due to a bad network connection. It blocked the whole IDA instance, so that working or saving the IDB was impossible, and I had to kill IDA.

Maybe setting a (reasonably short) timeout on network operations could help to at least recover the database?