Windows下给IDApro 安装yara-python 和findcrypt

https://blog.csdn.net/szxpck/article/details/107203718

目标：在IDA pro7.0上安装findcrypt这个插件。

而findcrypt这个插件需要依赖python的yara-python模块。因此先安装yara-python。

因为要用到pip安装，并且是给IDA自带的python安装模块。所以事先需要把当前python2的环境变量修改为IDA使用的python2.

修改完成后pip -V 就能查看当前使用的pip信息

然后使用pip install yara-python 报各种乱七八糟的错。

C:Usersygt>python -m pip install yara-python
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support
Looking in indexes: https://pypi.tuna.tsinghua.edu.cn/simple
Collecting yara-python
  Using cached https://pypi.tuna.tsinghua.edu.cn/packages/5f/32/23a3234978d746acfad00f306b13446a1935c52ec74a033416f457328239/yara-python-4.0.2.tar.gz (405 kB)
Using legacy setup.py install for yara-python, since package 'wheel' is not installed.
Installing collected packages: yara-python
    Running setup.py install for yara-python ... error
    ERROR: Command errored out with exit status 1:
     command: 'D:IDApython27python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'c:\users\ygt\appdata\local\temp\pip-install-cmkquh\yara-python\setup.py'"'"'; __file__='"'"'c:\users\ygt\appdata\local\temp\pip-install-cmkquh\yara-python\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'
'"'"', '"'"'
'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'c:usersygtappdatalocal	emppip-record-3a7pdhinstall-record.txt' --single-version-externally-managed --compile --install-headers 'D:IDApython27Includeyara-python'
         cwd: c:usersygtappdatalocal	emppip-install-cmkquhyara-python
    Complete output (21 lines):
    running install
    running build
    running build_ext
    building 'yara' extension
    creating build
    creating build	emp.win-amd64-2.7
    creating build	emp.win-amd64-2.7Release
    creating build	emp.win-amd64-2.7Releaseyara
    creating build	emp.win-amd64-2.7Releaseyaralibyara
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodules
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodulesdemo
    creating build	emp.win-amd64-2.7Releaseyaralibyaramoduleself
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodulesmath
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodulespe
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodules	ests
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodules	ime
    creating build	emp.win-amd64-2.7Releaseyaralibyaraproc
    C:UsersygtAppDataLocalProgramsCommonMicrosoftVisual C++ for Python9.0VCBinamd64cl.exe /c /nologo /Ox /MD /W3 /GS- /DNDEBUG -DUSE_WINDOWS_PROC=1 -D_CRT_SECURE_NO_WARNINGS=1 -Iyara/libyara/include -Iyara/libyara/ -I. -ID:IDApython27include -ID:IDApython27PC /Tcyara-python.c /Fobuild	emp.win-amd64-2.7Releaseyara-python.obj
    yara-python.c
    yara/libyara/includeyara/types.h(33) : fatal error C1083: Cannot open include file: 'stdbool.h': No such file or directory
    error: command 'C:\Users\ygt\AppData\Local\Programs\Common\Microsoft\Visual C++ for Python\9.0\VC\Bin\amd64\cl.exe' failed with exit status 2
    ----------------------------------------
ERROR: Command errored out with exit status 1: 'D:IDApython27python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'c:\users\ygt\appdata\local\temp\pip-install-cmkquh\yara-python\setup.py'"'"'; __file__='"'"'c:\users\ygt\appdata\local\temp\pip-install-cmkquh\yara-python\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'
'"'"', '"'"'
'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'c:usersygtappdatalocal	emppip-record-3a7pdhinstall-record.txt' --single-version-externally-managed --compile --install-headers 'D:IDApython27Includeyara-python' Check the logs for full command output.

C:Usersygt>python -m pip install yara-python
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support
Looking in indexes: https://pypi.tuna.tsinghua.edu.cn/simple
Collecting yara-python
  Using cached https://pypi.tuna.tsinghua.edu.cn/packages/5f/32/23a3234978d746acfad00f306b13446a1935c52ec74a033416f457328239/yara-python-4.0.2.tar.gz (405 kB)
Using legacy setup.py install for yara-python, since package 'wheel' is not installed.
Installing collected packages: yara-python
    Running setup.py install for yara-python ... error
    ERROR: Command errored out with exit status 1:
     command: 'D:IDApython27python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'c:\users\ygt\appdata\local\temp\pip-install-cmkquh\yara-python\setup.py'"'"'; __file__='"'"'c:\users\ygt\appdata\local\temp\pip-install-cmkquh\yara-python\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'
'"'"', '"'"'
'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'c:usersygtappdatalocal	emppip-record-3a7pdhinstall-record.txt' --single-version-externally-managed --compile --install-headers 'D:IDApython27Includeyara-python'
         cwd: c:usersygtappdatalocal	emppip-install-cmkquhyara-python
    Complete output (21 lines):
    running install
    running build
    running build_ext
    building 'yara' extension
    creating build
    creating build	emp.win-amd64-2.7
    creating build	emp.win-amd64-2.7Release
    creating build	emp.win-amd64-2.7Releaseyara
    creating build	emp.win-amd64-2.7Releaseyaralibyara
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodules
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodulesdemo
    creating build	emp.win-amd64-2.7Releaseyaralibyaramoduleself
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodulesmath
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodulespe
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodules	ests
    creating build	emp.win-amd64-2.7Releaseyaralibyaramodules	ime
    creating build	emp.win-amd64-2.7Releaseyaralibyaraproc
    C:UsersygtAppDataLocalProgramsCommonMicrosoftVisual C++ for Python9.0VCBinamd64cl.exe /c /nologo /Ox /MD /W3 /GS- /DNDEBUG -DUSE_WINDOWS_PROC=1 -D_CRT_SECURE_NO_WARNINGS=1 -Iyara/libyara/include -Iyara/libyara/ -I. -ID:IDApython27include -ID:IDApython27PC /Tcyara-python.c /Fobuild	emp.win-amd64-2.7Releaseyara-python.obj
    yara-python.c
    yara/libyara/includeyara/types.h(33) : fatal error C1083: Cannot open include file: 'stdbool.h': No such file or directory
    error: command 'C:\Users\ygt\AppData\Local\Programs\Common\Microsoft\Visual C++ for Python\9.0\VC\Bin\amd64\cl.exe' failed with exit status 2
    ----------------------------------------
ERROR: Command errored out with exit status 1: 'D:IDApython27python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'c:\users\ygt\appdata\local\temp\pip-install-cmkquh\yara-python\setup.py'"'"'; __file__='"'"'c:\users\ygt\appdata\local\temp\pip-install-cmkquh\yara-python\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'
'"'"', '"'"'
'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'c:usersygtappdatalocal	emppip-record-3a7pdhinstall-record.txt' --single-version-externally-managed --compile --install-headers 'D:IDApython27Includeyara-python' Check the logs for full command output.

在查阅了

https://blog.csdn.net/fjh1997/article/details/107167704/

的博客之后才知道，要想安装成功，需要限定wheel的版本——只有3.11的轮子支持python2，而且是windows版本。

因此使用

python -m pip install yara-python==3.11.0

• 1

如果提示：
Using legacy setup.py install for yara-python, since package 'wheel' is not installed.

可以使用
python -m pip install wheel安装wheel模块。

yara-python安装好后，去https://github.com/polymorf/findcrypt-yara 将下载好的 findcrypt3.py 和findcrypt3.rules拷贝到 IDAplugins 目录。随后打开IDA，随便拖入一个程序，就可以在edit-plugins里面找到Findcrypt这个插件了。

Findcrypt可以很有效地识别许多公开的加密算法。有效避免了把过多的时间花费在阅读加密代码上。当然了如果是自定义的加密函数肯定还是只有手撸的