软件逆向- MacOS ARM 安装 keypatch For IDA Pro 9.0 填坑

正常流程

下载最新版本的keypatch.py(代码地址), 放到/Applications/IDA Professional 9.0.app/Contents/MacOS/plugins/ 目录下
安装keystone:
1
pip3 install keystone-engine
如果是python3.11以下的, 需要再执行命令:
1
pip3 install six
到此, 如果你是intel版本的MacOS系统, 打开IDA Pro 9.0基本就可以正常使用了

但是如果你是ARM版本的MacOS系统, 打开IDA Pro 9.0, 大概率会看到以下报错:

/Applications/IDA Professional 9.0.app/Contents/MacOS/plugins/keypatch.py: ERROR: fail to load the dynamic library.
Traceback (most recent call last):
  File "/Applications/IDA Professional 9.0.app/Contents/MacOS/python/ida_idaapi.py", line 574, in IDAPython_ExecScript
    exec(code, g)
    ~~~~^^^^^^^^^
  File "/Applications/IDA Professional 9.0.app/Contents/MacOS/plugins/keypatch.py", line 53, in <module>
    from keystone import *
  File "/opt/homebrew/lib/python3.13/site-packages/keystone/__init__.py", line 4, in <module>
    from .keystone import Ks, ks_version, ks_arch_supported, version_bind, debug, KsError, __version__
  File "/opt/homebrew/lib/python3.13/site-packages/keystone/keystone.py", line 74, in <module>
    raise ImportError("ERROR: fail to load the dynamic library.")
ImportError: ERROR: fail to load the dynamic library.

解决报错

导致这个报错有两个可能是两个原因:

keystone的安装目录下没有libkeystone.dylib以及libkeystone.0.dylib(主要是libkeystone.0.dylib, libkeystone.dylib只是其快链)
libkeystone.dylib的架构不是ARM64的

如果你没办法判断自己的libkeystone.dylib是否是Arm64的架构, 可以使用file命令进行判断:

# 默认的libkeystone.dylib
 ➜ ~ file /opt/homebrew/lib/python3.13/site-packages/keystone/libkeystone.dylib
/opt/homebrew/lib/python3.13/site-packages/keystone/libkeystone.dylib: Mach-O 64-bit dynamically linked shared library x86_64
 
# 自己编译后
 ➜ ~ file /Users/studio/Downloads/keystone/build/llvm/lib/libkeystone.dylib
/Users/studio/Downloads/keystone/build/llvm/lib/libkeystone.0.dylib: Mach-O 64-bit dynamically linked shared library arm64

这两个问题解决方法都一样, 需要我们自己去编译一个libkeystone.0.dylib, 然后复制到keystone的安装目录.下面开始介绍如何自己编译:

下载

# 下载项目
git clone https://github.com/keystone-engine/keystone.git
cd keystone
 
# 创建build文件夹, 后续编译后的内容都存放在这
mkdir build
cd build

修改配置

编译前, 我们需要对原来的配置进行修改, 打开make-common.sh文件, 这样修改后面我们编译出来就默认是arm64架构:

# 第4行, 修改之前
ARCH=''
 
# 修改之后
ARCH='arm64'

打开make-share.sh, 把python的路径改为自己电脑上的路径:

# 修改前:
cmake -DBUILD_LIBS_ONLY=$BUILD_LIBS_ONLY -DLLVM_BUILD_32_BITS="$LLVM_BUILD_32_BITS" -DCMAKE_OSX_ARCHITECTURES="$ARCH" -DCMAKE_BUILD_TYPE=$BUILDTYPE -DBUILD_SHARED_LIBS=ON -DLLVM_TARGETS_TO_BUILD="all" -G "Unix Makefiles" ..
 
# 修改后:
cmake -DBUILD_LIBS_ONLY=$BUILD_LIBS_ONLY -DLLVM_BUILD_32_BITS="$LLVM_BUILD_32_BITS" -DCMAKE_OSX_ARCHITECTURES="$ARCH" -DCMAKE_BUILD_TYPE=$BUILDTYPE -DBUILD_SHARED_LIBS=ON -DLLVM_TARGETS_TO_BUILD="all" -DPYTHON_LIBRARY="/opt/homebrew/opt/python@3.12/Frameworks/Python.framework/Versions/3.12/lib/libpython3.12.dylib" -DPYTHON_EXECUTABLE="/opt/homebrew/opt/python@3.12/Frameworks/Python.framework/Versions/3.12/bin/python3.12" -G "Unix Makefiles" ..

在keystone目录下搜索名为CMakeLists.txt的所有文件, 都需要按照以下修改:

# 修改cmake最低支持版本
cmake_minimum_required(VERSION 2.8.7)
 
# 修改后:
cmake_minimum_required(VERSION 3.5)
 
# 注释或删除掉以下代码, CMP0051已经废弃
if (POLICY CMP0051)
  # CMake 3.1 and higher include generator expressions of the form
  # $<TARGETLIB:obj> in the SOURCES property.  These need to be
  # stripped everywhere that access the SOURCES property, so we just
  # defer to the OLD behavior of not including generator expressions
  # in the output for now.
  cmake_policy(SET CMP0051 OLD)
endif()

开始编译

1	`../make-share.sh`

如果看到以下窗口, 就是编译成功:

可能遇到的报错

make-share.sh中python路径设置错误, 就会报这个错误, 需要自己检查一下python的路径:

1 2	`CMake Error at llvm/CMakeLists.txt:358 (message):` `Unexpected failure executing llvm-build:`

使用编译好的动态库

编译好的libkeystone.dylib以及libkeystone.0.dylib动态库存放在keystone/build/llvm/lib目录下, 可以直接拷贝到前面IDA Pro 9.0中报错的路径, 我这里是/opt/homebrew/lib/python3.13/site-packages/keystone/, 只需要拷贝到该路径下即可!

参考了以下文章:
fc2K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6T1L8s2g2W2i4K6u0V1k6r3g2$3K9h3I4Q4x3V1k6S2k6Y4c8W2M7W2)9J5k6r3W2V1j5g2)9J5k6s2m8J5L8H3`.`.

最后于 5小时前被Ade0408编辑，原因：重复标题

更多【软件逆向- MacOS ARM 安装 keypatch For IDA Pro 9.0 填坑】相关视频教程：www.yxfzedu.com

软件逆向- MacOS ARM 安装 keypatch For IDA Pro 9.0 填坑

正常流程

解决报错

下载

修改配置

开始编译

可能遇到的报错

使用编译好的动态库

相关文章推荐

Markdown Editor

友情链接

课程目录

技术交流QQ群