If you do, you'll receive errors that IDA is unable to load a 64-bit module. Since Yara compiles as a 64-bit library on a 64-bit system, and yara-python does the same, we can't just install it directly into the IDA Python directory. If this is a pure Python module, then no problem. It can decompile any processor architecture which Ghidra and IDA both support. The plugin comes at both 32-bit and 64-bit address space variants (both are 64-bit binaries).

The plugin does NOT work with the freeware version of IDA 6/7.x. This also means that when you want to install a new Python library and use it in IDA, you have to install it into the IDA's bundled Python directory as well. The plugin is compatible with the IDA 5/6/7.x versions. ( There are other ways, but I have not done them.) This gives you a working 'out of the box' product. Hex Rays has gotten the majority of these fixed in the default install so you don't worry about them, and the way it does this with Python is by allowing you to install a bundled Python into the IDA Pro directory. This causes a number of interesting issues on 64-bit Linux systems, especially with Python. Idaq64: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), BuildID=0x1f03dcff4bfd776b23df71c8d9d471fb63b0bf48, stripped Idaq: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), BuildID=0xcb635dd38de5c73f050de37a0f2e492688b3ab9a, stripped Even the 64-bit version of IDA is compiled as a 32-bit program. If I am incorrect on this, please forgive me and let me know in the comments.

The following is based off my observations and experiences. I thought this was odd as I had Yara installed on my system, until I remembered how IDA works on a 64-bit Linux system. This means that you can now run Yara sigs against files you are reversing to help in the analysis process.Īfter I installed the new version of IDAScope into IDA Pro, however, I received errors stating that Yara could not be imported. Last Friday, pnX posted that he updated his awesome IDA plug-in, IDAScope, to include Yara support. See link below for files to just install. Tl dr Install a 32-bit VM, compile Yara, copy files over.

Ida pro 64 bit download