Cannot install KeyPatch in IDA7.0 on Win10

[SoarLife]

I use IDA7.0 on Win10.When I follow your step to install the latest keypatch,IDA 7.0 cannot import this plugins.

the step I follow

1. download the keypatch from github [https://github.com/keystone-engine/keypatch] and place keypatch.py into IDA 7.0/plugins/

2. download the 64-bit keystone msi [http://www.keystone-engine.org/download/] and install the keystone module,because i use 64-bit python2.7.13 in my os.

but it doesn't work,and got these error:(from IDA output window)

  bytes   pages size description
--------- ----- ---- --------------------------------------------
   262144    32 8192 allocating memory for b-tree...
    65536     8 8192 allocating memory for virtual array...
   262144    32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
   589824            total memory allocated

Loading processor module D:\Program Files\IDA 7.0\procs\pc64.dll for metapc...OK
Loading type libraries...
Autoanalysis subsystem has been initialized.
D:\Program Files\IDA 7.0\plugins\keypatch.py: ERROR: fail to load the dynamic library.
Traceback (most recent call last):
  File "D:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
    execfile(script, g)
  File "D:/Program Files/IDA 7.0/plugins/keypatch.py", line 53, in <module>
    from keystone import *
  File "D:\python\python2\lib\site-packages\keystone\__init__.py", line 4, in <module>
    from .keystone import Ks, ks_version, ks_arch_supported, version_bind, debug, KsError, __version__
  File "D:\python\python2\lib\site-packages\keystone\keystone.py", line 75, in <module>
    raise ImportError("ERROR: fail to load the dynamic library.")
ImportError: ERROR: fail to load the dynamic library.

Database for file 'vul' has been loaded.
Hex-Rays Decompiler plugin has been loaded (v7.0.0.170914)
  License: 55-BAE5-8A04-93 Jiang Ying, Personal license (1 user)
  The hotkeys are F5: decompile, Ctrl-F5: decompile all.
  Please check the Edit/Plugins menu for more informaton.
IDAPython Hex-Rays bindings initialized.
D:\Program Files\IDA 7.0\plugins\keypatch.py: cannot import name arm_const
Traceback (most recent call last):
  File "D:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
    execfile(script, g)
  File "D:/Program Files/IDA 7.0/plugins/keypatch.py", line 53, in <module>
    from keystone import *
  File "D:\python\python2\lib\site-packages\keystone\__init__.py", line 2, in <module>
    from . import arm_const, arm64_const, mips_const, sparc_const, hexagon_const, systemz_const, ppc_const, x86_const
ImportError: cannot import name arm_const

---------------------------------------------------------------------------------------------
Python 2.7.13 (v2.7.13:a06454b1afa1, Dec 17 2016, 20:53:40) [MSC v.1500 64 bit (AMD64)] 
IDAPython 64-bit v1.7.0 final (serial 0) (c) The IDAPython Team <[email protected]>
---------------------------------------------------------------------------------------------

I dive into deep step

When I google to solve this problem,I find your install tips from http://www.keystone-engine.org/keypatch/

A1. Windows

It is easiest to just download & install Python 2.7 module for Windows from http://www.keystone-engine.org/download. Be sure to get the 32-bit version, regardless of your Windows edition. 【32-bit python?】

If you prefer to compile from source, just use MSVC 32-bit & follow the instructions in Windows documentation to build keystone.dll. After that, install Python module as in Python documentation. Then copy keystone.dll to the directory of Keystone Python module.

In case you did all the above steps, but IDA still complains “fail to load the dynamic library”, then copy the whole directory keystone at C:\Python27\Lib\site-packages\keystone to C:\Program Files (x86)\IDA 6.8\python, so you have directory C:\Program Files (x86)\IDA 6.8\python\keystone after that (Use your actual IDA directory instead).

so I change my python-64-bit to python-32-bit,and reinstall the keystone-32bit-msi,at the same time,I copy the modles D:\python\python2\Lib\site-packages\keystone to D:\Program Files\IDA 7.0\python,and still get the same error in IDA7.0 output windows,

So what's the problem?

 File "D:/Program Files/IDA 7.0/plugins/keypatch.py", line 53, in <module>
    from keystone import *
  File "D:\python\python2\lib\site-packages\keystone\__init__.py", line 2, in <module>
    from . import arm_const, arm64_const, mips_const, sparc_const, hexagon_const, systemz_const, ppc_const, x86_const
ImportError: cannot import name arm_const

notice this "D:\python\python2\lib\site-packages\keystone_init_.py" is not the correct format in window,and the modle import failed,it the keypatch.py and kestone modle for python something wrong?

[DavidNorena]

If you face the same issue:

Please do this

1: Make sure you have the latest version of keypatch.py.
2. Make sure you have installed the correct version of the VC++ Redistributable 2013, please choose the correct architecture for your windows version, if you are using x64 then install that version.
3. Download keystone-engine Python module for Windows - Binaries again, please choose your correct architecture depending on your windows version as well.
4. OPTIONAL: Make sure whether you have the SIX module installed or not, you just have to run to install it. (at least I needed it)
5. Keep watching the output window after every IDA PRO start, you can have "clues" of how to fix the issue(s), regarding to the KEYPATCH plugin.

Windows 10
IDA PRO 7.2
Keypatch Latest

[aquynh]

try to install our new Pypi package with:

pip install keystone-engine --pre

and see if Keystone is properly installed for you.