2 of 1; half a nybble of another

Originally published on the old depletionmode / 2of1 blog (archived copy).

Installing IDA Pro on a 64-bit flavour of Linux is a bit of a business – mostly because there is no 64-bit version of IDA (yet).

Now of course you can install it in a VM, but what’s the point? A x86_64 can natively run 32-bit instructions can’t it?!

Getting IDA Pro up and running involves quite a few steps. Here’s how it’s done on Arch Linux.

32-bit chroot environment
This first thing to do is get a minimal 32-bit chroot environment going.
There are a number of ways of doing this (in fact, there are a number of ways of doing almost everything in this post).
The easiest is probably by installing the arch32-light package from the AUR:

listing text

pak -S arch32-light
sudo arch32initialize
sudo pacman32  -Sy bash coreutils filesystem grep gzip licenses sed
sudo pacman -S schroot

(NOTE: I use paktahn to install Arch Linux packages as to includes support for all repositories – including AUR – and has a ‘pacman’-esque command format feel to it; but please feel free to use whatever method/frontend you want)

You should now have a fancy, albeit minimal, 32-bit chroot environment set up.

Installing IDA Pro
Now you can go ahead and copy IDA Pro somewhere.

listing text

mkdir ~/tools/ida
tar xvf ida_XXXXXXXXXXXXX* -C ~/tools/ida

Getting IDA to execute using
We now need to install a number of 32-bit dependencies for IDA (./idaq) to run:

listing text

sudo pacman32 -S glib2 freetype2 ttf-dejavu libsm libxrender fontconfig libxext

IDA needs to connect to the host (64-bit) X-Windows server.
Access control is enabled by default, so simply give access to local clients:

listing text

xhost +local:

Give it a go!
You should now be able to take you IDA install for a spin:

listing text

schroot -p ./tools/ida/idaq

What you’ll notice is that idapython can’t dlopen() libpython2.6. Simply installing python2.7 in the chroot environment (with pacman32) or even installing python 2.6 from the AUR doesn’t seem to work (creating a symbolic link from 2.7 -> 2.6 is a no go either).
You can either compile a 32-bit, python2.7 version of idapython or ask/wait for one to be released.