Latest available version: IDA and decompilers v8.4.240320 see all releases
Hex-Rays logo State-of-the-art binary code analysis tools
email icon

  Posted on:   30 Oct 2017

  By:   Igor Skochinsky

  Categories:  IDA Pro IDAPython

  Tags: 

With IDA 7.0 switching fully to native x64 architecture, we also switched to the x64 Python which brought some
new issues but also exposed some we’ve seen before. This post tries to summarize the most common issues we’ve seen our users encounter as
well as suggestions about how to fix them or at least diagnose where things went wrong before you have to contact support.

Common errors

The specified module could not be found

You may see such messages in IDA’s Output window:

LoadLibrary(C:\Program Files\IDA\plugins\python.dll) error: The specified module could not be found.
C:\Program Files\IDA\plugins\python.dll: can't load file

…while the file is obviously there. This message (it comes from the OS) is a little misleading:
it actually means that one of the modules that
python.dll (IDAPython plugin) links to could not be found.

The most common one is python27.dll (python runtime) which is usually installed in %windir%\system32 but
may be in a different place for whatever reason (e.g. you’re using an alternative Python distribution or user-specific Python
installation). You may need to check your PATH environment variable or possibly reinstall Python (x64 version).

%1 is not a valid Win32 application

Typical output:

LoadLibrary(C:\Program Files\IDA\plugins\python.dll) error: %1 is not a valid Win32 application.
C:\Program Files\IDA\plugins\python.dll: can't load file

or:

ImportError: DLL load failed: %1 is not a valid Win32 application

This error can happen if IDA tries to load a DLL with wrong architecture (e.g. x86 DLL into x64 IDA or vice versa). Common causes:

  • wrong variant of python27.dll present in PATH
  • wrong versions of native modules (.pyd) are being used (e.g. you have PYTHONPATH or PYTHONHOME
    environment variable set pointing to the x86 install)
  • installing x86 and x64 Python into the same directory (this will never work).

IDAPython: importing “site” failed

DAPython: importing "site" failed

This issue is usually caused by presence of non-standard python27.dll in the PATH which
uses its own set of modules (you should edit PATH in this case). However, it may happen
if your Python installation is broken in some way. Reinstalling Python manually may fix it.

Diagnosis checklist

  1. Check that you have one and only one python27.dll in PATH. you can check it by executing
    “where python27.dll” in a command prompt. Expected output:

    c:\>where python27.dll
C:\Windows\System32\python27.dll

  2. Check where Python is looking for modules. Check this registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Python\PythonCore\2.7\InstallPath

    Its expected value is C:\Python27-x64\

  3. Check your environment (type “set” in command prompt) for any variables starting with
    PYTHON, especially PYTHONHOME or PYTHONPATH and fix or remove them. If you need
    these variables for other software, we suggest making a .bat file to clear
    these variables and then start IDA.

  4. if IDAPython loads but you get import errors when running scripts, dump sys.path and check for any unexpected/wrong entries.

    Example good output:

    Python>import sys
Python>sys.path
['C:\\Windows\\system32\\python27.zip', 'C:\\Python27-x64\\Lib', 'C:\\Python27-x64\\DLLs', 'C:\\Python27-x64\\Lib\\lib-tk', 'C:\\Program Files\\IDA 7.0\\python', 'C:\\Python27-x64', 'C:\\Python27-x64\\lib\\site-packages', 'C:\\Program
Files\\IDA 7.0\\python\\lib\\python2.7\\lib-dynload\\ida_32', 'C:\\Program Files\\IDA 7.0\\python']

  5. Trace from which paths IDAPython is loading modules. You can do it by setting environment
    variable PYTHONVERBOSE=1 before running IDA. Paths will be printed into Output Window
    (you can also save it to file by adding -L<logfile> to IDA’s
    command line).

Reinstalling Python/IDA

In case you decide to reinstall Python and/or IDA, do not just remove their directories
as this may leave remains of installation in registry or elsewhere and mess up future installs.
Use the corresponding uninstallers. Note that IDA’s uninstaller does not uninstall Python
so that needs to be done separately if required.

Normally IDA 7.0 installer installs x64 Python if it’s not already installed but you can also
download a recent 2.7.x installer
from python.org
(pick the “Windows x86-64 MSI installer”). You can install it into any location of your choice as long as IDA can find it
(python27.dll should be in PATH), however we recommend using C:\Python27-x64
(“All Users” option) so that it does not conflict with the 32-bit install.

Before uninstalling IDA, check that you still have the original installer. If necessary, you can
request a new download
(only possible with active support).