I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this: In c++ disassembled code exist calls to a certain function. 2 thousand of them, to be precise. So I want to replace all of them with nop, but after digging into hex-rays IDC docs, I can't quite figure out what to do I understood that I need to use loader_input_t.seek to search for those strings, but nothing after. My best guess had to do something using patch_qword, but I don't get how to input parameters into it.
1 Answer
For IDC scripting you can use the patch_byte() function [1], perhaps you can try idapython [2]:
import ida_bytes
ea = 0x41414141
ida_bytes.patch_byte(ea, 0x90)
this will patch the address at 'ea' with 0x90 (NOP), or in case of patching several bytes:
buffer = b'\x90\x90\x90\x90'
ida_bytes.patch_bytes(ea, buffer)
hope this helps.
[1] https://hex-rays.com/products/ida/support/idapython_docs/ida_bytes.html#ida_bytes.patch_byte
[2] https://hex-rays.com/products/ida/support/idadoc/713.shtml
patch_byte, and python is almost infinitely nicer than idc scripting. However, to get the 2000 calls to that certain function, you'd want to enumerate its references using theget_first_cref_toandget_next_cref_topair with a loop. This way you can use the cross references to find each call, and thenpatch_byteeach one of them according to your needs.