0

Is there a way to modify one or more bytes in memory without making any changes in the database? I know about idc.PatchByte() in idapython, but it will print the message that states that 'This database has been patched' on the next run.

3
  • 1
    You may also try Edit -> Patch program -> Change byte/word in IDA Pro. PS: Consider to save the state of your IDA Database before changing bytes with Database snapshot manager(Ctrl+Shift+T). It will help you to avoid troubles if something will go wrong. If you want to patch the binary that you dissect, there are a plenty of ways to do that. You may use Edit -> Patch program -> Apply patches to input file in IDA Pro. Alternatively you may modify a binary in a debugger or with some hex editor. What would you like to modify?
    – 0xDEADC0DE
    Commented Sep 17, 2015 at 15:04
  • This is not suitable for me for exactly the same reason why idc.PatchByte() is not suitable for me. I estimated that the first answer will be like that - sorry that I hadn't mentioned this in op post.
    – vdudouyt
    Commented Sep 17, 2015 at 15:51
  • Probably PatchDbgByte(ea,value) from IDA Pro command line or in script will help. As descibed in idc.py this function meant to "Change a byte in the debugged process memory only". Commented Jan 16, 2019 at 20:43

2 Answers 2

1

You can do it even in free IDA. Setup a breakpoint and use its condition property in Edit BreakPoint. This way you can change registers, memory, and even perform more complex actions. For example:

patch_dbg_byte(rcx+2,0),0

Byte at address rcx+2 is cleared when the breakpoint is hit.

0

Finally I'm answering my own question:

DbgWrite(ea, data)
    Write to debugger memory.
    
    @param ea: linear address
    @param data: string to write
    @return: number of written bytes (-1 - network/debugger error)
    
    Thread-safe function (may be called only from the main thread and debthread)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.