1

I'm working on reverse a binary from a MIPS based router. In order to do it I'm emulating the binary with qemu, but the binary executes some routines before stating with the logic that skips the execution if it's not loaded on the router.

I confirmed that if I skip the execution of those routines by editing some bytes I can run the binary locally and dynamically debug it. For now I'm doing it manually but I want to patch it so I can run it faster.

My problem comes once I change some bytes and try to export it in IDA I tried the idc script to write the changes, also ida_patcher with a DIF file and the built in function to export the changes (Edit>Patch Program...) but the changes are not applied to the binary and I can't generate a new one.

I was thinking in edit the binary with an hex editor but I was wondering if I can do it with IDA.

2
  • Are you able to perform the changes inside IDA, and only the export is missing?
    – tmr232
    Oct 27, 2015 at 9:39
  • Yes, I use the patch option or the hex editor and the problem is while exporting. It shows a message on console that no patches were applied
    – Nucklear
    Oct 27, 2015 at 11:46

1 Answer 1

1

You can always try and do away with IDAPython:

import idaapi
import idc

PATH_TO_COPY_OF_ORIGINAL_FILE = 'some-path'

def apply_patches_to_file(target_file):
    def patch_visitor(ea, fpos, org_val, patch_val):
        target_file.seek(fpos)
        target_file.write(chr(patch_val))

    idaapi.visit_patched_bytes(idc.MinEA(), idc.MaxEA(), patch_visitor)

with open(PATH_TO_COPY_OF_ORIGINAL_FILE, 'r+') as f:
    apply_patches_to_file(f)

Just create a copy of your original file, set the PATH_TO_COPY_OF_ORIGINAL_FILE, and give the script a go. It iterates all patches made to the IDB and try to apply them to the file.

That said, not knowing the cause of your issues - this script may fail as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.