IDA Pro - Error When Modifying JMP Instruction

Question

I am new to ASM. Working in IDA Pro 6.8 on a 64-bit executable.

I am not able to modify the jmp address for this instruction:

    ........   
    .text:0000000141BAFB57 loc_141BAFB57:                          
    .text:0000000141BAFB57                 lea     rcx, [rbp+520h+var_20]
    .text:0000000141BAFB5E                 lea     rdx, abc_data
    .text:0000000141BAFB65                 call    sub_141CCAC80
    .text:0000000141BAFB6A                 jmp     loc_141BAF9D6
    .text:0000000141BAFB6A subroutine endp
    .text:0000000141BAFB6A
    .text:0000000141BAFB6F

I want to either change the jmp address from loc_141BAF9D6 to loc_141BAFA9C or simply nop the instruction...

every time I attempt this in IDA Pro 6.8 it moves the jmp (or the nop) instruction outside the subroutine endp closing, and therefore IDA gives me now a SP-Analysis failed error... example:

.text:0000000141BAFB57 loc_141BAFB57:                          
.text:0000000141BAFB57                 lea     rcx, [rbp+520h+var_20]
.text:0000000141BAFB5E                 lea     rdx, abc_data
.text:0000000141BAFB65                 call    sub_141CCAC80
.text:0000000141BAFB65 subroutine endp ; sp-analysis failed
.text:0000000141BAFB65
.text:0000000141BAFB6A                 jmp     loc_141BAFA9C
.text:0000000141BAFB6F

I've tried editing the instruction via Edit > Patch Program Assemble, directly in HEX view, using IDAPatcher, and using Fetanyl plugin... it always moves the instruction outside of the endp statement, breaking the code...

Is this not possible in general or what am I doing wrong ?

I've tried OllyDbg but it does not open 64-bit files...

Answer 1

It is possible. I think that it is bug in IDA (editing last instruction of the function removes it from the function, I succeeded to reproduce this behavior), but you can work it around by fixing the function after patching.

The easiest way to do it is as follows:

1. After doing the patching
2. Place a cursor to the instruction removed from the function in IDA-View-A window (regular assembly window)
3. and press E. This will define the end of function to the current instruction, which means to the address where it was before.

You can do the same by editing the function end address in function properties dialog (Edit->Functions->Edit Function or Alt-P. Good luck.