1

I'm patching an executable on OSX. So far I know the patches have been applied successfully.

Steps taken (via LLDB):

lldb /users/Brandon/Desktop/Test.app/Contents/MacOS/Test
b start
run
br del 1
memory write 0x0006cc9f 0xB8
memory write 0x0006cc9f 0x01
memory write 0x0006cc9f 0x00
memory write 0x0006cc9f 0x00
memory write 0x0006cc9f 0x00
process continue

Everything works fine. The above changes:

call testFunc to mov eax, 1. TestFunc is simple, it looks like:

bool testFunc()
{
    return 0;
}

Now if I apply this patch via IDA-Pro/Hex-Rays, it does NOT run! I applied the patches via IDA-Pro and ran the executable but that function never seems to be executed.

However, if I take the same patched executable and I run:

memory read 0x0006cc9f

It prints: 0xB8, 0x01, 0x00, 0x00, 0x00 which is my patch! So the patch is applied.

Now if I run the same memory write code in lldb on the already patched executable, and then process continue the executable behaves correctly.

I suspect it's because it's some sort of memory protection. How can I re-protect my executable after patching it?

1

IDA Pro does not allow patching an image by default. When IDA Pro analyzes a binary, it is read into its on format; the original executable from that point forward doesn't need to be around.

You can however enable IDA Pro patching feature but you must be sure to have the original binary. With patching enabled in IDA Pro config, you select the following from their drop down menu: Edit > Patch Program > Apply Patch to ensure the change is committed.

It's is worth noting IDA Pro warns users to be cautious with this capability. Not sure it has ever been formally tested which could mean you will receive undefined behavior. If you have your doubts I suggest patching with some other utility (hex editor, debugger/disassembler).

| improve this answer | |
  • I actually solved it eventually.. It turns out when you patch an executable on Mac, it must be Re-Signed with a developer certificate or distribution certificate because its signature changed and it will no longer run. I'm not sure if IDA pro somehow fixes this. – Brandon Jul 20 '19 at 22:11
  • Ah yes. You can also force it to load non-signed binaries. Jtool is great to work with things like that. It is like otool but a bit better. – in70x Jul 22 '19 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.