Patching Application on OSX (Memory Protection)

Question

I'm patching an executable on OSX. So far I know the patches have been applied successfully.

Steps taken (via LLDB):

lldb /users/Brandon/Desktop/Test.app/Contents/MacOS/Test
b start
run
br del 1
memory write 0x0006cc9f 0xB8
memory write 0x0006cc9f 0x01
memory write 0x0006cc9f 0x00
memory write 0x0006cc9f 0x00
memory write 0x0006cc9f 0x00
process continue

Everything works fine. The above changes:

call testFunc to mov eax, 1. TestFunc is simple, it looks like:

bool testFunc()
{
    return 0;
}

Now if I apply this patch via IDA-Pro/Hex-Rays, it does NOT run! I applied the patches via IDA-Pro and ran the executable but that function never seems to be executed.

However, if I take the same patched executable and I run:

memory read 0x0006cc9f

It prints: 0xB8, 0x01, 0x00, 0x00, 0x00 which is my patch! So the patch is applied.

Now if I run the same memory write code in lldb on the already patched executable, and then process continue the executable behaves correctly.

I suspect it's because it's some sort of memory protection. How can I re-protect my executable after patching it?

Answer 1

IDA Pro does not allow patching an image by default. When IDA Pro analyzes a binary, it is read into its on format; the original executable from that point forward doesn't need to be around.

You can however enable IDA Pro patching feature but you must be sure to have the original binary. With patching enabled in IDA Pro config, you select the following from their drop down menu: Edit > Patch Program > Apply Patch to ensure the change is committed.

It's is worth noting IDA Pro warns users to be cautious with this capability. Not sure it has ever been formally tested which could mean you will receive undefined behavior. If you have your doubts I suggest patching with some other utility (hex editor, debugger/disassembler).