0

In viewing the diff for two files, a method in the original file starts with:

push    ebp
mov     ebp, esp

and in the modified file, it starts with:

push 0
pop rax
retn
endp

In essence, the modified file is patched to avoid running the method. My question is, what byte do I need to patch in IDA to achieve the same effect?

Improve this question

1 Answer 1

Reset to default
3

Something is wrong here, since the original push ebp; mov ebp, esp is 32 bit code, and the modified pop rax is 64 bit code. You might want to sort that out before proceeding.

That said, in IDA:

  • locate the method in the graph view, or disassembly view. The bottom line in this view will show you the load address of the current instruction as well as the offset in the loaded file, this will help you finding the correct address
  • put the cursor on the push ebp instruction`
  • from the menu, use 'Edit/Patch program/Assemble'
  • enter your assembly code, line by line
  • when done, use 'Edit/Patch program/Apply patches to input file' to save back your changes
Improve this answer
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.