1

I have an app in which I have to manually alter several flags in order to get to the part of the code Im interested in (imagine altering ZF to pass JNZ instruction). I have to do this every time I run application. What is the best way to do this permanently so I can simply run app to the part Im interested in?

I can patch binary (in different program - ie change jnz to jmp) and load it in IDA again but I have no idea how to load IDA database into it (to get my comments, function names I made etc etc).

Is there any way to do this?

Thanks.

  • The simplest way I see is writing IDAPython script to do all the manual altering automatically. BTW, you have patching capabilities in IDA, why not to use it ? – w s Oct 23 '16 at 10:43
  • What capabilities are you referring to? I can patch instruction in IDA but it wont survive next app run (jnz patched to jmp will still look like jmp in IDA but app will jump elsewhere as if jnz is still there) – Kra Oct 23 '16 at 11:39
  • 1
    Regarding the IDAPython: you can use put_dbg_byte or write_dbg_memory when on breakpoint to patch your jnz to jmp. – w s Oct 23 '16 at 12:02
3

You don't have to use separate program to patch in ida. Simple select/highlight in ida-view where you wanna patch, then in Edit(menu)>>patch byte Then after you are done patching what you need, Edit(menu>>apply patches to input file. I usually keep the backup ( you get a option for that)

| improve this answer | |
  • Great, that works perfectly. IDA then complains both DB and input file has changed but well .. who cares :) Thank you. – Kra Oct 23 '16 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.