1

I have an app in which I have to manually alter several flags in order to get to the part of the code Im interested in (imagine altering ZF to pass JNZ instruction). I have to do this every time I run application. What is the best way to do this permanently so I can simply run app to the part Im interested in?

I can patch binary (in different program - ie change jnz to jmp) and load it in IDA again but I have no idea how to load IDA database into it (to get my comments, function names I made etc etc).

Is there any way to do this?

Thanks.

Improve this question
3
  • The simplest way I see is writing IDAPython script to do all the manual altering automatically. BTW, you have patching capabilities in IDA, why not to use it ?
    – w s
    Oct 23, 2016 at 10:43
  • What capabilities are you referring to? I can patch instruction in IDA but it wont survive next app run (jnz patched to jmp will still look like jmp in IDA but app will jump elsewhere as if jnz is still there)
    – Kra
    Oct 23, 2016 at 11:39
  • 1
    Regarding the IDAPython: you can use put_dbg_byte or write_dbg_memory when on breakpoint to patch your jnz to jmp.
    – w s
    Oct 23, 2016 at 12:02

1 Answer 1

Reset to default
4

You don't have to use separate program to patch in ida. Simple select/highlight in ida-view where you wanna patch, then in Edit(menu)>>patch byte Then after you are done patching what you need, Edit(menu>>apply patches to input file. I usually keep the backup ( you get a option for that)

Improve this answer
1
  • Great, that works perfectly. IDA then complains both DB and input file has changed but well .. who cares :) Thank you.
    – Kra
    Oct 23, 2016 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.