Im a newbe in radare and while I tried to patch a crackme binary, I opened it the first time in debug mode (-d), while debugging I used oo+ to reopen it with write mode, when I modify an instruction using wx, it works but when I quit it gives me two confirmation messages with yes no I press enter two times, then it get back to the original stat, and loose the modification, How could I keep changes even after quitting ???
Add a comment
|
2 Answers
I just tried opening a binary file and patching and it actually saves my patches. The steps I followed are:
[99:99:99] <myuser>:answer $ cp crackme0x00 crackme0x00_patched
[99:99:99] <myuser>:answer $ radare2 -Aw crackme0x00_patched
[0x08048360]> [email protected]
[0x08048360]> 0x08048487
[0x08048487]> wa ret
Written 1 bytes (ret) = wx c3
[0x08048487]> q
[99:99:99] <myuser>:answer $ cmp -l crackme0x00 crackme0x00_patched | gawk '{printf "%08X %02X %02X\n", $1, strtonum(0$2), strtonum(0$3)}'
00000488 E8 C3
(I stole the compare script from here)
As you can see, in my case the binary remains patched even after quitting (C3 is the opcode for the ret instruction. Instead of reopening the file with oo+ as you did, I opened it in write mode with w and A (equivalent of aaa). I just tried myself and I couldn't patch binaries and save them (if anyone can give a more accurate explaination is welcome).
This is normal and expected behaviour. when you are in the debugger what you are modifying is the process memory, not the disk file.
-
Being a new be in the huge world of reverse ingeniering, I had not this idea in my mind, the next time, I'll be ready for similar cases (before asking) ^^ Dec 23, 2016 at 15:43