0

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another.

The original file has:

__text:00017B60 loc_17B60                           ; CODE XREF: sub_17384+5B2j
__text:00017B60                                     ; sub_17384+636j
__text:00017B60                 MOV             R0, #(aImageCheck - 0x17B6C) ;
__text:00017B68                 ADD             R0, PC  ;
__text:00017B6A                 BLX             _warnx
__text:00017B6E                 MOV.W           R11, #0x50
__text:00017B72                 B               loc_17956

The modified files has:

__text:00017B60 loc_17B60                           ; CODE XREF: sub_17384+5B2j
__text:00017B60                                     ; sub_17384+636j
__text:00017B60                 B               loc_17B16
__text:00017B60 ; End of function sub_17384
__text:00017B60
__text:00017B62 ; ---------------------------------------------------------------------------
__text:00017B62                 STR             R1, [R1,#0xC]
__text:00017B64                 MOVT.W          R0, #0
__text:00017B68                 ADD             R0, PC  ;
__text:00017B6A                 BLX             _warnx
__text:00017B6E                 MOV.W           R11, #0x50
__text:00017B72                 B               loc_17956

In essence, we're forcing a branch to another address, instead of continuing.

In IDA, when I go to the byte patch menu, I get the following for the MOV I want to change:

4D F6 C9 60 C0 F2 00 00 78 44 10 F0 46 EA 4F F0

In the patched file, I get the following for the new Branch:

D9 E7 C9 60 C0 F2 00 00 78 44 10 F0 46 EA 4F F0

The difference between both is the beginning: D9 E7. Does this mean D9 is the Branch, and E7 is the loc_17B16? How would you translate loc_17B16 to the byte value?

Any insight would be appreciated.

0

I finally figure this out and it's almost cheating. I have searched internet and found a branch calculator application that will determine what the new bytes will be after you enter current and next instruction. After that, I just enter new bytes in IDA and branch is done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.