How to patch file by adding a branch instruction to another address in arm

Question

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another.

The original file has:

__text:00017B60 loc_17B60                           ; CODE XREF: sub_17384+5B2j
__text:00017B60                                     ; sub_17384+636j
__text:00017B60                 MOV             R0, #(aImageCheck - 0x17B6C) ;
__text:00017B68                 ADD             R0, PC  ;
__text:00017B6A                 BLX             _warnx
__text:00017B6E                 MOV.W           R11, #0x50
__text:00017B72                 B               loc_17956

The modified files has:

__text:00017B60 loc_17B60                           ; CODE XREF: sub_17384+5B2j
__text:00017B60                                     ; sub_17384+636j
__text:00017B60                 B               loc_17B16
__text:00017B60 ; End of function sub_17384
__text:00017B60
__text:00017B62 ; ---------------------------------------------------------------------------
__text:00017B62                 STR             R1, [R1,#0xC]
__text:00017B64                 MOVT.W          R0, #0
__text:00017B68                 ADD             R0, PC  ;
__text:00017B6A                 BLX             _warnx
__text:00017B6E                 MOV.W           R11, #0x50
__text:00017B72                 B               loc_17956

In essence, we're forcing a branch to another address, instead of continuing.

In IDA, when I go to the byte patch menu, I get the following for the MOV I want to change:

4D F6 C9 60 C0 F2 00 00 78 44 10 F0 46 EA 4F F0

In the patched file, I get the following for the new Branch:

D9 E7 C9 60 C0 F2 00 00 78 44 10 F0 46 EA 4F F0

The difference between both is the beginning: D9 E7. Does this mean D9 is the Branch, and E7 is the loc_17B16? How would you translate loc_17B16 to the byte value?

Any insight would be appreciated.

Answer 1

I finally figure this out and it's almost cheating. I have searched internet and found a branch calculator application that will determine what the new bytes will be after you enter current and next instruction. After that, I just enter new bytes in IDA and branch is done.