I am looking for a way to modify memory location in IDA python script. We can read memory with these functions:
Byte(address)
Word(address)
Dword(address)
When I try to do something like this:
Byte(address) = value
IDA says that it is not valid to assign to a function call. I tried to use ctypes, however IDA says about unhandled exception on the line:
include ctypes
So how can I write to specific memory location? Thank you.
Byte(), Word() and Dword() are idapython's functions and every try to assign a value to a function call in python will end up with "SyntaxError: can't assign to function call".
These 3 functions you have mentioned are used to read the value of a given address, whether it's a byte, word or a dword. You can't use them to set a value to an address.
In order to modify a memory location you can use one of the following functions:
Prior IDA 7.0:
PatchByte(ea, value)
Change value of a program byte
If debugger was active then the debugged process memory will be patched too
PatchWord(ea, value)
Change value of a program word (2 bytes)
PatchDword(ea, value)
Change value of a double word
PatchDbgByte(ea, value)
Change a byte in the debugged process memory only
In case you want to get the original byte that was existed before any changes occurred, you should use:
GetOriginalByte(ea)
Get original value of program byte
IDA 7.0:
Since IDA 7.0 has arrived idapython made some changes that worth to mention.
The names of the functions has changed to patch_byte(), patch_word(), patch_dword(), patch_dbg_byte() and get_original_byte() accordingly, but, as for now, you still can use the old names since "IDA 7.0/Python/idc_bc695.py", which is responsible to compatibility, contains a wrapper to these functions.
Moreover, another function was added:
patch_qword(ea, value)
Change value of a quad word
Notice that PatchQword() won't work for you since it was not existed in older versions so there's no reason to create it as a wrapper to patch_qword() for compatibility.
Patching a single byte is very intuitive:
from idaapi import *
address= 0x67643021
new_value = 0xCC
PatchByte(address, new_value)
This will edit the IDB file to set the value of 0x67643021 to 0xCC. This won't affect the origianl file. In case that you only want to edit the value of the address in the memory and not in the IDB file, you should use PatchDbgByte() instead of PatchByte().
If you want your changes to affect the original file you'll need to make it by yourself like this:
address= 0x67643021
new_value = 0xCC
# Open the file
f = open("my_binary.exe", "rb+")
# Seek to the address you want to patch
f.seek(address)
# Write the new value to this address
f.write(new_value)
# Close the file
f.close()
You can check fwrapper.py by Alexander Hanel and ida-patcher by Peter Kacherginsky to see some code examples that you may find helpful.
from idaapi import *
from idautils import *
print Byte(ScreenEA())
PatchByte(ScreenEA(),100) <--- this will patch the byte at current address to 0x64
print Byte(ScreenEA())
