3

I am using IDA Free for malware analysis and I wanted to patch a binary I am looking at. I applied the patch by using the patch menu, which modifies the DATABASE representation of the executable.

When I go to run the executable via Debugger -> Run, it warns me that the database has been patched and there may be inconsistencies. However, when it finally runs it runs the original executable without patched code!

Is there a way to tell IDA to run the patched code? Or, since it's only patched in the database, my only choice is to export a DIF file and patch it manually to confirm it works?

  • Did you "Apply patches to input file"? – sudhackar Jan 9 '18 at 6:14
  • @sudhackar IDA Free is only IDA 5.0, I dont have that option. – user22856 Jan 9 '18 at 7:13
  • Then you can manually patch the file using a hex editor. I don't know of other options in IDA free. – sudhackar Jan 9 '18 at 7:15
2

IDA Free doesn't support the "Apply patches to input file..." feature. Hence, you'll have to do this the old way. I'll expand my answer and will go over things you already know so others (e.g coming from search engines) can benefit from a whole complete answer.

Edit the configuration file

The first thing you have to do is to modify an IDA GUI configuration file named idagui.cfg. You should be able to find the file at "IDA Free\cfg\idagui.cfg". Locate the file and change "DISPLAY_PATCH_SUBMENU" form "NO" to "YES".

After that, start IDA Free and you'll see a fresh new sub-menu called "Patch program".

Patching

You should be able to use this sub-menu to edit the program. It's pretty intuitive, just put your cursor wherever you want to make a change, and choose the appropriate option from the sub-menu.

Notice that every patch you do is only affected on the IDB, the IDA Database. Thus, the binary on disk won't be affected and when you'll try to debug/execute it you will not see your patches.

Exporting a .DIF file

When you finish with all your patches, it's time to apply them to the binary on disk. To do this, you'll first have to produce a .DIF file that will contain a list of the changes you've made.

To produce this file go to File -> Produce File -> Create DIF file...".

Applying the changes to the binary

You can use this Python script by stalker to apply the changes. Use it like this:

$ idadif.py <original_binary> <IDA_DIF_file.dif> [revert]

Alternatives:
Note that I didn't test these alternatives and I'm pretty sure that some of them will not work with IDA Free

  • Yes I am well aware of this. Maybe I wasn't clear in my question. I want to run the patched binary to test it. Does IDA not run from the database? I don't want to export a dif without knowing it works. – user22856 Jan 9 '18 at 7:56
  • 1
    No it can't. Just backup the original file and then apply the patches to either of them using one of the methods above. – Megabeets Jan 9 '18 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy