0

I am given a large memory dump (several megabytes). I need to update idb's memory. What I do now is: PatchQword(addr, value) if value != Qword(addr) for every qword in memory dump. Unfortunately, every PatchQword takes way too long (around 3-4 PatchQwords per second).

SO the question is: is there a way to tell IDA to update large regions of memory at once?

2 Answers 2

0

If you don't care about the value of original bytes, you can use put_bytes().

1
  • Currently on 6.95, because some important plugins aren't updated yet.
    – mizari
    Feb 5, 2018 at 5:13
0

There's a function in idc called LoadFile. It successfully does what I need.

Edit: there's also patch_many_bytes, but it's very slow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.