2

Using IDA PRO, after making a few patched, can I run the patched program in the debugger? What I have been doing so far is: 1. Edit > Patch Program > Apply patch to input file… 2. Save in a specific location 3. Move to windows location under /programs instead of the original file 4. Reload the patched file in IDA

This overwrites the original file. Mostly I need to put it in another location since the original may be under windows folder. In addition if forces my to reopen IDA and load the patched file and since this is a new file I lose all my work.

Is there a way, like in Oly, to simple run the patched file?

Improve this question

3 Answers 3

Reset to default
1

To debug a patched program in Ida, a simple way (for me!) is to patch it not in Ida, but in another hex editor. If you leave it its name, you will not lose your work in Ida.

In this way, you can leave Ida running and continue with the patched file, after applying "File, Load File, Reload the Input File". Your patches will show up.

Of course, you always should have saved your original file.

Improve this answer
3
  • Can't i do the same in IDA? I mean patch it in IDA and load it? What I am trying to achieve is to load my patched file with all my comments and edits
    – dandan
    Aug 22, 2018 at 5:18
  • Probably yes. In earlier versions of Ida (V5), there only existed "The Infamous Patch Program Menu" (the quote denotes a chapter in Chris Eagle's famous book, Ed. 2008, about that Ida version). Therefore I got used to patch not in Ida. However, the patching is independent of not losing your work in Ida.
    – josh
    Aug 22, 2018 at 10:17
  • You can patch in IDA 7
    – dandan
    Aug 23, 2018 at 6:00
1

You can not create a copy of your input file from within IDA. But if you copy it to a different location, you can point IDA to patch it there by changing the input file path in the patch program window (I verified that in IDA Free 7.0). Afterwards, you change the "Application path" and input file in the Process Options dialog inside the debugger menu to run the patched version. (I verified the presence of these settings in IDA Pro 5.6, I don't have a later commercial version at hand).

Improve this answer
0

The simplest solution is to use DebugAutoPatch plugin. To install, download DebugAutoPatch.py file to IDA plugins directory. Its features:

  • No need to modify any binary files to apply patches!

  • Automatically synchronizes the existing "Patched bytes" database in IDA with any launched debug sessions.

  • All patches stored in the "Patched bytes" database are applied to the debug session memory at "process start", before the main entry point.

  • Debug hooks automatically suspend process, apply patches, and resume process. The process is seamless and automatic to the user.

  • No extra breakpoints are added and no existing breakpoints are modified. The ability to disable automatic patching (and thus revert the binary to it's "original" state).

  • These options are available in the existing "Edit > Patch program" menu.

Improve this answer
2
  • It does not work for IDA 7.5
    – dandan
    Dec 27, 2020 at 8:40
  • It does not work in 7.2 either. Even latest "devel" branch. As far as I can tell, latest supported version of IDA is 7.0. In the script DebugAutoPatch.py there is a note "This has been tested with IDA 7.0 - I have made attempts at backward/forward compatibility, but please report bugs for other versions". Lack of support for 7.2 and 7.5 was already reported few days ago in github issues, so hopefully eventually either author updates it or somebody will create a pull request to add support for newer IDA versions.
    – Lissanro Rayen
    Dec 28, 2020 at 9:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.