Assemble function of IDA Pro not working properly

Ask Question

Asked 5 years ago

Modified 5 years ago

Viewed 2k times

I am using the Patch Program option of IDA Pro to edit the assembly of a binary at runtime.

When I enter the following instruction:

mov rax, [rsp + 0x48]

I get an "Invalid operand" error from IDA Pro. I tried changing the above instruction to different variants as shown below:

mov rax, [rsp + 48h]
mov rax, [rsp + 48]

However, it still gives me an error.

This is a valid assembly instruction. I can edit the assembly in other softwares like x64_dbg and it works with the above disassembly.

asked Dec 1, 2018 at 15:36

Neon Flash

7651 gold badge13 silver badges28 bronze badges

According to stackoverflow.com/questions/24294095/… The support is very little. Try github.com/keystone-engine/keypatch/blob/master/TUTORIAL.md
– sudhackar
Dec 1, 2018 at 19:50
Okay, I will try using the KeyStone engine. It's surprising that they do not plan to enhance the Assembler feature in IDA Pro even though they provide it as a feature.
– Neon Flash
Dec 5, 2018 at 21:38
The other workaround is of course to use another debugger like Olly Debugger or x64_dbg, get the opcodes and then use the Patch Program feature of IDA Pro.
– Neon Flash
Dec 5, 2018 at 21:39

Add a comment |

0 Your Answer

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.