2

What is the easiest way (or is there any) to modify an instruction inside a binary opened inside IDA and save the changes to the original? Is there a builtin assembler who's output I can place at a certain offset? How can I save back a binary after having edited the hex view?

1 Answer 1

4

This is quite easy with IDA Pro:

With the cursor at the first instruction you want to modify go to Edit | Patch Program | Assemble

IDA Pro | Edit | Patch Program | Assemble

Change the instruction(s) as required until you are done, then press OK IDA Pro | Assemble Instruction

Finally choose Edit | Patch Program | Apply patches to input file (and optionally make a backup).

Here is an example: https://www.remkoweijnen.nl/blog/2013/05/23/application-compatibility-fixing-to-the-extreme/

From the Help:

Edit|Patch core submenu This submenu allows you to patch the image of the input file. More precisely, IDA never modifies the input file. The image of the input file which was loaded to the database will be modified. You can modify the image of the input file:

    - change a byte
    - change a word
    - enter an assembler instruction (only for IBM PC)

IDA will display the original value, the current value and file offset. If the file offset is equal to 0xFFFFFFFF then the current byte comes from a compressed page (LX/LE/NE iterated pages, for example) and/or it is not possible to tell the file position. You can create a difference file and use an external tool to apply the patches or you can apply the patches directly to the file using IDA.

The following commands are availabe:

Patch byte or word Assemble... Apply patches to input file...

See also: Produce EXE file Produce DIF file Edit submenu.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.