IDA Pro, replace exit() with continue;

Question

This is the function:

loc_BA060:              ; status
xor     edi, edi
call    _exit

How can one replace exit with continue?

Answer 1

As stated in the comments by others, this depends what you mean exactly by "continue". I see this having 2 possible meanings:

1. You want to return to where the function was called from. You may be able to do this by patching that instruction with a ret or jmp, making sure things line up.
2. You want the program to execute the next instruction immediately following the call exit. In this case, you want that instruction to have no effect, so "no-operation". Thus, nop.

Answer 2

If this is the entire function, it seems you would want to nullify it. Make it just not call exit().

You could do that by simply replacing the call _exit instruction with multiple nop opcodes. In IDA, you'll need to use the patch program feature Under the edit-> patch bytes sub-menu (Notice that in older versions of IDA you had to manually turn it on before it was available, this is no longer the case, though).

You could either nop the call instruction, the entire function (both call and xor) or even completely remove the call loc_BA060 that leads to the function at 0xBA060.

your mileage may vary, however, depending on the surrounding code. It may be the case the prior to the call (and the following exit()), eax contained a meaningful value that is used further down the code execution line. If that's the case and you leave the xor eax, eax instruction intact, you'll only avoid the exit() to hit a crash. It's therefore important to review the code surrounding the instruction you wish to remove.

Additionally, in this specific case, exit() is a no-return-function. This means the compiler is not required to make sure code following the exit() call will function properly because it is never expected to execute and _exit is not expected to return. You may wish to make sure you modify the code in a way that handles that well, although that behavior depends on the compiler and optimizations used.