1

Using IDA Pro, I tried to patch int 2Dh to nop. However, with the debugger, it seems that the original code is being loaded. What may be the reason for that? This might be related for some protections? I'm new to RE and to IDA. I did not yet analyze deeply the routines before the int 2Dh anti-debug technique.

The view during static analysis is:

enter image description here

The view during debug is:

enter image description here

As you may notice, the original int 2Dh command has been reverted.

Improve this question
1
  • 1
    Have you tried saving the patched executable and then run/debug it?
    – Robert
    Commented Jul 23, 2021 at 2:04

1 Answer 1

Reset to default
1

When in ida you use patch byte, patch word, or assemble, the patch is NOT applied to the base executable. You just have to go to Edit-> Patch program -> Apply patches to input file. Then your input file is modified now.

Improve this answer
2
  • Thanks. I wonder why sometimes I don't have to do this in other programs. Sometimes I just use patch word and the debugger debugs what I've patched.
    – DifferentPulses
    Commented Jul 30, 2021 at 14:57
  • Also you have a patched byte window, that show you all applied patches, just in case you didn't know !
    – Chaotikmind
    Commented Jul 31, 2021 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.