0

Using IDA Pro, I tried to patch int 2Dh to nop. However, with the debugger, it seems that the original code is being loaded. What may be the reason for that? This might be related for some protections? I'm new to RE and to IDA. I did not yet analyze deeply the routines before the int 2Dh anti-debug technique.

The view during static analysis is:

enter image description here

The view during debug is:

enter image description here

As you may notice, the original int 2Dh command has been reverted.

1
  • 1
    Have you tried saving the patched executable and then run/debug it?
    – Robert
    Jul 23 at 2:04
1

When in ida you use patch byte, patch word, or assemble, the patch is NOT applied to the base executable. You just have to go to Edit-> Patch program -> Apply patches to input file. Then your input file is modified now.

2
  • Thanks. I wonder why sometimes I don't have to do this in other programs. Sometimes I just use patch word and the debugger debugs what I've patched. Jul 30 at 14:57
  • Also you have a patched byte window, that show you all applied patches, just in case you didn't know ! Jul 31 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.