1

I have a disassembly line showing:

lea rcx, Format

In which Format is a memory address named by IDA. The address is at 0x1400132E0 and points to a C-String "hello, my dear\n".

What I want to do is to patch the address of Format to 0x1400132E1 so that the string would become "ello, my dear\n". However, Edit->Patch Program->Assembly does not allow operand such as [0x1400132E1]. What can I do?

2 Answers 2

2

I have never used IDA free but the documentation I found is mostly pointed towards supporting only IBM PC

Currently, only the IBM PC processors provide an assembler, nonetheless, plugin writers can extend or totally replace the built-in assembler by writing their own.

So your option is only to assemble and patch bytes since IDA Free doesn't support plugins.

Example

.text:000000000000063A                      ; int __cdecl main(int argc, const char **argv, const char **envp)
.text:000000000000063A                      public main
.text:000000000000063A                      main proc near
.text:000000000000063A 55                   push    rbp
.text:000000000000063B 48 89 E5             mov     rbp, rsp
.text:000000000000063E 48 8D 3D 9F 00 00 00 lea     rdi, s          ; "hello, my dear"
.text:0000000000000645 E8 C6 FE FF FF       call    _puts           ; Call Procedure
.text:000000000000064A B8 00 00 00 00       mov     eax, 0
.text:000000000000064F 5D                   pop     rbp
.text:0000000000000650 C3                   retn                    ; Return Near from Procedure
.text:0000000000000650                      main endp

It shows that the actual instruction bytes are

48 8D 3D 9F 00 00 00

which translate to

48 8d 3d 9f 00 00 00     lea    rdi,  [rip+0x9f]

You can then select the instruction you want to edit and then go to Hex-View > Press F2 to edit bytes and change to

48 8d 3d a0 00 00 00     lea    rdi,  [rip+0xa0]

Press F2 again to apply changes to db which would take disassembly to

.text:000000000000063E 48 8D 3D A0 00 00 00 lea     rdi, s+1        ; "ello, my dear"

Then Edit>Patch Program> Apply patches to input file to push changes back to original file.

TLDR : Assemble using other tool and change bytes in IDA Free. I use rasm or pwntools asm for quick testing otherwise keystone

[/tmp] rasm2 -a x86 -b 64 "lea rdi, [rip+0xa0]"
488d3da0000000
[/tmp] asm -c amd64 "lea rdi, [rip+0xa0]"
488d3da0000000
1
  • Thanks! I think I need to learn how to translate opcode to assembly language, but this is a good start. Apr 17 at 11:05
2

Edit -> Patch Program -> Assembly is not the best choice because it does not work for all processors and all instructions. I agree with sudhackar, but you can also use Edit -> Patch Program -> Change byte... to change the relative address (in your case it will 4th byte).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.