1

I am trying to replace a jmp instruction with a ret in c++. How can I do that? enter image description here

Improve this question
1
  • If you have the source code then you can change that instruction to a return directly. If you have only the binary, then you'll need a hex editor, search for the instruction sequence, and change it there. However, the snippet is insufficient to know what kind of return is needed here. You might have more luck by changing the jump target to the functions true epilogue, so that the stack is cleared correctly.
    – peter ferrie
    Commented Jun 6, 2022 at 19:06

1 Answer 1

Reset to default
1

It seems you are looking for one of the menu items underneath Patch program from the Edit item (on the main menu).

Patch program menu item in IDA

Personally before I start patching around I enable the "Number of opcode bytes" option and give it a generous value of 7 or so:

IDA Options dialog

In your case you seem already to be set on a specific course of action and have made up your mind about which opcode to patch to what, so you can go right ahead and patch the EB ?? to C3 90, I reckon. The Change byte option could be exactly what you're looking for, but you need to know the hex representation of your opcodes to find the old one and replace it by the same number of bytes. Also, this seems to be limited to 16 bytes at a time, if I remember correctly.

Alternatively pick the Assemble... option and enter ret. Any trailing bytes (your jmp should be at least two bytes) will simply appear as non-code.

One point that may matter: this only applies to the IDB itself, not to the binary from which it got loaded. Use the last option in the popup menu for that.

Improve this answer
4
  • not in IDA. I know how to do it in IDA. I'm asking how can I do it in a c++ dll.
    – Mlemix
    Commented Jun 2, 2022 at 19:44
  • @Mlemix That's not even a reverse engineering question then.
    – 0xC0000022L ♦
    Commented Jun 2, 2022 at 19:48
  • do I ask that on regular stack overflow then? It kind of is a reverse engineering question, not sure.
    – Mlemix
    Commented Jun 2, 2022 at 20:03
  • @Mlemix Hmm, how to implement something in C++ would definitely be for StackOverflow, yes. Regarding the part where you take something like the ret mnemonic and try to get to C3, I think you want something like xed. Probably other libraries exist. But that part would also be "forward" engineering, as in assembling to the binary form. Also see recommendations in this Q&A.
    – 0xC0000022L ♦
    Commented Jun 2, 2022 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.