4

Do disassemblers like IDA or Ghidra change write rules on code segment of a process to change instructions? For example one can place NOP instead of a function call, so it should have RWX instead only RX bits

2 Answers 2

2

IDA and Ghidra create their own database files to store information about the binary (.idb and .gbf respectively). While binary editing is possible, it does not affect the binary's or its database's segment permissions.

For example, to check segment permissions in a PE executable with IDA, go to the beginning of a section in assembly text view: IDA Pro's segment metadata

2

I think you are mistaking analysis of a binary file with the file itself.

Sections can have permissions once in memory (because it will be mapped to physical pages that can have specific RWX permissions), but as long as your file is a file on disk, you should be able to edit its content the same way you edit a text file : get a file descriptor by opening the file with your OS API, read/writing it, close the file descriptor.

As stated by previous answer from mimak, IDA got its own database, and editing anything within IDA will only update the database, unless you explicitly ask IDA to write changes to the file (which you can do with File->Patches->apply patches to input file) ; in which case IDA will probably open your file on disk, read/write it, and close it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.