Need Help Figuring out Multi-byte (in-memory) byte replacement using ida script (idc)

Question

"I am trying to create a simple IDC script for IDA 7.7, which takes a known memory address (in the format 0x00000000), a string of replacement bytes (either in the format ffffffff or ff ff ff ff, it doesn't matter; whatever is easiest), and a size of bytes to replace (which should match the replacement byte buffer).

I was under the impression that it would be a simple for loop that starts at the given memory address and replaces each byte individually until it reaches the size of the 'buffer size' variable using the patchbyte function.

Turns out, that didn't work. My next attempt was to get ChatGPT to do it because, why not? That was a little bit more fruitful, but instead of replacing the bytes I asked it to change to, it replaced the bytes with 00, and then the script wouldn't work after the first try.

This is what I have from ChatGPT:

`static main()
{
    auto ea = 0x00400000;
    auto buffer = "ffffffff";
    auto buffer_size = 4;

    // Check if the specified memory address is valid
    if (ea == BADADDR)
    {
        Message("Invalid memory address!");
        return;
    }

    // Check if the buffer size is valid
    if (buffer_size <= 0)
    {
        Message("Invalid buffer size!");
        return;
    }

    // Check if the buffer is valid hexadecimal format
    auto len = strlen(buffer);
    if (len % 2 != 0)
    {
        Message("Invalid buffer format!");
        return;
    }

    auto i = 0;
    for (i = 0; i < buffer_size; i++)
    {
        auto value = buffer;
        PatchByte(ea + i, value);
    }

    Message("Successfully patched the memory address!");
}`

The goal is to replace a large encryption key with one of my own, just for testing, which is why I want to patch the memory instead of the database or binary itself. But I also feel that a script or function like this may become useful for others aswell.

Is this something I can only do by creating a plugin? (Please don't say that, I have never been able to successfully compile an IDA plugin..)

Any help would be appreciated. Thanks!"

p.s. i am aware the buffersize check only checks for a number over 0

Answer 1

You can do this with IDC or IDAPython without compiling a C++ plugin, but there are a number of problems with your code snippet. For example, value is not an integer, and is computed the same way for every loop iteration. I wouldn't recommend just copying and pasting code from ChatGPT; you should try actually writing it yourself, according to the documentation for IDC or IDAPython.

Here's a one-liner to do it in IDAPython:

for idx,byte in enumerate([0xFF,0xFE,0xFD,0xFC,0xFB]): ida_bytes.put_byte(0x180004F76+idx,byte)

Replace 0x180004F76 with the address you want to write to, and [0xFF,0xFE,0xFD,0xFC,0xFB] with the bytes you want to write there.