11

I'm trying to change an instruction in an executable that's loaded in IDA Pro v6.1

For example:

lis       r11, ((qword_90E1B2D8+0x10000)@h)

to

lis       r10, unk_90E163D0@h

Any help is appreciated, thank you very much.

Improve this question
2
  • 1
    Hmm, last time I tried to do this, I had to use IDC (PatchByte(ea, value)) to patch the database in memory, then Unassemble and Assemble again. If you have a bigger instructions, then you are kinda stuck and will need to use other methods (code cave, etc...)
    – fileoffset
    Mar 11, 2014 at 5:19
  • 1
    If the Edit - Patch menu works in your architecture, you can just use its Assemble command to write the instruction you want, see the bytes it produces (Options - General - Show opcode bytes), and then hex-edit them into the executable.
    – DCoder
    Mar 11, 2014 at 5:25

1 Answer 1

Reset to default
8

If you goal is to push the changes back to the original binary, then for IDA 6.1, your best bet is to use a combination of the Edit/Patch Program menu and the editing capabilities of the Hex View window to make the changes that you want. If you are looking at PPC code, unfortunately the PPC processor module does not support the Assemble... command on the Patch Program menu. Once you have made the changes that you want, use the File/Produce file/Create DIF file menu item to save an IDA style dif file. There is a utility here: http://idabook.com/examples/chapter_14/ida_patcher.c that may be used to apply your dif against the original binary to patch it.

Improve this answer
2
  • Would there be a more simplistic method if I just wanted to make a change like this: lis r11, ((qword_90E1B2D8+0x10000)@h) to lis r11, unk_90E163D0@h
    – user4128
    Mar 11, 2014 at 21:57
  • 2
    Can you please clarify whether your intent is to push the patch down into the original binary or whether you just want to patch the IDA database as sort of a "what if" exercise? If the former, the easiest way is to upgrade to IDA 6.2 or later which includes a "Edit/Patch/Apply patches to input file" menu option that pushes all the changes into the original binary without the need to generate a dif file. If the latter, the easiest thing is the simply use the hex view to edit the database. In either case, IDA's PPC module is not going to do the assembly for you.
    – Chris Eagle
    Mar 12, 2014 at 0:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.