5

I've recently been undertaking a little RE project where I needed to patch the executable. For small modifications, I know enough x86 to patch in an jump, nop, infinite loop, etc, so a hex editor is good enough. But what about larger ones?

I used to use OllyDbg for this, there were great tools in it, you could go to any line, press space and just start assembling, instructions you replaced would be padded with NOPs automatically and there were even nice plugins to find code caves.

Unfortunately, OllyDbg seems barely updated these days and fails to load any application on 64 bit Windows 8.1, so I've switched to Hiew. Hiew isn't bad, but the interface is well, more than a little dated and fairly cumbersome to use compared to Olly's.

I'm wondering if anyone knows any more modern tools that can perform this same sort of function.

Improve this question
4

If you have IDA pro, IDA patcher was released recently. While I haven't used it personally, it won one of the Hexrays plugin contests, and is probably pretty reasonable.

https://thesprawl.org/projects/ida-patcher/

There's also this simple python script which I have used in the past:

http://stalkr.net/files/ida/idadif.py

It's not modern, but it works.

Improve this answer
1
  • Looks like IDA has a built in edit -> patch program -> assemble feature these days and this just improves patch management. Thanks. This will do perfectly.
    – ultramancool
    Oct 12 '14 at 16:28
6

I regularly use radare2 for patching binaries. It works quite well, it's free (as in freedom), and scriptable.

Improve this answer
2
  • I had a quick look at radare2, but couldn't find much good information on using it for patching. Would you mind linking a good guide on it? Thanks.
    – ultramancool
    Oct 14 '14 at 13:49
  • In general the documentation on the radar.org site is quiet good. As to the specific question, here is the part on patching radare.org/doc/html/Section3.8.html#write
    – PhoeniX
    Oct 14 '14 at 22:10
3

There are a few really great options.

First, something that I frequently forget when doing patching is that LD_PRELOAD makes hooking/redirecting library routines very easy.

If you must patch instructions, the tools that I use on a regular basis are pwntools (a Python library) and Fentanyl (an IDAPython script).

For pwntools, the following would be an example of patching an instruction at file-address 0x1234, which we'll say is virtual-address 0x8001234. Note that this support is limited to ELF files, and does not work for PEs.

#!/usr/bin/env python
from pwn import *
file = ELF('/path/to/elf')
file.asm(0x8001234, 'nop') # Using virtual address
file.asm(file.offset_to_vaddr(0x1234), 'nop') # File offset
file.save('/path/to/output')

Using Fentanyl is GUI-driven, but it works pretty well and even nop-pads your instructions and fixes offsets.

Fentanyl demo

Improve this answer
1

Use x64dbg. It works perfectly with x86 and x64 on modern windows and you can patch and save like in Olly. Overall the interface is very similar looking to olly

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.