Are there any modern assembly-level patching tools?

Question

I've recently been undertaking a little RE project where I needed to patch the executable. For small modifications, I know enough x86 to patch in an jump, nop, infinite loop, etc, so a hex editor is good enough. But what about larger ones?

I used to use OllyDbg for this, there were great tools in it, you could go to any line, press space and just start assembling, instructions you replaced would be padded with NOPs automatically and there were even nice plugins to find code caves.

Unfortunately, OllyDbg seems barely updated these days and fails to load any application on 64 bit Windows 8.1, so I've switched to Hiew. Hiew isn't bad, but the interface is well, more than a little dated and fairly cumbersome to use compared to Olly's.

I'm wondering if anyone knows any more modern tools that can perform this same sort of function.

Answer 1

If you have IDA pro, IDA patcher was released recently. While I haven't used it personally, it won one of the Hexrays plugin contests, and is probably pretty reasonable.

https://thesprawl.org/projects/ida-patcher/

There's also this simple python script which I have used in the past:

http://stalkr.net/files/ida/idadif.py

It's not modern, but it works.

Answer 2

I regularly use radare2 for patching binaries. It works quite well, it's free (as in freedom), and scriptable.

Answer 3

There are a few really great options.

First, something that I frequently forget when doing patching is that LD_PRELOAD makes hooking/redirecting library routines very easy.

If you must patch instructions, the tools that I use on a regular basis are pwntools (a Python library) and Fentanyl (an IDAPython script).

For pwntools, the following would be an example of patching an instruction at file-address 0x1234, which we'll say is virtual-address 0x8001234. Note that this support is limited to ELF files, and does not work for PEs.

#!/usr/bin/env python
from pwn import *
file = ELF('/path/to/elf')
file.asm(0x8001234, 'nop') # Using virtual address
file.asm(file.offset_to_vaddr(0x1234), 'nop') # File offset
file.save('/path/to/output')

Using Fentanyl is GUI-driven, but it works pretty well and even nop-pads your instructions and fixes offsets.

Answer 4

Use x64dbg. It works perfectly with x86 and x64 on modern windows and you can patch and save like in Olly. Overall the interface is very similar looking to olly