2

I'm in the process of "enhancing" an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all these patches to the loaded shared library, continue the app, and debug my changes; then detach from the app and undo the changes again.

Can IDA do this, or is there a plugin to do this?

I know i can write back all my changes to the .so file and restart the app, but i don't want to do this at the moment (for various reasons, one being i suspect the app does a checksum on the library when it's first loaded in memory.

I also know i can patch single bytes interactively in memory while the debugger is attached, but my changes are a bit too extensive to want me enter them over and over again with each debug session.

Improve this question

2 Answers 2

Reset to default
2

Ida patcher might help you with some of this.

https://thesprawl.org/projects/ida-patcher/

Improve this answer
1
  • Thank you for your answer. Unfortunately, it doesn't help much - it makes the process of getting bytes into IDA easier (so if i assemble something outside ida, i can copy the object code instead of typing it), but it doesn't do anything with the debugged target.
    – Guntram Blohm
    Commented Mar 23, 2015 at 22:59
1

The point of the debugger is to show what actually is in memory and not what happens to be present in the database. That said, I imagine you can come up with some script based on visit_patched_bytes(), get_original_byte() and get_db_byte().

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.