Adding new code with Ida

Question

When I used CheatEngine (I know, I know...) it had this option that let you create code caves, meaning you could replace any instruction with a JMP to a new section, which contained the old instruction followed by your new code, and then JMP'd back to original place.

I'd like to do the same with Ida, in a way that lets me save my changes to executable. Is this possible?

_{I tried adding new section manually in the segments window, but saving the executable with "apply changes to input file" doesn't change anything, nor does saving a "DIF" file.}

Answer 1

As ExtremeCoders said, IDA is basically used as an analysis tool, and there are many other tools to do so like OllyDBG or x64_dbg ... still, it's not that limited.

I haven't tried to do so, but try to get the cave code address using PEiD (or any other PE tool that'll do), then use Fentanyl plugin to make changes and IDAPatcher plugin to save them easily.

Answer 2

I've done something like this with an ARM android application recently; however, IDA doesn't assemble ARM, and translating ARM code to binary manually isn't a fun task. I found the address of a suitable code cave in IDA first, wrote an assembly file beginning with .org code_cave_address (and another .org and a branch instruction at where i wanted to jump to my code cave) , used the arm version of gnu as to assemble it, then used objdump to find the assembled code, and finally used IDAPatcher to copy the hex code into my IDA database and patch the original shared library.

Not the most straightforward way, but something that will work with every kind of processor, even if IDA doesn't support assembling for it.