While I'm doing a patching using IDA, I accidentally patch wrong bites and I can't remember what bytes were there before. Is there a way to undo it..?

up vote 6 down vote accepted

There is a window to see all patched bytes, along with their unpatched versions: in the menu, use View / Open Subviews / Patched Bytes, or press STRG-ALT-P.

This is for IDA 6.8 (newest version), i don't know if older versions have the same thing.

However, i recommend you to install the ida patcher plugin, which improves working with patches greatly; for example, you can copy/paste a patch from somewhere else; you can fill a region with identical bytes, and there is a window that's similar to the standard patcher window, but lets you assign comments to patches, and revert them with a single click to the context menu.

  • I'm using a older version. So I think I can't undo it. I will try ida patcher plugin. Thanks for your help.. – Ramesh-X Aug 1 '15 at 1:35

Go to View / Open Subviews / Patched Bytes, where patches are. Right click on a line and click "Revert" . This works in Ida 6.8

I don't know how you could unpatch them, since I think there is no way to do that(I'm talking about IDA 6.5, which I use). But I would recommend you for future to use Database Snapshots in IDA. It's very convenient - you can save the state of all your bytes, function names, comments and so on. If something went wrong you can just restore a snapshot in snapshot manager. You can find the it in View --> Database Snapshot Manager in IDA Pro 6.5

  • Database Snapshot will be a good idea. Thank you for your help.. – Ramesh-X Aug 1 '15 at 1:34

An alternative solution, for older IDA versions:
Use File>Produce file>Create DIF file... to dump all the changes.
File format is Offset: Old New for every patched byte in file.
Find the bytes you want to change back, and do it manually.
Just remember that offsets are from file start, they are not memory addresses.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.