Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

IDA pro asm instructions change

I just want to know how I can change asm instructions in the IDA-view A:

  1. How to edit instructions(for instance: jnz to jmp)?
  2. How to insert new instructions(call func1, call func2 inserted to existing code)?

I know how to make dif files, I know how to apply the changes on my DLL, but how can I "make the difference"? How can I edit the code in IDA?

I learned how to modify a DLL:

  1. Modify code(how?)
  2. Generate dif file.
  3. Apply the code modifications to the DLL with the dif file and a script.
like image 345
asm Avatar asked Jun 13 '11 07:06

asm


People also ask

How do I edit a function in IDA Pro?

In order to change only the function end address, you can use FunctionEnd command. If the current address does not belong to any function, IDA beeps. This command allows you to change the function frame parameters too. You can change sizes of some parts of frame structure.

Is IDA Pro good?

IDA Pro is a very good disassembler that should be used in every reverse engineering scenario. We've seen the basic windows that IDA Pro uses and introduced them on the reverse Meterpreter executable.

How does IDA Pro work?

IDA Pro is primarily a multi-platform, multi-processor dis-assembler that translates machine executable code into assembly language source code for purpose of debugging and reverse engineering. It can be used as a local or as a remote debugger on various platforms.


3 Answers

  1. There is a Edit / Patch menu that used to be shown by default but that is hidden in recent IDA releases. If it is your case, edit the cfg/idagui.cfg file, look for the DISPLAY_PATCH_SUBMENU = NO line and change the setting. On the next IDA session, you will be able to change single byte / word values or assemble some code like in OllyDbg.
  2. Once you have patched your database, go to File / Produce file / Create DIF file, it will let you create a simple diff file in the form offset / value before / value after (it is not the common diff file format)
  3. To apply the diff file to an existing file, you can use the source code of a dif file patcher that was released in the IDA Pro Book
like image 156
Seki Avatar answered Oct 20 '22 13:10

Seki


Use Edit->patch program->assemble to write in assembly syntax

Use Edit->patch program -> patch bytes to edit bytes in the binary

Finally, use Edit->patch program -> apply patch to input file to apply patches. I'v personally used it in IDA 7.0

like image 38
789 Avatar answered Oct 20 '22 14:10

789


Try IDA Pro 6.1 or 6.2. It has the ability to write the changes to the input file directly.

like image 2
Elias Bachaalany Avatar answered Oct 20 '22 13:10

Elias Bachaalany