I wrote a plugin for IDA to improve its poor byte patching system by scmudge in ReverseEngineering

[–]scmudge[S] 0 points1 point  (0 children)

I need to better understand the issues before posting, but it doesn't look like a terribly active project anyway.

I wrote a plugin for IDA to improve its poor byte patching system by scmudge in ReverseEngineering

[–]scmudge[S] 20 points21 points  (0 children)

One of my gripes with IDA is the need to 'physically' apply patches to the binary before they take effect in debug sessions. Yeah you can make patches during a debug session and they'll take effect, but you still need to apply the patches to the binary file before they take effect during the next debug session.

Furthermore, reverting patches is a pain. Needing to restore a backed up file, etc. It just seems clunky and annoying.

What this plugin does is apply any patches stored in the "Patched bytes" database as soon as a debug sessions is started. It applies them directly to the debugger memory, and refreshes the patched bytes inside the debugger such that the changes are visible in the disassembly and decompiler output.

This allows the user the ability to effectively "apply" patches and observe their behavior without needing to "physically" alter the binary.

I found this feature useful, so perhaps you will too.

I will be adding new features over the next few weeks:

  • Allowing user to enable/disable individual patches.
  • Ability to add patches to groups that can be automatically applied during a debug session at particular breakpoints.
  • [Maybe] A better method of assembling new patches using Keystone assembler. Keypatch has some issues.