Palish
April 18th, 2006, 16:13
Hey all, I'm new to the forums. The search feature didn't turn out anything useful for this particular question, so I thought I'd ask...
In IDA Pro 4.xx (I forget the exact version I have, I'm at work right now, will check when I get home) is there a way to actually alter the hex of the program being disassembled inside of IDA? The steps I use to test a patch right now seem horribly inefficient:
1) Run IDA pro, disassemble a file. Locate an instruction I want to patch to a different instruction.
2) Open up the hex view panel, gather a large sample of hex values to do a search with. These sample hex values are just before the instruction I want to patch.
3) Copy these hex values of the instructions into WinHex, or some other hex editor, and find it.
4) Patch the instruction to a different instruction in this hex editor.
5) Save, test patch.
Now, this is okay, but the real pain is after I save the patch to the exe. IDA pro doesn't detect that I changed the exe, so I have to open up another instance of IDA pro and disassemble AGAIN, so that it reflects the change. Ideally, it would automatically detect that I altered the exe and update the assembly instructions realtime to show me what the assembly looks like of what I just did, without re-disassembling the whole exe.
So my question really is two things:
1) Is there a way to alter the hex of an exe directly in IDA Pro 4.xx?
Or
2) Is there a way for IDA pro to detect changes to the exe and reflect the changes without having to re-disassemble the whole exe?
Thanks,
Shawn
In IDA Pro 4.xx (I forget the exact version I have, I'm at work right now, will check when I get home) is there a way to actually alter the hex of the program being disassembled inside of IDA? The steps I use to test a patch right now seem horribly inefficient:
1) Run IDA pro, disassemble a file. Locate an instruction I want to patch to a different instruction.
2) Open up the hex view panel, gather a large sample of hex values to do a search with. These sample hex values are just before the instruction I want to patch.
3) Copy these hex values of the instructions into WinHex, or some other hex editor, and find it.
4) Patch the instruction to a different instruction in this hex editor.
5) Save, test patch.
Now, this is okay, but the real pain is after I save the patch to the exe. IDA pro doesn't detect that I changed the exe, so I have to open up another instance of IDA pro and disassemble AGAIN, so that it reflects the change. Ideally, it would automatically detect that I altered the exe and update the assembly instructions realtime to show me what the assembly looks like of what I just did, without re-disassembling the whole exe.
So my question really is two things:
1) Is there a way to alter the hex of an exe directly in IDA Pro 4.xx?
Or
2) Is there a way for IDA pro to detect changes to the exe and reflect the changes without having to re-disassemble the whole exe?
Thanks,
Shawn