11

I'm trying to change an instruction in an executable that's loaded in IDA Pro v6.1

For example:

lis       r11, ((qword_90E1B2D8+0x10000)@h)

to

lis       r10, unk_90E163D0@h

Any help is appreciated, thank you very much.

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
user4128
  • 111
  • 1
  • 1
  • 3
  • 1
    Hmm, last time I tried to do this, I had to use IDC (PatchByte(ea, value)) to patch the database in memory, then Unassemble and Assemble again. If you have a bigger instructions, then you are kinda stuck and will need to use other methods (code cave, etc...) – fileoffset Mar 11 '14 at 05:19
  • 1
    If the Edit - Patch menu works in your architecture, you can just use its Assemble command to write the instruction you want, see the bytes it produces (Options - General - Show opcode bytes), and then hex-edit them into the executable. – DCoder Mar 11 '14 at 05:25

1 Answers1

8

If you goal is to push the changes back to the original binary, then for IDA 6.1, your best bet is to use a combination of the Edit/Patch Program menu and the editing capabilities of the Hex View window to make the changes that you want. If you are looking at PPC code, unfortunately the PPC processor module does not support the Assemble... command on the Patch Program menu. Once you have made the changes that you want, use the File/Produce file/Create DIF file menu item to save an IDA style dif file. There is a utility here: http://idabook.com/examples/chapter_14/ida_patcher.c that may be used to apply your dif against the original binary to patch it.

Chris Eagle
  • 638
  • 4
  • 4
  • Would there be a more simplistic method if I just wanted to make a change like this:

    lis r11, ((qword_90E1B2D8+0x10000)@h) to lis r11, unk_90E163D0@h

     – user4128 Mar 11 '14 at 21:57
  • 2
    Can you please clarify whether your intent is to push the patch down into the original binary or whether you just want to patch the IDA database as sort of a "what if" exercise? If the former, the easiest way is to upgrade to IDA 6.2 or later which includes a "Edit/Patch/Apply patches to input file" menu option that pushes all the changes into the original binary without the need to generate a dif file. If the latter, the easiest thing is the simply use the hex view to edit the database. In either case, IDA's PPC module is not going to do the assembly for you. – Chris Eagle Mar 12 '14 at 00:36