patching: Interactive Binary Patching Plugin for IDA Pro

by do son · March 4, 2022

Patching – Interactive Binary Patching for IDA Pro

Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to create a more robust interactive binary patching workflow designed for rapid iteration.

This project is currently powered by a minor fork of the ubiquitous Keystone Engine, supporting x86/x64 and Arm/Arm64 patching with plans to enable the remaining Keystone architectures in a future release.

Usage

The patching plugin will automatically load for supported architectures (x86/x64/Arm/Arm64) and inject relevant patching actions into the right-click context menu of the IDA disassembly views:

A complete listing of the contextual patching actions is described in the following sections.

Assemble

The main patching dialog can be launched via the Assemble action in the right-click context menu. It simulates a basic IDA disassembly view that can be used to edit one or several instructions in rapid succession.

The assembly line is an editable field that can be used to modify instructions in real-time. Pressing enter will commit (patch) the entered instruction into the database.

Your current location (a.k.a your cursor) will always be highlighted in green. Instructions that will be clobbered as a result of your patch/edit will be highlighted in red prior to committing the patch.

Finally, the UP and DOWN arrow keys can be used while still focused on the editable assembly text field to quickly move the cursor up and down the disassembly view without using the mouse.

NOP

The most common patching action is to NOP out one or more instructions. For this reason, the NOP action will always be visible in the right-click menu for quick access.

Individual instructions can be NOP’ed, as well as a selected range of instructions.

Force Conditional Jump

Forcing a conditional jump to always execute a ‘good’ path is another common patching action. The plugin will only show this action when right-clicking a conditional jump instruction.

If you never want a conditional jump to be taken, you can just NOP it instead!

Save & Quick Apply

Patches can be saved (applied) to a selected executable via the patching submenu at any time. The quick-apply action makes it even faster to save subsequent patches using the same settings.

The plugin will also make an active effort to retain a backup (.bak) of the original executable which it uses to ‘cleanly’ apply the current set of database patches during each save.

Revert Patch

Finally, if you are ever unhappy with a patch you can simply right-click patched (yellow) blocks of instructions to revert them to their original value.

While it is ‘easy’ to revert bytes back to their original value, it can be ‘hard’ to restore analysis to its previous state. Reverting a patch may occasionally require additional human fixups.