21

i would like to know how to edit a binary file in ida pro (i just need to change one instruction!)

(its ARM binary)

thanks

lol
  • 3,910
  • 2
  • 37
  • 40

6 Answers6

22

Possibly edit:

idagui.cfg: DISPLAY_PATCH_SUBMENU = YES

If the menu is not enabled, then use

Edit/Patch code/Change Byte

lundman
  • 1,616
  • 13
  • 25
12

  1. select the instruction you need to change in "IDA View" subview. enter image description here

  2. switch to "Hex View" subview. You will see several highlighting hex numbers. enter image description here

  3. press "F2", edit it, when you finish, press "F2" again. enter image description here

  4. That's all. you will see your change in other subviews. enter image description here

VictorV
  • 637
  • 7
  • 16
  • In the nearly decade since I asked this question, the answer appears to have changed! Would it therefore be possible to quote the current working version number of IDA Pro this relates to in your answer? Thanks! – lol Dec 11 '18 at 13:32
  • In my experience, IDA 6.6 works fine. And so does following products. I met this problem,too. I hope it can help others if they see this problem. – VictorV Dec 13 '18 at 02:14
9

IDA 6.2 has the "Edit" -> "Patch program" menu enabled out of the box. No need to modify idagui.cfg. There is also an "Apply patches to input file" option that that will modify the target file.

bcleary
  • 1,268
  • 10
  • 17
8

I think IDA used to have a feature to do that, but it's not present in the current versions.

You should just use a hex editor. Note the file offset in IDA and edit the file at that address. If you'd like to see the changes in IDA, use the "File" -> "Load file" -> "Reload the input file" menu item.

Vladimir Panteleev
  • 24,651
  • 6
  • 70
  • 114
5

Here is how i did

Edit > Patch Program > Assemble

After Assembling/patching instruction click on Apply Patches to Binary

done :)

assemble

Soleil
  • 6,404
  • 5
  • 41
  • 61
whiteheart
  • 79
  • 1
  • 6
  • I did something similar. Since this is a lot easier than the older answers, is this a new approach in newer versions? I am using IDA Free 7.6. – Paul May 11 '21 at 19:27
  • Unless I'm doing something wrong (???), this doesn't seem to always work. Sometimes, I Assemble an instruction, it changes in IDA and I see it on the Hex View, but when I try to Apply the patch, on HxD I don't see the change (if I modify directly in Hex View as VictorV says though, it works). I've just patched a 2-byte instruction to 2 NOPs and it worked. Patched the NOPs to RET and it worked. Patched the RETs to NOPs again, and only one worked. The other byte remained C3 instead of 90 (x86). [IDA Pro 7.6 SP1 here.] Might stick to the Hex View way until they fix this. – Edw590 Jan 29 '22 at 20:42
1

First do as Lundman suggested, then choose File / Produce / DIF file.

Then apply the diff file using an external tool

Elias Bachaalany
  • 1,180
  • 2
  • 13
  • 27