📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Patch an operand value

Topic created on: November 1, 2011 08:33 CDT by pdrimel .

Hi,

I saved memory block 3a0000 and loaded into IDA, function calls looks okay however access to data segment is not working properly, for example:

mov     eax, ds:3ED87Dh

I want to make it:
mov     eax, ds:4D87Dh ; (3ed87d - 3a0000)

I found how to grab operand 1 value:
ea = get_screen_ea()
opvalue = GetOperandValue(ea,1)

However, I haven't found a way to patch only the operand value, using PatchDword does not work since I would need to find exactly the byte where second operand value starts.

Any idea/hint is appreciated.

Thanks in advance.

Pedro.

  prot0man   March 5, 2012 19:29.23 CST
I looked through ida.py for any functions that might help, but the closest thing I saw was ItemSize(ea), which will get the size of the instruction. This is going to sound really hackish, but what you might have to do is first look at the mneumonic and then look at the size of the instruction and infer the sizes of the operands (which will probably require a bit of reading the instruction manual a bit). Surely there's some lower level function that will allow you to access the ea of each operand, but I don't have IDA on this computer, so this is the best help I can provide for now.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit