关于ida pro的牛逼插件keypatch

关于ida pro的牛逼插件keypatch

通常ida在修改二进制文件，自带的edit->patch program->assemble 可以修改x86, x64 但是不能修改arm, arm64，移动端逆向该怎么办？

之前arm下可以使用ida-patcher http://thesprawl.org/projects/ida-patcher/ 这个插件，但是必须知道arm指令对应的机器码，使用还是有点麻烦.
如图：

ida-patcher 菜单:

ida-patcher patch:

edit selection:

今天介绍的这个神器插件keypatch
Keypatch is confirmed to work on IDA Pro version 6.4, 6.6, 6.8, 6.9, 6.95

https://github.com/keystone-engine/keypatch

支持的CPU架构: support Arm, Arm64 (AArch64/Armv8), Hexagon, Mips, PowerPC, Sparc, SystemZ & X86 (include 16/32/64bit).支持的平台: work everywhere that IDA works, which is on Windows, MacOS, Linux.Based on Python, so it is easy to install as no compilation is needed.

keypatch底层依赖keystone-engine

安装keystone-engine

For Windows
It is easiest to just download & install Python 2.7 module for Windows from http://www.keystone-engine.org/download. Be sure to get the 32-bit version, regardless of your Windows edition.

If you prefer to compile from source, just use MSVC 32-bit & follow the instructions in Windows documentation to build keystone.dll. After that, install Python module as in Python documentation. Then copy keystone.dll to the directory of Keystone Python module.

For osx
sudo pip install keystone-engine

---

安装keypatch
https://github.com/keystone-engine/keypatch.git

将 keypatch.py 复制到 /Applications/IDA\ Pro\ 6.95/idaq.app/Contents/MacOS/plugins

重新打开ida

使用keypatch 快捷键ctrl+alt+k

arm汇编

keypatch界面

keypatch修改界面

点击patch, 修改成功

keypatch修改界面后，注意右边的注释(保留前面的代码)

如何撤销修改

ctrl+alt + p 右击revert指定的修改

或者