The “Address” here presents the virtual address where our cursor is currently located. In the picture above, we can see that the first 16 bytes are indeed the exact same ones as on the picture below. If we now press on the Edit – Patch program – Patch bytes, a new pop-up window will be displayed presenting the first 16 bytes from the beginning of our cursor, which is located at the address 0x004011E5. We’re currently located at the first byte 0x91 at address 0x004011E5. Let’s first switch to the hexadecimal view, which can be seen on the picture below: The Edit – Patch program – Change byte option can be used to change one or more bytes in the Ida database. If the Patch program submenu in the Edit menu is not present, we need to change the idagui.cfg configuration file and change the DISPLAY_PATCH_SUBMENU configuration option to YES as we can see on the picture below:Īfter that, we need to restart Ida for the Patch program submenu to become available. We can use the options presented above to change the Ida database, which we can later use to create a new patched binary executable. With these options, we won’t actually change the binary executable itself, but only the database representation of the executable that Ida uses for reversing. On the picture above we can see three options: Change byte, Change word and Assemble, which can be used to change the database that Ida uses for representing the binary executable. Let’s first take a look at the Edit – Patch program options, which can be shown on the picture below: idb archive database and can be used by reverse engineers. Because of this, the binary executable is no longer needed to debug and execute the program everything is saved in the. Ida’s primary purpose is not binary patching, because when you first load the binary, it takes a snapshot of the binary and builds an internal representation, which is saved in the.

Ida hex