osirislab / fentanyl Goto Github PK

Fentanyl is an IDAPython script that makes patching significantly easier

Python 100.00%

fentanyl's Introduction

Fentanyl

Introduction

Fentanyl is an IDAPython script that makes patching significantly easier. Fentanyl lets you patch from IDA Pro or Demo easily. Most patches can be done without touching a hex editor but if you must edit raw bytes you can simply use IDA's hex view. You can also undo and redo changes to the idb.

Fentanyl supercedes other tools for binary patching by being able to assemble with IDA's built in assemblers which can support more than x86 and x86_64. Fentanyl also automates commonly performed patches. One of Fentanyl's best features is that it supports Undo/Redo. We can see changes to the graph live and undo them if they aren't to our liking.

Setup (IDA 7.x / Python 3)

Simply move all items from this repository into the following directory:

%IDA%\plugins

The %IDA% directory can usually be found bellow:

C:\Program Files\IDA <version>\

Now on program start, the plugin will be loaded automatically.

Setup (IDA 6.x / Python 2)

Need to add backwards compatibility with IDA 6.x / Python2 or mark as deprecated.

IDAPython

Download IDAPython here.
Move appropriate folders to IDA plugins directory as per the README

IDA PySide

Download (custom built by ancat): Python 2.7 PySide bindings installer or raw.
Extract and move PySide folder to C:\python27\Lib\site-packages\

Usage

Loading Fentanyl.py

IDA 7.x / Python 3

Follow instructions under Setup.

IDA 6.x / Python 2

Alt+F7 or File > Script File to load scripts
Browse to main.py and open it
That's it!

Key Bindings

Some of these keybindings can be accessed by right-clicking on the screen in graph view.

Ctrl-Alt-N Convert instructions to nops
Ctrl-Alt-X Nop all xrefs to this function
Ctrl-Alt-J Invert conditional jump
Ctrl-Alt-P Patch instruction
Alt-Z Undo modification (Won't always work. Should still be careful editing.)
Alt-Y Redo modification (Won't always work. Should still be careful editing.)
Ctrl-Alt-S Save file
Ctrl-Alt-C Find Code Caves
Ctrl-Alt-F Make jump unconditional
Alt-N Neuter the binary (remove calls to fork, setuid, setgid, getpwnam, setgroups, and chdir)

Extras

Loading Fentanyl on Startup

Check out this example.

PySide

PySide is annoying to compile. If you don't want to use the PySide binaries available here, or don't want to compile it yourself, you don't actually need it. Fentanyl will not use the GUI if PySide is not available.

fentanyl's People

Contributors

Stargazers

Watchers

fentanyl's Issues

GUI

Right click graph and have a submenu for patching.

Prebuilt IDA Pyside for Python 2.6
http://dvlabs.tippingpoint.com/blog/2012/02/25/mindshare-yo-dawg-i-heard-you-like-reversing

IDA's patches for Pyside:
https://www.hex-rays.com/products/ida/support/download.shtml

Keyboard shortcuts fail to bind when Fentanyl is reloaded

While debugging Fentanyl, if you want to reload it (say you had an error calling a function) and you do it via "Open Script", the keyboard shortcuts won't re-bind.

The console output after reloading:

Bound entries to []

Jump to Undo/Redo Location

When you redo or undo jump to the location so the user is aware of the modification.

Write tests for Fentanyl

We need tests!

Add functionality to add new sections to the binary

Code caves are okay for small pieces of code, but sometimes it makes more sense to allocate an entire section within the binary. This allows for introduction of larger pieces of code to the binary with less restrictions.

Pros:

Inject more code very easily

Cons:

Modifies the binary more significantly than using a code cave
Might require IDA to reload the binary

Improve context menu binding code

The code to add context menu entries to new Graph View windows is very hacky. Find a better way.

Auto install script

Installs Fentanyl automatically (includes dependency checks).

Conflicting Keyboard shortcut

The new update causes "Convert instructions to nops" and "Neuter the binary" to both use Ctrl+Alt+N. This results in conflict when using IDA Pro.

Attribute Error

After I install Python 2.7 PySide and IDAPython I try to load the script file main.py but I encounter this error:

Python 2.7.6 (default, Nov 10 2013, 19:24:18) [MSC v.1500 32 bit (Intel)]
IDAPython v1.5.2 final (serial 3) (c) The IDAPython Team [email protected]

type object 'Form' has no attribute 'MultiLineTextControl'
Traceback (most recent call last):
File "C:\Program Files\IDA PRO Advanced Edition\python\idaapi.py", line 396, in IDAPython_ExecScript
execfile(script, g)
File "C:/Documents and Settings/Owner/My Documents/Downloads/Fentanyl/main.py", line 51, in
asf = AssembleForm.AssembleForm()
File "C:/Documents and Settings/Owner/My Documents/Downloads/Fentanyl\AssembleForm.py", line 14, in init
'inp':idaapi.Form.MultiLineTextControl('', idaapi.textctrl_info_t.TXTF_FIXEDFONT),
AttributeError: type object 'Form' has no attribute 'MultiLineTextControl'

Exception AttributeError: "'AssembleForm' object has no attribute 'ui_cntls'" in <bound method AssembleForm.del of <AssembleForm.AssembleForm object at 0x068D99D0>> ignored