Fentanyl is an IDAPython script that makes patching significantly easier
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
icons
.gitignore Clean up context menu code. Auto bind on file load Dec 22, 2013
AssembleForm.py Added icons and split up classes Dec 21, 2013
CodeCaveFinder.py
Fentanyl.py
FtlHooks.py
Neuter.py
README.md Update README.md Oct 2, 2015
Util.py
main.py

README.md

Fentanyl

Introduction

Fentanyl is an IDAPython script that makes patching significantly easier. Fentanyl lets you patch from IDA Pro or Demo easily. Most patches can be done without touching a hex editor but if you must edit raw bytes you can simply use IDA's hex view. You can also undo and redo changes to the idb.

Fentanyl supercedes other tools for binary patching by being able to assemble with IDA's built in assemblers which can support more than x86 and x86_64. Fentanyl also automates commonly performed patches. One of Fentanyl's best features is that it supports Undo/Redo. We can see changes to the graph live and undo them if they aren't to our liking.

Setup

IDAPython

  1. Download IDAPython here.
  2. Move appropriate folders to IDA plugins directory as per the README

IDA PySide

  1. Download (custom built by ancat): Python 2.7 PySide bindings installer or raw.
  2. Extract and move PySide folder to C:\python27\Lib\site-packages\

Usage

Loading Fentanyl.py

  1. Alt+F7 or File > Script File to load scripts
  2. Browse to main.py and open it
  3. That's it!

Key Bindings

Some of these keybindings can be accessed by right-clicking on the screen in graph view.

  • Alt-N Convert instructions to nops
  • Alt-X Nop all xrefs to this function
  • Alt-J Invert conditional jump
  • Alt-P Patch instruction
  • Alt-Z Undo modification (Won't always work. Should still be careful editing.)
  • Alt-Y Redo modification (Won't always work. Should still be careful editing.)
  • Alt-S Save file
  • Alt-C Find Code Caves
  • Ctrl-Alt-F Make jump unconditional
  • Ctrl-Alt-N Neuter the binary (remove calls to fork, setuid, setgid, getpwnam, setgroups, and chdir)

Extras

Loading Fentanyl on Startup

Check out this example.

PySide

PySide is annoying to compile. If you don't want to use the PySide binaries available here, or don't want to compile it yourself, you don't actually need it. Fentanyl will not use the GUI if PySide is not available.