Fentanyl is an IDAPython script that makes patching significantly easier. Fentanyl lets you patch from IDA Pro or Demo easily. Most patches can be done without touching a hex editor but if you must edit raw bytes you can simply use IDA's hex view. You can also undo and redo changes to the idb.
Fentanyl supercedes other tools for binary patching by being able to assemble with IDA's built in assemblers which can support more than x86 and x86_64. Fentanyl also automates commonly performed patches. One of Fentanyl's best features is that it supports Undo/Redo. We can see changes to the graph live and undo them if they aren't to our liking.
- Download IDAPython here.
- Move appropriate folders to IDA plugins directory as per the
- Download (custom built by ancat): Python 2.7 PySide bindings installer or raw.
- Extract and move PySide folder to
File > Script Fileto load scripts
- Browse to
main.pyand open it
- That's it!
Some of these keybindings can be accessed by right-clicking on the screen in graph view.
Alt-NConvert instructions to nops
Alt-XNop all xrefs to this function
Alt-JInvert conditional jump
Alt-ZUndo modification (Won't always work. Should still be careful editing.)
Alt-YRedo modification (Won't always work. Should still be careful editing.)
Alt-CFind Code Caves
Ctrl-Alt-FMake jump unconditional
Ctrl-Alt-NNeuter the binary (remove calls to fork, setuid, setgid, getpwnam, setgroups, and chdir)
Loading Fentanyl on Startup
Check out this example.
PySide is annoying to compile. If you don't want to use the PySide binaries available here, or don't want to compile it yourself, you don't actually need it. Fentanyl will not use the GUI if PySide is not available.