Fentanyl is an IDAPython script that makes patching significantly easier. Fentanyl lets you patch from IDA Pro or Demo easily. Most patches can be done without touching a hex editor but if you must edit raw bytes you can simply use IDA's hex view. You can also undo and redo changes to the idb.
Fentanyl supercedes other tools for binary patching by being able to assemble with IDA's built in assemblers which can support more than x86 and x86_64. Fentanyl also automates commonly performed patches. One of Fentanyl's best features is that it supports Undo/Redo. We can see changes to the graph live and undo them if they aren't to our liking.
Simply move all items from this repository into the following directory:
%IDA% directory can usually be found bellow:
C:\Program Files\IDA <version>\
Now on program start, the plugin will be loaded automatically.
Need to add backwards compatibility with IDA 6.x / Python2 or mark as deprecated.
- Download IDAPython here.
- Move appropriate folders to IDA plugins directory as per the
- Download (custom built by ancat): Python 2.7 PySide bindings installer or raw.
- Extract and move PySide folder to
Follow instructions under Setup.
File > Script Fileto load scripts
- Browse to
main.pyand open it
- That's it!
Some of these keybindings can be accessed by right-clicking on the screen in graph view.
Ctrl-Alt-NConvert instructions to nops
Ctrl-Alt-XNop all xrefs to this function
Ctrl-Alt-JInvert conditional jump
Alt-ZUndo modification (Won't always work. Should still be careful editing.)
Alt-YRedo modification (Won't always work. Should still be careful editing.)
Ctrl-Alt-CFind Code Caves
Ctrl-Alt-FMake jump unconditional
Alt-NNeuter the binary (remove calls to fork, setuid, setgid, getpwnam, setgroups, and chdir)
Check out this example.
PySide is annoying to compile. If you don't want to use the PySide binaries available here, or don't want to compile it yourself, you don't actually need it. Fentanyl will not use the GUI if PySide is not available.