Home

Awesome

Keypatch

Keypatch is the award winning plugin of IDA Pro for Keystone Assembler Engine.

Keypatch consists of 3 tools inside.

See this quick tutorial for how to use Keypatch, and this slides for how it is implemented.

Keypatch is confirmed to work on IDA Pro version 6.4, 6.5, 6.6, 6.8, 6.9, 6.95, 7.0, 7.5 but should work flawlessly on older versions. If you find any issues, please report.


1. Why Keypatch?

Sometimes we want to patch the binary while analyzing it in IDA, but unfortunately the built-in asssembler of IDA Pro is not adequate.

Keypatch was developed to solve this problem. Thanks to the power of Keystone, our plugin offers some nice features.

Keypatch can be the missing piece in your toolset of reverse engineering.


2. Install

NOTE


3. Usage

<p align="center"> <img src="screenshots/keypatch_patcher.png" height="460" /> </p> <p align="center"> <img src="screenshots/keypatch_fillrange.png" height="460" /> </p> <p align="center"> <img src="screenshots/keypatch_search.png" height="360" /> </p> <p align="center"> <img src="screenshots/keypatch_menupopup.png" height="300" /> </p>

4. Contact

Email keystone.engine@gmail.com for any questions.

For future update of Keypatch, follow our Twitter @keystone_engine for announcement.


Appendix. Install Keystone for IDA Pro

We all know that before IDA 7.0, IDA Pro's Python is 32-bit itself, so it can only loads 32-bit libraries. For this reason, we have to build & install Keystone 32-bit. However, since IDA 7.0 supports both 32-bit & 64-bit, which means we also need to install a correct version of Keystone. Simply install from Pypi, with pip (32-bit), like followings:

pip install keystone-engine

Done? Now go back to section 2 & install Keypatch for IDA Pro. Enjoy!