Tool
Keypatch
IDA Pro plugin built on the Keystone assembler engine that patches a binary from typed assembly, fills an address range with instructions or raw bytes and searches the loaded binary for assembly instructions. It assembles Arm, Arm64, Hexagon, MIPS, PowerPC, SPARC, SystemZ and 16-, 32- and 64-bit x86 code, shows the encoding while you type, can pad with NOPs up to the next instruction boundary, keeps the original instruction in an IDA comment and can undo the last patch.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: Needs IDA Pro on Windows, macOS or Linux with the Keystone engine and its Python binding plus the six module; keypatch.py is copied into IDA's plugins folder. The README confirms IDA Pro 6.4 to 7.5, and the reviewed master commit (2024-09-06) adds IDA 9.0 API changes. The latest tagged release is 2.1 (2017-01-17), while the code reports version 2.2.
- Limits: Patches change only the IDA database until Edit | Patch program | Apply patches to input file writes them to the original binary.
- License: GPL-2.0 per COPYING.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · keystone-engine/keypatch · Revision e7ecb93
- TUTORIAL.md GitHub · keystone-engine/keypatch · Revision e7ecb93
- keypatch.py#L105-L118 GitHub · keystone-engine/keypatch · Revision e7ecb93
- COPYING GitHub · keystone-engine/keypatch · Revision e7ecb93
- https://github.com/keystone-engine/keypatch/releases/tag/2.1
More in Native binaries
- edb-debugger · Tool
- BinNavi · Tool
- flare-emu · Tool
- IDA Pro · Tool
- Binary Ninja · Tool
- Hopper Disassembler · Tool