keystone-engine / keypatch

Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
http://www.keystone-engine.org/keypatch
GNU General Public License v2.0
1.49k stars 355 forks source link

Failed to assembly when converted to code in IDA #53

Open confile opened 6 years ago

confile commented 6 years ago

I use IDAP Pro 7.1 wich keypatcher 2.2. At address 0048ED60 I want to insert some code:

malware-windows_10_pro_x64

I inserted push esp:

image

After hitting the patch button I get this:

image

That is correct. IDA tries to interpret the code. When I now try to continue editing lie in this screenshot:

image

and hit the Patch button, then I get the following error.

image

In order to make the plugin work I need to cancel editing after the first operation. Go to the edited address 0048ED60 and hit u für undefine. After that I can continue with the keypatcher.

Can you please fix that? It makes multi editing very hard.