keystone-engine / keypatch

Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
http://www.keystone-engine.org/keypatch
GNU General Public License v2.0
1.52k stars 358 forks source link

Pseudocode incorrect if not using "undo last patching" option of keypath. #91

Open Uzver123 opened 4 months ago

Uzver123 commented 4 months ago

For for ARM64 if simply open Patched bytes window and delete multiple patches then sometimes pseudocode is not restoring back properly, however if using keypatch > undo last patching option then pseudocode restores to original state.

Another issue there might be multiple changes to assembly instructions using keypatch and undo last patching only remembers last one.

Only one workaround so far since keypatch comment remains next to the changed assembler instruction on deleting the patch from Patched bytes window - can change that instruction again to anything like NOP and use keypatch > undo last patching command then keypatch changes get properly removed and pseudocode can be restored properly to original state.

Ida Pro v8.4