Skip to content

Instantly share code, notes, and snippets.

@scrapbird
Created November 7, 2017 04:05
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save scrapbird/f256b19586f57de318d65b18b9839ae9 to your computer and use it in GitHub Desktop.
Save scrapbird/f256b19586f57de318d65b18b9839ae9 to your computer and use it in GitHub Desktop.
Applies an x64dbg .1337 patch file to a binary in radare2. Call with: #!pipe ./r21337patch.py /path/to/patch.1337
#!/usr/bin/env python
import r2pipe
import sys
r2 = r2pipe.open()
# r2 base address
delta = 0x400000
def patchByte(addr, oldbyte, newbyte):
print "[-] Patching byte at addr: {} {}->{}".format(hex(addr), oldbyte, newbyte)
r2.cmd("wx {} @ {}".format(newbyte, hex(addr)))
res = r2.cmd("p8 1 @ {}".format(hex(addr)))
if res != newbyte:
print "[!] Error writing byte at {}".format(hex(addr))
# Check file permissions
if r2.cmd("i~mode[1]").find("w") < 0:
print "Please open file in write mode (oo+)"
quit()
# Check args
if len(sys.argv) != 2:
print "Please run script with path to patch file"
quit()
with open(sys.argv[1], 'r') as f:
for line in f:
if not line.startswith(">"):
line = line.rstrip("\n")
split = line.split(":")
addr = int(split[0], 16) + delta
bytesplit = split[1].split("->")
patchByte(addr, bytesplit[0], bytesplit[1])
@OTsector
Copy link

OTsector commented Jan 8, 2022

Hello, can I ask a question?
Can you tell me why delta size is 0x400000?
What you mean in "r2 base address" ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment