[Patch all XREFs] #r2pipe #radare2 #r2 #patch

patch_xrefs.py

# WARNING: This is probably bad in most cases, you should first analyze your binary and figure out if you really want to nop out all xrefs...

import r2pipe
import sys

NOP = '90'

def main(binary, location):
    r2 = r2pipe.open(binary, ['-w'])
    print '[-] Analyzing binary...'
    r2.cmd('aaa')
    print '[+] Finished running aaa!'
    xrefs = r2.cmdj('axtj @ {}'.format(location))
    print '[+] Found {} XREFS to address {}'.format(len(xrefs), location)
    xrefs_locations = [i['from'] for i in xrefs]
    xref_instructions = [r2.cmdj('pdj 1 @ {}'.format(i))[0] for i in xrefs_locations]
    for ins in xref_instructions:
        patch = (len(ins['bytes']) / 2) * NOP
        loc = ins['offset']
        print '[!] Writing {} over {} ({}) in address {}'.format(patch, ins['bytes'], ins['disasm'], hex(loc))
        r2.cmd('wx {} @ {}'.format(patch, loc))
    print '[+] Finished patching!'


if __name__ == '__main__':
    if len(sys.argv) != 3:
        print 'Usage: xref_patch.py <binary> <location>'
        sys.exit(1)
    print 'WARNING: No backup file is made'
    main(sys.argv[1], sys.argv[2])