Patching - angr Management

angr Management provides powerful patching capabilities that allow you to modify binary code and data, test changes interactively, and export patched binaries.

Overview

Patching in angr Management lets you:

Modify Code

Change assembly instructions, replace with NOPs, or rewrite logic

Edit Data

Modify strings, constants, and data structures

Test Changes

Verify patches with debugging before exporting

Export Binary

Save patched binary for deployment

Patch Types

angr Management supports several patching approaches:

Assembly Patching

Replace instructions with new assembly code:

Select Instruction

Right-click on instruction in disassembly view

Open Patch Dialog

Select “Patch Instruction”

Enter Assembly

Type new assembly (e.g., nop, xor eax, eax, jmp 0x401234)

Apply

Click OK to apply the patch

Examples:

# NOP out an instruction
nop

# Change return value
mov rax, 1
ret

# Skip a call
nop
nop
nop
nop
nop

# Redirect execution
jmp 0x401000

Hex Patching

Directly modify bytes in the hex view:

Open Hex View

View → Hex

Navigate to Address

Press G and enter address, or scroll

Edit Bytes

Click on hex bytes section
Type new hex values (e.g., 90 for NOP)
Or click ASCII section to edit as text

Automatic Patch

Patch is created automatically when you edit

Programmatic Patching

Use the Python console for complex patches:

# Patch via console
workspace.patch(0x401000, "nop", pad=True)

# Patch with raw bytes
from angr.knowledge_plugins.patches import Patch
addr = 0x401000
new_bytes = b'\x90\x90\x90\x90\x90'  # 5 NOPs
patch = Patch(addr, new_bytes)
workspace.instance.patches.add_patch_obj(patch)

# Multiple instruction patch
asm_code = """mov rax, 0
ret"""
workspace.patch(0x401000, asm_code)

Patch Management

Viewing Patches

Open the Patches View (View → Patches) to see all patches:

Column	Description
Address	Location of patch in hex
Size	Number of bytes modified
Original	Original byte values
Patched	New byte values
Comment	Optional description

Patch Highlighting

Patches are visually marked throughout the interface:

Disassembly View: Yellow background on patched instructions
Hex View: Yellow highlight on patched bytes
Patches View: Complete list with details

Editing Patches

Modify existing patches:

In Patches View
In Hex View
Re-patch

Double-click patch in Patches view
Modify bytes or comment
Click OK to save

Reverting Patches

Single Patch

In Patches View:

Right-click patch
Select “Revert Patch”
Confirm reversion

In Hex View:

Right-click yellow highlight
Select “Revert”
Patch is removed

All Patches

Via Console:

# Remove all patches
pm = workspace.instance.patches
for addr in list(pm.keys()):
    pm.remove_patch(addr)
pm.am_event()

Patch Comments

Document your patches:

Right-click patch (in Hex View or Patches View)
Select “Set Comment”
Enter description (e.g., “Bypass license check”)
Comment appears in Patches view

Common Patching Patterns

NOPing Instructions

Remove unwanted instructions:

call check_license
test eax, eax
jz invalid_license

How to:

Right-click call instruction
Patch Instruction → nop
Repeat for test and jz
Or use multi-byte NOP for efficiency

Changing Conditionals

Flip conditional logic:

jz fail_case    ; Jump if zero

Forcing Return Values

Change function results:

call expensive_check
test eax, eax

Redirecting Calls

Change call targets:

call 0x401000   ; Original function

Ensure the new target has a compatible calling convention and signature.

Patching Data

Modify strings and constants:

Strings
Constants

In Hex View:

Navigate to string address
Click in ASCII column
Type new text
Null terminator handled automatically

Example: Change “Error” to “OK ”

In Hex View:

Navigate to constant
Edit hex bytes
Verify endianness

Example: Change timeout from 1000 to 9999:

Find: E8 03 00 00 (1000 in little-endian)
Change to: 0F 27 00 00 (9999 in little-endian)

Advanced Patching

Multi-Instruction Patches

Replace multiple instructions:

# Via console - more control
addr = 0x401000

# Assemble new code
ks = workspace.instance.project.arch.keystone
new_asm = """
mov rax, 0
test rax, rax
ret
"""
new_bytes = ks.asm(new_asm, addr)[0]

# Create patch
from angr.knowledge_plugins.patches import Patch
patch = Patch(addr, new_bytes)
workspace.instance.patches.add_patch_obj(patch)

Conditional Patching

Apply patches based on conditions:

# Patch all calls to a specific function
target_func = 0x404000
for func in workspace.instance.kb.functions.values():
    for block in func.blocks:
        for insn_addr in block.instruction_addrs:
            insn = block.capstone.insns[insn_addr]
            if insn.mnemonic == 'call':
                # Check if calling target_func
                operand = insn.op_str
                if hex(target_func) in operand:
                    # NOP out this call
                    workspace.patch(insn_addr, 'nop', pad=True)

Patch Merging

Combine adjacent patches:

Apply patch at address A
Apply patch at address A+N (adjacent)
In Hex View, right-click first patch
Select “Merge with next”
Patches combine into single patch

Merging patches can simplify patch management and reduce overhead.

Patch Splitting

Split large patches:

Navigate to middle of patch in Hex View
Right-click on patch highlight
Select “Split”
Two independent patches created

Use case: You want to revert only part of a large patch.

Testing Patches

Debug Patched Code

Apply Patches

Make your modifications

Set Breakpoint

Break before or at patched code

Create State

Right-click → “New State”

Step Through

Press F7 to step through patched instructions

Verify

Check registers, memory, and control flow

Decompile Patched Code

View patches in pseudocode:

Apply patches in disassembly
Press Tab to switch to pseudocode
Decompiler shows patched code
Verify logic changes

Decompiler uses patched bytes, so you see the modified logic in C code.

Exporting Patched Binaries

Save Patched Binary

Open Save Dialog

File → Save Patched Binary As…

Choose Location

Select output file path (e.g., program.patched)

Save

Click Save

Verify

Test the patched binary externally

What Gets Saved:

All applied patches
Preserved file structure
Updated checksums (where applicable)
Original file format maintained

Patch Persistence

Patches are stored in:

angr database (.adb): When you save the database
Patched binary: When you export
Memory only: Until you save (lost on exit)

Always save your database (File → Save angr database) to preserve patches across sessions.

Patch Limitations

Size Constraints

Patches cannot exceed original instruction sizeIf your new code is longer:

Use a jump to a code cave
Place new code in unused space
Jump back when done

Example:

# At original location (5 bytes)
jmp code_cave

# At code_cave (unused space)
; Your long patch here
; ...
jmp return_address

Relocation Issues

Some binaries have relocations:

PIE executables
DLLs/shared libraries
Position-independent code

Considerations:

Patched addresses may change at runtime
Use relative addressing when possible
Test at expected load address

Code Signing

Signed binaries:

Patches invalidate signatures
Binary won’t verify after patching
May need to re-sign (platform-dependent)

Solution: Remove/disable signature verification or re-sign.

Best Practices

Document Patches

Add comments to every patch
Explain why the patch was needed
Note any side effects
Keep a patch log

Test Thoroughly

Use debugger to verify patches
Test edge cases
Check for unintended effects
Validate with decompiler

Backup First

Save original binary
Save angr database frequently
Version your patches
Test on copies, not originals

Minimal Changes

Patch only what’s necessary
Preserve original behavior where possible
Avoid cascading changes
Keep patches simple

Troubleshooting

Patch Not Applied

Patch doesn’t appear in binary:Solutions:

Check Patches view for the patch
Verify address is correct
Ensure you exported after patching
Check file permissions

Crash After Patch

Patched binary crashes:Causes:

Incorrect instruction encoding
Changed stack alignment
Broken calling convention
Invalid jump target

Debug:

Revert patches one by one
Use debugger to find crash location
Verify instruction bytes are correct

Wrong Instruction Encoding

Patch assembles incorrectly:Solutions:

Check architecture (x86 vs x64, ARM mode)
Verify syntax (AT&T vs Intel)
Use hex bytes directly if needed
Consult instruction reference

Next Steps

Debugging

Test patches with the debugger

Scripting

Automate patching workflows

Advanced Topics

Advanced binary modification techniques

Disassembly

Return to disassembly guide

Get Started

User Guide

Features

​Overview

Modify Code

Edit Data

Test Changes

Export Binary

​Patch Types

​Assembly Patching

​Hex Patching

​Programmatic Patching

​Patch Management

​Viewing Patches

​Patch Highlighting

​Editing Patches

​Reverting Patches

​Patch Comments

​Common Patching Patterns

​NOPing Instructions

​Changing Conditionals

​Forcing Return Values

​Redirecting Calls

​Patching Data

​Advanced Patching

​Multi-Instruction Patches

​Conditional Patching

​Patch Merging

​Patch Splitting

​Testing Patches

​Debug Patched Code

​Decompile Patched Code

​Exporting Patched Binaries

​Save Patched Binary

​Patch Persistence

​Patch Limitations

​Best Practices

Document Patches

Test Thoroughly

Backup First

Minimal Changes

​Troubleshooting

​Next Steps

Debugging

Scripting

Advanced Topics

Disassembly

Build docs developers (and LLMs) love

Overview

Patch Types

Assembly Patching

Hex Patching

Programmatic Patching

Patch Management

Viewing Patches

Patch Highlighting

Editing Patches

Reverting Patches

Patch Comments

Common Patching Patterns

NOPing Instructions

Changing Conditionals

Forcing Return Values

Redirecting Calls

Patching Data

Advanced Patching

Multi-Instruction Patches

Conditional Patching

Patch Merging

Patch Splitting

Testing Patches

Debug Patched Code

Decompile Patched Code

Exporting Patched Binaries

Save Patched Binary

Patch Persistence

Patch Limitations

Best Practices

Troubleshooting

Next Steps