generate-signature-for-patch

Generate Signature for Patch

Generate a unique hex byte signature that locates an instruction to be patched at runtime, along with the replacement patch_bytes.

Core Concept

For patch signatures, we signature the instruction to be patched. The signature uniquely identifies the location so a runtime patcher can find and overwrite the original bytes with patch_bytes.

Hard requirements:

1. The target instruction must be fully fixed (no wildcard bytes at all).
2. Instructions other than the target instruction may use wildcarding.
3. Signature length grows by complete instruction boundaries and stops at the shortest unique prefix.
4. patch_bytes are determined by the LLM based on the desired patch effect, not by the script.
5. len(patch_bytes) must equal len(original_instruction_bytes) (pad with 0x90 NOP if the replacement is shorter).

Strategy:

• Forward-only expansion: Expand only forward (after target instruction). The signature may extend beyond the current function boundary into CC padding or the next function. patch_sig_disp is always 0 — the signature always starts at the target instruction.

Prerequisites

• Target instruction address (the instruction to be patched)
• Desired patch effect description (e.g., "skip if-branch", "NOP out function call", "change immediate value")
• IDA Pro MCP session, resolved per mcp-ida-session.md: idb_list → idb_open (script fallback only if the endpoint is unreachable). Honor its IDB save discipline — an idle-TTL self-exit does not save.

Method

1. Determine patch_bytes (LLM Step — before running the script)

Examine the target instruction and its context using IDA Pro MCP, then determine the appropriate patch_bytes.

Common patch patterns:

• Skip conditional branch (near jcc 0F 8x rel32 → jmp rel32): Replace first 6 bytes with E9 <new_rel32> 90. Compute new_rel32 = original branch target − (patch_addr + 5).
• Skip conditional branch (short jcc 7x rel8 → jmp short): Replace 7x rel8 with EB rel8.
• Force conditional branch to fall through: NOP the entire jcc instruction (90 90 ...).
• NOP a call rel32: Replace E8 xx xx xx xx with 90 90 90 90 90.
• NOP a call [reg+disp]: Replace all bytes with 90.
• Change immediate operand: Modify the immediate bytes in-place.