Do disassemblers like IDA or Ghidra change write rules on code segment of a process to change instructions? For example one can place NOP instead of a function call, so it should have RWX instead only RX bits
2 Answers
IDA and Ghidra create their own database files to store information about the binary (.idb
and .gbf
respectively). While binary editing is possible, it does not affect the binary's or its database's segment permissions.
For example, to check segment permissions in a PE executable with IDA, go to the beginning of a section in assembly text view:

- 579
- 1
- 3
- 15
I think you are mistaking analysis of a binary file with the file itself.
Sections can have permissions once in memory (because it will be mapped to physical pages that can have specific RWX permissions), but as long as your file is a file on disk, you should be able to edit its content the same way you edit a text file : get a file descriptor by opening the file with your OS API, read/writing it, close the file descriptor.
As stated by previous answer from mimak, IDA got its own database, and editing anything within IDA will only update the database, unless you explicitly ask IDA to write changes to the file (which you can do with File->Patches->apply patches to input file) ; in which case IDA will probably open your file on disk, read/write it, and close it.

- 72
- 5