IDA: call a function with different arguments

Question

I'm reversing some software and found the function which decrypts some stuff:

As you can see it has the password parameter for it which gets decrypted in this function.

Function disassembly:

sub_401350      proc near               ; CODE XREF: sub_4013F0+28Ep
                                        ; sub_4013F0+2D2p

var_4           = dword ptr -4
arg_0           = dword ptr  8
arg_4           = dword ptr  0Ch
arg_8           = dword ptr  10h
arg_C           = dword ptr  14h
arg_10          = byte ptr  18h

                push    ebp
                mov     ebp, esp
                push    ecx
                mov     [ebp+var_4], 0
                jmp     short loc_401366
loc_40135D:                             ; CODE XREF: sub_401350+46j
                mov     eax, [ebp+var_4]
                add     eax, 1
                mov     [ebp+var_4], eax

loc_401366:                             ; CODE XREF: sub_401350+Bj
                mov     ecx, [ebp+var_4]
                cmp     ecx, [ebp+arg_4]
                jnb     short loc_401398
                mov     edx, [ebp+arg_0]
                add     edx, [ebp+var_4]
                movsx   ecx, byte ptr [edx]
                mov     eax, [ebp+var_4]
                xor     edx, edx
                div     [ebp+arg_C]
                mov     eax, [ebp+arg_8]
                movsx   edx, byte ptr [eax+edx]
                movzx   eax, [ebp+arg_10]
                add     edx, eax
                xor     ecx, edx
                mov     edx, [ebp+arg_0]
                add     edx, [ebp+var_4]
                mov     [edx], cl
                jmp     short loc_40135D
.text:00401398
loc_401398:                             ; CODE XREF: sub_401350+1Cj
                mov     esp, ebp
                pop     ebp
                retn    14h
sub_401350      endp

This function is called in some other places too. My goal is to call this function with some other parameters to decrypt other stuff and see the content.

How can I achieve this? how can I call this function with some other parameters using python or any other way? thanks.

Answer 1

A bit unorthodox, but I personally tend to use Cheat Engine for something "quick 'n dirty" like this.

The basic idea is you'd hook that call, jump to allocated memory which contains instructions you write to move the data you want into any registers/memory that should be passed to the callee, then trace the call to see the results. If the function is shared and is executing at times beyond your control, you could simply use a cmp instruction in your code injection to have your code run only when a certain condition is met.

An example of what your injection might look like is as follows:

//--Allocate memory page in address space of application
alloc(newmem,2048,"application.exe"+40167E)

//--Create labels for your code
label(returnhere)
label(originalcode)
label(exit)

//--This is where your custom code would go
newmem:
//Maybe pop unwanted values off stack
//Then push your custom values onto stack

//--This is the CALL you hooked which will now run
originalcode:
call sub_401350

//--Jump to exit code injection
exit:
jmp returnhere

//--This hooks the CALL and injects a jump to your allocated memory
"application.exe"+40167E:
jmp newmem

//--Exit label jumps here, returning you to normal execution
returnhere:

Here's a video that demonstrates roughly what it looks like to do this type of injection via Cheat Engine.

Answer 2

I think the classic way to go about it is to recreate the decoding algorithm after reversing it and then you can test it with any string that you want. A hacky way to do it is to break before the function call and manually change my_password to the string that you wanted to test with. A more automated solution is the Binary Ninja plugin ripr. From its github page:

ripr attempts to automatically generate a python class that is functionally identical to a selected piece of code by statically gathering sufficient information and wrapping it all into a "harness" for the unicorn emulator