4

I have an application that calls a subroutine before sending the data over socket and in that subroutine the packet is being encrypted. Is there any way to make application skip that subroutine and send the packet as non-encrypted ?

  • 1
    Replace the call by a NOP if the encryption is in-place, or modify the function to just copy the input if it's not. Without more information about how the program & the call work, it's hard to help you further. – Dillinur Sep 14 '15 at 8:42
  • Here's a screenshot from IDA: i.imgur.com/zurZc9f.png – AcarX Sep 14 '15 at 8:48
  • There are two calls in you screenshot. edit : I guess it's encoder_func – Hackndo Sep 14 '15 at 8:58
  • Yeah that's the subroutine i want to skip. – AcarX Sep 14 '15 at 9:03
10

As Dillinur wrote, you need to NOP out this call. To do that you may need a hex editor, like WinHex. To NOP out the subroutine, you have to determine from which address it is called. To see that address, in IDA go to Options -> General and mark Line Prefixes.

It's also nice to see which Opcodes you would like to NOP out. Go to Options -> General and write 6 in the field Number of opcode bytes. Then your IDA graph mode will look like that:

IDA Graph mode

In my example, if I want to skip the foo-subroutine while execution, I need to set the opcode bytes E8 DF E6 FF FF to 90 90 90 90 90 (E8 is the call mnemonic and the rest are the offset bytes). 0x90 is the NOP opcode.

To NOP out these bytes I open the executable in WinHex and search the offset 0x31CC (not 0x4031CC, because 0x400000 is the load address of my executable in IDA). Finally, when I've found the offset 0x31CC I look for the sequence of bytes E8 DF E6 FF FF and then edit them to 90 90 90 90 90. Save it.

Also you may think about NOPing out of the PUSH-instruction(s) preceding your subroutine in order to avoid errors in the succeeding code.

| improve this answer | |
  • 4
    Just a note, it is also possible to edit the function within Ollydbg then save the modified ("patched") executable. The advantage with olly is that you can see the instructions you are changing, while with a plain hex editor it can be difficult. – Dominik Antal Sep 14 '15 at 11:25
  • I don't know if it's still prevalent (in days of DEP - data execution prevention), but with many programs of old, while you could find such a block of code during execution, but it wouldn't appear that way on disk, so you couldn't (easily) make permanent changes (essentially, the "code" was a block of data that was decrypted during the start-up phase). Also, doesn't the add esp,8 balance the pushes, so they should stay? – TripeHound Sep 14 '15 at 16:12
  • You don't need to nop the preceding pushes as there as an add esp, 8 after the function call. – Milhous Sep 23 '15 at 3:26
  • In general, you may need to NOP the preceding pushes if the called function uses stdcall as calling convention, where the called function is responsible for cleaning up the stack. That is why I wrote "you may think about NOPing". – 0xDEADC0DE Sep 23 '15 at 8:48
9

There is an ida tag, but your question doesn't mention it, so let's do that with radare2 instead ;)

enter image description here

aa to analyse the binary, pdf to show the current function, wx to write hexpairs, and pdf again to check the result. It's also possible to use "wa nop;nop;nop;nop;nop" instead, if you prefer writing instructions, or even better, the magical wao nop command, to replace the current opcode with nop.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.