I have an application that calls a subroutine before sending the data over socket and in that subroutine the packet is being encrypted. Is there any way to make application skip that subroutine and send the packet as non-encrypted ?
2 Answers
As Dillinur wrote, you need to NOP out this call. To do that you may need a hex editor, like WinHex. To NOP out the subroutine, you have to determine from which address it is called. To see that address, in IDA go to Options -> General and mark Line Prefixes.
It's also nice to see which Opcodes you would like to NOP out. Go to Options -> General and write 6 in the field Number of opcode bytes. Then your IDA graph mode will look like that:
In my example, if I want to skip the foo-subroutine while execution, I need to set the opcode bytes E8 DF E6 FF FF to 90 90 90 90 90 (E8 is the call mnemonic and the rest are the offset bytes). 0x90 is the NOP opcode.
To NOP out these bytes I open the executable in WinHex and search the offset 0x31CC (not 0x4031CC, because 0x400000 is the load address of my executable in IDA). Finally, when I've found the offset 0x31CC I look for the sequence of bytes E8 DF E6 FF FF and then edit them to 90 90 90 90 90. Save it.
Also you may think about NOPing out of the PUSH-instruction(s) preceding your subroutine in order to avoid errors in the succeeding code.
-
4Just a note, it is also possible to edit the function within Ollydbg then save the modified ("patched") executable. The advantage with olly is that you can see the instructions you are changing, while with a plain hex editor it can be difficult. Sep 14, 2015 at 11:25
-
I don't know if it's still prevalent (in days of DEP - data execution prevention), but with many programs of old, while you could find such a block of code during execution, but it wouldn't appear that way on disk, so you couldn't (easily) make permanent changes (essentially, the "code" was a block of data that was decrypted during the start-up phase). Also, doesn't the
add esp,8balance thepushes, so they should stay? Sep 14, 2015 at 16:12 -
You don't need to nop the preceding pushes as there as an add esp, 8 after the function call.– MilhousSep 23, 2015 at 3:26
-
In general, you may need to NOP the preceding pushes if the called function uses stdcall as calling convention, where the called function is responsible for cleaning up the stack. That is why I wrote "you may think about NOPing". Sep 23, 2015 at 8:48
There is an ida tag, but your question doesn't mention it, so let's do that with radare2 instead ;)
aa to analyse the binary, pdf to show the current function, wx to write hexpairs, and pdf again to check the result. It's also possible to use "wa nop;nop;nop;nop;nop" instead, if you prefer writing instructions, or even better, the magical wao nop command, to replace the current
opcode with nop.
encoder_func