I have an application that calls a subroutine before sending the data over socket and in that subroutine the packet is being encrypted. Is there any way to make application skip that subroutine and send the packet as non-encrypted ?

  • 1
    Replace the call by a NOP if the encryption is in-place, or modify the function to just copy the input if it's not. Without more information about how the program & the call work, it's hard to help you further. Commented Sep 14, 2015 at 8:42
  • Here's a screenshot from IDA: i.imgur.com/zurZc9f.png
    – AcarX
    Commented Sep 14, 2015 at 8:48
  • There are two calls in you screenshot. edit : I guess it's encoder_func
    – Hackndo
    Commented Sep 14, 2015 at 8:58
  • Yeah that's the subroutine i want to skip.
    – AcarX
    Commented Sep 14, 2015 at 9:03

2 Answers 2


As Dillinur wrote, you need to NOP out this call. To do that you may need a hex editor, like WinHex. To NOP out the subroutine, you have to determine from which address it is called. To see that address, in IDA go to Options -> General and mark Line Prefixes.

It's also nice to see which Opcodes you would like to NOP out. Go to Options -> General and write 6 in the field Number of opcode bytes. Then your IDA graph mode will look like that:

IDA Graph mode

In my example, if I want to skip the foo-subroutine while execution, I need to set the opcode bytes E8 DF E6 FF FF to 90 90 90 90 90 (E8 is the call mnemonic and the rest are the offset bytes). 0x90 is the NOP opcode.

To NOP out these bytes I open the executable in WinHex and search the offset 0x31CC (not 0x4031CC, because 0x400000 is the load address of my executable in IDA). Finally, when I've found the offset 0x31CC I look for the sequence of bytes E8 DF E6 FF FF and then edit them to 90 90 90 90 90. Save it.

Also you may think about NOPing out of the PUSH-instruction(s) preceding your subroutine in order to avoid errors in the succeeding code.

  • 4
    Just a note, it is also possible to edit the function within Ollydbg then save the modified ("patched") executable. The advantage with olly is that you can see the instructions you are changing, while with a plain hex editor it can be difficult. Commented Sep 14, 2015 at 11:25
  • I don't know if it's still prevalent (in days of DEP - data execution prevention), but with many programs of old, while you could find such a block of code during execution, but it wouldn't appear that way on disk, so you couldn't (easily) make permanent changes (essentially, the "code" was a block of data that was decrypted during the start-up phase). Also, doesn't the add esp,8 balance the pushes, so they should stay?
    – TripeHound
    Commented Sep 14, 2015 at 16:12
  • You don't need to nop the preceding pushes as there as an add esp, 8 after the function call.
    – Milhous
    Commented Sep 23, 2015 at 3:26
  • In general, you may need to NOP the preceding pushes if the called function uses stdcall as calling convention, where the called function is responsible for cleaning up the stack. That is why I wrote "you may think about NOPing".
    – 0xDEADC0DE
    Commented Sep 23, 2015 at 8:48

There is an ida tag, but your question doesn't mention it, so let's do that with radare2 instead ;)

enter image description here

aa to analyse the binary, pdf to show the current function, wx to write hexpairs, and pdf again to check the result. It's also possible to use "wa nop;nop;nop;nop;nop" instead, if you prefer writing instructions, or even better, the magical wao nop command, to replace the current opcode with nop.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.