Running machine code that I need to execute with arguments. How?

Question

There is a program which I expect to run to generate a seed, but I don't know how to proceed and I am new to reversing.

I have the machine code of a program which is built for x86 architecture. I know that the expected function of the code is to generate a seed from three 8 byte arguments. However, I have no idea on how to proceed and debug this. The numbers in this case are (as integer, not hex) 1095923727, 3459613537, and 2312051101.

The hexdump of the code looks like this:

5589 e583 ec18 c704 2410 0000 00e8 26ff
ffff 8945 f0c7 45f4 0000 0000 eb62 8345
f401 8b45 08f7 d0c1 e810 3345 0889 45f8
8b55 f48b 45f8 01d0 69c0 6745 2301 35ef
cdab 8989 4508 8b45 0831 450c 8b45 0801
4510 8b55 f48b 45f8 01d0 69c0 efcd ab89
3567 4523 0189 4508 8b45 0889 45f8 8b45
0c89 4508 8b45 1089 450c 8b45 f889 4510
817d f4ff 0000 0076 958b 550c 8b45 0831
d033 4510 8945 f88b 45f0 8945 fc8b 55fc
8b45 0889 028b 45fc 8d50 048b 450c 8902
8b45 fc8d 5008 8b45 1089 028b 45fc 8d50
0c8b 45f8 8902 8b45 f0c9 c3         

Running that through a disassembler (r2 in this case) yields this:

/ (fcn) fcn.00000000 203
|   fcn.00000000 (int arg_8h, int arg_ch, int arg_10h);
|           ; var int local_10h @ rbp-0x10
|           ; var int local_ch @ rbp-0xc
|           ; var int local_8h @ rbp-0x8
|           ; var int local_4h @ rbp-0x4
|           ; arg int arg_8h @ rbp+0x8
|           ; arg int arg_ch @ rbp+0xc
|           ; arg int arg_10h @ rbp+0x10
|           0x00000000      55             push rbp
|           0x00000001      89e5           mov ebp, esp
|           0x00000003      83ec18         sub esp, 0x18
|           0x00000006      c70424100000.  mov dword [rsp], 0x10       ; [0x10:4]=0x4589ffff
|           0x0000000d      e826ffffff     call 0xffffffffffffff38
|           0x00000012      8945f0         mov dword [rbp - local_10h], eax
|           0x00000015      c745f4000000.  mov dword [rbp - local_ch], 0
|       ,=< 0x0000001c      eb62           jmp 0x80
|      .--> 0x0000001e      8345f401       add dword [rbp - local_ch], 1
|      ||   0x00000022      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024
|      ||   0x00000025      f7d0           not eax
|      ||   0x00000027      c1e810         shr eax, 0x10
|      ||   0x0000002a      334508         xor eax, dword [rbp + arg_8h]
|      ||   0x0000002d      8945f8         mov dword [rbp - local_8h], eax
|      ||   0x00000030      8b55f4         mov edx, dword [rbp - local_ch]
|      ||   0x00000033      8b45f8         mov eax, dword [rbp - local_8h]
|      ||   0x00000036      01d0           add eax, edx
|      ||   0x00000038      69c067452301   imul eax, eax, 0x1234567
|      ||   0x0000003e      35efcdab89     xor eax, 0x89abcdef
|      ||   0x00000043      894508         mov dword [rbp + arg_8h], eax ; [0x8:4]=0x1024
|      ||   0x00000046      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024
|      ||   0x00000049      31450c         xor dword [rbp + arg_ch], eax
|      ||   0x0000004c      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024
|      ||   0x0000004f      014510         add dword [rbp + arg_10h], eax
|      ||   0x00000052      8b55f4         mov edx, dword [rbp - local_ch]
|      ||   0x00000055      8b45f8         mov eax, dword [rbp - local_8h]
|      ||   0x00000058      01d0           add eax, edx
|      ||   0x0000005a      69c0efcdab89   imul eax, eax, 0x89abcdef
|      ||   0x00000060      3567452301     xor eax, 0x1234567
|      ||   0x00000065      894508         mov dword [rbp + arg_8h], eax ; [0x8:4]=0x1024
|      ||   0x00000068      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024
|      ||   0x0000006b      8945f8         mov dword [rbp - local_8h], eax
|      ||   0x0000006e      8b450c         mov eax, dword [rbp + arg_ch] ; [0xc:4]=0xff26e800
|      ||   0x00000071      894508         mov dword [rbp + arg_8h], eax ; [0x8:4]=0x1024
|      ||   0x00000074      8b4510         mov eax, dword [rbp + arg_10h] ; [0x10:4]=0x4589ffff
|      ||   0x00000077      89450c         mov dword [rbp + arg_ch], eax ; [0xc:4]=0xff26e800
|      ||   0x0000007a      8b45f8         mov eax, dword [rbp - local_8h]
|      ||   0x0000007d      894510         mov dword [rbp + arg_10h], eax ; [0x10:4]=0x4589ffff
|      ||   ; JMP XREF from 0x0000001c (fcn.00000000)
|      |`-> 0x00000080      817df4ff0000.  cmp dword [rbp - local_ch], 0xff ; [0xff:4]=-1 ; 255
|      `==< 0x00000087      7695           jbe 0x1e
|           0x00000089      8b550c         mov edx, dword [rbp + arg_ch] ; [0xc:4]=0xff26e800
|           0x0000008c      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024
|           0x0000008f      31d0           xor eax, edx
|           0x00000091      334510         xor eax, dword [rbp + arg_10h]
|           0x00000094      8945f8         mov dword [rbp - local_8h], eax
|           0x00000097      8b45f0         mov eax, dword [rbp - local_10h]
|           0x0000009a      8945fc         mov dword [rbp - local_4h], eax
|           0x0000009d      8b55fc         mov edx, dword [rbp - local_4h]
|           0x000000a0      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024
|           0x000000a3      8902           mov dword [rdx], eax
|           0x000000a5      8b45fc         mov eax, dword [rbp - local_4h]
|           0x000000a8      8d5004         lea edx, dword [rax + 4]    ; 0x4
|           0x000000ab      8b450c         mov eax, dword [rbp + arg_ch] ; [0xc:4]=0xff26e800
|           0x000000ae      8902           mov dword [rdx], eax
|           0x000000b0      8b45fc         mov eax, dword [rbp - local_4h]
|           0x000000b3      8d5008         lea edx, dword [rax + 8]    ; 0x8
|           0x000000b6      8b4510         mov eax, dword [rbp + arg_10h] ; [0x10:4]=0x4589ffff
|           0x000000b9      8902           mov dword [rdx], eax
|           0x000000bb      8b45fc         mov eax, dword [rbp - local_4h]
|           0x000000be      8d500c         lea edx, dword [rax + 0xc]  ; 0xc
|           0x000000c1      8b45f8         mov eax, dword [rbp - local_8h]
|           0x000000c4      8902           mov dword [rdx], eax
|           0x000000c6      8b45f0         mov eax, dword [rbp - local_10h]
|           0x000000c9      c9             leave
\           0x000000ca      c3             ret

How can I run the code above with the three input arguments and generate output?

Answer 1

I can see three ways to do that:

1. Using IDA's AppCall functionality to call that function from within IDA's console.
2. Spawning a debugger (x64, olly) and debug any process, find an empty region in memory and change the instruction pointer to point to it. Since parameters to this function are passed on the stack, make sure you override the stack with your desired input value.

3. If you're looking for a more automated/generic approach to running that function, run that code from within your own executable, as if it was a C function compiled.

   Using GCC and Extended ASM you can create a small stub function that will only push variables to the stack and jump to an executable region containing the raw binary defined in an array for example (make sure the region is executable and protections are off). You could also simply embed the copied assembly into your code.

Answer 2

This should work, i think i didnt miss anything.

Would be nice to know at least a few expected inputs and outputs for comparison.

Also not sure if the call 0xffffffffffffff38 would do anything to local_10h aside from making a struct of integers..

#include<stdio.h>
#include<string.h>

unsigned * func_00000000 (unsigned arg_8h, unsigned arg_ch, unsigned arg_10h) {
    static unsigned local_10h [4]; //init should be local_10h call 0xffffffffffffff38 ??
    unsigned local_ch;
    unsigned local_8h;
    unsigned local_4h;


    for (local_ch = 0; local_ch <= 0xff; ++local_ch) {
        local_8h = local_4h + (((~arg_8h >> 16 ^ arg_8h) + local_ch) * 0x1234567 ^ 0x89abcdef);
        arg_ch = ((~arg_8h >> 16 ^ arg_8h) + local_ch) * 0x89abcdef ^ 0x1234567;
        arg_8h = arg_10h ^ (((~arg_8h >> 16 ^ arg_8h) + local_ch) * 0x1234567 ^ 0x89abcdef);
        arg_10h = local_8h;
        local_4h = arg_ch;
    }
    local_10h[0] = arg_8h;
    local_10h[1] = arg_10h;
    local_10h[2] = local_4h;
    local_10h[3] = arg_8h ^ arg_10h ^ local_4h;
    return local_10h;
}

main()
{
    unsigned * p;
    int i;
    p = func_00000000(1095923727, 3459613537, 2312051101);

    for ( i = 0; i < 4; i++ ) {
        printf( "%u\n", p[i]);
   }

   return 0;

}