4

I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it.

How can I run an exe file from a specific offset and give it parameters to some arguments?

2

You can use Ida's Appcall functionality:

Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a mechanism can be used for debugging, fuzzing and testing applications. Appcall mechanism highly depends on the type information of the function to be called. For that reason it is necessary to have a correct function prototype before doing an Appcall, otherwise different or incorrect results may be returned.

I have an example of using Appcall or rolling your own on my blog here.

  • thank you, your post is great! Can you show the code how do you invoke to sub_41C91C without use IDA ?with CreateRemoteThread by using lpStartAddress and how can you pass the file path as a argument to this function – g319909.nwytg.coM Dec 27 '18 at 20:09
  • @g319909.nwytg.coM at the bottom of my blog post is a download link which happens to include the source code (as mentioned in the article) – Remko Dec 27 '18 at 23:15
0

If you want to keep it simple, it must not do a lot of syscalls and interactions with the whole memory.

You may be looking for a Unicorn-based IDA plugin such as this one which can achieve emulation of not-too-dependent functions and provide you a view of registers and memory.

Otherwise, you may have to use Unicorns bindings outside of IDA, here are some examples and so you'll be able to emulate syscalls and all the stuff you need.

0

I'll suggest using LIEF. It has a neat feature add_exported_function to add a function at an address as exported in a new file. You can have a look at this feature here

  • Thank about your replay. I not sure I'm understand your offer. I have exe file with lot of function and I want to invoke to spesific function . Do you say that I can export this function ? How can I invoke to this function when I run the exe? Thanks – g319909.nwytg.coM Dec 27 '18 at 9:15
  • If you go to the linked tutorial you'll see how you can use an exported function to call. – sudhackar Dec 27 '18 at 10:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.