I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it.
How can I run an exe file from a specific offset and give it parameters to some arguments?
3
-
Question too broad. Read these: hex-rays.com/products/ida/debugger/index.shtml and hex-rays.com/products/ida/support/tutorials/debugging.shtml– BiswapriyoCommented Dec 24, 2018 at 17:26
-
@Biswapriyo I know how to debug program, that not what I want, I want to create a new exe file starting from spesific offset and set it parameters– g319909.nwytg.coMCommented Dec 24, 2018 at 17:44
-
Provide a hello world like example. It'll help to understand your question.– BiswapriyoCommented Dec 24, 2018 at 17:46
Add a comment
|
3 Answers
You can use Ida's Appcall functionality:
Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a mechanism can be used for debugging, fuzzing and testing applications. Appcall mechanism highly depends on the type information of the function to be called. For that reason it is necessary to have a correct function prototype before doing an Appcall, otherwise different or incorrect results may be returned.
I have an example of using Appcall or rolling your own on my blog here.
-
thank you, your post is great! Can you show the code how do you invoke to
sub_41C91Cwithout use IDA ?withCreateRemoteThreadby usinglpStartAddressand how can you pass the file path as a argument to this function Commented Dec 27, 2018 at 20:09 -
@g319909.nwytg.coM at the bottom of my blog post is a download link which happens to include the source code (as mentioned in the article)– RemkoCommented Dec 27, 2018 at 23:15
If you want to keep it simple, it must not do a lot of syscalls and interactions with the whole memory.
You may be looking for a Unicorn-based IDA plugin such as this one which can achieve emulation of not-too-dependent functions and provide you a view of registers and memory.
Otherwise, you may have to use Unicorns bindings outside of IDA, here are some examples and so you'll be able to emulate syscalls and all the stuff you need.
I'll suggest using LIEF. It has a neat feature add_exported_function to add a function at an address as exported in a new file. You can have a look at this feature here
-
Thank about your replay. I not sure I'm understand your offer. I have exe file with lot of function and I want to invoke to spesific function . Do you say that I can export this function ? How can I invoke to this function when I run the exe? Thanks Commented Dec 27, 2018 at 9:15
-
If you go to the linked tutorial you'll see how you can use an exported function to call. Commented Dec 27, 2018 at 10:24