2

I am learning IDA pro on a test binary and I'd like to return a static value from this function:

; __int64 __fastcall sub_B580(char *name)
sub_B580 proc near

pai= qword ptr -70h
req= addrinfo ptr -68h
service= byte ptr -2Fh
var_20= qword ptr -20h

; __unwind {
push    rbp
push    rbx
sub     rsp, 68h
mov     rax, fs:28h
mov     [rsp+78h+var_20], rax
xor     eax, eax
test    rdi, rdi
jz      loc_B676

2

Returning a static value from any function is quite easy. I assume that your calling convention takes return value in the (e|r)ax register.

So to return some value, just patch your function to look like

mov rax, <value>
ret

Lets consider an example.

#include <stdio.h>

int test(int n) {
    int i, sm = 0;
    for (i = 1; i <= n; i++)
        sm += (i * i);
    return sm;
}

int main(int argc, char **argv) {
    int n;
    scanf("%d", &n);
    printf("%d\n", test(n));
    return 0;
}

When run this looks like

$ ./test
9
285
$ ./test
10
385

When compiled this looks like

.text:0000000000000720                 public test
.text:0000000000000720 test            proc near               ; CODE XREF: main+2C↓p
.text:0000000000000720
.text:0000000000000720 var_14          = dword ptr -14h
.text:0000000000000720 var_8           = dword ptr -8
.text:0000000000000720 var_4           = dword ptr -4
.text:0000000000000720
.text:0000000000000720 ; __unwind {
.text:0000000000000720                 push    rbp
.text:0000000000000721                 mov     rbp, rsp
.text:0000000000000724                 mov     [rbp+var_14], edi
.text:0000000000000727                 mov     [rbp+var_8], 0
.text:000000000000072E                 mov     [rbp+var_4], 1
.text:0000000000000735                 jmp     short loc_745
.text:0000000000000737 ; ---------------------------------------------------------------------------
.text:0000000000000737
.text:0000000000000737 loc_737:                                ; CODE XREF: test+2B↓j
.text:0000000000000737                 mov     eax, [rbp+var_4]
.text:000000000000073A                 imul    eax, [rbp+var_4]
.text:000000000000073E                 add     [rbp+var_8], eax
.text:0000000000000741                 add     [rbp+var_4], 1
.text:0000000000000745
.text:0000000000000745 loc_745:                                ; CODE XREF: test+15↑j
.text:0000000000000745                 mov     eax, [rbp+var_4]
.text:0000000000000748                 cmp     eax, [rbp+var_14]
.text:000000000000074B                 jle     short loc_737
.text:000000000000074D                 mov     eax, [rbp+var_8]
.text:0000000000000750                 pop     rbp
.text:0000000000000751                 retn
.text:0000000000000751 ; } // starts at 720
.text:0000000000000751 test            endp

Click on the function start at 0x720. Go to Edit -> Patch Program -> Assemble.

In the window opened write

mov eax, 99

and press OK.

It will patch the current push rbp.

Finally write

ret

press OK and then Cancel to stop patching.

Go to Edit -> Patch Program -> Apply patches to input file

Save binary with the updated changes. Now it runs like

$ ./test
9
99
$ ./test
10
99
$ ./test
99
99
| improve this answer | |
  • Thank you so much. I had another question: I have a if condition that if met will call exit(0). Is there a way i can change exit(0) to continue; ? – bestupload Oct 19 '19 at 1:38
  • 1
    Please post it as other question. – sudhackar Oct 19 '19 at 2:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.