if you determined the argv and argc and values in there you gone half of the way . from value of argc you can understand how many arguments you should pass and from values in argv you can determine what you "should" pass.
i wrote a very simple example for you
70 _main proc near ; CODE XREF: _main_0j
.text:00401070 var_44 = byte ptr -44h
.text:00401070 var_4 = dword ptr -4
.text:00401070 arg_0 = dword ptr 8
.text:00401070 arg_4 = dword ptr 0Ch
.text:00401070 push ebp
.text:00401071 mov ebp, esp
.text:00401073 sub esp, 44h
.text:00401076 push ebx
.text:00401077 push esi
.text:00401078 push edi
.text:00401079 lea edi, [ebp+var_44]
.text:0040107C mov ecx, 11h
.text:00401081 mov eax, 0CCCCCCCCh
.text:00401086 rep stosd
.text:00401088 cmp [ebp+arg_0], 2
.text:0040108C jge short loc_4010A0
.text:0040108E push offset aCheckUsage ; "check usage"
.text:00401093 call _printf
.text:00401098 add esp, 4
.text:0040109B or eax, 0FFFFFFFFh
.text:0040109E jmp short loc_4010DB
as you can see there is
cmp [ebp+arg_0], 2 it means at least we have to pass one "argument" then there is jqe (jump if greater or equal) .
so we will call program with one argument to pass this condition so we will be in
loc_4010A0 and here is the code .
0 loc_4010A0: ; CODE XREF: _main+1Cj
.text:004010A0 push offset Str2 ; "n00b"
.text:004010A5 mov eax, [ebp+arg_4]
.text:004010A8 mov ecx, [eax+4]
.text:004010AB push ecx
.text:004010AC call _strcmp
.text:004010B1 add esp, 8
.text:004010B4 mov [ebp+var_4], eax
.text:004010B7 cmp [ebp+var_4], 0
.text:004010BB jle short loc_4010CC
.text:004010BD push offset aWrongPassword ; "wrong password !!!"
.text:004010C2 call _printf
.text:004010C7 add esp, 4
.text:004010CA jmp short loc_4010D9
now as you can see we have another compare here this time using strcmp and before that we will push our str and
arg_4 and here is our actual argument vector .
you can really easily analysis arguments using static and dynamic analysis but there is a few notes you have to keep in your mind .
- how many arguments we have to pass
- type of arguments
- location of arguments (argv)
also there is additional note here , sometime maybe we "DO NOT" use argc/argv for getting command line arguments we can use windows API like
GetCommandLine and so on too. you have to check how arguments are received and parsed too.