How to reverse command line arguments?

Question

I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments passed (argv). The jumps are looked up using some sorts of jump table, which is constructed dynamically. It seems to be a daunting task try to figure out all of the possible command line arguments. It looks like the binary only executes only when certain number of particular arguments is parsed. I have collected some possible options using strings utility.

Is there a general road map for reversing command line arguments? What are possible approaches to reversing them? Are there any tools that could be employed?

Answer 1

if you determined the argv and argc and values in there you gone half of the way . from value of argc you can understand how many arguments you should pass and from values in argv you can determine what you "should" pass.

i wrote a very simple example for you

70 _main           proc near               ; CODE XREF: _main_0j
.text:00401070
.text:00401070 var_44          = byte ptr -44h
.text:00401070 var_4           = dword ptr -4
.text:00401070 arg_0           = dword ptr  8
.text:00401070 arg_4           = dword ptr  0Ch
.text:00401070
.text:00401070                 push    ebp
.text:00401071                 mov     ebp, esp
.text:00401073                 sub     esp, 44h
.text:00401076                 push    ebx
.text:00401077                 push    esi
.text:00401078                 push    edi
.text:00401079                 lea     edi, [ebp+var_44]
.text:0040107C                 mov     ecx, 11h
.text:00401081                 mov     eax, 0CCCCCCCCh
.text:00401086                 rep stosd
.text:00401088                 cmp     [ebp+arg_0], 2
.text:0040108C                 jge     short loc_4010A0
.text:0040108E                 push    offset aCheckUsage ; "check usage"
.text:00401093                 call    _printf
.text:00401098                 add     esp, 4
.text:0040109B                 or      eax, 0FFFFFFFFh
.text:0040109E                 jmp     short loc_4010DB

as you can see there is cmp [ebp+arg_0], 2 it means at least we have to pass one "argument" then there is jqe (jump if greater or equal) .

so we will call program with one argument to pass this condition so we will be in loc_4010A0 and here is the code .

0 loc_4010A0:                             ; CODE XREF: _main+1Cj
.text:004010A0                 push    offset Str2     ; "n00b"
.text:004010A5                 mov     eax, [ebp+arg_4]
.text:004010A8                 mov     ecx, [eax+4]
.text:004010AB                 push    ecx             
.text:004010AC                 call    _strcmp         
.text:004010B1                 add     esp, 8          
.text:004010B4                 mov     [ebp+var_4], eax
.text:004010B7                 cmp     [ebp+var_4], 0  
.text:004010BB                 jle     short loc_4010CC
.text:004010BD                 push    offset aWrongPassword ; "wrong password !!!"
.text:004010C2                 call    _printf        
.text:004010C7                 add     esp, 4          
.text:004010CA                 jmp     short loc_4010D9 

now as you can see we have another compare here this time using strcmp and before that we will push our str and arg_4 and here is our actual argument vector .

you can really easily analysis arguments using static and dynamic analysis but there is a few notes you have to keep in your mind .

1. how many arguments we have to pass
2. type of arguments
3. location of arguments (argv)

also there is additional note here , sometime maybe we "DO NOT" use argc/argv for getting command line arguments we can use windows API like GetCommandLine and so on too. you have to check how arguments are received and parsed too.