How to get the input necessary to get to the end

Question

In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those conditions are not met.

There are 20 of those verifications, and I do not think it is efficient to reverse it manually considering the first is (according to Ghidra disassemblying), being param1 = (long) input; and input = the 32-byte array in which the input is stored,

void verify1(long param_1){
    if ((int)*(char *)(param_1 + 4) * (int)*(char *)(param_1 + 0xf) - (int)*(char *)(param_1 + 0xd) !=
      0x349f) {
        exit(-1);
      }
    return;
}

I think a program or plugin to automate this would be useful. However, I could not find anything useful at all.

Answer 1

trying to tackle it with pencil and paper

a common pattern pattern noticeable is
(int)*(char *)(param_1 + x) which is equivalent to param_1[x] (unsigned char Array access)

so if you pass an array like

char param_1[] ={ 0,1,2,3,4,5,6,7,8,9,0xa,0xb,0xc,0xd,0xe,0xf}; 

then the function will multiply param_1[4] * param_1[0xf] and subtract param_1[0xd] or actually 4*0xf-0xd = 0x2f

since we know it is a char so any of these values can be only with 0 to 255

so the equation is a * b = 0x349f+c where a,b,c can only be between 0 and 255 or rather 1 and 255 as multiplication by 0 is 0

simply brute forcing you have a possible 215 key space for next round

def brute1(x):    
    for divisor in range(1, x + 1):
        rem = (x % divisor)
        quo = (x / divisor)
        if ( (rem == 0) and (quo < 128) and (divisor<255) ):
            print("a = %3d        b = %3d          c = %3d\t" % 
            (divisor,quo,((divisor*quo)-0x349f)))
            
print ("a = param_1[4] b = param_1[0xf] c = param_1[0xd]")            
for i in range(0x349f,(0x349f+0xff),1):    
    brute1(i)

some possible chars

python verify.py | wc -l
216
python verify.py | head -n 5
a = param_1[4] b = param_1[0xf] c = param_1[0xd]
a = 175        b =  77          c =   4
a = 245        b =  55          c =   4
a = 221        b =  61          c =  10
a = 107        b = 126          c =  11

with this in hand you can possibly lift the function and dump it into a c maybe for testing a set of key lets say (55,245,4)

#include <stdio.h>
#include <stdlib.h>

void verify1(unsigned char *param_1)
{
    if (
        (int)*(unsigned char *)(param_1 + 4) *
                (int)*(unsigned char *)(param_1 + 0xf) -
            (int)*(unsigned char *)(param_1 + 0xd) !=
        0x349f)
    {
        exit(-1);
    }
    return;
}

int main(void)
{
    unsigned char param_1[] = {0, 0, 0, 0, 55, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 245};
    verify1(param_1);
    printf("we passed verify1\n");
}

compiling and executing

cl /Zi /W4 /analyze /Od /nologo verify.cpp /link /release
verify.cpp

verify.exe
we passed verify1