Binary Cracking and Byte Patching With IDA Pro

#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <conio.h>  
#define password "ajay"  
int _tmain(int argc, _TCHAR * argv[]) {  
  char pwd[100];  
  printf("Please enter the password::\n\n");  
  scanf("%s", pwd);  
  if (strcmp(pwd, password) == 0) {  
    printf("Congratulation!!\n\n");  
    printf("Ready to login with: %s", password);  
  } else {  
    printf("Wrong password");  
  }  
  getch();  
  return 0;  
} 

Finally, we have concluded that hex code 35 is the key value that directs the execution flow of the program. However, select the address location 0041140D in text view go to the Edit menu, choose Patch program, and select Patch Bytes there. It will show up the entire 16 hex bytes sequence like in the hex view as in the following.

To diffuse the effect of the jnz statement where the execution is shifting towards the 1oc_411444 block, we need to change its corresponding hex value from 35 to 00 which typically fills no action in the memory as in the following.

The moment you change the 1oc_411444 instruction code to 00, it will also reflect in the assembly as in the following.

You can also notice the modification in the hex view as in the following.

One of the important changes to notice is that after making the value 00, this time no jump arrow is showing that was pointing to the execution that diverts to 1oc_411444 as in earlier.

Now open the graph view and see that the “congratulation” block is merged into the main code rather than being separated as earlier before the editing of the hex value. The Blue arrow finally goes to the end of the statement block and the “wrong password” block is isolated or disconnected from the main operation. So even if we enter the wrong password value, the correct password block would always be executed because the jnz statement code is diffused to 00 and the 1oc_411444 block is disconnected as in the following.

Ok, we have done the byte editing, it is time to save the effect permanently into memory, but IDA Pro is not capable of writing bytes of the binary file into memory. It can instead write altered bytes into a database. So for this purpose, an IDA special script file is used here. Go to File select Script file and choose pe_write.idc that makes the perpetual effects in the memory as in the following.

The moment you run the pe_write.idc file, you will see that bytes have been written to segments successfully and finally, IDA will prompt to re-save the binary file as in the following.

Save the modified binary with the same name as binaryCrack.exe as in the following.

Now, load the binaryCrack.exe and it will prompt you to enter the password, merely enter a value, and Bingo! The congratulatory message along with the original password appears. We have successfully bypassed or subverted the password mechanism by patching some related critical bytes using IDA Pro.

Patching String Bytes As we can observe in the binaryCrack.exe, a couple of string messages are showing. We can access all these strings into place via the String window (shift + F12) and can directly reach its assembly code merely by clicking the string.

It is not a good programming practice to show sensitive strings like serial keys or passwords directly. Such information should be hidden because after patching (reverse engineering) the password assembly code, the hacker can easily understand that the password is “Ajay” since it is showing after the “congratulation” message. So we can hide or rename the showing of the password on the screen by patching its corresponding bytes. So, double-click over the “Ajay” in the String windows, and IDA will let us reach its assembly code where we can modify its visibility.

Thereafter open the Hex view and we can observe the “ajay” byte code sequence as 61 6A 61 79 00 as in the following.

Again open the Patch Bytes from the Patch program that resides in the Edit menu and replace all these bytes with 00 as in the following.

Now once again, run the pe_write.idc to make the changes perpetual in the binary file and the binaryCrack.exe. Enter any value as the password and observe that this time the real password is not showing.

Removing Segments A question comes into the mind of why should we display the string message after the “Congratulation” message when we subverted the password mechanism. We cannot allow the execution of a specific assembly code by using IDA Pro. Here, we can easily determine that the code instruction after address location 00411411 is senseless to be displayed as in the following.

This time we are not patching the bytes, instead, we are integrating them into new assembly code so that any string message won't be displayed after the “Congratulation” message. Hence, go and patch the program and choose to Assemble as in the following.

Now place a nop assembly instruction (that stands for no operation) and it decides that none of the code would be executed as in the following.

After this, you can see that a nop is placed after 0041132 locations as in the following.

Now, run pe_write.idc again and see that none of the code is executing after the message as in the following.

Script Patching Substitute It is not necessary that we can only patch bytes using an IDA Script file that exports the current IDA database into the EXE binary executable. Rather, we can choose another approach. First, make changes in the byte or hex code just by editing them and produce a new DIF file as a test. dif. Now open the test.dif file and it shows the original hex code and patched code as in the following.

Later compile the following C program using any editor (I suggest using GCC in the Linux platform).

#include <stdio.h>
int main(int argc, char **argv) {
    char line[256];
    FILE *patch = stdin;
    FILE *input = NULL;
    unsigned int offset;
    int orig;
    int newval;
    int i;
    
    for (i = 1; i < argc; i += 2) {
        if (!strcmp(argv[i], "-p")) {
            if ((i + 1) < argc) {
                FILE *f = fopen(argv[i+1], "r");
                if (f) {
                    patch = f;
                }
                else {
                    fprintf(stderr, "Failed to open patch file %s\n", argv[i+1]);
                    exit(0);
                }
            }
        }
        else if (!strcmp(argv[i], "-i")) {
            if ((i + 1) < argc) {
                fprintf(stderr, "Opening %s\n", argv[i+1]);
                input = fopen(argv[i+1], "rb+");
                if (input == NULL) {
                    fprintf(stderr, "Failed to open input file %s\n", argv[i+1]);
                    exit(0);
                }
            }
        }
        else {
            fprintf(stderr, "usage:\n\t%s [-i <binary>] [-p <dif file>]\n", argv[0]);
            fprintf(stderr, "\t%s [-p <dif file>]\n", argv[0]);
            fprintf(stderr, "\t%s [-i <binary>] < <dif file>\n", argv[0]);
            fprintf(stderr, "\t%s < <dif file>\n", argv[0]);
            exit(0);
        }
    }
    
    if (patch == stdin) {
        fprintf(stderr, "Reading patch data from stdin.\n");
    }
    fgets(line, sizeof(line), patch); /* eat dif file intro line */
    fgets(line, sizeof(line), patch); /* eat blank line */
       
    if (input == NULL) {
        fprintf(stderr, "Inferring input file name from patch file data.\n");
        fscanf(patch, "%256s", line);
        input = fopen(line, "rb+");
        if (input == NULL) {
            fprintf(stderr, "Failed to open input file %s\n", line);
            exit(0);
        }
    }
    else { /* don't need input file name, but need to skip it in dif file */
        fgets(line, sizeof(line), patch);
    }
    
    while (fscanf(patch, "%x: %x %x", &offset, &orig, &newval) == 3) {
        fseek(input, offset, SEEK_SET);
        if (fgetc(input) == orig) {
            fseek(input, offset, SEEK_SET);
            fputc(newval, input);
        }
        else {
            //original bytes don't match expected?
        }
    }
    fclose(input);
    if (patch != stdin) {
        fclose(patch);
    }
}

After compiling this code successfully, execute the following command in a command prompt that requires the DIF file and the new patched file name as in the following.

ida_patcher.exe -i PatchedApp.exe -p binaryCrackPatched.dif

This approach also fulfills the same objective and produces a patched binary as defined earlier in the papers.

Final Note

So, we have learned one of the amazing tactics of patching the binary and producing a new executable file using IDA Pro, for which crackers used to struggle because of the IDA limitation that it can only disassemble the binary code to analyze the vulnerabilities or bugs in the code. We can temporarily divert the instruction code by modifying the ZF register during debugging just by placing the breakpoint but can't patch or modify the bytes sequence into the memory directly to produce a new binary executable because IDA Pro makes changes in the database, not in the binary executable. This paper taught us how to see the hidden features of the Patch program in the IDA Pro IDE. We have also come across string patching and a new way to modify bytes by producing a DIF file that is later passed as an argument to a custom C patch code.