Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names.
I tried to use a debugger and checked for the URL it posts to as binary string (referenced strings) and in the memory map but surprisingly I found nothing. The URL must be there some where after all the program knows how to send data to a specific host.
How do I find and change this URL?
The best way to find this URL is looking into EXE with disassembler like IDA(you can use free version for this).
It will disassemble EXE and then you can search for this string. If URL really isn't in the file, then you must locate function that is sending informations to the website. The best way is look for functions that are using Windows' network API. Then place some breakpoints to look what function is this one you are looking for. And now trace down the URL variable. Look where it came from, is it loaded from file, or registry, or anything else.
Now when you know where is the URL in-file you can change it with hex editor(if it is hardcoded, or change the file/registry).
Note that you need a basics of assembler to do it.
Or the fast(and not too good) way is to change hosts file :)
