0

I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names.

I tried to use a debugger and checked for the URL it posts to as binary string (referenced strings) and in the memory map but surprisingly I found nothing. The URL must be there some where after all the program knows how to send data to a specific host.

How do I find and change this URL?

0
1

The best way to find this URL is looking into EXE with disassembler like IDA(you can use free version for this).

It will disassemble EXE and then you can search for this string. If URL really isn't in the file, then you must locate function that is sending informations to the website. The best way is look for functions that are using Windows' network API. Then place some breakpoints to look what function is this one you are looking for. And now trace down the URL variable. Look where it came from, is it loaded from file, or registry, or anything else.

Now when you know where is the URL in-file you can change it with hex editor(if it is hardcoded, or change the file/registry).

Note that you need a basics of assembler to do it.

Or the fast(and not too good) way is to change hosts file :)

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.