0

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP address. I know it is easier to set-up IP Tables or use Fiddler to redirect the traffic, but I want to learn something new about reverse engineering.

The malware IPv4 address is 52.90.24.115 which I successfully replaced with a shorter address by adding a space (20 in hex) at the end, and confirmed with netstat. I was expecting to terminate with 0x00 which I found strange.

Since my honeypot IPv4 address is longer, how can I hex edit this into the malware without corrupting the PE? I have had this problem in the past, where I want to increase the length of text within an application, but if I surpass the original text's length is breaks!

If this is not possible with a hex editor (in my case Hex Editor NEO) then I am open minded to other approaches, such as reverse engineering with IDA or OlyDbg, where I can modify the executable file.

Screen shot of hex edit

3
  • Just had my question moved here. May 30, 2022 at 22:44
  • You can lengthen your IPv4 address by two numbers as you have 3 NULLs following the existing embedded IPV4 address string. This is sufficient space to embed any valid IPv4 address of the form NNN.NNN.NNN.NNN.
    – fpmurphy
    Jun 1, 2022 at 3:34
  • @fpmurphy If I give you the binary, and a fake IP address, could you try this and when it works (verify with netstat command) post an answer? I have tried using a longer IP in the manner you described, but in netstat it gives a completely different IP that is corrupted. It was also strange that I had to replace the first of the 3 NULLs with a space... Jun 3, 2022 at 15:44

1 Answer 1

1

IP addresses can also be represented as a decimal number, for example:

52.90.24.115 == 878319731

This examples saves 3 bytes, maybe give this method a try and pad with 0x20. There are many sites to convert IP to decimal for you.

4
  • But what if malware only understands/reads dotted decimal representation of ip address?
    – Viktor
    Jun 22, 2022 at 13:01
  • The screenshot shows it using HTTP so I thought it was a possibility that would usually (always?) take up fewer bytes than a dotted decimal address. However I don't have enough creds to comment on the question so had to offer it as an answer even though it's a suggestion to try. Jun 23, 2022 at 0:35
  • @MegaTonnage I appreciate the suggestion, however I was trying to learn whether there was some reverse engineering trick which did not require me to convert the IP address into decimal. I understand your suggestion and it will likely work, but that was not the answer I was looking for. Thank you! Jun 23, 2022 at 21:15
  • Ah, I see. Generally you can't write more bytes than what you're trying to replace, or you'll overwrite/corrupt the item after it. It's worth a try, but it usually fails. When working with executable code, if you need more space than you have you would insert a jump to a "code cave" (an unused portion of memory), do what you need to do, then jump back. Jun 23, 2022 at 23:26

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .