-2

My target exe file has a button. It will display a webpage when the button is clicked on. I used OllyDBG to disassemble this file. My questions are:

  1. How can I find the url of this webpage? I have searched text strings, but found nothing.
  2. I want to create a new button with the same function as this previous button. How can I make this work?
3
  1. It may be generated dynamically, loaded from a file, be there, but obfuscated or encrypted, in the original .exe, or something else. The easiest way to get the url is probably using Fiddler, as you're on windows. Listening to network communication with wireshark or a similar program might work as well, but if the application uses TLS, encryption will get in the way, which fiddler can usually work around.

  2. This is where it becomes complicated. Adding a new button to a dialog box might work with a resource editor, if the application uses standard windows gui elements. If the application uses a different GUI framework, you're out of luck. Once you have the button, you need to change the button handler of the dialog box to recognize your new button id and react accordingly. This includes writing a new routine, finding a bunch of unused bytes in the code segment of your .exe to place it in, or enlarging the code segment or creating a new segment for your code, patching the original button handler to call your routine if the new button ID is detected, and hoping you don't break anything in the process. Considerable experience is required for this to work, so if you're a beginner with RE, you probably have to learn a lot before attempting this.

  • Poor me, XN resource editor can modify child dialogs, but not main windows - where I want to add new button. Is my work possible now? May be I should try to change this default url to my own url :( – tungdt Dec 15 '14 at 11:03
0

To find the url which the application connects to search for window socket functions wsaconnect, or set a return breakpoint which will break in when a function return after you click the button and see the stack for functions executed and values pushed, for modifying try to include a resource dialog and find a code cave to write code for executing your app dialog.

  • thank you! set breakpoint in all APIs of WS2_32.dll and found the url, however it is not hardcoded. So can I modify this url to my own url? – tungdt Dec 15 '14 at 10:56
  • Find from where the url is taken, nd modify the source, or find a code cave write ur url there, and replace the address of url with your in the api function call. – Alok Saini Dec 15 '14 at 11:00
0

As the page is about to be displayed, capture the text (probably, basically a large string) using a code hook. Use the same memory allocation functions the target is using (if it's using a DLL CRT it will be easier). "Realloc()" or just recreate the text to fit in your changes (I.E. an html button section) using string functions. The hard part might be that you'll have to handle the extra button press(es) your self via probably yet another hook.

Is it connecting to hosted webpage on the net? If not it probably has a mini-webserver built in. There is a good chance in this case it's either using an open source, or commercial setup. Look for strings in the target that indicate what library/system it might be using, and, or, look for relevant DLL's (like "awesomium", etc.) in the targets path. You might be able to find matching libs that you can use; again making some general assumptions that you are going to facilitate your mod/hack via a DLL.

You got to do more RE'ing to find out how it's doing things and the answer(s) will reveal it's self.

-1

As for the webpage URL changing use CFF Explorer' hex editor to search for the caption of the button, there you will find a parameter that execute the URL and change it to your favourite

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.