0

Simple as that. I have a massive Disassembly, that I want to check for I.P addresses. Since the text search in IDA doesn't seem to have a regex function, I'm not sure the best way to get this done. Perhaps a script?

I also realize this may be complicated by the fact that some of the I.P adresses may not exist as strings.

Improve this question
8
  • Are these specific IP addresses you know, or are you looking for anything that looks like a random IP address?
    – Guntram Blohm
    Mar 2, 2015 at 10:05
  • Anything that looks like a random i.p address
    – MrSynAckSter
    Mar 2, 2015 at 12:57
  • 2
    You'll never find random IP addresses that aren't strings that way, since just about every byte combination might be an IP address. Or better, you'll find way too many. Even your "Hello world!" string might be 110.145.154.154 .. As for strings, right-clicking the strings window and selecting "modify filters" brings up a dialog that includes a "regular expression" checkbox.
    – Guntram Blohm
    Mar 2, 2015 at 18:31
  • That's a useful answer, thanks! I would have expected a regex search to have been under the text search functionality.
    – MrSynAckSter
    Mar 2, 2015 at 18:41
  • However, if you have any tips for automatically finding spots where I.P addresses that aren't strings are loaded into memory (I'm trying to find the "call home" i.p for an antivirus) I'm all ears.
    – MrSynAckSter
    Mar 2, 2015 at 18:46

1 Answer 1

Reset to default
1

Only responds to ping probes from arbitrary hosts

In that case, reverse engineer the code that calls recvfrom() to find out how it validates the source IP of the received ping packet.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.