0

Simple as that. I have a massive Disassembly, that I want to check for I.P addresses. Since the text search in IDA doesn't seem to have a regex function, I'm not sure the best way to get this done. Perhaps a script?

I also realize this may be complicated by the fact that some of the I.P adresses may not exist as strings.

  • Are these specific IP addresses you know, or are you looking for anything that looks like a random IP address? – Guntram Blohm supports Monica Mar 2 '15 at 10:05
  • Anything that looks like a random i.p address – baordog Mar 2 '15 at 12:57
  • 2
    You'll never find random IP addresses that aren't strings that way, since just about every byte combination might be an IP address. Or better, you'll find way too many. Even your "Hello world!" string might be 110.145.154.154 .. As for strings, right-clicking the strings window and selecting "modify filters" brings up a dialog that includes a "regular expression" checkbox. – Guntram Blohm supports Monica Mar 2 '15 at 18:31
  • That's a useful answer, thanks! I would have expected a regex search to have been under the text search functionality. – baordog Mar 2 '15 at 18:41
  • However, if you have any tips for automatically finding spots where I.P addresses that aren't strings are loaded into memory (I'm trying to find the "call home" i.p for an antivirus) I'm all ears. – baordog Mar 2 '15 at 18:46
1

Only responds to ping probes from arbitrary hosts

In that case, reverse engineer the code that calls recvfrom() to find out how it validates the source IP of the received ping packet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.