Search code examples
c++decompilingida

Is it possible to change a Byte Array (4) in a Compiled Application


Me and my friend have been creating a Advanced C++ TCPClient, He created the client, and i created the server. The client has a static IP inside the code and We lost the code for the client. I am currently wondering is it possible to decompile in IDA and change the IP. i have been scanning through IDA and i have not found the IP anywhere. Does anyone know if this is possible?

Its not as simple as just recreating the client, it is a bit more complex then just placing a listener and client


Solution

  • If the address is in fact stored in an array of 4 bytes (regardless of how it's declared), then it's quite possible to change it in the executable image.

    Finding it, with confidence, is another story. Depending on how the code was written, the bytes may be in ascending or descending order of precedence. Let's say the address is 12.34.56.78 - if you perform a binary search on the executable for those four bytes in either order and find exactly one instance, it's pretty likely that's them, and depending on how brave you are, you can just change them and see if it works.

    If you find more than one instance (in either order), things get significantly trickier.

    If you have a recollection of what the code looked like where the address was stored and used it'll make it much easier to find. In particular, if the address was actually stored in a data segment, especially if referenced from another module, that narrows down where you need to search.

    Because IPv4 addresses fit comfortably in 32-bit integers, it's entirely possible to use them in a manner where they'll only appear in actual machine instructions, which takes you into the code segment, a much more dangerous place to be playing around.

    I'd only do this for a one-off check - without the source code, the software is un-maintainable, so for anything beyond the most minimal usage, I'd say you really need to rewrite it ... and keep the source!