2.7 Example of Injection of a Software
197
After finding the desired string, double-click and go to the location. IDA finds all
string cross-references inside section. To output all cross-references, press Ctrl + X.
Figures 2.45 and 2.46 show the reference inside the function that displays the
string “login as:”.
Figure 2.47 shows the instruction that we are going to change. After execution of
the backdoor code, this instruction will be used again.
After replacing PUSH 467C7C with JMP 0x47A478, the process of redirecting
the execution thread can be considered done. It is necessary to remember that the
address of the following instruction will be used as the return address after execution
of the malware code. The next step is injecting the backdoor code.
Fig. 2.45 Reference to the “login as:” string
Fig. 2.46 Reference inside the function that displays the string “login as:”
Fig. 2.47 The instruction to be changed
197
After finding the desired string, double-click and go to the location. IDA finds all
string cross-references inside section. To output all cross-references, press Ctrl + X.
Figures 2.45 and 2.46 show the reference inside the function that displays the
string “login as:”.
Figure 2.47 shows the instruction that we are going to change. After execution of
the backdoor code, this instruction will be used again.
After replacing PUSH 467C7C with JMP 0x47A478, the process of redirecting
the execution thread can be considered done. It is necessary to remember that the
address of the following instruction will be used as the return address after execution
of the malware code. The next step is injecting the backdoor code.
Fig. 2.45 Reference to the “login as:” string
Fig. 2.46 Reference inside the function that displays the string “login as:”
Fig. 2.47 The instruction to be changed