Re:Petya: “I Want to Believe”
by tyingq on Friday June 30, 2017 @07:32AM
(#14669981)
>When I read stuff like "Petya (binary edited)" I feel like a complete noob
There's probably a way to try it with tools you already know. Know vim for example?
cp /bin/grep ./mygrep
vim -b ./mygrep
[find a string to change, like something from the output of ./mygrep -V]
[don't change the length]
[change a few letters]
<esc>: %s/Free Software/Tree Software/g
[save it]
:wq!
[run it]
./mygrep -V
Changing things that aren't strings just requires a little research into the file format. A linux executable, for example, would usually be in the ELF format. Knowing that, you could, for example, coerce a linux binary to load a shared library from a different directory or name. Or research x86 opcodes and change some operation to a NOP...though a hex editor might be easier than vim -b.
There's probably a way to try it with tools you already know. Know vim for example?
Changing things that aren't strings just requires a little research into the file format. A linux executable, for example, would usually be in the ELF format. Knowing that, you could, for example, coerce a linux binary to load a shared library from a different directory or name. Or research x86 opcodes and change some operation to a NOP...though a hex editor might be easier than vim -b.