Ida Pro reverse tool finds the IP and port of the socket server

When reverse analyzing code , Sometimes we need to find some software provided by the server ip:port.

Use IDA pro Decompiled code , Find the socket setting code , Find what we expect IP and port Where is the number

 

What should we do then ？

First step ： Turn the address information into 16 A positive number in hexadecimal

Check the number , Right click selection invert sign and Hexadecimal.

The second step ：ip The address is converted to an integer

Use the online address translation tool to ip The address is converted to an integer

If you want to write it yourself C Language code implementation , have access to atoi function , Refer to this article ：

C Language implementation string IP And integer type IP Mutual conversion of - Ding peifei - Blog Garden  

The third step ： Byte order conversion

There are four kinds of byte order conversion functions

htons : take 16 Wei Wu Symbolic integers are converted from local byte order to network byte order

htonl : take 32 Wei Wu Symbolic integers are converted from local byte order to network byte order

ntohs : take 16 Wei Wu Symbolic integers are converted from network byte order to local byte order

ntohl : take 32 Wei Wu Symbolic integers are converted from network byte order to local byte order

You can also do it by hand .

there IP yes 1.0.0.127 -> 127.0.0.1

there port yes 0xA822 -> 0x228A = 8872