Investigation of Linux.Mirai Trojan family
u97CXm
u97CXm
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
29<br />
29<br />
The getNumberOrDefault function has the following structure:<br />
int __cdecl getNumberOrDefault(unsigned __int8 length, param2 *param,<br />
char id, int default)<br />
It returns the value from the parameter array with the specified id or the value default if the id is not<br />
found. Values for the id field:<br />
Id<br />
Value<br />
0 It is changed depending on the handler and implies either the length <strong>of</strong> the<br />
whole packet or the length <strong>of</strong> the data.<br />
1 For some types <strong>of</strong> attacks, it determines whether random data needs to be<br />
generated in the packet.<br />
2 ip_header.TOS<br />
3 ip_header.identification<br />
4 ip_header.TTL<br />
5 ip_header.flags