Raw botnet message size?

concept · Post by **concept** » Tue Aug 26, 2003 4:22 am

I would like to enlarge the size of the raw messages sent between bots on a botnet. I'm not very familiar with the Eggdrop source code, and am not very proficient in C. Any pointers on what must be done to achieve this would be greatly appreciated.

Background: I've written a tcl script which syncronizes many eggdrop functions between bots, and all data sent back and forth between bots is encrypted. The encrypted strings are much longer than the original strings, and often become cut-off in transit between bots, I'm assuming, due to the size limit on the data sent.

One again, thanks in advance for any input.

stdragon · Post by **stdragon** » Tue Aug 26, 2003 1:17 pm

Change the code in net.c, sockgets() and sockread() for starters. I'm not sure what else, but that's the main stuff.

You'll probably end up with hidden bugs, since other functions expect the input to have a certain maximum size which you will change.

An easier solution would be for you to break the encrypted data up into chunks and recombine them at the other end. For instance, say you encrypted 520 bytes and now the data is 1600 bytes long. Your first message should be "4" because you will send the data in 4 chunks. First chunk is 500 bytes, 2nd is 500, 3rd is 500, 4th is 100. When the other bot gets all 4 chunks, it recombines them, decrypts them, and does whatever you want.

concept · Post by **concept** » Wed Aug 27, 2003 3:35 am

stdragon wrote:An easier solution would be for you to break the encrypted data up into chunks and recombine them at the other end. For instance, say you encrypted 520 bytes and now the data is 1600 bytes long. Your first message should be "4" because you will send the data in 4 chunks. First chunk is 500 bytes, 2nd is 500, 3rd is 500, 4th is 100. When the other bot gets all 4 chunks, it recombines them, decrypts them, and does whatever you want.

I've played with that, but there's an awful lot of traffic, and it does cause quite a bit of overhead in the long run, especially since the nature of the beast is that all traffic is broadcast, and not neccessarily sent to the bot or bots it is intended for.

I'd be interested in coming up in a more "efficient" way of dis' and reassembling messages though. Sooner or later, it seems, it's going to be my only option.

Thanks for the reply.

-concept

stdragon · Post by **stdragon** » Thu Aug 28, 2003 4:47 pm

I'm not sure what you tried, but putbot doesn't broadcast the message. It sends it to the hub and the hub sends it to the destination (or the next hub), but it doesn't go to all the bots.

If you don't want it to go to any other bots, why don't you open up a connection directly to it? Then you don't have to encode it, another benefit.

concept · Post by **concept** » Fri Aug 29, 2003 2:14 pm

I use putallbots to send the message to all bots on the botnet. The nature of the application requires this.

ppslim · Post by **ppslim** » Fri Aug 29, 2003 3:06 pm

Then some form of inbuilt webserver functionality, from which bots can be triggered to download using a putallbots

Methods are limitless, however, one to many functionality is pointless.

Running on putallbots completly would only see ~5.5% more traffic that raw feed.

Thats about 56KBs for every MB.