Quote from: PrimeNumber7 on July 24, 2020, 04:29:59 AM

I believe it is theoretically possible to embed a virus into an image file that can run arbitrary code on someone's computer. This is probably the only way you will be able to get more than the creep's IP address on your own. How this is done is outside of my area of expertise, and I would caution that sending a file with a virus is almost certainly illegal.

It's practical. There's a science around it called steganography which embeds arbitrary bytes into an image, and the quality reduction of it is minimal and barely noticeable. You can put the image on an image host, set up a webpage that decodes it (using some javascript library like this) using some free service like Github Pages or Netlify, and then attempt to trick the blackmailer to go there.

The "virus" in this case won't be something destructive, installing Wireshark in the background and run it to sniff the attacker's network packets should disclose his IP address from which you can roughly derive which town he lives in, since there should be packets in there showing his real IP as he connects to a VPN. I think that's what eddie13 wants. The procedure is similar for Windows and MacOS there are just different privilege escalation vulnerabilities (and whatever code you'd want to run in the OS after that will be in C language) to exploit*, because you don't want to display a confirmation message for him to see then he will know he is being hacked.

There is no wireshark for android but if the attacker is using that then you can use something like androiddump instead. There's no wireshark for iOS either but regardless it is a PITA to exploit anything on with a small budget because of its security and iOS not lending itself well to background jobs.

* After exploiting a remote code execution vuln depending on the browser he's using, and different vulns can be embedded in the image that can be chosen after you inspect the User Agent to check which browser it is.

Your best bet is to find a coder whose willing to write a package to this spec. Web devs with Javascript knowledge are abundant the tricky part is finding one who is OK with doing a grey hat activity like this. I can go research these things more if you want.

Usual disclaimer: I don't condone any of this. I don't have the infrastructure or technical skills to help with anything either. I'm just explaining how it can be done. Though I also think law enforcement will handle your case very slowly and it could drag on for months.