3

A qualifier - all I know of what I'm about to explain has been gathered from spending the last few hours researching to solve my problem, so forgive the naivety and clumsiness of a non-expert in this particular area of tech... including the title.

I have a very old and small (possibly DOS) .exe program file that I got from the net. The program works perfectly, but its text strings are in French. I'm wanting to modify just those text strings to change them to English. According to PEid, the program was written in MS Visual C++, although I couldn't find a C++ decompiler that was free, or anything else that would allow me to edit the program in anything other than Hex or machine code. Hex is a lot less intimidating, so I decided to opt for editing it via CFF Explorer.

Explorer is great because it allows me to update the checksum each time I edit the file, which does away with a previous problem that corrupted the program file each time I tried to edit it, but now I'm having another problem: I can only seem to edit the text strings of the program with CFF insomuch as the overall character count remains the same - add any more or less characters than the original .exe, and the output of the file is overwritten... or at least, that's what it looks like from my end.

So, is it possible to edit an .exe file without the limitation of keeping the amount of characters in it the exact same?

I'd really appreciate an answer. Thanks!

Improve this question
2
  • Are the strings in a PE section named .rsrc or in a PE section with a different name?
    – Jason Geffner
    Commented Jan 2, 2016 at 15:21
  • Just use a disassembler. Modify all the text strings and assemble it again. Should be an easy thing to do if it's not too large of a file and is not packed.
    – Viktor
    Commented Jan 3, 2016 at 5:11

3 Answers 3

Reset to default
2

Without seeing the program, we can't say definitely one way or the other if it would be possible.

However, whenever the French text is at least the same size as the English equivalent, you can simply use a hex editor to overwrite the French text with the corresponding English text without any issue (leaving any left-over French characters in place, in order to keep the file size the same). The problem that you will have is whenever the English text would be longer than the French text.

In that case, you would have to extend the size of the file (including adjusting the header fields that specify the length internally), apply the English text to this new area, and then find all references to the original text, and replace them with references to the new text.

Improve this answer
1

Ok, you clearly have no idea what you are on about. However this is not a problem, first learn why a C++ Decompiler is a weird thing to ask for. Second, if you are in luck the strings can be accessed directly from the program. Open the application in a decen hexeditor (HxD, 010, Hiew, Hexworkshop) and scroll down hoping you find the strings. Edit them (dont forget to close with a NULL-Byte), test if that works and work from there.

However if the text is written with lets say bitmaps, you'll have to disassemble the application. Can you share the bin w/ us?

Improve this answer
3
  • I don't see at all how it's a weird thing to ask for, especially given that there's a clear precedent of them being asked for, with plenty of answers, plus the fact that I spent a good portion of yesterday downloading many: stackoverflow.com/questions/205059/is-there-a-c-decompiler, and reverseengineering.stackexchange.com/questions/2603/… and hex-rays.com/products/decompiler/compare_vs_disassembly.shtml.
    – Hashim Aziz
    Commented Jan 2, 2016 at 21:35
  • As mentioned in the question details, I've already found the strings, they're in ASCII format - the problem I get is that I can't edit the strings unless I put in or take away the exact amount of characters that are already there. I'm not doing what you mentioned about "closing with a NULL-Byte" nor do I know what it is - is that likely to be the answer to my problem?
    – Hashim Aziz
    Commented Jan 2, 2016 at 21:39
  • 1
    Well when you have the string "Hallo\0" if you remove bytes all the code around gets messedup. So if you'd change it to "Hi\0" things will break. But you can change it to "Hi\0XXX" to keep all the buffers the same. If this leads to not having enough space, you'll have to change the location the strings are and fix where the code will look for them.
    – Stolas
    Commented Jan 3, 2016 at 11:01
1

IDA Pro https://www.hex-rays.com/products/ida/ and my blog https://firebitsbr.wordpress.com/2015/09/28/list-of-pluginsscripts-for-ida-pro-both-re-malware-vulnerabilities-and-exploits/ many plugins for ida pro.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.