0

Can anyone help me edit a string in a native dll?

enter image description here

When I try to open the dll in CFF explorer or other similar tools, I can't see the string table, probably because it's hidden somehow.

The DLL in question is msrating.dll (Internet Ratings and Local User Management DLL), and I want to change the string:

"This Page was blocked by your Approved Sites list."

to another specific string that will guide users to another browser when they access some sites.

Here we can see the entire string table, but I can't seem to find them while editing the DLL.

Some guidance please :( ? Thanks in advance!

2

You can find the string resources in the mui files under the folder contains resources dedicated to localization (e.g. c:\Windows\System32\en-US). The strings are in Unicode format.

enter image description here

0

There is no reason for static strings to be in the Ressource section, but that's irrelevant.

Just open the DLL in any hex editor, grep for the given string, and replace it manually. Since (from what I understand from your link) a simple strings shows your target, there should be no obfuscation whatsoever.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.