0

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to make it a 4 char string?

  • 2
    no unless you detour you cant mess with length – blabb Aug 26 '16 at 12:02
  • @blabb that is the only way? – Ciolte Alin Aug 26 '16 at 12:23
2

As Far As i Know there isn't another way assume you have a program like this

enter image description here

the hex for this function will look like this

0:000> db main l21
00111260  55 8b ec 6a 00 eb 04 74-68 69 00 68 67 12 11 00  U..j...thi.hg...
00111270  68 67 12 11 00 6a 00 ff-15 5c c1 14 00 33 c0 5d  hg...j...\...3.]
00111280  c3 

and disassembling the function will yield this

0:000> uf main 
smallstr!main [e:\test\smallstr\smallstr.cpp @ 2]:
    2 00111260 55              push    ebp
    2 00111261 8bec            mov     ebp,esp
    5 00111263 6a00            push    0
    6 00111265 eb04            jmp     smallstr!main+0xb (0011126b)  Branch

smallstr!main+0xb [e:\test\smallstr\smallstr.cpp @ 13]:
   13 0011126b 6867121100      push    offset smallstr!main+0x7 (00111267)
   14 00111270 6867121100      push    offset smallstr!main+0x7 (00111267)
   15 00111275 6a00            push    0
   16 00111277 ff155cc11400    call    dword ptr [smallstr!_imp__MessageBoxA (0014c15c)]
   18 0011127d 33c0            xor     eax,eax
   19 0011127f 5d              pop     ebp
   19 00111280 c3              ret

can you think of a way to alter the string "thi" to "i know what i do don't you dare to interfere with me"

the only way possible is recompile if you have source or detour the pointers to string

if you are detouring you have to take care of relocations too

00D71260 smallstr.main       /$  55            PUSH    EBP
00D71261                     |.  8BEC          MOV     EBP, ESP
00D71263                     |.  6A 00         PUSH    0
00D71265                     |.  EB 04         JMP     SHORT 00D7126B                ;  00D7126B
00D71267                     |.  74 68 69 00   ASCII   "thi",0
00D7126B                     |>  68 6712D700   PUSH    0D71267                       ; |Title = "thi"
00D71270                     |.  68 6712D700   PUSH    0D71267                       ; |Text = "thi"
00D71275                     |.  6A 00         PUSH    0                             ; |hOwner = NULL
00D71277                     |.  FF15 5CC1DA00 CALL    NEAR DWORD PTR DS:[DAC15C]    ; \MessageBoxA
00D7127D                     |.  33C0          XOR     EAX, EAX
00D7127F                     |.  5D            POP     EBP
00D71280                     \.  C3            RETN
| improve this answer | |
  • I have the source but is updated and I need to use an old bin .I don't know much about RE but I try to use this and do my best .Thanks for help – Ciolte Alin Aug 26 '16 at 13:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.