2

I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it.

I open foo.exe in ILSpy and was able to find myString.

I do see human readable text in the hex editor but I think the .net strings are encoded some other way.

Some background is we have a client site that switched servers on some 10+ year old code and the server configuration was hard coded. The old server was left online during testing and the issue was not found until 12 hours into production.

1

C# encodes its string literals as UTF-16. (http://csharpindepth.com/Articles/General/Strings.aspx)

To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are able to search your string.

If you are able to then change your string to the correct character without breaking UTF-16 and file size then your new string will be updated.

well i wrote a similar answer but discarded it and just adding a screen shot that explains your answer better

enter image description here

  • 2
    Please, don't call the encoding "Unicode", as Microsoft often does. Unicode has several encodings, the one used here is UTF-16. – svick Jun 20 '17 at 15:38
  • @svick, and sometimes it is UCS16 which is also annoying (Unicode code points encoded as a sixteen bit integer. – hildred Jun 23 '17 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.