3

I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it.

I open foo.exe in ILSpy and was able to find myString.

I do see human readable text in the hex editor but I think the .net strings are encoded some other way.

Some background is we have a client site that switched servers on some 10+ year old code and the server configuration was hard coded. The old server was left online during testing and the issue was not found until 12 hours into production.

Improve this question

1 Answer 1

Reset to default
2

C# encodes its string literals as UTF-16. (http://csharpindepth.com/Articles/General/Strings.aspx)

To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are able to search your string.

If you are able to then change your string to the correct character without breaking UTF-16 and file size then your new string will be updated.

well i wrote a similar answer but discarded it and just adding a screen shot that explains your answer better

enter image description here

Improve this answer
2
  • 2
    Please, don't call the encoding "Unicode", as Microsoft often does. Unicode has several encodings, the one used here is UTF-16.
    – svick
    Commented Jun 20, 2017 at 15:38
  • @svick, and sometimes it is UCS16 which is also annoying (Unicode code points encoded as a sixteen bit integer.
    – hildred
    Commented Jun 23, 2017 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.