0

I am developing a game in GameMaker: Studio and have run into a minor problem. No matter what I do, the games output payload is generated, named, and referenced as data.win. I would like to name it something other than data.win and still be able to run it. I have been able to pinpoint the reference of the payload in the game's executable with OllyDbg, but am, of course, limited to modifying the value with only eight bytes. I know it is possible to insert bytes in OllyDbg, but I can't figure out how.

Here is the value I found in referenced strings

I was able to change the extension successfully, but only that. I did this to ensure that modifying this value directly actually works.

Yes, I am completely aware that this has the potential to break the executable, but it is a risk I am willing to make. I have already used Binary edit both with, and without the Keep size box checked. I am still somewhat new to OllyDbg, so any help is grealy appreciated.

Improve this question

1 Answer 1

Reset to default
2

So you are trying to modify a string, increasing it's size? You actually can insert more than 8 bytes there if you uncheck "Keep size" box and continue typing bytes as usual (don't forget to insert 0 byte at the end of a string), but you will end up with corrupting following data (next string in your case)

Here you have 2 solutions:

  1. Forget about your next string, corrupt it
  2. Create you file name string in some other empty space in memory, modify all references to your original "data.win" string to reference your new string (you can find all references by RMB click at the begining of a string -> Find references to -> Selected block), and save modified executable
Improve this answer
5
  • I modified the string using the first method (that's usually what I do), but if it exceeds eight bytes the executable can no longer locate the payload. Overwriting the neighboring string doesn't seem to be ideal. Is there perhaps a way to insert additional bytes that will shift the rest of the data over by as many bytes that are inserted? Your second option sounds promising, but I don't even know where to start on it.
    – Mr. Mendelli
    Aug 6, 2017 at 18:26
  • How do you think you can shift the data? It is impossible. If your program knows that some specific variable is located at adress 1D400, you can't simply shift it, you will invalidate basically EVERYTHING. "executable can no longer locate the payload" - what does it mean? Can you explain in more details? Everything should be okay, just rewrite that next useless string. Or if you don't want to, you have an extremely complicated solution. If you are still interested in it, i can try to explain it, but you will still have to do the work by yourself
    – Eugen1344
    Aug 6, 2017 at 22:50
  • If the payload remains as data.win, the game will run automatically and normally. If however, the payload is named to something other than "data.win", the executable brings up explorer.exe and asks the user to manually browse for the payload. Now, this method does work, but is obviously not as stream-lined. I have overwritten the next string, but by doing so the executable asks to browse again. I believed that shifting the data was necessary because I believe the data.win value needs to be in the location it is currently in, while retaining the bytes between the next string.
    – Mr. Mendelli
    Aug 7, 2017 at 8:51
  • String is a variable that consists of chars, ending with special bytes 0x00 0x00 to indicate the end of a string (in your case it may be 4 0 bytes like 00000000 because it is compiler dependent). If you have extended it's length, everything should work properly. If your executable can't find the file, there are a lot reasons it can't. Maybe there is another string "data.win" that is referencing this file, or the file simply does not exist
    – Eugen1344
    Aug 7, 2017 at 13:53
  • Please provide some screenshots, i have no idea what have you modified, thus i can't properly help you
    – Eugen1344
    Aug 7, 2017 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.