2

I'm a programmer and have an application (an executable file that maybe compiled from a c++ source).

It has an rdata section (read-only data section) that include many (several thousand) strings of the user interface of the application and I want change these strings so that after the changes, the corresponding executable file can be executed without any errors (the source is not available).

enter image description here

The app has 32 and 64 bit versions.

I have to change strings in the rdata section without damaging the executable file.

For example changing the highlighted section: enter image description here

  • Is it possible?
  • What are the correct steps and best tools too change these strings and make a new exe file?

Please guid my with tools and additional links to tutorials if it is possible in your answer and comments.


Update:

New strings are in a different language and have different lengths with the length of the main strings and i should change many string in the rdata.

Platform: Windows 8.1

  • if they are resources try reshacker by angus johnson – blabb Nov 18 '17 at 6:25
  • @blabb, I'm familiar with changing the resources of executable files but as I said these strings are not resource and some application like resource hacker dose not show them. They are inside the rdata section and I have to change rdata without damaging the executable file. I'm finding correct steps and useful tools to do it. – RAM Nov 18 '17 at 13:32
  • For same length strings you can directly patch from a hex editor such as ghex in Ubuntu. For shorter strings pad with \x00 to the same length. – sudhackar Nov 18 '17 at 13:52
  • @blabb, I updated the question with some images and... Please read it. – RAM Nov 18 '17 at 13:57
  • @sudhackar, Thank you for your reply. My platform is Windows and the new strings are in a different language with different length. – RAM Nov 18 '17 at 13:59
2

it is a tough and tedious task and completely error prone

assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push opcode and the strings would be in .rdata section

#include <windows.h>
const char mystr1[] = "mystr1";
const char *mystr2 = "mystr2";
void main(void) {
    MessageBoxA(0,mystr2,mystr1,0);
}

as seen below

|           0x00401000      6a00           push 0 
|           0x00401002      6810204000     push str.mystr1  
|           0x00401007      ff3500304000   push dword [0x403000]
|           0x0040100d      6a00           push 0
|           0x0040100f      ff1500204000   call dword [sym.imp.USER32.dll_MessageBoxA]
|           0x00401015      33c0           xor eax, eax
\           0x00401017      c3             ret

checking the strings

[0x00401000]> ps @0x402010
mystr1
[0x00401000]> pv @0x403000
0x00402018
[0x00401000]> ps @0x402018
mystr2

you can use some tools like CFF_Explorer iidking etc to add a section

radare2 also adds a section but i couldn't coax it to write back the section details back to pe header

Comparing files rdata.exe and RDATA1.EXE
000000C6: 04 05
00000111: 50 60
000001C0: 1E 00
000001C1: 00 10
000001E8: C2 00
000001E9: 01 10
00000210: 04 00
00000211: 00 10
00000238: 1C 00
00000239: 00 10
00000258: 00 2E
00000259: 00 6A
0000025A: 00 73
0000025B: 00 74
00000260: 00 80
00000265: 00 50
00000269: 00 02
0000026D: 00 0C
0000027F: 00 40
00000800: 18 00
00000801: 20 50
FC: RDATA1.EXE longer than rdata.exe

the new string at the new section as follows

:\>xxd -s 0xc00 -l 0x60 rdata1.exe
0000c00: 8341 838a 8347 838b 82f0 8e67 82c1 82c4  .A...G.....g....
0000c10: 8376 838d 8379 838d 82c9 82e6 82c1 82c4  .v...y..........
0000c20: 9755 9866 82b3 82ea 82bd 9792 82cd 8141  .U.f...........A
0000c30: 837e 8389 8393 835f 82aa 88a4 82f0 91cc  .~....._........
0000c40: 8cb1 82c5 82ab 82e9 82e6 82a4 82c9 82b7  ................
0000c50: 82e9 0000 0000 0000 0000 0000 0000 0000  ................

the modification at 0x800 , 0x801 in diff above is redirection to this string

now if you execute this you will get gibberish

you may either need to set the System Locale or need the now discontinued app like applocale.applet with appcompat shim database to hook and hack the Unicode characters

do it if it is your cup of tea :) (try translating the messagebox message for a refresher )

enter image description here

  • did you use nul character in string ? and have you checked out it's ascii coded ? – Abr001am Nov 27 '17 at 13:56
  • @idle sorry i am not able to understand your comment – blabb Nov 27 '17 at 17:41
  • It's because the string formatting doesn't look ascii at all, more like UTF-16. – Abr001am Nov 27 '17 at 17:45
  • @idle i have never mentioned ascii in my demo i say unicode or rather a wide char array of letters in a non english language – blabb Nov 27 '17 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.