1

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer allows this and I am forced to execute my app with admin permission so it can create those files within its folder in Program Files (x86).

Now I was wondering if I can patch it by changing the directory of instead creating the files in the current directory it will instead create it at %localappdata%\MyApp\.

I know the address of the code that creates the files and I know it uses the freopen function with r+ or wb modes.

I have tried editing the path directly with a hex editor from Data\Display\OptionData.opf to %localappdata%\MyApp\od.opf but that didn't work.

What are my options? I am new to assembly and reverse engineering but I really want to fix this without injecting a DLL and detouring the function. (my issue with detours is it sometimes gets false positive as virus by some AV)

I'm now thinking of doing a codecave. But like I said I need to change the directory to the localappdata directory. How do I do this? (and supporting as far back as winxp upto latest win10)

I understand in code (c++) this will work:

char* appdata = getenv("APPDATA"); // wont work with winxp

or even:

LPTSTR GetSpecialFolder(int CSIDL) {
    TCHAR szPath[MAX_PATH];

    if (SUCCEEDED(SHGetFolderPath(NULL, CSIDL | CSIDL_FLAG_CREATE, NULL, 0, szPath)))
    {
        PathAppend(szPath, TEXT("\\MyApp\\"));
        CreateDirectory(szPath, NULL);

        return szPath;
    }
    else {
        return TEXT("");
    }
}
  • RE.SE is not for software development questions, actually. Have you considered using the USERPROFILE variable instead of APPDATA? That one would exist also on XP and earlier and all you seem to aim for is a writable location, right? – 0xC0000022L Oct 16 '18 at 12:29
  • Yes, a writable location. I do think this question fits right here. I'm reverse engineering an app I have no source code for. I'm trying to create a codecave to replace the filepath. My question really is how do I do char* appdata = getenv("APPDATA"); in assembly. – majidarif Oct 16 '18 at 12:34
  • that's my point. While you're doing this as part of a reverse engineering project, perhaps, the task of writing a certain piece of C code in assembly better fits on StackOverflow. But I'll leave it to the community to decide, especially since for a codecave special limitations apply. – 0xC0000022L Oct 16 '18 at 12:36
  • Don't patch the executable. Instead make a symbolic link from that folder to a LocalAppData\foo\bar where user has r/w permission. – Biswapriyo Oct 17 '18 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.