1

I'm in a reverse engineering class. Our current assignment is to edit a notepad.exe application. Just to start out, I opened my notepad.exe in FlexHex, went to the end of the.rsrc section, changed a byte in one of the stock text strings from "70" to "31" and then saved the new file as an .exe. The size of the section and the overall file remains the same. Below is the line I changed.

.rsrc line I changed

When I try to run the file, I get an error that Windows cannot run the file, specifically "This app cannot run on your PC". I didn't think that I changed anything essential. I'm wondering if Windows is preventing me from running a modified version of a Window's program. Is there a way to specify that Windows should run this program?

Any help is appreciated, thank you.

  • This is weird. If you have this error message, it means you, somehow, corrupted the executable. If you try to execute notepad.exe from another designed folder (e.g. desktop), the application won't run and you won't get any error message. This is because the .mui is not present is the current folder. I suggest you share the modified executable for further investigations. – wisk Feb 24 '19 at 22:21
  • I suggest that you perform a "fc" to compare the before and after versions to see what changed. Perhaps FlexHex made additional changes, like saving in ASCII instead of binary format. – peter ferrie Mar 1 '19 at 16:59
2

I think “notepad.exe” has been digitally signed by Microsoft. You cannot change it because the signature will ( very very probably) be invalid. The OS doesn’t trust it anymore.

| improve this answer | |
  • Some evidence to back this claim up would be good. – mrexodia Mar 5 '19 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.