So I'm looking for some guidance on this topic.
If I open up my exe in a Hexeditor and go to the location where the address of the string is pushed as argument I have the following:
68 7C 9D F1 01 - push 01F19D7C
The string in the exe however is at 01ADC808.
I do have the same exe but for a different language.
68 78 DE F0 01 - push 01F0DE78
and the string is at 01B94B0C.
Looking at it in Ghidra for example, the address from the push instruction matches the location of the string. So currently my best guess is, that Ghidra aligns the data properly with info from the PE Header.
I'm writing a tool that modifies that string. Patterns could be created for each version, however I'd like a rather "universal" way to solve this.
Feel free to let me know if my question was not clear enough or more information is required!
Thanks in advance for any advice! :)
EDIT: Forgot to mention the tool I'm writing is written in C#.