1

A friend asked me to make some small mod on a app. The mod should be to rewrite some labels like button, textbox text into his language, so he can better understand the app...

I loaded the app to IDA 7.0 and the two dll's too which are UPX packed, but I unpacked it before loading into IDA, but I can't find any string...

Nothing. There should be some buttons labeled with "Diagnostic", "Settings", "About the program" etc. But no way to figure out why I cant find all the strings...

Here is the link to the files I got: Files

Any help would be nice. Thank you very much.

Improve this question
3
  • Did you try to search the strings in some other tools? I mean open it with some hex editor and try to search it. BTW, did you try to search in different encodings: UTF8, UTF16?
    – Anton Kukoba
    Commented Jun 11, 2019 at 7:49
  • Thanks for reply. Yes, I tried in severan hex editors, changed encodings too but nothing. When I was first edited in my HxD I saw something strange. It looks for me like if the exe is packed or protected with some software like UPX bit I can't figure out which software is used. I also checked the exe with PEiD but it says not packed... Pic.: imgur.com/RmthSGd After opening in IDA I get a warning msg. "The imports segment seems to be destroyed..." That tells me does something is really buggy.
    – Chris
    Commented Jun 11, 2019 at 10:54
  • The main executable itself is packed with MPRESS.
    – ismael_akez
    Commented Jun 11, 2019 at 11:23

2 Answers 2

Reset to default
1

You can unpack MPRESS directly in IDA using the Bochs debugger (or any other supported by IDA). Check this blog post for the details (IDA 6.1 but still mostly applied to current versions).

Disclaimer: I work for Hex-Rays.

Improve this answer
0

The file is compressed with MPRESS. The first thing you do is debug it with OllyDbg. You can follow this link for unpacking.

Unpacked size is ~143MB.

https://www.youtube.com/watch?v=-Cg6KPMFOG0

I tried to modify the strings.

enter image description here

enter image description here

Below, you can see the properties of each strings or button.

enter image description here

Improve this answer
3
  • These strings seems to be in resources section. So if file was loaded to IDA without setting an option to load resources, then it's nothing unexpected, that strings are not found.
    – Anton Kukoba
    Commented Jun 11, 2019 at 13:13
  • I also set to load the resources but still nothing usable. As mentioned by the poster before, it is packed with MPRESS, so I have to learn how to extract it... I never faced MPRESS before... Is there any simpler way to unpack it?
    – Chris
    Commented Jun 11, 2019 at 15:18
  • Since the file is packed, you cannot find the string you mentioned above even loading it in IDAPro or any disassembler. I think it is the easiest way to unpack the file considering that we already have a tool such as OllyDump and Import Reconstructor.
    – ismael_akez
    Commented Jun 11, 2019 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.