0

I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages). I managed to replace strings in hexadecimal with other ones of same lenght, but I face some issues of course when I want to replace strings with longer ones...First option - overwrite - will overwrite next bytes, and second option - insertion - will mess up my .exe probably because of his structure and so one.

What possibilities do I have ?

Already tried radar2;ResEdit; ResTuner which founds most of strings (string tables) but not the ones which needs interaction in the exe. For example if I click on a button a dialog appears, which is not found by those tools. That's why no I'm in need to replace those strings directly with an hexadecimal editor.

After some reasearch it seems that those softwares found string in .rsrc but not in .data

EDIT1

Now I succeed. It seems that there is some kind of check of string length or something like this but not on all strings...

Here is a replaced string with his correct size: enter image description here ant it's function: enter image description here Here another with length issues:

enter image description here and it's local function: enter image description here Here what I replaced : enter image description here

It seems that ther is probably a check of string length somewhere...where do I need to give an eye ? Thanks!

EDIT2 Here sub_41A974 (I tried to understand what this fct is doing but I still don't understand: enter image description here

The fct sub_4028E0 sets font style :(1/2)

enter image description here

(2/2):

enter image description here

EDIT3

Seems that doesn't have to deal with any of this. Directly after started the software, my data is trunked (Windbg comfirmed it I only started and exit the software) : enter image description here

1

Rewriting my answer:

The resource editors (like ResTuner) find strings in resources, generally in the .rsrc section. This section is very easy to edit because it contains a tree of pointer/size to data. If you want to edit a string and you do not have enough space for the longer string - you can move it to some other address and fix the pointer and size.

If you can find the strings, but they are in .data (or some other section) then they are referenced in code by their offset. If you are lucky, the offsets are hardcoded in the program (i.e. you can see xrefs in RE tools), you can modify them. In this case, write your longer string where you have enough space, like at the end of the section and modify the hard-coded offset to point to the new area.

Resizing and moving sections around the binary files is also possible, in case you don't have enough space at the section end.

If the offsets to your strings are not hardcoded (i.e. they have no xrefs in RE tools) then they are dynamic and you will have to dig deeper in the code to find where they are referenced.

| improve this answer | |
  • When you're talking about RE Tools you're talking about reverse tools in general ? With radar2 package (rabin2.exe) I found the adress of each string in .data ! It's "paddr" but how can I change those address now ? – Martin Apr 19 at 14:15
  • Yes, reverse engineering tools (IDA, Radare2, Ghidra). In IDA: find the string's address, then click 'x' and see if you find any Xrefs. In radare2, find the string's address, then use axt <addr>. This does not guarantee you will find all of the references, but it can give you ideas where to look. – Yotamz Apr 20 at 13:08
  • Yeah I succeed with IDA thnaks ;) ! the offset was hardcoded in push op. Now I face some issues with some strings where I have the beginning of my string but not all of it. See my edit. – Martin Apr 20 at 14:54
  • I see your edit, the strings look intact. IDA will not show the full string as a comment where it is too long to fit in the line but the program will get the whole string – Yotamz Apr 20 at 16:24
  • 1
    The text font and size of your two strings are different. Are they displayed on the same object in the UI? Note that you have a this pointer in ECX and something else saved in ESI. I'd assume that you are working with a class of some visual element. If so, it may have a "maxlength" property of some sort. What is there inside SUB_41A974? – Yotamz Apr 20 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.