0

I was playing around with some golang code I wrote, and I modified the Go BuildID. However, I had to pad whatever I wanted the buildID to be with characters so that it was the length of the original string.

I found that both hexedit and Ghirda's Byte Viewer (which allows modifying bytes) do not allow you to delete bytes (unless I cannot figure out how) from a file. I am wondering whats the reasoning, is there some sort of checksum they don't want you to overwrite? What about files where a checksum is not a concern?

Which tool can I use to modify hex bytes, including deleting them from the file?

Improve this question
1
  • Deleting bytes means changing the file-size and all sections after the delete position move "forward" the number of deleted bytes. This means you would have to update all pointers and other references. So if you miss just one pointer/reference then the executable will be defect.
    – Robert
    Aug 27, 2022 at 22:54

1 Answer 1

Reset to default
1

Deleting bytes would move around anything after the edit, breaking pointers which would break the whole binary, so Ghidra doesn't even allow you to do it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.