3

I created a simple Cocoa app (Mac 64bit) in Xcode, and in it I created a string object, and then outputted the contents of the string in a NSLog statement.

enter image description here

Then I decided to see if I could modify the contents of the binary (exe) in the .app directory of the application. I used 0xED to change, This is my string. to This is my new string. I did this by typing the word new in the right portion of the 0xED editor.

enter image description here

Finally, I saved the file, then tried to launch it, but it appears to crash. The crash report appears somewhat cryptic to me, so I am not exactly sure why the app is crashing.

Improve this question
1
  • Maybe you didn't modify the string by pressing Insert key first..
    – SSpoke
    Commented Feb 12, 2021 at 16:12

1 Answer 1

Reset to default
3

Code before This is my string relies on addresses/offsets of data (and possibly code) after This is my string. When you insert the string new, you're effectively shifting the code/data after This is my string to the right by 4 bytes. When code before This is my string tries to access that content, it access the wrong content since the location has been shifted.

Improve this answer
3
  • Is there a proper a way to insert bits using a hex editor to prevent the crash from happening?
    – ipatch
    Commented Mar 14, 2014 at 22:17
  • 1
    In this context, no. You can likely overwrite data here without incurring any problems. But if you want to make larger changes to the text, you'd need to add the new text to the end of the program (or write it into an unused area) and then patch the code so that it references the new text instead of the old text.
    – Jason Geffner
    Commented Mar 14, 2014 at 22:56
  • .. or, alternatively, create a much larger string -- large enough to be edited without these problems. Note, however, that some executable formats do some sort of self-check with a checksum. Can't recall if Mac OS/Macho/ELF files do this, though.
    – Jongware
    Commented Mar 14, 2014 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.