I created a simple Cocoa app (Mac 64bit) in Xcode, and in it I created a string object, and then outputted the contents of the string in a NSLog statement.

enter image description here

Then I decided to see if I could modify the contents of the binary (exe) in the .app directory of the application. I used 0xED to change, This is my string. to This is my new string. I did this by typing the word new in the right portion of the 0xED editor.

enter image description here

Finally, I saved the file, then tried to launch it, but it appears to crash. The crash report appears somewhat cryptic to me, so I am not exactly sure why the app is crashing.

  • Maybe you didn't modify the string by pressing Insert key first.. – SSpoke Feb 12 at 16:12

Code before This is my string relies on addresses/offsets of data (and possibly code) after This is my string. When you insert the string new, you're effectively shifting the code/data after This is my string to the right by 4 bytes. When code before This is my string tries to access that content, it access the wrong content since the location has been shifted.

  • Is there a proper a way to insert bits using a hex editor to prevent the crash from happening? – ipatch Mar 14 '14 at 22:17
  • 1
    In this context, no. You can likely overwrite data here without incurring any problems. But if you want to make larger changes to the text, you'd need to add the new text to the end of the program (or write it into an unused area) and then patch the code so that it references the new text instead of the old text. – Jason Geffner Mar 14 '14 at 22:56
  • .. or, alternatively, create a much larger string -- large enough to be edited without these problems. Note, however, that some executable formats do some sort of self-check with a checksum. Can't recall if Mac OS/Macho/ELF files do this, though. – Jongware Mar 14 '14 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.