0

I dont have any experience with assembler or reversing code. I need to change charset of .exe program to support turkish characters. I have opened it in Ollydbg do some tests.

enter image description here

There are several blocks like this. I tried to change binary 6A 01 to 6A A2 which should change to 162 (turkish charset) but instead turned to negative value. Also there are some codes like this one. Is changing CP_ACP to CP_UTF8 gonna work ?

Either way, is it possible to edit like this and get program support charset ?

enter image description here

2

I tried to change binary 6A 01 to 6A A2 which should change to 162 (turkish charset) but instead turned to negative value.

Usually the instruction set reference is a huge help if you don't understand how instructions behave. In this case, I'd say you will need to use 68 (PUSH imm32) instead of 6A (PUSH imm8). The imm8 is sign-extended when pushed onto the stack. Note that you'll have to either shift the following function code by 3 bytes (which are the difference in sizes between imm32 and imm8 operands). Depending on the compiler used, its options, and the function size, there may be pad bytes after the function which can be used exactly for that. Watch out for e.g. jump tables, if there are any -- they may need to be patched as well.

If it is not possible to shift the code, you can make use of code space somewhere else in the executable -- usually, the last page in .text is not fully used; move instructions that do not fit there and make a jump, like:

...
PUSH EDI
PUSH EDI
PUSH A2 ; Your patched insn; 5 bytes
...
PUSH 190
PUSH EDI
PUSH EDI
; So we need 2 extra bytes here
; Moving CALL gives 6, patched PUSH takes 3, patched JMP takes 5
; Moving two PUSHes along with CALL solves the problem
JMP _somewhere_ ; Takes 5 bytes, opcode E9 disp32
PUSH Game5_4.... ; back is here

And then, in the newly coded part (_somewhere_):

PUSH EDI
PUSH EAX
CALL DWORD PTR DS:[<&GDI32.CreateFontA>]
JMP back

Is changing CP_ACP to CP_UTF8 gonna work ?

I don't know, to be honest. Depends a lot on other code. Making the program support something it was not designed for is a big ordeal. It might work, it might not, it might end up being buggy.

| improve this answer | |
  • @safarov Please accept this answer then. It is good to mark a problem as solved. Thank you – user11773 Nov 14 '15 at 6:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.