Hex Editor & VB6
in [Visual Basic]
|
Prev: Resolved: Re: Slider math
Next: use sendmessage to find folders and files in the folders in vb6
From: Jerry West on 19 Feb 2010 14:34 Hi Karl, I do indeed wish to shorten the string versus versus lengthen it. I have a statement, in part, that looks like this: Select Case True Case is = InStr(1, sTmp$, "@foobar.com", vbTextCompare) I want to change it to: Select Case True Case is = InStr(1, sTmp$, "@foo.com", vbTextCompare) As I indicated, when I load in a hex editor I cannot find this string 'foobar.com'. But any string declared as a constant --no problem. I've done a hex search and a unicode as well as text search to no avail. What could I be doing wrong? Is there a special editor for VB6 to use? As well, given what I'm trying to do it sounds like if I can find this string to edit it should work? Thanks for any additional info! JW "Karl E. Peterson" <karl(a)exmvps.org> wrote in message news:eManHgZsKHA.3908(a)TK2MSFTNGP05.phx.gbl... > > Karl E. Peterson wrote: >> Jerry West wrote: >>> I have a old VB6 exe that is important to a client for continued use. >>> The source code is not available. A hard coded string within the source >>> code needs to be changed, otherwise the exe is no longer of use to them. >>> Is it possible to use a HexEditor to open the exe and change the string >>> and resave the exe? >> >> As long as you just overwrite it. I imagine it could get very dicey if >> you tried changing the length of it. Especially if you tried to lengthen >> it. You could fairly easily shorten it, for most purposes, by filling >> the end of it with null chars. > > Just confirmed this. I changed the text in a MsgBox string, and it worked > just fine. I even truncated it by padding it out with 00's. > > But, when I inserted new bytes, to try extending it, the program blew > chunks when starting. > > So, there ya go. > > -- > .NET: It's About Trust! > http://vfred.mvps.org > >
From: Nobody on 19 Feb 2010 14:46 Try this hex editor: http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm
From: Helmut Meukel on 19 Feb 2010 14:52 Jerry, what do you mean with: > It is a hard coded string in the source. I did try opening the file in a Hex > editor but only found it showed the strings that were declared as > constants --I could not see any strings that were actually in the code itself. I just checked it myself: I created an app in VB6 with no form, just a module. Const Text01 = "Text as Constant" Sub Main Dim MyText as String MyText = Text01 Debug.Print MyText MyText = "HM-Soft Hof" Debug.Print MyText End Sub I compiled it to native code and opened the Exe with Notepad. -----<snip>----- Module1 TestStringInExe T e x t a s C o n s t a n t ^ H M - S o f t H o f VBA6.DLL -----<snip>----- As I see it, the second text "HM-Soft Hof" *is* hard coded in the source and it shows up quite fine. So what's your real problem? I can see two scenarios where the string doesn't show up in the exe: 1) it's read from a file, the registry or a database. 2) it's encrypted. So do you try to hack a password protected app? Then I will *not* help you! Helmut.
From: Karl E. Peterson on 19 Feb 2010 15:02 Jerry West wrote: > Hi Karl, > > I do indeed wish to shorten the string versus versus lengthen it. > > I have a statement, in part, that looks like this: > > Select Case True > Case is = InStr(1, sTmp$, "@foobar.com", vbTextCompare) > > I want to change it to: > > > Select Case True > Case is = InStr(1, sTmp$, "@foo.com", vbTextCompare) That should be very possible. > As I indicated, when I load in a hex editor I cannot find this string > 'foobar.com'. But any string declared as a constant --no problem. I've done a > hex search and a unicode as well as text search to no avail. What could I be > doing wrong? Is there a special editor for VB6 to use? I like the Cygnus hex editor, myself. There is a free edition available, although I'm not sure what limitations it comes with. But, using my own HexDump module (http://vb.mvps.org/samples/HexDump), it's very easy to determine the search pattern you need to look for: ?hexdump(strptr("@foobar.com"), 22) ================================================================================= lpBuffer = &h69DF3F4 nBytes = 22 069DF3F4 0000 40 00 66 00 6F 00 6F 00-62 00 61 00 72 00 2E 00 @.f.o.o.b.a.r... 069DF404 0010 63 00 6F 00 6D 00 - c.o.m. ================================================================================= > As well, given what I'm trying to do it sounds like if I can find this string > to edit it should work? I'd change the bytes to look like this: 069DE704 0000 40 00 66 00 6F 00 6F 00-2E 00 63 00 6F 00 6D 00 @.f.o.o...c.o.m. 069DE714 0010 00 00 00 00 18 03 - ...... Hope that helps. (And that it doesn't wordwrap too horribly!) -- Karl -- ..NET: It's About Trust! http://vfred.mvps.org
From: Karl E. Peterson on 19 Feb 2010 15:09
Karl E. Peterson wrote: > Jerry West wrote: >> As well, given what I'm trying to do it sounds like if I can find this >> string to edit it should work? > > I'd change the bytes to look like this: > > 069DE704 0000 40 00 66 00 6F 00 6F 00-2E 00 63 00 6F 00 6D 00 @.f.o.o...c.o.m. > 069DE714 0010 00 00 00 00 18 03 - ...... > > Hope that helps. (And that it doesn't wordwrap too horribly!) Not a great example! I didn't clean it up entirely. Here's what I meant. Before: ?hexdump(strptr("@foobar.com"), 24) ================================================================================= lpBuffer = &h69DDE64 nBytes = 24 069DDE64 0000 40 00 66 00 6F 00 6F 00-62 00 61 00 72 00 2E 00 @.f.o.o.b.a.r... 069DDE74 0010 63 00 6F 00 6D 00 00 00- c.o.m... ================================================================================= After ?hexdump(strptr("@foo.com"), 24) ================================================================================= lpBuffer = &h69DE704 nBytes = 24 069DE704 0000 40 00 66 00 6F 00 6F 00-2E 00 63 00 6F 00 6D 00 @.f.o.o...c.o.m. 069DE714 0010 00 00 00 00 00 00 00 00- ........ ================================================================================= Note that what I did was totally zero out the truncated bytes. The previous example probably would've worked, but you might as well be clean about it. -- ..NET: It's About Trust! http://vfred.mvps.org |