Hex Editor & VB6
in [Visual Basic]
|
Prev: Resolved: Re: Slider math
Next: use sendmessage to find folders and files in the folders in vb6
From: Jerry West on 19 Feb 2010 15:10 I explained further what I meant in my response to Karl. I still do not see the strings in question. Do I need to convert the string to Hex and search that way, including spaces between the letters? Because I did try that to no avail. It just doesn't seem to show up but I can't discount I'm doing something wrong in searching for it. The file is not encrypted nor does it read strings from the registry nor is it a file I'm trying to hack for nefarious purposes. Also, not trying to open in Notepad but a hex editor. JW "Helmut Meukel" <NoSpam(a)NoProvider.de> wrote in message news:uwbna0ZsKHA.1476(a)TK2MSFTNGP02.phx.gbl... > Jerry, > > what do you mean with: >> It is a hard coded string in the source. I did try opening the file in a >> Hex editor but only found it showed the strings that were declared as >> constants --I could not see any strings that were actually in the code >> itself. > > I just checked it myself: > I created an app in VB6 with no form, just a module. > Const Text01 = "Text as Constant" > Sub Main > Dim MyText as String > MyText = Text01 > Debug.Print MyText > MyText = "HM-Soft Hof" > Debug.Print MyText > End Sub > I compiled it to native code and opened the Exe with Notepad. > -----<snip>----- > Module1 TestStringInExe T e x t a s C o n s t a n t > ^ H M - S o f t H o f VBA6.DLL > -----<snip>----- > As I see it, the second text "HM-Soft Hof" *is* hard coded in > the source and it shows up quite fine. > So what's your real problem? > I can see two scenarios where the string doesn't show up in > the exe: > 1) it's read from a file, the registry or a database. > 2) it's encrypted. So do you try to hack a password protected > app? Then I will *not* help you! > > Helmut.
From: Karl E. Peterson on 19 Feb 2010 15:24 Jerry West wrote: > I explained further what I meant in my response to Karl. > > I still do not see the strings in question. Do I need to convert the string > to Hex and search that way, including spaces between the letters? Because I > did try that to no avail. It just doesn't seem to show up but I can't > discount I'm doing something wrong in searching for it. The file is not > encrypted nor does it read strings from the registry nor is it a file I'm > trying to hack for nefarious purposes. Also, not trying to open in Notepad > but a hex editor. Try this one: Cygnus Hex Editor FREE EDITION http://www.softcircuits.com/cygnus/fe/ On the Find dialog, there's a Find Text tab which offers a "Unicode text" option. That found the string I was looking for in a flash. -- ..NET: It's About Trust! http://vfred.mvps.org
From: Helmut Meukel on 19 Feb 2010 15:33 "Helmut Meukel" <NoSpam(a)NoProvider.de> schrieb im Newsbeitrag news:uwbna0ZsKHA.1476(a)TK2MSFTNGP02.phx.gbl... > Jerry, > > what do you mean with: >> It is a hard coded string in the source. I did try opening the file in a Hex >> editor but only found it showed the strings that were declared as >> constants --I could not see any strings that were actually in the code >> itself. > > I just checked it myself: > I created an app in VB6 with no form, just a module. > Const Text01 = "Text as Constant" > Sub Main > Dim MyText as String > MyText = Text01 > Debug.Print MyText > MyText = "HM-Soft Hof" > Debug.Print MyText > End Sub > I compiled it to native code and opened the Exe with Notepad. > -----<snip>----- > Module1 TestStringInExe T e x t a s C o n s t a n t > ^ H M - S o f t H o f VBA6.DLL > -----<snip>----- > As I see it, the second text "HM-Soft Hof" *is* hard coded in > the source and it shows up quite fine. > So what's your real problem? > I can see two scenarios where the string doesn't show up in > the exe: > 1) it's read from a file, the registry or a database. > 2) it's encrypted. So do you try to hack a password protected > app? Then I will *not* help you! > > Helmut. Don't get me wrong, I can think of some totally legal motives to change an encrypted string. As you said in your follow-up posts, things like a company name or web adress. The programmer might have encrypted the name of his customer to prevent use of illegal copies by other companies. Now the name of the customer changed, and the original programmer is long dead, out-of-business, ... But... From the distance I can't judge if it's legal, doubtful or plain illegal. So I stay away and won't help. Helmut.
From: Helmut Meukel on 19 Feb 2010 15:48 Jerry, I didn't say the file is encrypted, just the string may be encrypted. this mustn't be something fancy. Even if the programmer did something simple like: MyString = part1 & part2 & part3 & part4 where part1, part2, part3 and part4 are declared elsewhere in the code, some as constants some as functions, then I think you are out of luck. About hacking, read my earlier follow-up post. Helmut. "Jerry West" <jw(a)comcast.net> schrieb im Newsbeitrag news:XcydnQpPJvWPbePWnZ2dnUVZ_tWdnZ2d(a)giganews.com... >I explained further what I meant in my response to Karl. > > I still do not see the strings in question. Do I need to convert the string to > Hex and search that way, including spaces between the letters? Because I did > try that to no avail. It just doesn't seem to show up but I can't discount I'm > doing something wrong in searching for it. The file is not encrypted nor does > it read strings from the registry nor is it a file I'm trying to hack for > nefarious purposes. Also, not trying to open in Notepad but a hex editor. > > JW > > "Helmut Meukel" <NoSpam(a)NoProvider.de> wrote in message > news:uwbna0ZsKHA.1476(a)TK2MSFTNGP02.phx.gbl... >> Jerry, >> >> what do you mean with: >>> It is a hard coded string in the source. I did try opening the file in a Hex >>> editor but only found it showed the strings that were declared as >>> constants --I could not see any strings that were actually in the code >>> itself. >> >> I just checked it myself: >> I created an app in VB6 with no form, just a module. >> Const Text01 = "Text as Constant" >> Sub Main >> Dim MyText as String >> MyText = Text01 >> Debug.Print MyText >> MyText = "HM-Soft Hof" >> Debug.Print MyText >> End Sub >> I compiled it to native code and opened the Exe with Notepad. >> -----<snip>----- >> Module1 TestStringInExe T e x t a s C o n s t a n t ^ H >> M - S o f t H o f VBA6.DLL >> -----<snip>----- >> As I see it, the second text "HM-Soft Hof" *is* hard coded in >> the source and it shows up quite fine. >> So what's your real problem? >> I can see two scenarios where the string doesn't show up in >> the exe: >> 1) it's read from a file, the registry or a database. >> 2) it's encrypted. So do you try to hack a password protected >> app? Then I will *not* help you! >> >> Helmut. >
From: Stan Weiss on 19 Feb 2010 16:13
Read EXE file into HOLD NName = Text3.Text 'get search string NNameUni = StrConv(NName, vbUnicode) Inc = InStr(HOLD, NNameUni) If Inc > 0 Then ' Replace string here Write new EXE file here Else ' String not found End If Stan dpb wrote: > > Jerry West wrote: > > I have a old VB6 exe that is important to a client for continued use. > > The source code is not available. A hard coded string within the source > > code needs to be changed, otherwise the exe is no longer of use to them. > > Is it possible to use a HexEditor to open the exe and change the string > > and resave the exe? Would this idea be a viable solution? The string is > > not a constant. It is a hard coded string in the source. I did try > > opening the file in a Hex editor but only found it showed the strings > > that were declared as constants --I could not see any strings that were > > actually in the code itself. > > > > Can anybody shed some light on this? > > The string is embedded in the executable if it is a constant string. It > will be unicode though, so a simple ASCII search won't find it easily. > > But, if you can change it to a usable string in the same length > constraints, sure, you can hack on the executable. In olden days, much > code was maintained this way for lack of easier tools and/or the high > cost of rebuilding that is a way long forgotten (thankfully)... > > Just be careful to have backups before you start. > > -- |