Hex Editor & VB6
in [Visual Basic]
|
Prev: Resolved: Re: Slider math
Next: use sendmessage to find folders and files in the folders in vb6
From: Nobody on 19 Feb 2010 17:02 "Stan Weiss" <srweiss(a)erols.com> wrote in message news:4B7EFEEE.FD8D0EBF(a)erols.com... > Read EXE file into HOLD > > NName = Text3.Text 'get search string > NNameUni = StrConv(NName, vbUnicode) > Inc = InStr(HOLD, NNameUni) > If Inc > 0 Then > ' Replace string here > > Write new EXE file here > > Else > ' String not found > End If The free hex editor that I posted the link to can search for either ASCII or Unicode, so if he didn't find the string, it's encrypted. VB6 even puts the text in "Debug.Print" in the EXE, it's not omitted like said in the help file. I checked the assembly output. However, calls to Debug.Assert are really omitted.
From: Nobody on 19 Feb 2010 17:05 "Jerry West" <jw(a)comcast.net> wrote in message news:bvWdnSnDw94veuPWnZ2dnUVZ_u-dnZ2d(a)giganews.com... > Hi Karl, > > I do indeed wish to shorten the string versus versus lengthen it. > > I have a statement, in part, that looks like this: > > Select Case True > Case is = InStr(1, sTmp$, "@foobar.com", vbTextCompare) > > I want to change it to: > > > Select Case True > Case is = InStr(1, sTmp$, "@foo.com", vbTextCompare) > If the software is emailing something and the server to connect to can be changed, you can make a simple Winsock server as filtering gateway, and tell the VB6 app to connect to "localhost" or "127.0.0.1", and your application can replace what it needs to replace.
From: Jeff Johnson on 19 Feb 2010 17:35 "Jerry West" <jw(a)comcast.net> wrote in message news:bvWdnSnDw94veuPWnZ2dnUVZ_u-dnZ2d(a)giganews.com... > I have a statement, in part, that looks like this: > > Select Case True Bob's head will explode in 3...2...1...
From: Helmut Meukel on 19 Feb 2010 17:43 "Nobody" <nobody(a)nobody.com> schrieb im Newsbeitrag news:e7o1H9asKHA.1472(a)TK2MSFTNGP05.phx.gbl... > "Stan Weiss" <srweiss(a)erols.com> wrote in message > news:4B7EFEEE.FD8D0EBF(a)erols.com... >> Read EXE file into HOLD >> >> NName = Text3.Text 'get search string >> NNameUni = StrConv(NName, vbUnicode) >> Inc = InStr(HOLD, NNameUni) >> If Inc > 0 Then >> ' Replace string here >> >> Write new EXE file here >> >> Else >> ' String not found >> End If > > The free hex editor that I posted the link to can search for either ASCII or > Unicode, so if he didn't find the string, it's encrypted. VB6 even puts the > text in "Debug.Print" in the EXE, it's not omitted like said in the help file. > I checked the assembly output. However, calls to Debug.Assert are really > omitted. > > No real encryption is needed, you can test it for yourself. I just used something like: MyString = Chr(Asc("H") & Chr(Asc("M") & Chr(Asc("-") _ & Chr(Asc("S") & Chr(Asc("o") & Chr(Asc("f") _ & Chr(Asc("t") & " " & Chr(Asc("H") & _ Chr(Asc("o") & Chr(Asc("f") to built the name of my company "HM-Soft Hof". In the exe I found the part "HM-Soft" as single characters with 7 other bytes between each character and the next. The & " " & caused the second part "Hof" to be put elseswhere in the exe, I couldn't find it. Helmut.
From: Mike Williams on 19 Feb 2010 17:54
"Jerry West" <jw(a)comcast.net> wrote in message news:XcydnQpPJvWPbePWnZ2dnUVZ_tWdnZ2d(a)giganews.com... > I still do not see the strings in question. Do I need to convert > the string to Hex and search that way, including spaces > between the letters? Because I did try that to no avail. They're not spaces, they are zeros, because VB uses two bytes per character in a standard Ascii string (the first byte is the Ascii code and the second byte is zero). For example, if you are looking for the character "A" (which of course has the Ascii code 65) then you need to search the file for the two bytes 65,0 (in that order). But finding the data is just the first part of your problem. Obviously you cannot increase its length without completely messing up the compiled exe, but if you wanted to alter it and reduce its length (as you do in your specific case) then you could simply find the data in the exe file and replace it with the new string data, adding trailing spaces to the replacement to make it the same data size as the original. This would cause the new printed or displayed string to appear as your new string and the fact that the new data size was the same size as the old would not mess up your compiled exe. However, in your specific case there is a little more to it than that because the string you are looking for is part of a VB instruction, in this specific case the string in the following code (I've used the hash sign instead of the ampersand throughout the rest of this message because Windows Mail keeps thinking I am typing links!): Select Case True Case is = InStr(1, sTmp$, "#foobar.com", vbTextCompare) .. . . which you want to change to: Select Case True Case is = InStr(1, sTmp$, "#foo.com", vbTextCompare) In such a case you cannot simply change the "#foobar.com" part to "#foo.com " because the three trailing spaces would cause the Case code to look for the wrong string (it would be looking for a string with three spaces on the end whereas you don't want it to do that). You cannot add trailing zeros either, because the Case code will still not work (I know because I've just tried it!). However, looking at the data in a standard native code compiled exe that contains the above lines of code I can see the text itself (the "#foobar.com" with each character being represented by two bytes as mentioned above) is preceeded by a Long (four bytes) representing the byte length (not the character length) of the string. I actually anticipated that (although I wasn't sure of course because I don't usually delve into compiled exe data, and I anyway expected that it might be the character length rather than the byte length). However, that's the way it appears in the compiled exe (the string being preceeded by a byte length descriptor) and so changing the preceeding byte length descriptor as well as changing the actual string data does indeed work, and the code works fine after the change, with the Case statement correctly looking for the modified string "#foo.com". I've only tried this on the compiled exe of a simple small test program so far, but I do appear to be at least on the right track. (naturally you will want to make a backup of your exe before you mess about with it in this way!). To summarise, you need to look for the characters by looking for "pairs of bytes" representing each character (with the first byte of each pair being the Ascii value and the second byte of each pair being zero). Then, when you have found that data you need to change it to similar data representing your new desired string (as long as it is no longer than the orioginal) and padding it with space characters (byte 32 followed by byte zero) to make it the same overall byte length as the original. Then you also need to alter the immediately preceeding four bytes, which will currently hold the "Long" value 22 in this specific case (because "#foobar.com" contains 11 characters) and you need to change it so that it holds the Long value 16 (because the "#foo.com" portion of the replacement "@foo.com " contains 8 characters, even though the overall replacement "#foo.com " still contains the original 11 characters, and you want your Case statement to look for only those 8 characters. Here's some VB code which does all the stuff I've just been talking about. Mike |