Hex Editor & VB6
in [Visual Basic]
|
Prev: Resolved: Re: Slider math
Next: use sendmessage to find folders and files in the folders in vb6
From: Bob Butler on 19 Feb 2010 18:05 "Jeff Johnson" <i.get(a)enough.spam> wrote in message news:uwGSRPbsKHA.1352(a)TK2MSFTNGP06.phx.gbl... > "Jerry West" <jw(a)comcast.net> wrote in message > news:bvWdnSnDw94veuPWnZ2dnUVZ_u-dnZ2d(a)giganews.com... > >> I have a statement, in part, that looks like this: >> >> Select Case True > > Bob's head will explode in 3...2...1... LOL
From: Mike Williams on 19 Feb 2010 18:22 "Mike Williams" <Mike(a)WhiskyAndCoke.com> wrote in message news:OfI29ZbsKHA.4752(a)TK2MSFTNGP04.phx.gbl... .. . . oops. Pressed the button too quickly there. Here is the code I mentioned. It searches for and replaces the specific examples you mentioned, and it hard codes the values 22 and 16 that I mentioned in my previous response rather than calculating them, so you'll need to change the strings to the actual string(s) you are looking for and change the 22 and 16 accordingly, but it should be easy for you to see what you need to do. Also, as it stands it looks for only the first occurrence of the string, so if there is more than one "whole string" of @foobar.com then it will replace only the first of them. Narturally, if the code contained in the compiled exe is not what you posted (perhaps the @foobar.com is made up of substrings or loaded or calculated in some way) then it won't find it. Anyway, for what it's worth, here's the example to get you started, although perhaps in view of the fact that some people here think your request is not exactly "Kosher" perhaps I'd better n ot post it . . . too late now . . . I've clicked the button . . . but perhaps you might like to tell us what you want this for, just to put our minds at ease. Mike Private Sub Command1_Click() Dim b1() As Byte, b2() As Byte, p As Long Open "c:\temp\native.exe" For Binary As 1 ReDim b1(1 To LOF(1)) Get #1, 1, b1() b2() = Chr(22) & Chr(0) & "@foobar.com" p = InStrB(b1(), b2()) If p > 0 Then b2() = Chr(16) & Chr(0) & "@foo.com" & Space$(3) Put #1, p, b2() MsgBox "Replacement made at position " & p End If Close 1 End Sub
From: Karl E. Peterson on 19 Feb 2010 18:25 Helmut Meukel wrote: > No real encryption is needed, you can test it for yourself. > I just used something like: > MyString = Chr(Asc("H") & Chr(Asc("M") & Chr(Asc("-") _ > & Chr(Asc("S") & Chr(Asc("o") & Chr(Asc("f") _ > & Chr(Asc("t") & " " & Chr(Asc("H") & _ > Chr(Asc("o") & Chr(Asc("f") > to built the name of my company "HM-Soft Hof". > In the exe I found the part "HM-Soft" as single characters with > 7 other bytes between each character and the next. The & " " & > caused the second part "Hof" to be put elseswhere in the exe, > I couldn't find it. I had to do that with a registry key name once, to avoid a false-positive alarm... ' Need to build this string at runtime, to avoid ' McAfee triggering a Trojan alert! RunKey = Join(Array("SOFTWARE", "Microsoft", _ "Windows", "CurrentVersion", "Run"), "\") Still makes me <growl> just thinking about it... -- ..NET: It's About Trust! http://vfred.mvps.org
From: Karl E. Peterson on 19 Feb 2010 18:29 Mike Williams wrote: > However, looking at the data in a standard native code compiled exe > that contains the above lines of code I can see the text itself (the > "#foobar.com" with each character being represented by two bytes as mentioned > above) is preceeded by a Long (four bytes) representing the byte length (not > the character length) of the string. I actually anticipated that (although I > wasn't sure of course because I don't usually delve into compiled exe data, > and I anyway expected that it might be the character length rather than the > byte length). D'oh!!! Of course. The string descriptor. Yeah, that's a *must* change value, there, too! Heckuva good catch! -- ..NET: It's About Trust! http://vfred.mvps.org
From: Nobody on 19 Feb 2010 21:11
"Jerry West" <jw(a)comcast.net> wrote in message news:bvWdnSnDw94veuPWnZ2dnUVZ_u-dnZ2d(a)giganews.com... > As I indicated, when I load in a hex editor I cannot find this string > 'foobar.com'. But any string declared as a constant --no problem. I've > done a hex search and a unicode as well as text search to no avail. What > could I be doing wrong? Is there a special editor for VB6 to use? What I would suggest is that you write a routine that prints out the index of each byte value that you are looking for, and then check the numbers. The characters should have equal spaces between them if they are encrypted in a simple way. For example, they could be separated by 3 or 4 bytes. Example air code: Private Sub Search() Dim bFind(1 To 8) As Byte Dim FileContents() As Byte Dim i As Long Dim j As Long Dim Diff As Long Dim LastDiff As Long FileContents = GetEntireFile("C:\Project1.exe") bFind(1) = Asc("f") bFind(2) = Asc("o") bFind(3) = Asc("b") bFind(4) = Asc("a") bFind(5) = Asc("r") bFind(6) = Asc(".") bFind(7) = Asc("c") bFind(8) = Asc("m") For i = 1 To UBound(FileContents) For j = 1 To UBound(bFind) If FileContents(i) = bFind(j) Then Diff = i - Diff Debug.Print Format(i, "000000000"), bFind(j), Diff; If Diff = LastDiff Then Debug.Print "**********" Else Debug.Print End If LastDiff = Diff End If Next Next End Sub ' Read the entire file into a byte array and returns it Public Function GetEntireFile(ByRef FileName As String) As Byte() Dim f As Integer Dim FileContents() As Byte Dim i As Long f = FreeFile Open FileName For Binary Access Read Shared As f ' Allocate buffer for the entire file ReDim FileContents(1 To LOF(f)) ' Read the entire file into memory Get f, , FileContents Close f GetEntireFile = FileContents End Function |