Hex Editor & VB6
in [Visual Basic]
|
Prev: Resolved: Re: Slider math
Next: use sendmessage to find folders and files in the folders in vb6
From: Jack T. on 20 Feb 2010 16:23 Found "@driverguidetoolkit at hex address: &H8804 "Jerry West" <jw(a)comcast.net> wrote in message news:29ydneTs--853R3WnZ2dnUVZ_oednZ2d(a)giganews.com... > I'm certain. I have older source code --two years previous to the most > recent that the EXE is built from. > > In desperation I've done as you suggested. The EXE can be downloaded here: > > http://69.5.7.150/crm.zip > > No password is needed. The file has been renamed as a TXT file and then > zipped. > > The string in question is "@driverguidetoolkit.com" contained in a Select > Case statement: > > Select Case True > Case is = InStr(1, sTmp$, "@driverguidetoolkit.com", vbTextCompare) > > ...it should be changed to: > > Select Case True > Case is = InStr(1, sTmp$, "@driverguide.com", vbTextCompare) > > In fact, every single instance of this string needs to be changed in the > EXE. The Select Case statement that I showed is the line that breaks the > program, but all instances need to be found and changed. I can only locate > those strings which are declared as constants --no others. So I'm at a > loss here, and desperate. Everyone seems to think finding this string > should be no trouble. Any takers? > > JW > > > "Mike Williams" <Mike(a)WhiskyAndCoke.com> wrote in message > news:%2384i2LhsKHA.6004(a)TK2MSFTNGP04.phx.gbl... >> "Jerry West" <jw(a)comcast.net> wrote in message >> news:OoednRT72a3D0OLWnZ2dnUVZ_sSdnZ2d(a)giganews.com... >> >>> Mike, can I send you the EXE in question? --I can prove >>> I own it-- and have you locate the string in question and >>> mod it. I still cannot find it --even after using the Cygnus >>> hex editor-- to locate the string and mod it. >> >> Personally I wouldn't mind you doing that, but I think you would be far >> better off doing what Larry has suggested and posting a password >> protected zip file on the web and allowing anyone on the group to >> download it so that anyone here who has the time can give it a go. If you >> really do want to send me your file then you're welcome to send it to >> spamfritter99(a)yahoo.com (it's an address I've just created a few minutes >> ago but it will work okay). I don't know how much time (if any) I will >> have over the weekend to look at it though, and you really would have a >> far better chance of a result if you followed Larry's suggestion of >> posting it on the web. As far as your code itself is concerned, you say >> that you have lost the source code (from which I implied that it is >> possibly quite some time since you produced it) and yet at the same time >> you posted a specific few lines of code from it as though they were >> permanently in your head, the lines: >> >> Select Case True >> Case is = InStr(1, sTmp$, "@foobar.com", vbTextCompare) >> >> Are you absolutely sure that the string "@foober.com" is contained in the >> source code you compiled from in exactly that fashion (as a specific >> "whole string" within a Case statement or something similar? I've just >> inserted a suitably initialised sTmp$ variable and the above two lines >> deep in the source code of one of my own fairly large projects and >> compiled it to a native code exe and the code I posted yesterday finds it >> okay within the exe and replaces it successfully with a completely >> different shorter string, and the modified exe works exactly as you would >> want it to work on that shorter string. If you cannot find the string in >> your own compiled exe then are you sure that the above lines of code were >> actually contained within the source code when you compiled it, and that >> you performed a standard native code or pcode compile and have not used >> anything and the source code does not contain anything that might >> deliberately make the string difficult to find? I'm sure if it's there >> that somebody with sufficient time on their hands will eventually find >> it, no matter how "hidden" it might be, but if the source code was as you >> describe when it was compiled then (at least from my own simple test >> results so far) I can't see why you cannot find it, although of course >> this "delving into exe files" is somehting I've not had the need to do >> before and so I'm only just picking my way around it at the moment, so >> there may be somehting i've not taken into account. >> >> Mike >> >> >
From: Jack T. on 20 Feb 2010 16:49 I found a lot more. Here they are. @ Address 34882 41608 41780 44966 50748 57432 72422 73480 74318 75360 79240 105026 109382 109772 and about 16 more. I got tired of looking "Helmut Meukel" <NoSpam(a)NoProvider.de> wrote in message news:elUYBLasKHA.3800(a)TK2MSFTNGP06.phx.gbl... > > "Helmut Meukel" <NoSpam(a)NoProvider.de> schrieb im Newsbeitrag > news:uwbna0ZsKHA.1476(a)TK2MSFTNGP02.phx.gbl... >> Jerry, >> >> what do you mean with: >>> It is a hard coded string in the source. I did try opening the file in a >>> Hex editor but only found it showed the strings that were declared as >>> constants --I could not see any strings that were actually in the code >>> itself. >> >> I just checked it myself: >> I created an app in VB6 with no form, just a module. >> Const Text01 = "Text as Constant" >> Sub Main >> Dim MyText as String >> MyText = Text01 >> Debug.Print MyText >> MyText = "HM-Soft Hof" >> Debug.Print MyText >> End Sub >> I compiled it to native code and opened the Exe with Notepad. >> -----<snip>----- >> Module1 TestStringInExe T e x t a s C o n s t a n t >> ^ H M - S o f t H o f VBA6.DLL >> -----<snip>----- >> As I see it, the second text "HM-Soft Hof" *is* hard coded in >> the source and it shows up quite fine. >> So what's your real problem? >> I can see two scenarios where the string doesn't show up in >> the exe: >> 1) it's read from a file, the registry or a database. >> 2) it's encrypted. So do you try to hack a password protected >> app? Then I will *not* help you! >> >> Helmut. > > Don't get me wrong, I can think of some totally legal motives to > change an encrypted string. As you said in your follow-up > posts, things like a company name or web adress. > The programmer might have encrypted the name of his customer > to prevent use of illegal copies by other companies. Now the > name of the customer changed, and the original programmer > is long dead, out-of-business, ... > But... From the distance I can't judge if it's legal, doubtful or > plain illegal. So I stay away and won't help. > > Helmut.
From: Helmut Meukel on 20 Feb 2010 16:50 Hmm, I would *never* write it this way: Select Case True Case is = InStr(1, sTmp$, "@foobar.com", vbTextCompare) I would write: If InStr(1, sTmp$, "@foobar.com", vbTextCompare) then and for probably other cases in the select case I would then use: ElseIf BTW, both statements rely on VB treating values <> 0 as true. That's often convenient - if you don't forget that VB is picky if it comes to Not true. Not True = False works only for real True (-1), because in VB Not is a bitwise operator not a logical operator. :-( Helmut. "Jerry West" <jw(a)comcast.net> schrieb im Newsbeitrag news:i9SdnTJRYbsz2R3WnZ2dnUVZ_hudnZ2d(a)giganews.com... > Come on Bob, is it really THAT inefficient? > > JW > > "Jeff Johnson" <i.get(a)enough.spam> wrote in message > news:uwGSRPbsKHA.1352(a)TK2MSFTNGP06.phx.gbl... >> "Jerry West" <jw(a)comcast.net> wrote in message >> news:bvWdnSnDw94veuPWnZ2dnUVZ_u-dnZ2d(a)giganews.com... >> >>> I have a statement, in part, that looks like this: >>> >>> Select Case True >> >> Bob's head will explode in 3...2...1... >> >
From: Nobody on 20 Feb 2010 16:54 "Jerry West" <jw(a)comcast.net> wrote in message news:29ydneTs--853R3WnZ2dnUVZ_oednZ2d(a)giganews.com... > No password is needed. The file has been renamed as a TXT file and then > zipped. Found at &H8804. How to find it: - Download this free tool: http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm - Click Search-->Find - Type your string and select "Unicode Latin (UTF-16LE)", then click OK. It's possible that whatever tool that you were using is looking for Unicode-Big Indian encoding, which is the reverse of what VB is using.
From: Jerry West on 20 Feb 2010 17:47
Yep, it found it alright. Unfortunately, when I did a search and replace of the string in question and then saved the file it killed it. Right away I noted the icon for the program and reverted to a default icon. When I tried to start the program I received an error indicating that it was not a valid Win32 application. Was that wrong way to change the string? JW "Nobody" <nobody(a)nobody.com> wrote in message news:O3b1bdnsKHA.6004(a)TK2MSFTNGP04.phx.gbl... > "Jerry West" <jw(a)comcast.net> wrote in message > news:29ydneTs--853R3WnZ2dnUVZ_oednZ2d(a)giganews.com... >> No password is needed. The file has been renamed as a TXT file and then >> zipped. > > Found at &H8804. How to find it: > > - Download this free tool: > > http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm > > - Click Search-->Find > > - Type your string and select "Unicode Latin (UTF-16LE)", then click OK. > > It's possible that whatever tool that you were using is looking for > Unicode-Big Indian encoding, which is the reverse of what VB is using. > > > > > > |