Hex Editor & VB6
in [Visual Basic]
|
Prev: Resolved: Re: Slider math
Next: use sendmessage to find folders and files in the folders in vb6
From: Mike Williams on 20 Feb 2010 17:52 "Jerry West" <jw(a)comcast.net> wrote in message news:29ydneTs--853R3WnZ2dnUVZ_oednZ2d(a)giganews.com... I received your email with the attachment (although I see that you have taken my advice and also hosted it on the web for anyone in the group to check out). The text "driverguidetoolkit.com" appears 45 times in the exe and the text "@driverguidetoolkit.com" (with the preceding @ sign) appears 29 times. However, on 24 of those entries it appears as part of a larger text string, such as "send questions or concerns to . . . " and various other pieces of text, whereas it appears only 4 times as a "whole string" email address on its own (and not as part of a larger piece of text), as can be deduced from the descriptor bytes preceeding those four entries. The four entries actually are (byte number, counting from 1, shown against each item with the byte position being the start of the four byte descriptor preceeding the string, which of course needs to be changed to a new value as well): 34797 dgtsupport(a)driverguidetoolkit.com 44949 support(a)driverguidetoolkit.com 57417 extend(a)driverguidetoolkit.com 79237 @driverguidetoolkit.com I think it is fairly certain that the last of those four entries is the one in your code line: Case is = InStr(1, sTmp$, "@driverguidetoolkit.com", vbTextCompare) The other three entries are probably links in the code that will be used to send the various emails. All the other entries (the large number I've mentioned that are part of much larger strings of text) are clearly part of the help files etc. I would think that the very least you need to do is replace the four entries I have mentioned with their new equivalents and their new descriptor values and in fact I'll do that for you and email the .exe file back to you some time in the next fifteen minutes or so. Ideally of course you also need to replace all occurrences in the help files etc (the other entries I've mentioned) but that will take quite a lot more time because it will be necessary to examine the code a little more in each of those 29 places (and better still in all 45 places) to make sure we alter the entire string it "lives" in where it seems appropriate to do so and also to amend the correct descriptor (length) bytes to the correct values. I won't have time to do that for you at the moment because it is about eleven o' clock in the evening here in the UK and I'll be supping my mug of cocoa soon :-) Anyway, I'll replace those four entries mentioned above with the new equivalents and the modified exe file will be with you very soon. By the time I am up and about tomorrow you may have done the rest yourself, or one of the others here may have done it for you. Mike
From: Mike Williams on 20 Feb 2010 18:22 "Mike Williams" <Mike(a)WhiskyAndCoke.com> wrote in message news:%23CMMv9nsKHA.5356(a)TK2MSFTNGP02.phx.gbl... > Anyway, I'll replace those four entries mentioned above > with the new equivalents and the modified exe file will be > with you very soon. By the way, I thought I would mention that I found all those 45 entries using the code I posted the other day, simply by modifying it a little bit to peform the search in a loop and report every occurrence it found, together with the byte address, in a ListBox. That enabled me to easily read the data around each byte position in a separate ListBox. When I decided which ones really needed changing right away and which ones, such as those in the help files in much larger strings could be left until later, I used the same code that I had already posted to perform the search and replace of both the string ad its descriptor, which it did with no trouble at all. It might be worth you looking again at that code and keeping hold of it because you can easily modify it to perform all kinds of different automated search and or replaces of such nature. Anyway, the modified file with the four replacements I mentioned should be with you by now. I did the job in a bit of a hurry because it is quite late in the evening here in the UK so post again if you have any problems with it. Mike
From: Jack T. on 20 Feb 2010 18:47 I replaced all of the strings and it appears to be working. I get the black club icon and a what look like an order processing form. "Jerry West" <jw(a)comcast.net> wrote in message news:QIidncyZU985-x3WnZ2dnUVZ_r6dnZ2d(a)giganews.com... > Yep, it found it alright. Unfortunately, when I did a search and replace > of the string in question and then saved the file it killed it. Right away > I noted the icon for the program and reverted to a default icon. When I > tried to start the program I received an error indicating that it was not > a valid Win32 application. > > Was that wrong way to change the string? > > JW > > "Nobody" <nobody(a)nobody.com> wrote in message > news:O3b1bdnsKHA.6004(a)TK2MSFTNGP04.phx.gbl... >> "Jerry West" <jw(a)comcast.net> wrote in message >> news:29ydneTs--853R3WnZ2dnUVZ_oednZ2d(a)giganews.com... >>> No password is needed. The file has been renamed as a TXT file and then >>> zipped. >> >> Found at &H8804. How to find it: >> >> - Download this free tool: >> >> http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm >> >> - Click Search-->Find >> >> - Type your string and select "Unicode Latin (UTF-16LE)", then click OK. >> >> It's possible that whatever tool that you were using is looking for >> Unicode-Big Indian encoding, which is the reverse of what VB is using. >> >> >> >> >> >> >
From: Jerry West on 21 Feb 2010 20:20 Hi Mike, I received the file back from you and found that it now works perfectly!Many thanks for your time and explanation on what needed to be done and why. Clearly, you were right on target with your comments and help. JW "Mike Williams" <Mike(a)WhiskyAndCoke.com> wrote in message news:%23CMMv9nsKHA.5356(a)TK2MSFTNGP02.phx.gbl... > "Jerry West" <jw(a)comcast.net> wrote in message > news:29ydneTs--853R3WnZ2dnUVZ_oednZ2d(a)giganews.com... > > I received your email with the attachment (although I see that you have > taken my advice and also hosted it on the web for anyone in the group to > check out). The text "driverguidetoolkit.com" appears 45 times in the exe > and the text "@driverguidetoolkit.com" (with the preceding @ sign) appears > 29 times. However, on 24 of those entries it appears as part of a larger > text string, such as "send questions or concerns to . . . " and various > other pieces of text, whereas it appears only 4 times as a "whole string" > email address on its own (and not as part of a larger piece of text), as > can be deduced from the descriptor bytes preceeding those four entries. > The four entries actually are (byte number, counting from 1, shown against > each item with the byte position being the start of the four byte > descriptor preceeding the string, which of course needs to be changed to a > new value as well): > > 34797 dgtsupport(a)driverguidetoolkit.com > 44949 support(a)driverguidetoolkit.com > 57417 extend(a)driverguidetoolkit.com > 79237 @driverguidetoolkit.com > > I think it is fairly certain that the last of those four entries is the > one in your code line: > > Case is = InStr(1, sTmp$, "@driverguidetoolkit.com", vbTextCompare) > > The other three entries are probably links in the code that will be used > to send the various emails. All the other entries (the large number I've > mentioned that are part of much larger strings of text) are clearly part > of the help files etc. > > I would think that the very least you need to do is replace the four > entries I have mentioned with their new equivalents and their new > descriptor values and in fact I'll do that for you and email the .exe file > back to you some time in the next fifteen minutes or so. Ideally of course > you also need to replace all occurrences in the help files etc (the other > entries I've mentioned) but that will take quite a lot more time because > it will be necessary to examine the code a little more in each of those 29 > places (and better still in all 45 places) to make sure we alter the > entire string it "lives" in where it seems appropriate to do so and also > to amend the correct descriptor (length) bytes to the correct values. I > won't have time to do that for you at the moment because it is about > eleven o' clock in the evening here in the UK and I'll be supping my mug > of cocoa soon :-) > > Anyway, I'll replace those four entries mentioned above with the new > equivalents and the modified exe file will be with you very soon. By the > time I am up and about tomorrow you may have done the rest yourself, or > one of the others here may have done it for you. > > Mike > > >
From: Dee Earley on 22 Feb 2010 05:09
On 19/02/2010 19:34, Jerry West wrote: > Hi Karl, > > I do indeed wish to shorten the string versus versus lengthen it. > > I have a statement, in part, that looks like this: > > Select Case True > Case is = InStr(1, sTmp$, "@foobar.com", vbTextCompare) > > I want to change it to: > > > Select Case True > Case is = InStr(1, sTmp$, "@foo.com", vbTextCompare) > > > As I indicated, when I load in a hex editor I cannot find this string > 'foobar.com'. But any string declared as a constant --no problem. I've > done a hex search and a unicode as well as text search to no avail. What > could I be doing wrong? Is there a special editor for VB6 to use? > > As well, given what I'm trying to do it sounds like if I can find this > string to edit it should work? If you do find it, good luck. Putting nulls in the string may end up being used as part of the search pattern. -- Dee Earley (dee.earley(a)icode.co.uk) i-Catcher Development Team iCode Systems |