How to edit strings in dll files

spicydog · **Joined:** Mon Mar 16, 2009 11:56 am **Posts:** 252

POST DELETED

lyx · **Joined:** Mon Feb 15, 2010 1:23 am **Posts:** 84

Quote:

The closest I can get to that is by using Radialix but the string length (in characters) restriction is very difficult to bypass.

If i'm understanding stuff correctly, then changing this is impossible without recompiling the library. Reason is that lowlevel, things aren't dynlength - and the way how memory is managed and marked is not standardized. Phrased differently: This requires understanding the application and changing it according to its own rules - it isn't search'n replace - it's program modification.

spicydog · **Joined:** Mon Mar 16, 2009 11:56 am **Posts:** 252

lyx wrote:

If i'm understanding stuff correctly, then changing this is impossible without recompiling the library. Reason is that lowlevel, things aren't dynlength - and the way how memory is managed and marked is not standardized. Phrased differently: This requires understanding the application and changing it according to its own rules - it isn't search'n replace - it's program modification.

I know all that and I can confirm that I have been successfully (for years) editing dlls with the tools I mentioned in my 1st post... Unfortunately sometimes I come across some hard-coded strings that are very short (few char only) and in such situations I need to bypass the string length restriction, hence my post in this forum.

Anybody with a more creative response than the one I just received?

Gunner · **Posted:** Mon Nov 01, 2010 1:03 pm

Why? You can't make the strings longer than they are AFAIK without the source and or modifying some stuff in the pe header....

spicydog · **Joined:** Mon Mar 16, 2009 11:56 am **Posts:** 252

Gunner wrote:

Why? You can't make the strings longer than they are AFAIK without the source and or modifying some stuff in the pe header....

If you (know your way around and) are familiar with Radialix (in combination with the IDA disassembler plugin) you can.

With these tools it is possible to increase the hardcoded* strings length but it is a real PITA... That's why I am posting here to see if someone can suggest me an easier way to do that.

Hopefully somebody will provide some positive input :mrgreen:

* For the other (non-hardcoded) strings it is real easy, even without the plugin!

Napiophelios · **Posted:** Mon Nov 01, 2010 3:00 pm

What does this have to do with JauntePE?
What exactly are you working on Spicydog?

spicydog · **Joined:** Mon Mar 16, 2009 11:56 am **Posts:** 252

Napiophelios wrote:

What does this have to do with JauntePE?
What exactly are you working on Spicydog?

Oh shit, sorry guys... I did not realize that I posted in the JauntePE section... My bad :oops:

Can I somehow move the thread myself or do I have to contact the forum admin for that?

Gunner · **Posted:** Mon Nov 01, 2010 5:40 pm

Until it is moved:

Strings in the resource section are not a problem, but lets say I put a string in the code section of the pe (so it is harder to modify). take this code for example:

Code:

   jmp      @F
   szStringIinCode   BYTE   'Why you wanna modify me?', 0
   @@:
   mov      eax, 10
   mov      ebx, 10
   mul      ebx

if you try to make that string longer, you are going to step on the instructions that follow, or is that what you are trying to do?

And strings that are in the data area:

Code:

szStrings   db "string 1",13,10
          db "string 2",13,10
          db "string 3",13,10,0
szAnother   db "Another string", 0

If you try to make string 3 longer, you are going to corrupt szAnother string...

usdcs · **Joined:** Sat Jun 10, 2006 11:54 am **Posts:** 180

[moderator] Moved to Chit-Chat section.

spicydog · **Joined:** Mon Mar 16, 2009 11:56 am **Posts:** 252

usdcs wrote:

[moderator] Moved to Chit-Chat section.

Thanks for having taken care of that and once more sorry if I inadvertently posted in the wrong section.

Chit-Chat section? Hahaha, yeah, that's more like it I guess, since I do not seem to get any realistic response to my query I feel that it's just better I shut up and continue doing what I did until now and leave the damn hardcoded strings alone :mrgreen:

Anyway, THANKS to everybody for the creative input and for having taken part to this 'amazingly fruitful' thread :mrgreen:

How to edit strings in dll files

Who is online