Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Changing exe hex values

Posted on 2000-03-18
8
Medium Priority
?
343 Views
Last Modified: 2010-05-02
Is it possible to change the hex values of an EXE like you would with a hex editor?
I know it is possible in C to SEEK hex addresses, but I don't know if this is possbile in vb or not.
Once I've got to the right place by using a hex address, can I then change what ever the program has at that point?
For instance goto 00046D7A in a program and change the code from something like 753C6A006A00 to E93900000090? For instance.
Can you give me some code or some explanations please.
0
Comment
Question by:billy_98_1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
8 Comments
 
LVL 14

Accepted Solution

by:
mcrider earned 400 total points
ID: 2631849
Yes, open the EXE in binary and then you can use the SEEK statement to go to a particular BYTE offset.

The SEEK statement uses decimal offsets instead of HEX beginning at 1

Using a hex dumping program like "Quick View Plus" lets say you identified the place you wanted to change the bytes at offset hex 000840...  

    Const PatchOffset = &H840
    Dim fNum As Long
    Dim FileName As String
     
    fNum = FreeFile
    FileName = "c:\windows\desktop\testfile.exe"
    Open FileName For Binary As #fNum
    Seek #fNum, PatchOffset + 1
    Put #fNum, , Chr$(&H59)
    Put #fNum, , Chr$(&H0)
    Put #fNum, , Chr$(&H45)
    Put #fNum, , Chr$(&H0)
    Put #fNum, , Chr$(&H50)
    Put #fNum, , Chr$(&H0)
    Put #fNum, , Chr$(&H21)
    Close fNum



Cheers!®©

0
 
LVL 1

Author Comment

by:billy_98_1
ID: 2631862
So, I need to change my hex offset to a decimal. And any thing I want to change I have to change from a hex value to a decimal?
I'm guessing I can add up the hex values in my mind. So A1 would be 11+2 (just so to make sure)?
0
 
LVL 14

Expert Comment

by:mcrider
ID: 2631883
>>So, I need to change my hex offset to a decimal.

You need to change it to decimal+1... Remember, SEEK starts at 1, not 0


>>And any thing I want to change I have to change from a hex value to a decimal?

If for example, you wanted to write the letter "A" which is x41 at a particular byte offset, you would do chr$(65)

Make Sense??


Cheers!®©

0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
LVL 14

Expert Comment

by:mcrider
ID: 2631889
By the way, you see in the code example above that I am writing the CHR$ like this:

    Put #fNum, , Chr$(&H59)

Chr$(&H59) is the same as using Chr$(89)...

Both give you a "Y". &H59 gets converted automatically to a decimal value...



Cheers!®©
0
 
LVL 1

Author Comment

by:billy_98_1
ID: 2631890
Where did x41 come from? I'm guessing 65 is the ascii value for 'A'?
0
 
LVL 14

Expert Comment

by:mcrider
ID: 2631937
the x41 was just an example of an A... for example if you hex dumped a file and saw:

         41 6C 6C 65 6E 00

in ascii that would be "Allen"+Chr$(0)

Try this in the debug window... Type:

   ?chr$(&h41)

You will get an "A" to appear... Type:

   ?chr$(65)

And you will also get an "A" to appear...


Hopefully this question will get graded with a chr$(&h41) or a chr$(65) or an "A"... 'cause they're all the same...

;-)


Cheers!®©



   
0
 
LVL 1

Author Comment

by:billy_98_1
ID: 2632892
That's brilliant thanks. You've cleared up a lot for me. This was definitely a chr$(&h41) grade answer.

Thanks again.
0
 
LVL 14

Expert Comment

by:mcrider
ID: 2633393
Thanks for the &h41! Glad I could help!


Cheers!®©
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction While answering a recent question (http://www.experts-exchange.com/Q_27402310.html) in the VB classic zone, I wrote some VB code in the (Office) VBA environment, rather than fire up my older PC.  I didn't post completely correct code o…
Article by: Martin
Here are a few simple, working, games that you can use as-is or as the basis for your own games. Tic-Tac-Toe This is one of the simplest of all games.   The game allows for a choice of who goes first and keeps track of the number of wins for…
Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
Get people started with the utilization of class modules. Class modules can be a powerful tool in Microsoft Access. They allow you to create self-contained objects that encapsulate functionality. They can easily hide the complexity of a process from…
Suggested Courses

664 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question