[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 350
  • Last Modified:

Changing exe hex values

Is it possible to change the hex values of an EXE like you would with a hex editor?
I know it is possible in C to SEEK hex addresses, but I don't know if this is possbile in vb or not.
Once I've got to the right place by using a hex address, can I then change what ever the program has at that point?
For instance goto 00046D7A in a program and change the code from something like 753C6A006A00 to E93900000090? For instance.
Can you give me some code or some explanations please.
0
billy_98_1
Asked:
billy_98_1
  • 5
  • 3
1 Solution
 
mcriderCommented:
Yes, open the EXE in binary and then you can use the SEEK statement to go to a particular BYTE offset.

The SEEK statement uses decimal offsets instead of HEX beginning at 1

Using a hex dumping program like "Quick View Plus" lets say you identified the place you wanted to change the bytes at offset hex 000840...  

    Const PatchOffset = &H840
    Dim fNum As Long
    Dim FileName As String
     
    fNum = FreeFile
    FileName = "c:\windows\desktop\testfile.exe"
    Open FileName For Binary As #fNum
    Seek #fNum, PatchOffset + 1
    Put #fNum, , Chr$(&H59)
    Put #fNum, , Chr$(&H0)
    Put #fNum, , Chr$(&H45)
    Put #fNum, , Chr$(&H0)
    Put #fNum, , Chr$(&H50)
    Put #fNum, , Chr$(&H0)
    Put #fNum, , Chr$(&H21)
    Close fNum



Cheers!®©

0
 
billy_98_1Author Commented:
So, I need to change my hex offset to a decimal. And any thing I want to change I have to change from a hex value to a decimal?
I'm guessing I can add up the hex values in my mind. So A1 would be 11+2 (just so to make sure)?
0
 
mcriderCommented:
>>So, I need to change my hex offset to a decimal.

You need to change it to decimal+1... Remember, SEEK starts at 1, not 0


>>And any thing I want to change I have to change from a hex value to a decimal?

If for example, you wanted to write the letter "A" which is x41 at a particular byte offset, you would do chr$(65)

Make Sense??


Cheers!®©

0
The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

 
mcriderCommented:
By the way, you see in the code example above that I am writing the CHR$ like this:

    Put #fNum, , Chr$(&H59)

Chr$(&H59) is the same as using Chr$(89)...

Both give you a "Y". &H59 gets converted automatically to a decimal value...



Cheers!®©
0
 
billy_98_1Author Commented:
Where did x41 come from? I'm guessing 65 is the ascii value for 'A'?
0
 
mcriderCommented:
the x41 was just an example of an A... for example if you hex dumped a file and saw:

         41 6C 6C 65 6E 00

in ascii that would be "Allen"+Chr$(0)

Try this in the debug window... Type:

   ?chr$(&h41)

You will get an "A" to appear... Type:

   ?chr$(65)

And you will also get an "A" to appear...


Hopefully this question will get graded with a chr$(&h41) or a chr$(65) or an "A"... 'cause they're all the same...

;-)


Cheers!®©



   
0
 
billy_98_1Author Commented:
That's brilliant thanks. You've cleared up a lot for me. This was definitely a chr$(&h41) grade answer.

Thanks again.
0
 
mcriderCommented:
Thanks for the &h41! Glad I could help!


Cheers!®©
0

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

  • 5
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now