# Changing exe hex values

Is it possible to change the hex values of an EXE like you would with a hex editor?
I know it is possible in C to SEEK hex addresses, but I don't know if this is possbile in vb or not.
Once I've got to the right place by using a hex address, can I then change what ever the program has at that point?
For instance goto 00046D7A in a program and change the code from something like 753C6A006A00 to E93900000090? For instance.
Can you give me some code or some explanations please.
LVL 1
###### Who is Participating?

x

Commented:
Yes, open the EXE in binary and then you can use the SEEK statement to go to a particular BYTE offset.

The SEEK statement uses decimal offsets instead of HEX beginning at 1

Using a hex dumping program like "Quick View Plus" lets say you identified the place you wanted to change the bytes at offset hex 000840...

Const PatchOffset = &H840
Dim fNum As Long
Dim FileName As String

fNum = FreeFile
FileName = "c:\windows\desktop\testfile.exe"
Open FileName For Binary As #fNum
Seek #fNum, PatchOffset + 1
Put #fNum, , Chr\$(&H59)
Put #fNum, , Chr\$(&H0)
Put #fNum, , Chr\$(&H45)
Put #fNum, , Chr\$(&H0)
Put #fNum, , Chr\$(&H50)
Put #fNum, , Chr\$(&H0)
Put #fNum, , Chr\$(&H21)
Close fNum

0

Author Commented:
So, I need to change my hex offset to a decimal. And any thing I want to change I have to change from a hex value to a decimal?
I'm guessing I can add up the hex values in my mind. So A1 would be 11+2 (just so to make sure)?
0

Commented:
>>So, I need to change my hex offset to a decimal.

You need to change it to decimal+1... Remember, SEEK starts at 1, not 0

>>And any thing I want to change I have to change from a hex value to a decimal?

If for example, you wanted to write the letter "A" which is x41 at a particular byte offset, you would do chr\$(65)

Make Sense??

0

Commented:
By the way, you see in the code example above that I am writing the CHR\$ like this:

Put #fNum, , Chr\$(&H59)

Chr\$(&H59) is the same as using Chr\$(89)...

Both give you a "Y". &H59 gets converted automatically to a decimal value...

0

Author Commented:
Where did x41 come from? I'm guessing 65 is the ascii value for 'A'?
0

Commented:
the x41 was just an example of an A... for example if you hex dumped a file and saw:

41 6C 6C 65 6E 00

in ascii that would be "Allen"+Chr\$(0)

Try this in the debug window... Type:

?chr\$(&h41)

You will get an "A" to appear... Type:

?chr\$(65)

And you will also get an "A" to appear...

Hopefully this question will get graded with a chr\$(&h41) or a chr\$(65) or an "A"... 'cause they're all the same...

;-)

0

Author Commented:
That's brilliant thanks. You've cleared up a lot for me. This was definitely a chr\$(&h41) grade answer.

Thanks again.
0

Commented:
Thanks for the &h41! Glad I could help!

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.