Find and replace byte in exe files (find byte on the basis of it's offset)

[ßädbö¥]

Hi.. gurus..

I've some work 4 u...

i'm trying to find a hex value in a exe file... i have the offset value of that byte.. i want to find that hex value by using the offset value for that byte..
how can i do taht ?????

need urgent help...

Thnx...

[jemidiah]

Well, if I remember random access, you could use that with the put statement (if I remember that correctly). Seeing as your editing hex values in an executable, I think you'll be able to use it

[DiGiTaIErRoR]

Random or Binary should work fine.

[ßädbö¥]

OK....??

but how can i find that character using it's offset value
I just ve the offset value of the character i want to replace.

Suppose i want to find the (hex Value) 74 26 from whatever.exe and i only know it's offset (:40AB7B). then how can i find 74 26 by using it's Offset :40AB7A from the exe file....

[jemidiah]

Like we (kinda) said, look up Binary or Random [file] access in MSDN or here on the forums.

[DiGiTaIErRoR]

Well, it's rather simple.

For this I'd use Binary.

Dim bChr(1) as Byte
Open file for Binary as #1
Get #1,val("&H40AB7B"), bChr
If bChr(0) = val("&H74") and bchr(1) = val("&H26") then
bChr(0) = val("&hFF")
bChr(1) = val("&hFF")
Put #1, val("H40AB7B"), bChr
end if
Close #1

[ßädbö¥]

Thanx DiGiTaIErRoR

But this code dosen't work....!! i tried it on my file. when i search on that (offset) address through Vb it shows diffrent byte but if i open that file in hex editor then the value 74 26 is on that address.... if u 've another way then plz suggest me... if u've any ASM code then also it will helpful to me....

thanx

[jemidiah]

It worked fine for me... (I should say, after I added 1 to the offset it worked fine for me)

[ßädbö¥]

Jemidiah can u send me your code ?

[jemidiah]

All I did was copy DiGiTaIErRoR's code and replace 'file' with some text file I had sitting around, and incremented the offset by one (Val(whatever the hex offset was) + 1)

[DiGiTaIErRoR]

My code works, you just have the wrong offset.

Try:

Get #1,val("&H40AB7C"), bChr

Also change the Put!

[ßädbö¥]

I tried it. It works fine for starting bytes like offset address 0, 10, 260 etc. but not for entire file....

I used this Code....

Private Sub Command1_Click()
Dim bChr(1) As Byte
Open "C:\target.exe" For Binary As #1
Get #1, Val("&H4037A0") + 1, bChr ' In file it's 28 (hex value)

MsgBox Hex(bChr(0))

If bChr(0) = Val("&H28") And bChr(1) = Val("&H00") Then
MsgBox "I GOT IT!!"
End If
Close #1

End Sub



I m attaching my file... u just check that file....

and plz send me working code ASAP

thanx

[jemidiah]

That target.exe file is wayyy too small for your offset.

[dzzie]

you got your offsets from debugger, you have to subtract base load address to get actual offset in file

[ßädbö¥]

Ok..... and how can i do that ???. I got that offset from hexeditor and debugger. both shows same offset for that byte. and one more thing ... What is the base load address and how can i substract base load address ? plz explain with example if possible....

Thanx

[ßädbö¥]

I m waiting ....