Results 1 to 7 of 7

Thread: Comparing Executables and looking for byte offsets

  1. #1

    Thread Starter
    Hyperactive Member
    Join Date
    Nov 2003
    Location
    In Front of my computer...
    Posts
    367

    Comparing Executables and looking for byte offsets

    Hi people
    ok this is what i wanna know becuause i have no idea how to do it

    1. I want toI compare every byte in between 2 executables
    when I find a changed byte in case the executables are different Get the Offset of that byte and save it to a variable


    2.count the number of different bytes between the 2 executables

    ok i don't know if any you guys know this one prolly no but who knows maybe gurus can

    Thanks for the help to whoever helps!

    Regards,
    Last edited by EJ12N; Apr 22nd, 2004 at 04:17 PM.
    Born to help others
    (If I've been helpful then please rate my post. Thanks)

    call me EJ or be slapped!

  2. #2
    Super Moderator si_the_geek's Avatar
    Join Date
    Jul 2002
    Location
    Bristol, UK
    Posts
    41,974
    That is fairly easy, but not as easy as giving a thread a decent title. In future please give your threads meaningful titles (eg: this one could be "How to compare two executable files").

    Simply open both files for Binary Input (using the Open # statement, or FSO), then loop through them (both at the same time) reading bytes (using Get), and if they are different store the info you want.

  3. #3
    Super Moderator Wokawidget's Avatar
    Join Date
    Nov 2001
    Location
    Headingly Occupation: Classified
    Posts
    9,632
    Here's the code to load a file into a byte array.
    VB Code:
    1. Public Function GetFile(ByVal pstrFilename As String) As Byte()
    2. Dim bytData()   As Byte
    3. Dim intFile     As Integer
    4. Dim lngLen      As Long
    5. On Error GoTo ErrHandler
    6.     If Dir(pstrFilename) = vbNullString Then
    7.         Err.Raise vbObjectError, App.EXEName, "File not found."
    8.     Else
    9.         intFile = FreeFile
    10.         Open pstrFilename For Binary Access Read Lock Read Write As #intFile
    11.         lngLen = LOF(intFile)
    12.         ReDim bytData(lngLen - 1) As Byte
    13.         Get #intFile, 1, bytData()
    14.         Close #intFile
    15.         GetFile = bytData
    16.     End If
    17.     Exit Function
    18. ErrHandler:
    19.     Close #intFile
    20.     Err.Raise Err.Number, Err.Source, Err.Description
    21. End Function
    Hope that helps.

    Woka

  4. #4

    Thread Starter
    Hyperactive Member
    Join Date
    Nov 2003
    Location
    In Front of my computer...
    Posts
    367
    ok but how do i know the offset of the byte that is different to the other Exe?

    example

    00401031 |. 817D 0C 100100>CMP DWORD PTR SS:[EBP+C],110
    00401038 |. 75 5A JNZ SHORT blah.00401094

    that's execuable one

    00401031 |. 817D 0C 100100>CMP DWORD PTR SS:[EBP+C],110
    00401038 |. 74 5A JE SHORT blah.00401095

    excutable 2

    as you can see byte 75 in exe 1 is different in exe 2 is 74 so tha offset of that byte changed would be 1039h

    so how do i do that in vb ? get the offset of the byte changed in this case 1039h and store into variable
    Thanks

    P.S. Geek i changed my title sorry
    Born to help others
    (If I've been helpful then please rate my post. Thanks)

    call me EJ or be slapped!

  5. #5
    Super Moderator Wokawidget's Avatar
    Join Date
    Nov 2001
    Location
    Headingly Occupation: Classified
    Posts
    9,632
    VB Code:
    1. Dim lngIndex As Long
    2. Dim bytFile1() As Byte
    3. Dim bytFile2() As Byte
    4.    bytFile1 = GetFile("C:\Woof.exe")
    5.    bytFile2 = GetFile("C:\Growl.exe")
    6.    For lngIndex = 0 to UBound(bytFile1)
    7.       If bytFile1(lngIndex) <> bytFile2(lngIndex) Then
    8.          MsgBox "DIFFERENT!"
    9.       End If
    10.    Next lngIndex
    Woka

  6. #6

    Thread Starter
    Hyperactive Member
    Join Date
    Nov 2003
    Location
    In Front of my computer...
    Posts
    367
    Thanks Woka
    Born to help others
    (If I've been helpful then please rate my post. Thanks)

    call me EJ or be slapped!

  7. #7
    Super Moderator Wokawidget's Avatar
    Join Date
    Nov 2001
    Location
    Headingly Occupation: Classified
    Posts
    9,632
    Test reply using ya app....

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width