Log in

View Full Version : Replacing Strings


mbro
November 23rd, 2004, 10:35
I have a dll that exports a function that basically contains a string. I wish to change the value of the string that is being exported.
I loaded the DLL into reshacker and changed the string, when I loaded the product, it didnt work.
So I then looked at the dll in W32Dasm, and saw that the function was actually being assigned a specific resource string - so I went back to reshacker and added a string, changed the dll using Hiew so that it picked up my new string - but it didnt work!

I then looked at the dll in W32Dasm again, and saw that all the string IDs were there apart from the new one I had added. I dont think I am too far away from getting this right, but could do with some help on what I need to do next. I am guessing I somehow need to rebuild the resources for this dll - but I am a newbie and dont know how to do this!

Any help would be appreciated.

naides
November 23rd, 2004, 11:17
1. change the original string instead of adding a new one, asl long as the size is not too different, and leave the resources alone.
2. Run the program in a DEBUGGER put a bp on code of the actual exported function that returns the string, and find out, in real time, where it reads it from, and experiment how you can change that behavoir (make it read your string instead).

mbro
November 23rd, 2004, 11:20
Have already tried the first suggestion, changed an 'm' to a 'w' and it didnt work for some reason!
However when I change the resource id it does pick up the new resource. I.e. there are 10 resources, when I change it from id4 to id3 it works. When I change it to the id I added - doesnt work!
Will look at the second suggestion though, thanks for the help - any other suggestions are welcome!!

naides
November 23rd, 2004, 12:43
Please clarify the sentence it doesn't work.
It means that the function corrects the string it returns or it means that it returns an error or nothing at all?

Smells to me that,given this is related to software protection (i guess), further checks are performed on the string, either before it is returned by the dll function or after, in the main exe. By debugging and tracking who reads/copies the string at each step of the way, you should be able to figure that out.