+  RHDN Forum Archive
|-+  Romhacking
| |-+  ROM Hacking Discussion
| | |-+  Finding spaces in EXEs
Pages: [1]
Author Topic: Finding spaces in EXEs  (Read 2 times)
Falco
Guest
« on: July 07, 2008, 10:11:38 pm »

A lot of executable files have strings that can only be found with Hex Editors, limiting your translation space. Is there a way to expand this space without corrupting the whole executable?
byuu
Guest
« Reply #1 on: July 08, 2008, 11:52:28 am »

Option 1:

Hook a DLL to launch along with the process. Once it does, allocate memory and overwrite the pointers / references to the strings to point to your RAM area instead. Or point them to the strings in the DLL directly.

Option 2:

Create a launcher, have the launcher open the EXE as a debugged process. Now you have full control over that process, and you can use VirtualAllocEx to allocate heap memory in your debugged process. Now update the pointers / references to your newly allocated RAM. You have to use RAM in this case, as you obviously can't have your debugged process reference data inside the launcher directly.

If you use RAM, you'll obviously want to either load the script from an external text file, or from the DLL / launcher itself.

---

I personally like the latter, because it requires no permanent modifications to the original EXE, but the former is probably more professional looking.

If you don't know how to do either, sorry. I don't have any time to teach. Google should turn up some good stuff with "DLL injector", or look for API documentation on CreateProcess, VirtualAllocEx, WriteProcessMemory, etc.
Pages: [1]  


Powered by SMF 1.1.4 | SMF © 2006-2007, Simple Machines LLC