开发者

Replacing a XORed string in an excutable (x86)

I have an executable that I am trying to patch. The e开发者_JAVA技巧xecutable is storing strings using XOR encryption. I used XORSearch to find the string im looking for. It returned:

Found XOR FD Position 3E22:

Now I'd like to change that string. I'm assuming "FD" is the xor key so if I xor'ed the new string with FD I should be able to patch the executable. Problem is: I cannot find the place in the executable. I'm not sure what Position 3E22 means.

Please help!


Position 3E22 is hexadecimal and does mean Byte 15906 from the beginning.


it depends if ur code is relocatble or not. usually good programers make reloctable code because it save some space for example when using branch conditions. what u want is to relocate the code first and then patch code at that position. but such an xor code can be easily break with a statistical analyse. do u have the key?

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜