From: Jerry West on
Hi Karl,

I do indeed wish to shorten the string versus versus lengthen it.

I have a statement, in part, that looks like this:

Select Case True
Case is = InStr(1, sTmp$, "@foobar.com", vbTextCompare)

I want to change it to:


Select Case True
Case is = InStr(1, sTmp$, "@foo.com", vbTextCompare)


As I indicated, when I load in a hex editor I cannot find this string
'foobar.com'. But any string declared as a constant --no problem. I've done
a hex search and a unicode as well as text search to no avail. What could I
be doing wrong? Is there a special editor for VB6 to use?

As well, given what I'm trying to do it sounds like if I can find this
string to edit it should work?

Thanks for any additional info!

JW


"Karl E. Peterson" <karl(a)exmvps.org> wrote in message
news:eManHgZsKHA.3908(a)TK2MSFTNGP05.phx.gbl...
>
> Karl E. Peterson wrote:
>> Jerry West wrote:
>>> I have a old VB6 exe that is important to a client for continued use.
>>> The source code is not available. A hard coded string within the source
>>> code needs to be changed, otherwise the exe is no longer of use to them.
>>> Is it possible to use a HexEditor to open the exe and change the string
>>> and resave the exe?
>>
>> As long as you just overwrite it. I imagine it could get very dicey if
>> you tried changing the length of it. Especially if you tried to lengthen
>> it. You could fairly easily shorten it, for most purposes, by filling
>> the end of it with null chars.
>
> Just confirmed this. I changed the text in a MsgBox string, and it worked
> just fine. I even truncated it by padding it out with 00's.
>
> But, when I inserted new bytes, to try extending it, the program blew
> chunks when starting.
>
> So, there ya go.
>
> --
> .NET: It's About Trust!
> http://vfred.mvps.org
>
>

From: Nobody on
Try this hex editor:

http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm


From: Helmut Meukel on
Jerry,

what do you mean with:
> It is a hard coded string in the source. I did try opening the file in a Hex
> editor but only found it showed the strings that were declared as
> constants --I could not see any strings that were actually in the code itself.

I just checked it myself:
I created an app in VB6 with no form, just a module.
Const Text01 = "Text as Constant"
Sub Main
Dim MyText as String
MyText = Text01
Debug.Print MyText
MyText = "HM-Soft Hof"
Debug.Print MyText
End Sub
I compiled it to native code and opened the Exe with Notepad.
-----<snip>-----
Module1 TestStringInExe T e x t a s C o n s t a n t  
 ^  H M - S o f t H o f VBA6.DLL
-----<snip>-----
As I see it, the second text "HM-Soft Hof" *is* hard coded in
the source and it shows up quite fine.
So what's your real problem?
I can see two scenarios where the string doesn't show up in
the exe:
1) it's read from a file, the registry or a database.
2) it's encrypted. So do you try to hack a password protected
app? Then I will *not* help you!

Helmut.

From: Karl E. Peterson on
Jerry West wrote:
> Hi Karl,
>
> I do indeed wish to shorten the string versus versus lengthen it.
>
> I have a statement, in part, that looks like this:
>
> Select Case True
> Case is = InStr(1, sTmp$, "@foobar.com", vbTextCompare)
>
> I want to change it to:
>
>
> Select Case True
> Case is = InStr(1, sTmp$, "@foo.com", vbTextCompare)

That should be very possible.

> As I indicated, when I load in a hex editor I cannot find this string
> 'foobar.com'. But any string declared as a constant --no problem. I've done a
> hex search and a unicode as well as text search to no avail. What could I be
> doing wrong? Is there a special editor for VB6 to use?

I like the Cygnus hex editor, myself. There is a free edition available,
although I'm not sure what limitations it comes with.

But, using my own HexDump module (http://vb.mvps.org/samples/HexDump),
it's very easy to determine the search pattern you need to look for:

?hexdump(strptr("@foobar.com"), 22)
=================================================================================
lpBuffer = &h69DF3F4 nBytes = 22
069DF3F4 0000 40 00 66 00 6F 00 6F 00-62 00 61 00 72 00 2E 00 @.f.o.o.b.a.r...
069DF404 0010 63 00 6F 00 6D 00 - c.o.m.
=================================================================================

> As well, given what I'm trying to do it sounds like if I can find this string
> to edit it should work?

I'd change the bytes to look like this:

069DE704 0000 40 00 66 00 6F 00 6F 00-2E 00 63 00 6F 00 6D 00 @.f.o.o...c.o.m.
069DE714 0010 00 00 00 00 18 03 - ......

Hope that helps. (And that it doesn't wordwrap too horribly!)

-- Karl

--
..NET: It's About Trust!
http://vfred.mvps.org


From: Karl E. Peterson on
Karl E. Peterson wrote:
> Jerry West wrote:
>> As well, given what I'm trying to do it sounds like if I can find this
>> string to edit it should work?
>
> I'd change the bytes to look like this:
>
> 069DE704 0000 40 00 66 00 6F 00 6F 00-2E 00 63 00 6F 00 6D 00 @.f.o.o...c.o.m.
> 069DE714 0010 00 00 00 00 18 03 - ......
>
> Hope that helps. (And that it doesn't wordwrap too horribly!)

Not a great example! I didn't clean it up entirely. Here's what I
meant. Before:

?hexdump(strptr("@foobar.com"), 24)
=================================================================================
lpBuffer = &h69DDE64 nBytes = 24
069DDE64 0000 40 00 66 00 6F 00 6F 00-62 00 61 00 72 00 2E 00 @.f.o.o.b.a.r...
069DDE74 0010 63 00 6F 00 6D 00 00 00- c.o.m...
=================================================================================

After

?hexdump(strptr("@foo.com"), 24)
=================================================================================
lpBuffer = &h69DE704 nBytes = 24
069DE704 0000 40 00 66 00 6F 00 6F 00-2E 00 63 00 6F 00 6D 00 @.f.o.o...c.o.m.
069DE714 0010 00 00 00 00 00 00 00 00- ........
=================================================================================

Note that what I did was totally zero out the truncated bytes. The
previous example probably would've worked, but you might as well be
clean about it.

--
..NET: It's About Trust!
http://vfred.mvps.org