Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

.NET 

read string value and replace it inside EXE file

Hey mates , i search for away that let me to search specific string in EXE file and replace its value to another value

all that with .net c# or vb.net
Is the exe you are trying to edit .net? You could use Mono.Cecil.
Lotta blood to let, peace to make, give a fuk about a check
(Sep 2, 2015 07:46 AM)BahNahNah Wrote:  Is the exe you are trying to edit .net? You could use Mono.Cecil.

yes .net i coding it by c# or vb.net
you can look here:
Vb.Net FUD Builder method VIA server patching / byte replacement (Source)

the images are dead, but everything in the thread will make sense.
(Sep 2, 2015 07:42 AM)SIM-2564555 Wrote:  Hey mates , i search for away that let me to search specific string in EXE file and replace its value to another value

all that with .net c# or vb.net

Mono.Cecil is one of the .NET libraries that can do this.
use mono.cecil or dnlib or go directly for raw writing and check the #us heap
(Sep 2, 2015 08:16 AM)nathan72389 Wrote:  you can look here:
Vb.Net FUD Builder method VIA server patching / byte replacement (Source)

the images are dead, but everything in the thread will make sense.

ok mate this metod seems good i will go to try it now 👍


(Sep 2, 2015 08:16 AM)nathan72389 Wrote:  you can look here:
Vb.Net FUD Builder method VIA server patching / byte replacement (Source)

the images are dead, but everything in the thread will make sense.

didn't work with me , is this metod must used with same size string , beacuse i'm try to replace 1 chacracter string with huge string (Hex values for other exe)🤮
(Sep 2, 2015 09:20 AM)SIM-2564555 Wrote:  ok mate this metod seems good i will go to try it now 👍



didn't work with me , is this metod must used with same size string , beacuse i'm try to replace 1 chacracter string with huge string (Hex values for other exe)🤮

maybe you did not read:
nathan72389 Wrote:ow, there are some things to remember when doing this. the new and old string MUST be the same length
nathan72389 Wrote:I have my "Replacement String" padded with a crapload of spaces at the end, this is setting up some free space inside the server for me to add just about anything i wanted to
nathan72839 Wrote:well, just think of the logic, if a (for example) gmail username can only have a max of 25 chars, then thats one string that we know the length of, so simply (like i did in the source) pad it with a few extra spaces, and use the trim function.
Taserz Wrote:Like if in the stub it was STRINGGOESHERE and the string you added was string it should work if you fill in the rest of the string with blanks or make it A0.

if you cant get it to work, its your problem. there is enough spoon feeding going on, i dont need to chew it for you also.
I guess the simplest way is to use dnlib, - as long as you try to modify a managed assembly.
Download the dnlib library from here : https://github.com/0xd4d/dnlib

First make sure you add these imports after you've referenced the lib:

Code
using dnlib.DotNet;
using dnlib.DotNet.Emit;

Then you can lookup the string value you like to replace by iterating through the different types/methods/properties etc.
This should give you an idea of how its supposed to be done :

[Image: e283c901c4.png]

Not the most elegant attempt, but I guess it will suffice for your needs.
Other solutions are Mono.Cecil, System.Reflection or AsmResolver.

Edit : and as already mentioned by nathan72389 you should give us a proper error description, - otherwise
we can't help you. "Doesn't work" isn't a proper error description.
[C#/C++/Asm Coder]
Reverse Engineering / .Net security
no need for 3d lib if its string bytes patch is very simple
You can look Quasar's source. It uses mono cecil to write server settings.
https://hackforums.net/showthread.php?tid=4107161
(Sep 2, 2015 10:33 AM)Only3 Wrote:  no need for 3d lib if its string bytes patch is very simple

That will only work if the string is the same size as the replacement string.
If the new string is longer all offsets in the PE will get messed up.
I would recommend OP to use dnlib/Mono.Cecil to avoid such problems.
[C#/C++/Asm Coder]
Reverse Engineering / .Net security


Possibly Related Threads...
Thread / Author Replies Views Last Post
[Python] by PELockJan 26, 2025 05:29 PM 7 419 Jan 26, 2025 05:29 PM
Last Post: PELock
[C] by rognarJun 8, 2022 08:56 PM 0 122 Jun 8, 2022 08:56 PM
Last Post: rognar
[Shell] by Eternal BlueMay 14, 2022 04:02 PM 4 228 May 14, 2022 04:02 PM
Last Post: Sajuuk