Changing the byte in an Executable file in Delphi

lee_can · 11-13-2012, 01:22 PM

Hi,

I am working on a program who will find an address in a executable file, then read the byte and replace it.

For example,
File name is Test.exe (size 10.6 kb), I want to change the byte FA located at 5000 to 05.

I search on the net about SetFilePointer, and i try to do this:

Code:

var
  h,      : HFILE;
  buf     : array[0..4095] of Byte;
  Read, p : DWORD;
  m, nac  : DWORD;

begin

  m := 1;
  nac := 5000;
  h := CreateFileA('C:\TEST\test.exe', GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, NIL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  
if h <> INVALID_HANDLE_VALUE then
  begin
    p := SetFilePointer(h, nac, @m, FILE_BEGIN);
    if p <> 0 then
      ReadFile(h, Buf, SizeOf(Buf), Read, NIL);
  end;

 edit1.Text := InTtoStr(m);
 edit2.Text := InTtoStr(nac);
 edit3.Text := InTtoStr(p);

Can anyone advice please how can I rearrange the above code?

Regards

sundialsvcs · 11-13-2012, 04:03 PM

This is a Linux forum...

Furthermore: you should assume that an executable file cannot be altered by whoever-you-are, and further that if you did, the operating system would no longer consent to run it (since it was digitally signed).

PTrenholme · 11-13-2012, 04:36 PM

It's been to long since I (briefly) used Delphi, so I can't help you with your code problem.

I should note that almost all ELF object files (i.e., compiled executable files) on Linux systems contain a section, .gnu.hash, that must match the hash code of the object file before it will be executed, so simply changing a byte in an executable will, almost always, kill the file. (Among other things, this prevents a bad drive from making your file do catastrophic things to your system.)

So, even if you get your code to work, the result may not work.

Oh, if this is not just a Delphi programming exercise, you can install the hexedit package and make you change "by hand."

lee_can · 11-13-2012, 08:56 PM

Sorry Guys

I must put this thread in a Delphi Forum.

Regards