Find string offset in exe or dll

Archive: Find string offset in exe or dll

Rolando
31st May 2007 03:19 UTC

Find string offset in exe or dll
I was searching for a function that can give me the offset in where a string can be found inside a exe/dll file and came across this. Now that function seems to do the job quite well, only it doesn't give me the hexadecimal or decimal offset of where the string I searched for is found. Is there anyway to do that?

demiller9
31st May 2007 08:14 UTC

Push "C:\Program Files\NSIS\makensis.exe"
Push "KERNEL32"
Push 0  ; offset to start
Call BinStrSearch
Pop $1  ; address of string or 0 if not found

I use the code shown above to call BinStrSearch; I've just added it to the Wiki since I can't find the original function at the moment.

It will return the decimal offset, but you can convert it to hex with a single statement:

Pop $1
IntFmt $1 "0x%04x" $1

Don

Rolando
31st May 2007 12:15 UTC

well thanks for that, but the weird thing is that using SearchByteFile I do find the string but I can't know the offset however, using BinStrSearch returns 0 for the same string, meaning it's not found.

Isn't it possible to modify the first function and make it return the offset?

Afrow UK
31st May 2007 13:45 UTC

I shall re-write that function is it doesn't always work with the offset (or -1) as the output.

Stu

Afrow UK
31st May 2007 14:02 UTC

Try this:


Function SearchBinaryFile
Exch $R0 # file
Exch
Exch $R1 # search
Push $R2
Push $R3
Push $R4
Push $R5
Push $R6

  StrLen $R2 $R1
  ClearErrors
  FileOpen $R3 $R0 r
  IfErrors error
  StrCpy $R0 0

  read:
    StrCpy $R6 ``
    StrCpy $R4 0
    read_string:
      ClearErrors
        FileReadByte $R3 $R5
      IfErrors error
      IntFmt $R5 %c $R5
      StrCpy $R6 $R6$R5
      IntOp $R4 $R4 + 1
    StrCmp $R4 $R2 0 read_string

    StrCmp $R6 $R1 done
      IntOp $R0 $R0 + 1
      FileSeek $R3 $R0 SET
      Goto read

  error:
    StrCpy $R0 -1
    Goto +2
  done:
    FileClose $R3

Pop $R6
Pop $R5
Pop $R4
Pop $R3
Pop $R2
Pop $R1
Exch $R0 # offset or -1
FunctionEnd

Usage:


Push "string"
Push "path\to\file.ext"
  Call SearchBinaryFile
Pop $R0 # offset / -1

Stu