你看看这个工具可以用吗？
8 A5 s' R- B7 \1 o# x% ~http://www.aluigi.org/mytoolz/exestringz.zip! O* ~6 W/ l% r4 v1 W
) U" F: V6 }7 v' ] Whttp://www.aluigi.org/mytoolz.htm
, ]3 B7 y( B. \8 j. l2 H: jExecutable's strings lister and replacer 0.2.3 (exestringz) .image.0 n; {) F( b0 i% \0 k/ z" i
this tool has the main purpose of finding any ASCII and unicode string inside PE and ELF executables with the possibility of modifying them using any external text editor and re-injecting them in the original executable.
_$ | r: G% j+ w& U8 m' Itechnically the finding of the strings works in the following way: it disassembles all the executable sections of the input file (like .text, only x86 32 bit supported) and visualizes any string or any array of strings, so any instruction like push "string" or mov eax, "string" or mov eax, "[4*edx+array]" and so on is handled perfectly.
7 n0 Y+ L0 A; einstead the injecting of the modified strings back in the executable (ELF not supported) is performed through the adding of a new "stringz" section which contains all the new strings and the substituiting of all the pointers to those strings collected in the "finding" operation with the new ones (relocation).. k: s; P5 s7 D: g& k, D
the tool can be also used as a quick and advanted strings program (the one available on *nix) with the difference that the strings found by exestringz are not casuals but are found and confirmed by the disassembled code avoiding false positives.
2 ?: s: D: A/ e" _% H" u1 z; ranyway through the -b option the tool can acts exactly like the strings program and naturally can also re-import the modified strings.
# e y& p3 _- p sthere is also an "experimental" option specific for the asian utf8 which was also the reason of the initial creation of this tool for the translating of a japanese game.& C( _- N3 r( s6 e+ ^! X, A
note that for obvious technical reasons is not possible to export and reimport ever all the strings for any executable because in some cases (usually with big programs) could be generated false positives, anyway the output file generated by the tool is very easy to understand and edit so it's not a problem.
4 l4 Z/ t) k; i; q0 _technical limitations:
- ?& K, D2 K+ M% c" `! q' O1 |: y# q n. h: I& w
the end_of_line (carriage return/line feed) is left as was in the original string, so the result is that the output file could have a "mixed" style of unix ('\\n') and windows ('\\r\\n'), and some text editor could try to convert the whole text in or the other style causing troubles (for example overwriting other strings or resources in the executable)
+ U4 ^$ t/ M/ V2 g3 A5 @1 B* Z( lthe recognization of the english strings is ok since that charset is enough limited but for the others it's just a chaos anyway the tool is still a work-in-progress... |
发表于 2009-7-10 20:58
QQ好友和群
QQ空间
腾讯微博
腾讯朋友
收藏
分享
很美好
很差劲
发表于 2009-7-11 13:22
楼主
