Reverse Engineering Asked by Alonia on December 6, 2020
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from Chinese to German.
The second ELF "(binary2)" has a slightly different structure.
In my first ELF file "(binary1)", which I successfully modified, the pointers for the respective strings were in the ".data.rel.ro" part.
So with a short C# code I could output the strings.
static int start_data_rel_ro = 0x1708;
static int end_data_rel_ro = 0x1A3CF;
static void binToConsole(string inputFile)
{
var data = getData(inputFile);
for (int i = start_data_rel_ro; i < end_data_rel_ro;)
{
var line = "";
var addr = BitConverter.ToInt32(new byte[] { data[i], data[i + 1], data[i + 2], data[i + 3],0,0,0,0 },0);
i += 4;
List<byte> textData = new List<byte>();
do
{
textData.Add(data[addr] == 10 ? ((byte)0x7C) : data[addr]);
addr++;
} while (data[addr] != 0);
line = System.Text.Encoding.UTF8.GetString(textData.ToArray());
Console.WriteLine(line);
}
}
static byte[] getData(string path)
{
byte[] data;
using (var file = File.OpenRead(path))
using (var ms = new MemoryStream())
{
file.CopyTo(ms);
data = ms.ToArray();
}
return data;
}
For the "(binary1)" I already have a finished program which stores the strings in a CSV and afterwards inserts the CSV back into the "(binary1)" and patches the pointers. So I can make a string longer if I make a string shorter somewhere else.
Here is an excerpt of my previous file, which I have processed successfully
The .rodata contains all strings:
The .data.rel.ro contains all pointers to the strings:
but the new file "(binary2)" I want to edit now looks a bit different.
My C# code can’t work in the second ELF, because it’s a bit different. Unfortunately I don’t know what to do. Maybe someone has an approach for me, so I can write a new little tool.
Here is a download link to the "(binary2)": https://drive.google.com/file/d/12vr-zcTnC3TzCIuvZ9Yt19lbb6dkEFdl/view?usp=sharing
Get help from others!
Recent Answers
Recent Questions
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP