<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Windows computer software on LEl_FENG Blog</title><link>https://blog.xpdbk.com/en/categories/windows-computer-software/</link><description>Recent content in Windows computer software on LEl_FENG Blog</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>LEl_FENG Copyright</copyright><lastBuildDate>Sun, 01 Oct 2023 15:08:31 +0700</lastBuildDate><atom:link href="https://blog.xpdbk.com/en/categories/windows-computer-software/index.xml" rel="self" type="application/rss+xml"/><item><title>X64DBG Modify String</title><link>https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/</link><pubDate>Sun, 01 Oct 2023 15:08:31 +0700</pubDate><guid>https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/</guid><description>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/2.webp" alt="Featured image of post X64DBG Modify String" />&lt;blockquote>
&lt;p>&lt;strong>TL;DR / [Geek Summary]:&lt;/strong>&lt;/p>
&lt;ul>
&lt;li>Reverse Engineering 101: Use x64dbg to intercept and modify static strings within a binary without source code access.&lt;/li>
&lt;li>Patching Pipeline: A complete walkthrough from global module string searching and hex editing to exporting permanent binary patches.&lt;/li>
&lt;li>Practical Customization: Demonstrated on a Minecraft GC sample to show how low-level binary manipulation can rebrand or tweak software UIs.&lt;/li>
&lt;/ul>
&lt;/blockquote>
&lt;h2 id="preface">
&lt;a href="#preface" class="heading-anchor" aria-label="Anchor for Preface">#&lt;/a>
Preface
&lt;/h2>
&lt;p>I was using x64dbg to study a program and suddenly thought of what would happen if I changed the string. This program is a Minecraft GC that I found on the Internet and put it in the following link for use&lt;/p>
&lt;blockquote>
&lt;p>&lt;a class="link" href="https://pvphack.lanzoue.com/imViN1ad7o6h" target="_blank" rel="noopener"
>Lanzoue Cloud&lt;/a>
&lt;span style="white-space: nowrap;">&lt;svg width=".7em"
height=".7em" viewBox="0 0 21 21" xmlns="http://www.w3.org/2000/svg">
&lt;path d="m13 3l3.293 3.293l-7 7l1.414 1.414l7-7L21 11V3z" fill="currentColor" />
&lt;path d="M19 19H5V5h7l-2-2H5c-1.103 0-2 .897-2 2v14c0 1.103.897 2 2 2h14c1.103 0 2-.897 2-2v-5l-2-2v7z"
fill="currentColor">
&lt;/svg>&lt;/span>
Access password: &lt;code>gy99&lt;/code>&lt;/p>
&lt;p>Compression password: &lt;code>GgGg313df&lt;/code>&lt;/p>
&lt;/blockquote>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/1.webp"
width="798"
height="458"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/1_hua6c0fd07871ca857cbabe0d0162125cf_12084_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/1_hua6c0fd07871ca857cbabe0d0162125cf_12084_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Where the string needs to be changed"
class="gallery-image"
data-flex-grow="174"
data-flex-basis="418px"
>&lt;/p>
&lt;h2 id="start">
&lt;a href="#start" class="heading-anchor" aria-label="Anchor for Start">#&lt;/a>
Start
&lt;/h2>
&lt;p>Open our &lt;code>x64dbg&lt;/code> This software is a reverse software that can be downloaded on github. After opening the software and opening our sample program&lt;/p>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/2.webp"
width="1365"
height="767"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/2_hu5ccc287b1a7bfaf0d10fdba009885d63_194468_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/2_hu5ccc287b1a7bfaf0d10fdba009885d63_194468_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Software interface"
class="gallery-image"
data-flex-grow="177"
data-flex-basis="427px"
>&lt;/p>
&lt;p>Then right click and there will be a tab&lt;/p>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/3.webp"
width="427"
height="674"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/3_hu741313233f38f6328d341c7048a94fa1_31020_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/3_hu741313233f38f6328d341c7048a94fa1_31020_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Tab"
class="gallery-image"
data-flex-grow="63"
data-flex-basis="152px"
>&lt;/p>
&lt;p>Then we scan &lt;code>Search&lt;/code> and then scan &lt;code>All modules&lt;/code> and then click &lt;code>String&lt;/code>&lt;/p>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/4.webp"
width="1365"
height="767"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/4_hu1392d007dc134cb2c97f5093bfeb20f8_183850_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/4_hu1392d007dc134cb2c97f5093bfeb20f8_183850_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Analyzing"
class="gallery-image"
data-flex-grow="177"
data-flex-basis="427px"
>&lt;/p>
&lt;p>After the analysis, we directly enter the characters and click the unique string&lt;/p>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/5.webp"
width="1365"
height="767"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/5_hua2e6840d12aaa01d55ce44651258fa6a_47386_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/5_hua2e6840d12aaa01d55ce44651258fa6a_47386_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Enter the required string"
class="gallery-image"
data-flex-grow="177"
data-flex-basis="427px"
>&lt;/p>
&lt;p>Then modify the string according to hexadecimal&lt;/p>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/6.webp"
width="1366"
height="767"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/6_hu6a02421dd26f187604903f65d67cd88a_236866_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/6_hu6a02421dd26f187604903f65d67cd88a_236866_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Modify string"
class="gallery-image"
data-flex-grow="178"
data-flex-basis="427px"
>&lt;/p>
&lt;p>After the modification, right-click the file in the upper left corner and click Patch&lt;/p>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/7.webp"
width="287"
height="250"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/7_hu9e0344a243cff79ed534d340ba4b5157_11406_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/7_hu9e0344a243cff79ed534d340ba4b5157_11406_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Find patch in the file"
class="gallery-image"
data-flex-grow="114"
data-flex-basis="275px"
>&lt;/p>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/8.webp"
width="509"
height="477"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/8_hu2bd05ad13e442ba3bdd179fad07a2bc3_9112_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/8_hu2bd05ad13e442ba3bdd179fad07a2bc3_9112_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Patch"
class="gallery-image"
data-flex-grow="106"
data-flex-basis="256px"
>&lt;/p>
&lt;p>After applying the patch, the file modification is complete&lt;/p>
&lt;p>&lt;img src="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/9.webp"
width="232"
height="34"
srcset="https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/9_hue9a17fd2d3e711825191710f657e3218_1466_480x0_resize_q75_h2_box_2.webp 480w, https://blog.xpdbk.com/en/posts/x64dbg%E6%94%B9%E5%AD%97%E7%AC%A6%E4%B8%B2/9_hue9a17fd2d3e711825191710f657e3218_1466_1024x0_resize_q75_h2_box_2.webp 1024w"
loading="lazy"
alt="Result"
class="gallery-image"
data-flex-grow="682"
data-flex-basis="1637px"
>&lt;/p></description></item></channel></rss>