Locked Modifying .exe files

[Zyan94]

Hi, anyone with experience in modifying .exe or .dll files can provide me some advice.

1. Some content, e.g. window title, text or buttons can be accessed and modified through exe editor or hex editor, but some can't, not even a single text that exist in the UI can be found in the exe HEX file, does that mean they are encrypted?
2. I have a few miscellaneous .exe file that blast audio in the background, for some occasion, the audio resource (in hex not wav format, i just delete stuff through trial and error and found out it was a audio RCData) can be found in exe resource software, and can be deleted easily. Other times, that similar resources doesn't show up for different file, is it also due to encryption?
3. If so, is there anyway to decrypt data for modifyiing? Is there some sort of documentation for .exe files for all its headers/length/and wheredo other components start and end.

I also saw some tutorials on using software like x64dbg, but this is more targeted towards the runtime data not the UI shell itself. Nevertheless, I still need more time to poke around x64dbg.

 

[Jerry_Xristos]

You can use recourse hacker for dll files and especially when you make custom builds for windows.
As for programs not a clue for my site.
Good luck

 

[xDaemon]

You can try 010 Editor, HTE [ outside Link Removed ⛔️ ], ResEdit, Resource Tuner or HxD Hex Editor!

 

[Zyan94]

Thanks for the suggestions @Jerry_Xristos @xDaemon
For exploring resources, I've tried ResTuner, PE Explorer and resource hacker. For occasion that the resources do appear, they appear in all three software, and when they don't, all three failed to access.
For hex editor, the entire hex code of the file is presented, so I thought logically that searching for text that are embedded into the .exe files (text that shows up in the UI) would be always plausible, even if they are separated by space or other chars.
Turns out even going that low level (assembly or hex) may result in nothing due to encryption, or perhaps I have not dig deep enough

 

[Cyler]

I think we are mixing some things here. I will try to avoid getting technical about this tho it's a fairly complex subject.

Resources are in general the messages, dialogs, and/or Icons that a program displays when it's used. The reason that a lot of software companies use resources files is simply for translations and editing of the current text for typos and spelling. If one wants their program to become multilingual all they have to do is give the resource files to people that know the language and they simply translate and rewrite the messages without having to know how to code etc. Having said that, the use of resource files is optional and a lot of times depends on the compiler and the choice of the programmer. Some do use them, some don't.

We have to distinguish between what a resource is and what a function is. For example, if a program plays a sound with a certain volume or uses a certain compression to do things, we can't just change a resource for it. In some cases, you may just change the sound by changing the sound file, but that is not always the case, and for sure you won't have control of the volume or other aspects of the sound. For that, you need to learn how to reverse engineer a program, and even then it's not really guaranteed.

To make things worse, a lot of programmers/companies will try with everything they have/can to protect even their bitmaps let alone their EXE. That's why they use encryption and compression on their exe files and resources for protection and code obfuscation. It's hard to even debug and set breakpoints in those programs, let alone decompile and edit and so those programs are off-limits.

So long story short, Resource editors have a rather limited range, and what they can edit depends on the wishes or knowledge of the EXE coder/programmer and not you. You can only edit what they allow (or forgot to set it not to be edited )

Sadly I can't get deeper at this and show you how to decompile an executable. It requires very good knowledge of both assembly language (or even C) and internal windows functions but you can find many resources (pun intended) to read on that subject if that is something you wish.

As a site and to follow the rules, we try to avoid keeping topics open that aren't directly related to what we do. If there isn't anything else to add, I think we should close this thread and I hope you understand.

 

[Zyan94]

I think we are mixing some things here. I will try to avoid getting technical about this tho it's a fairly complex subject.

Resources are in general the messages, dialogs, and/or Icons that a program displays when it's used. The reason that a lot of software companies use resources files is simply for translations and editing of the current text for typos and spelling. If one wants their program to become multilingual all they have to do is give the resource files to people that know the language and they simply translate and rewrite the messages without having to know how to code etc. Having said that, the use of resource files is optional and a lot of times depends on the compiler and the choice of the programmer. Some do use them, some don't.

We have to distinguish between what a resource is and what a function is. For example, if a program plays a sound with a certain volume or uses a certain compression to do things, we can't just change a resource for it. In some cases, you may just change the sound by changing the sound file, but that is not always the case, and for sure you won't have control of the volume or other aspects of the sound. For that, you need to learn how to reverse engineer a program, and even then it's not really guaranteed.

To make things worse, a lot of programmers/companies will try with everything they have/can to protect even their bitmaps let alone their EXE. That's why they use encryption and compression on their exe files and resources for protection and code obfuscation. It's hard to even debug and set breakpoints in those programs, let alone decompile and edit and so those programs are off-limits.

So long story short, Resource editors have a rather limited range, and what they can edit depends on the wishes or knowledge of the EXE coder/programmer and not you. You can only edit what they allow (or forgot to set it not to be edited )

Sadly I can't get deeper at this and show you how to decompile an executable. It requires very good knowledge of both assembly language (or even C) and internal windows functions but you can find many resources (pun intended) to read on that subject if that is something you wish.

As a site and to follow the rules, we try to avoid keeping topics open that aren't directly related to what we do. If there isn't anything else to add, I think we should close this thread and I hope you understand.

Wow, this is a very good explanation for distinguishing a resource and a function, encryption and compression of a exe files. Thanks for the insights and enlightenment.
I totally get that the topic is straying further from the main focal of this forum, admins can close it anytime, no worries. @Cyler did help me clear most of my confusion.

I do have some experience in assembly and C, probably abit rusty, but zero knowledge for internal windows function, I'll spent some time reading up on that, coz i do have much interest in modifying stuff (low-level wise), and would one day love to develop/mod my own distros like you guys too.
Thanks again everyone, appreciate it.