How to find and replace certain hex value within a compiled exe

Question

I am trying to create a C# application that will patch a certain application. As an example, I have 8 files, all 8 need to be patched in a similar fashion, (they have the same hex values to replace, but at different offsets). I need my program to find where these hex values are, and replace them. I cannot figure out a way to get my program to search for the hex values. Any help would be greatly appreciated. Currently, this is my code:

private const string SoftwareDirectory = @"C:\Program Files\ExampleSoftware";
private const string HexCode = "C8 49 73 B9";
private const string IgnoreEXE = "ignoreMe.exe";

static void Main(string[] args)
    {
        List<string> allTheFiles = FindFiles(SoftwareDirectory, "*.exe", SearchOption.AllDirectories, IgnoreEXE);
        allTheFiles.ForEach((string s) =>
        {
            // Find and replace hex value here, Hex value defined by HexCode, and modified version is C7 49 73 C6, as an example
        });
        Console.ReadLine();
    }

static List<string> FindFiles(string directory, string searchPattern, SearchOption searchOption, string ignoreFiles = null)
    {
        List<string> files = new List<string>();
        foreach (string file in Directory.EnumerateFiles(directory, searchPattern, searchOption))
        {
            if (!file.Contains(ignoreFiles))
            {
                files.Add(file);
            }
        }
        return files;
    }

That code seems to have nothing to do with the question. Does that mean you havent tried anything? For what you describe, you should not have to find the value - they can be many places it appears. The patcher ought to already know the offset otherwise you could change the wrong one or too many or... — Ňɏssa Pøngjǣrdenlarp, Feb 16 '18 at 17:59
I do have the offsets, I simply want to find a more modular alternative, rather than typing in new offsets each time. Also, the "example" software only have the hex values appear once in the entire table. — Kontorted, Feb 16 '18 at 18:05

score 3 · Accepted Answer · edited Feb 16 '18 at 18:09

3

It doesn't matter that it's an exe (apart from the fact that you may not have permission to write to the Program Files directory, or may not be able to write to the executable because it is running). Just treat it as a binary file.

Use IO.File.ReadAllBytes and IO.File.WriteAllBytes.

Finding a byte sequence within a byte array has already been answered. byte[] array pattern search

edited Feb 16 '18 at 18:09

41686d6564 stands w. Palestine

19,168
12
41
79

answered Feb 16 '18 at 18:04

Wyck

10,311
6
39
60

2

And replace your original string HexCode by byte[] HexCode = new byte[]{0xC8, 0x49, 0x73, 0xB9} – oliver Feb 16 '18 at 18:09

How to find and replace certain hex value within a compiled exe

1 Answers1