Can hardcoded strings in a compiled exe be modified?

Question

Suppose you have a code in your application with a hard-coded string.

If somevalue = "test123" Then End If 

Once the application is compiled, is it possible for someone to change the .exe file and change "test123" to something else? If so, will it work only if the string contains the same number of characters?

Answer 1

It is possible, but not necessarily simple. For example, if your string is loaded into memory, someone might use the memory manager tool to directly change the value of the string address.

In addition, they can decompile your application, modify the line and recompile it to create a new assembly with a new line. However, whether this can happen depends on your application and how important it is for this line to be changed.

You can use an obfuscator to make it a little more complicated, but ultimately, a determined cracker can do it. The question is whether this line is important for concern, and if so, perhaps consider an alternative approach, such as using a web service to provide the line.

Answer 2

Strings hardcoded without any obfuscation methods can be easily found inside compiled executable files by opening them in any HEX editor. After detection, line replacement can be performed in two ways:

1. Easy way (* conditions apply)

If the following conditions apply in your case, this is a very quick way to modify hard-coded strings in an executable binary.

• length(new-string) <= length(old-string)
• There is no logic in the code to check for modifications using CRC.

This is a viable option ONLY if the new line is equal to or shorter than the old. Use the hex editor to find the occurrences of the old line and replace it with a new line. Put extra space using NULL ie 0x00

For example old-long-string in binary

changes to a shorter new-string and is filled with null characters to the same length as the original string in the binary executable

Please note that such modifications of executable files are detected using any code that checks the checksum of the binary file for the preliminary calculated checksum of the original executable file.

2. More stringent (applicable in almost all cases)

Decompiling binary code into native code opens up the possibility of changing any lines (and even code) and rebuilding them to obtain a new executable file.

There are dozens of such decompiler tools for decompiling vb.net (Visual Studio.net in general). An excellent detailed comparison of the most popular (ILspy, JustDecompile, DotPeek, .NET Reflector, to name a few) can be found here .

There are scenarios in which an even more difficult path will NOT be successful. This is the case when the original developer used obfuscation techniques to prevent detection and modification of strings in the binary executable. One such method of obfuscation is the preservation of encrypted strings .