Find String Offsets in a file easily! (VB.Net) 02-09-2016, 03:38 AM
#1
Yo.
So this is just something I whipped up and threw together to get this working, I imagine this could be much more efficient however I'm not worrying about parsing massive files so efficiency isn't a huge deal as long as it works relatively quickly.
It works by converting the inputted string into a Unicode encoded string, then from there converts it to a list of Hex bytes.
After that it loops through the desired file and will return the starting offset, and the ending offset once it finds all of the Hex bytes in a row.
Super simple and amazingly useful for patching, I'll be personally using this in Ven0m to patch dll's before they're sent to the client.
Screenshot of it implemented:
Below is an example of a DLL opened in HxD and a simple console I made to scan for the desired Hex pattern. HxD has the string found and selected, and from there we can compare my function's starting and ending addresses vs. what HxD found. As you see they match.
![[Image: UHCD42c.png]](http://i.imgur.com/UHCD42c.png)
Function:
[hide]
It will return a response like:
{StartingOffset}|{EndingOffset}
[/hide]
So this is just something I whipped up and threw together to get this working, I imagine this could be much more efficient however I'm not worrying about parsing massive files so efficiency isn't a huge deal as long as it works relatively quickly.
It works by converting the inputted string into a Unicode encoded string, then from there converts it to a list of Hex bytes.
After that it loops through the desired file and will return the starting offset, and the ending offset once it finds all of the Hex bytes in a row.
Super simple and amazingly useful for patching, I'll be personally using this in Ven0m to patch dll's before they're sent to the client.
Screenshot of it implemented:
Below is an example of a DLL opened in HxD and a simple console I made to scan for the desired Hex pattern. HxD has the string found and selected, and from there we can compare my function's starting and ending addresses vs. what HxD found. As you see they match.
Function:
[hide]
Quote:Function findOffset(ByVal filename As String, ByVal sourcesrc As String) As String
Dim spos As Integer = 0 ' <== THIS IS THE STARTING OFFSET
Dim epos As Integer = 0 ' <== THIS IS THE ENDING OFFSET
Dim offsetlist As New List(Of Byte)
For Each b As Byte In Encoding.Convert(Encoding.ASCII, Encoding.Unicode, Encoding.ASCII.GetBytes(sourcesrc))
offsetlist.Add(String.Format("&H{0:x2}", b))
Next
Using reader As New BinaryReader(File.Open(filename, FileMode.Open))
Dim pos As Integer = 0
Dim curct As Integer = 1
Dim length As Integer = reader.BaseStream.Length
Do While pos < length
Dim value As Byte = reader.ReadByte()
If value = offsetlist(curct-1) Then
If curct = 1 Then spos = pos
If curct = offsetlist.Count Then
epos = pos
Exit Do
End If
curct += 1
Else
If curct > 1 Then curct = 1
End If
pos += 1
Loop
End Using
Return String.Format("{0}|{1}", Hex(spos), Hex(epos))
End Function
It will return a response like:
{StartingOffset}|{EndingOffset}
[/hide]
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
