ollydbg change unicode string bulk method

3.1k views Asked by At

I want to change many of parts of a unicode string in ollydbg.

Is there any plugin or trick that can be used to replace bulky of unicode string at once?

For example, if 100 unicode 'test' words exist in the string reference then I want to change all 'test' to 'test2'

00459FD0  5C 00 55 00 6C 00 74 00 72 00 61 00 4D 00 61 00  \test\.J.
00459FF0  5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00  \Microso
0045A000  66 00 74 00 20 00 53 00 68 00 61 00 72 00 65 00  ft Share
0045A010  64 00 5C 00 54 00 72 00 69 00 45 00 64 00 69 00  d\TriEdi
0045A020  74 00 5C 00 44 00 68 00 74 00 6D 00 6C 00 45 00  t\DhtmlE
0045A030  64 00 2E 00 6F 00 63 00 78 00 00 00 0C 00 00 00  d.ocx...
0045A040  3F 00 6C 00 61 00 6E 00 67 00 3D 00 00 00 00 00  ?lang=..
0045A050  22 00 00 00 5C 00 55 00 6C 00 74 00 72 00 61 00  ".\test.︁ൃᇏ
0045A080  89 40 00 A0 C9 05 42 28 10 9D 0B 2A 87 4B D3 11  䂉ꀀ׉⡂鴐⨋䮇ᇓ

Until now I was trying to find a trick or plugin but I have been unsuccessful.

How can I accomplish this task?

Thank you.

1

There are 1 answers

0
Antoine C. On

I struggled few hours to figure this, so here is the way I replaced all my strings with Olly (it was ascii, but no difference).

First we can't do hardcoding, except if the string are at the same size. So go find a free space in your executable, and paste it your string (you have to put a zero byte right after). Keep your string offset in mind, and in your CPU view, search for all referenced text strings.

Then select the string you want to replace, press enter then space to open the assemble window, then replace your offset with the one of your new string.

Cheerz! :)