Hex Editing Help Required...

Hmm, you're attempting to edit an exe file with a hex editor? Ok.....If you're just changing stuff in the .data section, maybe you would want to add a new section to the exe file, put your new data in the new section, and change the appropriate references to the new section, which can be done with ollydbg (which will show you (probably) all references to a string), or more easily in ida.

i don't understand what you mean by a "byte boundary", or how the executable could become corrupted. Do you mean that some of the data is inlined into the .text(code) section? If so, of course you can't alter its size.

if you plan on making relatively complicated modifications to an exe file, you might want to get a copy of the pe file format specfication (although it sounds like you already know a bit about that).

You don't have access to the source? How do you know what is text and what is not text? If all you are doing is changing the text, then you don't need to worry about virtual addresses and such, but you might run into problems with dynamically constructed sentences and things like that.

I can't think of any existing tools that might help you, although a tool that searches the binary for strings would be helpful.

Alright. First off, I would recommend a good disam. engine / debugger such as Olly, or if you can buy/get a copy from uni IDA Pro.

You are correct though, you need to maintain the byte count, other wise you won't load the whole string / bad things happen / etc.

Olly has a fantastic inline patching engine, so you can easily search for all string references in the exe (it won't find the resource ones) and then replace them. Should be faster and easier than using a hex editor. As well, if you have to replace a short string with a longer one, you can write an inline patch to redirect to some custom code that can handle loading the longer string.

You can also find the mallocs and whatnot and change how much space is being alloced so you can load difference sized strings.

If you don't know any ASM and can't do the above inline patching, you'll have to stick with just searching for string references. Either way, it should work better than a hex editor.

As for updating offsets etc, unless you are writing code caves you can just replace the korean unicode hex bytes with english ones.


Cheers
Chris