A great way to modify the behavior of a program is by directly altering the executable file. Anyone with experience programming in assembly knows that the executable file itself is just operations and data. Opcode and operands, represented in hexadecimal format. As long as we do not change the length of the overall program, we do not risk corrupting the application. With enough study, one can apply techniques to reverse engineer and manipulate programs.

I will not be going into very advanced topics, as this is mostly produced from my own playing with executables. That, and this can expose security vulnerabilities of systems. Furthermore, I am not liable for any damage that may incur from you doing this. Broken computers or software is not my concern. If you are careful, you should be fine.

My first example will be a "Hello World!" example. Basically, we will write a "Hello World!" Program in C, and then manipulate the executable to change our message to something else. All you need to do this is GCC and your favorite text editor. You can use a hex editor as well, but this is a very straight forward example, and it is unnecessary.

The code for hello world is shown here:

#include<stdio.h>

int main(int argc, char** argv) {
    printf("Hello World\n");
    return 0;
}

We then compile with gcc:

gcc -o hello hello.c

Then, open the file in a text editor

texteditorname hello

I use vim personally, but you may use whatever you wish (emacs, kate, gedit, etc)

When you first open the executable, it may seem daunting, but there is not a lot we have to worry about here. Look through it, and find our message, Hello World!

We can replace this text with another message. For now, let's make it the same length. I used Fellow Guys! but you can add whatever you want.

Save the file, and execute it. Your output will be the new message!

Now, take a single character from right after our string, and replace the last character of the string with it. (In vim, it is ^@ )

We've now shortened the string by 1. We can do the opposite as well, as long as the character is replacing an ^@ and is a part of the string, and there is at least one ^@ at the end of the string.

I'll be experimenting with this over the next few days, and will post another entry with my own discoveries (because playing around with it is more fun than reading a tutorial)