在十六进制编辑器中编辑库，同时保持其完整性
我正在尝试在十六进制编辑器插入模式下编辑库。要点是重命名其中的一些条目。如果我在“Otherwrite”模式下进行操作，一切正常，但每次我尝试在“插入”模式下向字符串末尾添加一些符号时，库都无法加载。我这里缺少什么吗？
I'm attempting to edit a library in hex editor, insert mode. The main point is to rename a few entries in it. If I make it in "Otherwrite" mode, everything works fine, but every time I try to add a few symbols to the end of string in "Insert" mode, the library fails to load. Anything I'm missing here?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
是的，你错过了很多。库遵循 PE/COFF 格式，该格式在整个文件中的指针相当多。 （例如，文件开头有一个表，它指向文件中每个部分的位置）。
在您正在编辑资源的情况下，如果您确保在编辑后更正任何指向的任何指针和大小，则有可能在不破坏内容的情况下完成此操作，但我怀疑这会很容易。如果您正在编辑 .text 部分（即代码），那么我怀疑您能否完成它，因为函数调用和跳转的操作数是其在代码中位置的相对位置 - 您需要更新整个代码都要考虑编辑。
克服这个问题的一种技术是“代码洞”，您可以使用显式 JMP 指令替换一段现有代码到某个空位置（您可以在运行时执行此操作，您可以在其中创建新内存） - 其中您定义了一些可以是任意长度的新代码 - 然后您显式 JMP 返回到您调用的位置（+5 个字节表示 JMP 操作码 + 操作数）。
Yes, you're missing plenty. A library follows the PE/COFF format, which is quite heavy on pointers throughout the file. (Eg, towards the beginning of the file is a table which points to the locations of each section in the file).
In the case that you are editing resources, there's the potential to do it without breaking things if you make sure you correct any pointers and sizes for anything pointing to after your edits, but I doubt it'll be easy. In the case that you are editing the .text section (ie, the code), then I doubt you'll get it done, since the operands of function calls and jumps are relative locations to their position in code - you would need to update the entire code to account for edits.
One technique to overcome this is a "code cave", where you replace a piece of the existing code with an explicit JMP instruction to some empty location (You can do this at runtime, where you have the ability to create new memory) - where you define some new code which can be of arbitrary length - then you explicitly JMP back to where you called from (+5 bytes say for the JMP opcode + operand).
您要更改的名称的长度与旧名称的长度相同吗？如果不是，则所有内容的偏移量都会发生变化。这些函数是否互相调用？这可能是另一个问题点。获取源代码（如果不是内部的，则从项目的网站，或者如果项目已关闭，则从供应商）获取源代码并对其进行更改，然后重新编译会更容易。我很好奇你为什么要改名字。
Are the names you're changing them to the same length as the old names? If not, then the offsets of everything is shifted. And do any of the functions call one another? That could be another problem point. It'd be easier to obtain the source code (from the project's website if it's not in-house, or from the vendor if it's closed) and change them in that, and then recompile it. I'm curious as to why you are changing the names anyway.
DLL 是一种复杂的二进制格式（即编译代码）。编译过程将命名函数调用转换为对文件中特定位置（“偏移量”）的硬连线引用。因此，如果您将字符插入文件中间，该点之后的偏移量将不再与它们引用的实际位置匹配，这意味着库中的函数调用将运行错误的代码（如果它们设法运行任何内容）根本没有）。
基本上，底线是你所做的事情总是会破坏东西。如果你运气不好，它甚至可能会严重损坏它并造成严重损坏。
DLLs are a complex binary format (ie compiled code). The compiling process turns named function calls into hard-wired references to specific positions in the file ("offsets"). Therefore if you insert characters into the middle of the file, the offsets after that point will no longer match what is actually at the position they reference, meaning that the function calls in your library will run the wrong code (if they manage to run anything at all).
Basically, the bottom line is what you're doing is always going to break stuff. If you're unlucky, it might even break it really badly and cause serious damage.
当然 - 详细了解格式以及需要更改的内容。如果您想知道为什么某些编辑会导致加载失败，那么您就缺少这方面的知识。
库旨在由链接器编写以供链接器使用。它们遵循明确定义的格式，旨在方便链接器写入和读取。它们不需要像编译器那样容忍人类输入。
很简单，库不适合由十六进制编辑器修改。可以通过用相同长度的名称覆盖条目来更改条目，或者可能会在某处搞乱索引。如果您更改任何内容的长度，则可能会破坏指针和元数据。
您没有给出任何想要这样做的理由。如果是为了好玩，那么，这比你想象的要困难。如果您有其他原因，您最好获取源代码，或者让拥有源代码的人进行重命名和重建。
Sure - a detailed knowledge of the format, and what has to change. If you're wondering why some of your edits cause loading to fail, you are missing that knowledge.
Libraries are intended to be written by the linker for the use of the linker. They follow a well-defined format that is intended to be easy for the linker to write and read. They don't need tolerance for human input like a compiler does.
Very simply, libraries aren't intended to be modified by hex editors. It may be possible to change entries by overwriting them with names of the same length, or that may screw up an index somewhere. If you change the length of anything, you're likely breaking pointers and metadata.
You don't give any reason for wanting to do this. If it's for fun, well, it's harder than you expected. If you have another reason, you're better off getting the source, or getting somebody who has the source to rename and rebuild.