Re: Help with a hex hack...?

From: Michael Young (barbaraandmichaelyoung_at_hotmail.com)
Date: 05/29/04

  • Next message: Stephen Sprunk: "Re: No need to optimize in assembly anymore" 
    Date: Sat, 29 May 2004 07:09:42 +0000 (UTC)

    > > >>All,
    > > >>I've been playing around with hex-editors since back in the Amiga
    > days,
    > > >>and I've had lots of fun going into binaries and changing whatever
    > ASCII
    > > >>code there was in there, to change menus and so forth.
    >
    > > >>The one place that I thought this might be really worthwhile to do is
    > in
    > > >>Win 98 scandisk, where scandisk tells you on autorun "Since you
    > didn't
    > > >>shut down your system properly, etc. etc....You can avoid this by
    > > >>"whatever", whatever"".
    >
    > > >>I always wanted to change this to something like: "Since Windows is
    > so
    > > >>unstable, and your system probably crashed through no fault of your
    > own,
    > > >>etc.etc." However, I cannot find that text anywhere in the scandisk
    > > >>executable. I have edited boot menus and all kinds of other programs,
    > but
    > > >>I can't find the text that I really started out on all this to
    > > >change.
    > > >
    > > >>Anyone have any ideas where this text is? It's hard for me to believe
    > > >>that it's hard-coded into the application...(It probably *is* in ASCII
    > > >>in scandisk and I just never saw it maybe?)
    > > >>Anyway, thanks,
    > > >>mrpaslow
    > > >
    > > >On 22 May 2004 09:19:30 -0700, barbaraandmichaelyoung@hotmail.com
    > > >(Michael Young) wrote:
    > > >I'm also trying to do change my scandisk message to read as follows
    > > >"....to avoid this problem in the future please switch from Windows to
    > > >a stable OS" Any linux gurus out there willing to take this on for
    > > >us?
    > > >
    > > >
    > >
    > > When you can't find your text in ascii, you'll often find it in
    > > unicode.
    >
    >
    > The first chunk looks like:
    > MZJ r* # pR !PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved
    > r | ` * ENU 5 NSSC
    >
    > eeeew. that didn't cut and paste right.... Anyway, my point is, the ref to
    > pklite - looks like its some kind of compressed executable. You would
    > need to decompress it, then hex edit.

    Thanks for the push in the right direction! I've made some progress
    but have quite aways to go.

    PKLITE corupted the scandisk.exe file. I tried various PKLITE options
    for a week in my spare time. All made scandisk.exe's that crashed
    hard under windows or returned out of memory errors under dos.

    Then I tried TRON V1.6
    (http://www.hackcanada.com/blackcrawl/hack/tronv106.zip) which worked.

    Within the uncompressed (320,288 byte) scandisk.exe @ 474D2 (hex)
    bytes from the start of the file is some familier text.

    I edited what I could make out to read as follows. "_x_ #xzxG 
    y2xy+'yX{%{:, U"R
    '_yRx'@j_it. 9avoid seeing z_u_switch {%{:
    'x)?to a stable opperating sytm z_. __z_x_ #xz: %M_xu x?x: y_y_
    %M_;"

    When I power off, now scandisk reads as follows

     To avoid seeing this message again, switch shut down
     your computer by to a stable opperating sytm menu.

    I'm getting close but need some help getting at the "shut down your
    compter by" & "menu." stings.

  • Next message: Stephen Sprunk: "Re: No need to optimize in assembly anymore"