How to erase a cyrillic word in s splash screen of a program?

  • Thread starter Thread starter Dima
  • Start date Start date
D

Dima

Hello
I want to erase a cyrillic word in s splash screen of a program. Code
Genie program has found the cyrillic word in some files in the program
folder, but the Code Genie does not show the word, but an abracadabra,
thefore I cannot delete the word in the Code Genie.
How to erase a cyrillic word in s splash screen of a program?
 
I want to erase a cyrillic word in s splash screen of a program. Code
Genie program has found the cyrillic word in some files in the program
folder, but the Code Genie does not show the word, but an abracadabra,
thefore I cannot delete the word in the Code Genie.
How to erase a cyrillic word in s splash screen of a program?
Click to expand...

Depends on the way, the Cyrillic word has been inserted into the Splash
screen. It could be part of a picture or a string. Both would usually
be a resource somewhere inside the main executable file, but could be
located anywhere else, too.

Take a look at the program file with Resource Hacker by Angus Johnson:

http://www.angusj.com/resourcehacker

Note, that Cyrillic chars will be displayed as question marks within
Resource hacker. So you may need some try and error to identify the
word in question. Resource Hacker can also used for modifications.

If the program is encrypted and/or packed, then you must use an
appropriate decryptor/unpacker, beforehand.

BeAr
 
Thanks for your reply.
The Cyrillic word is part of a string.
What is the "try and error to identify the Cyrillic word"?
The program is not packed, I think, since It runs from a LAN without an
install.
 
Thanks BeAr.
I opened the main executable in Resource Hacker program. Resource
Hacker did not find the word. How to search all program files in the
program folder for the word? The program does not need an installation.
It runs from a LAN.
 
Thanks BeAr.
I opened the main executable in Resource Hacker program. Resource
Hacker did not find the word. How to search all program files in the
program folder for the word? The program does not need an installation.
It runs from a LAN.
Click to expand...

Then it's most probably an image of some sort. Best of luck.
 
Then it's most probably an image of some sort. Best of luck.
Click to expand...


It could also be rendered at runtime using TextOut() or some similar
function, in which case your only hope will be to crack the program to
intercept this api call.
 
I opened the main executable in Resource Hacker program. Resource
Hacker did not find the word.
Click to expand...

ResouceHacker will not display the word, because it doesn't understand
Cyrillic charset. You need to browse through all entries which *might*
contain the word (e.g. string resources, dialogs, version information).
You can ignore all readable entries. Entries consisting of (enough)
question marks could, however, be your word. To verify, you just need
to replace such entries by readable plain text and tell ResourceHacker
to recompile the resources. - That's the approach I meant by 'trial and
error'.

As soon as your replacement string shows up, you know you've found the
right position. After that you change *only* that string. Be sure to
keep a backup of the file before you edit *anything*!
How to search all program files in the program folder for the word?
Click to expand...

Step by step. Open one after another within ResourceHacker.

You can also do a search on the string using the most possible char
representations, of course. Let's assume you want to look for the word:
ÄÐÙÛ.

There are many charset possible. To get the Unicode variant just open
the windows charmap program or use the BabelMap freeware:

www.babelstone.co.uk/Software/BabelMap.html

and create the string char by char. Browse to 'Cyrillic' Unicode block
and select the chars: 0x0424 0x0430 0x0439 0x043B.

Another possibility would be ANSI 8-bit charset with codepage 1251.
Create the String using the decimal or hexadecimal character positions
derived from codepage listings like these:

www.microsoft.com/typography/unicode/1251.gif
www.microsoft.com/typography/unicode/1251.htm
www.science.co.il/Language/Character-Code.asp?s=1251

and input them using Alt+Numpad or one of the two mentioned character
map programs. You need to switch to the Basic Latin charset in this
case. The character positions are: 0xD4 0xE0 0xE9 0xEB. Depending
on *your* system codepage you'll now see some gibberish. But the
Cyrillic string ÄÐÙÛ would be found, nevertheless. (If encoded with
CP-1251.)

Other charsets are possible, too. KOI-8 would be another example.

You have to unpack/decrypt the program files first, if they are packed
or encrypted. And (in any case) the program code can create the string
runtime, as Luis rightfully mentioned. So you have to decide, whether
changing this string is really worth your effort.
It runs from a LAN.
Click to expand...

You need write access. Else you would need to patch the running program.
That's way more complicated.

There are lots of possibilities. And all can be solved. But most are
usually not worth the time needed. And quite a few are yet harder to
explain than to do... ;-)

BeAr
 
Back
Top