Note: I don't know how much mess, I can't change it. Please go to the original http://people.os.org.cn/zoudan/doc/patch_2.htm how to play patch (1) --- foundation Article: One. This paper is practical for beginners, requiring certain assembly and system underlying knowledge. two. This article is only to let the majority of netizens will improve some basic knowledge. I will do not find out if I need readers who need this knowledge, if you are a master, or don't need this knowledge, please skip. three. Examples of this article are ordinary procedures, if there is similarity, please understand. four. This article welcomes the transfer, if it is commercial use, please contact me. Http://www.zoudan.com Zoudan@sina.com Pressing a common software upgrade and update tool. There are many forms in the patch, and the ways described herein are substantially used in the way to modify the original program binary code (Win32). The executable files after Windows95 (Win32) are all PE formats, .exe, .ocx, .dll., Etc. are all common PE format file images, see if a file is a PE file, not to see its extension, Instead, see if there is a PE file header and the specific file content in its file header. For example, the Wry.dll in the common software "chasing" is not a PE format DLL (Dynamic Library) file, usually using the 16-en-editing software to open the file first observation. About the specific format and tutorials of the PE file are not the scope of this article, you can consult the relevant information, and the "About 95 Executive Document Encryption Research" is also more detailed. The PE file is a program code, the collection of data. The program code is that the execution file itself, which may access other subsidiary programs or dynamic connection libraries by dynamic connection, usually a large number of system calls and calls to other programs and dynamic connection libraries. The universal method is not a way to change, the program is improved, or the program is not changed, and the most direct method is to change the execution file. Everyone knows that I made patch, basically modifying the program file, making it the functions we need. There is usually a number of sections in a PE executable, which describes unconflicted data structures and code. The most basic segments have .code (.text) (code segment) ,. data (data segment) ,. rData, .rscs (resource), etc., the names of these segments can be program-specific, determine their properties. Not his name, but a description in the PE file header. There are a lot of software to view PE file structure and content. I recommend a small software called TDUMP from Borland C, which is very simple and convenient, in the current Borland C Builder and Borland C, everyone can use him. Understand the internal information of the PE file. For the convenience of modifying the resource segment is the most simple. Those dialogs, strings, bitmaps, and more. Modifying these resources is easy, because there are many software, the most common is VC , just open the program file with the VC modification, all this program related resources will be easily modified. Everyone can find a few programs to try the hand, the NMD dialog, change attributes, edit the text, draw bitmap, and easy to get started and familiar.
