Modifying .rdata unicode strings from windows PE files

Question

I have been looking for a way of modifying static strings stored in Windows .exe files in the .rdata section, however I haven't found a real way to do so yet.

• The whole thing is too complicated to do by hand (in this case by a HEX editor) and so I wanted to know if you have a solution to do so.

Answer 1

What is complicated about doing it in a hex editor? One 'gotcha' that might be tripping you up is that you have to maintain each string's original length. You can do so with spaces at the end or (sometimes) by null-terminating it early, depending on how it's accessed in the executable.

If you really want to get tricky, you can try finding every cross reference to said string in the code and modify the length parameter passed to functions that use it.