1

I am trying to edit some portable executable file with text editor. In the top of the file a backward compatibility string is supposed to display messages on DOS systems.

This program cannot be run in DOS mode.(click the link to see screenshot)

I first tried to edit this string by replacing a char (not removing or adding : just replacing to not change the file size). Then when I try to execute the file windows return an error saying I can't run this app on my computer.

I also tried to edit the padding at the very end of the file and the error is the same.

I suppose an integrity check is performed. Did someone already read about this? If you did, do you know if/where the file hash is stored in it?

fpmurphy
  • 2,464
  • 1
  • 18
  • 22
Max Buridant
  • 15
  • 3

1 Answers1

1

A text editor is not appropriate for editing binary files. Use a hex editor instead.

Norbert Willhelm
  • 2,579
  • 1
  • 23
  • 33
  • It worked fine with a hexeditor. Next time I won't be so lazy and I will install it from the beginning. Thx & have a nice day :) – Max Buridant May 21 '21 at 10:06
  • @MaxBuridant Just to add to Norbert's answer, PE files can also be signed which prevent any modifications (see [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#certificate-data) or search for PE authenticode). – Neitsa May 21 '21 at 12:21
  • There's also a checksum in PE headers, see IMAGE_OPTIONAL_HEADER32/IMAGE_OPTIONAL_HEADER64 CheckSum filed docs. – nevilad Jun 02 '21 at 16:15