Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 12-11-2022, 00:50
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 638
Rept. Given: 38
Rept. Rcvd 568 Times in 215 Posts
Thanks Given: 33
Thanks Rcvd at 3,020 Times in 509 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
EmptyFinder

EmptyFinder
Find empty place inside target exe,
By default Byte to find is 00 (must be entered as 2 hexadecimal bytes)
you can specify on which section from PE to search, or section characteristics.

Last edited by CodeCracker; 12-24-2022 at 16:42.
Reply With Quote
The Following 2 Users Gave Reputation+1 to CodeCracker For This Useful Post:
MarcElBichon (12-11-2022), user1 (12-11-2022)
The Following 10 Users Say Thank You to CodeCracker For This Useful Post:
Apuromafo (12-11-2022), Fyyre (12-21-2022), Mahmoudnia (12-11-2022), Mendax47 (12-12-2022), niculaita (12-17-2022), pnta (12-22-2022), user1 (12-11-2022), user_hidden (12-11-2022), wilson bibe (12-11-2022), Zeokat (12-11-2022)
  #2  
Old 12-11-2022, 17:04
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 1,294
Rept. Given: 335
Rept. Rcvd 236 Times in 126 Posts
Thanks Given: 325
Thanks Rcvd at 631 Times in 349 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
Thanks CodeCracker
do you know how to make this code compatible with VS2019+?

https://prnt.sc/2_-u5LTC9vsN

error code is

EmptyFinder\EmptyFinderDlg.cpp(56,2): error C2440: 'static_cast': cannot convert from 'void (__thiscall CEmptyFinderDlg::* )(HDROP)' to 'LRESULT (__thiscall CWnd::* )(WPARAM,LPARAM)'
Reply With Quote
  #3  
Old 12-17-2022, 16:25
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 638
Rept. Given: 38
Rept. Rcvd 568 Times in 215 Posts
Thanks Given: 33
Thanks Rcvd at 3,020 Times in 509 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
EmptyFinder v2

EmptyFinder v2: added "dec" and "hex" radio for setting base of "Min number of bytes".

@sendersu: This seems to be related to drag and drop support, don't know about drag and drop in VS2019+.
Attached Files
File Type: zip EmptyFinder_Exe_v2.zip (6.5 KB, 17 views)
File Type: zip EmptyFinder_src_v2.zip (42.7 KB, 17 views)
Reply With Quote
The Following 4 Users Say Thank You to CodeCracker For This Useful Post:
Fyyre (12-21-2022), niculaita (12-17-2022), pnta (12-22-2022), user_hidden (12-22-2022)
  #4  
Old 12-20-2022, 20:47
blue_devil's Avatar
blue_devil blue_devil is offline
Family
 
Join Date: Dec 2011
Location: Observable Universe
Posts: 439
Rept. Given: 93
Rept. Rcvd 60 Times in 33 Posts
Thanks Given: 474
Thanks Rcvd at 710 Times in 231 Posts
blue_devil Reputation: 60
@CodeCracker,

1. Searching for empty bytes mean null bytes right? If so can we change the sought value; like 0x00 to 0xCC or to 0xFF
2. Can we search a pattern? (More than one byte)

Sorry, I am asking because i cannot download the files.
Reply With Quote
  #5  
Old 12-22-2022, 19:02
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 638
Rept. Given: 38
Rept. Rcvd 568 Times in 215 Posts
Thanks Given: 33
Thanks Rcvd at 3,020 Times in 509 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
1. Yes 2. No.

1. empty bytes means usually 00, you can enter other hex byte value like CC or FF
under "Byte to find" textbox. By default searches for 00 byte
Reply With Quote
The Following User Says Thank You to CodeCracker For This Useful Post:
blue_devil (12-22-2022)
  #6  
Old 12-24-2022, 16:43
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 638
Rept. Given: 38
Rept. Rcvd 568 Times in 215 Posts
Thanks Given: 33
Thanks Rcvd at 3,020 Times in 509 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
Thank for interest on my tool EmptyFinder,
here is the uploaded exe:
https://www10.zippyshare.com/v/Z0Ep9u98/file.html
Reply With Quote
The Following 2 Users Say Thank You to CodeCracker For This Useful Post:
blue_devil (12-27-2022), retro (12-26-2022)
  #7  
Old 05-04-2025, 03:29
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 638
Rept. Given: 38
Rept. Rcvd 568 Times in 215 Posts
Thanks Given: 33
Thanks Rcvd at 3,020 Times in 509 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
EmptyFinder v3

EmptyFinder v3:
- added dll extension;
- fixed section name to always shows 8 chars (added spaces (" ") to it)
Attached Files
File Type: rar EmptyFinder_v3.rar (38.7 KB, 15 views)
Reply With Quote
The Following 8 Users Say Thank You to CodeCracker For This Useful Post:
Apuromafo (05-04-2025), Codeman (05-30-2025), MarcElBichon (05-04-2025), niculaita (05-09-2025), Shub-Nigurrath (05-05-2025), user_hidden (05-05-2025), wilson bibe (05-04-2025), Zeokat (05-04-2025)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 02:18.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2025 )