HOWTO: Relocate strings with OllyDbg
Introduction
This short HOWTO shows how to relocate strings in an executable file, taking a RO client as an example. This approach is usually neccessary when there is not enough space for replacing strings in-place. You are required to be able to work with a debugger (for example OllyDbg, which will be used in this overview). Before you continue reading, read the disclaimer first. If you find a mistake or have a suggestion, please post it in the bbs.
Steps
Find Free Space for New String
The new strings need a free space in the executable, typically put either in the padding of existing sections or in a new section (won't be explained here). In this case we choose the padding between the PE header and the .text (code) section in the range 0x400400~0x400FFF. Open the context menu in window CPU in the Dump section (left bottom) and select "Go to >" and "Expression". By default the Dump shows the data section, thus enter '400400' (beginning of the range above) to get into the desired padding.
Insert String
Mark the area that you intend to edit, open context menu on the selection and select "Binary >" and "Edit". This allows entering of the desired string or strings. Each string must be terminated with a 00 byte.
Find Code by Old String
Open context menu in the Disassembly section of the CPU window and select "Search for >" and "All referenced text strings". Open context menu in the results and select "Search for text" to find the string to replace. When found, double click the line to show the position in the Disassembly section of the CPU window.
Update Reference to New String
In the disassembly section of the CPU window mark the line that contains the old string and press SPACE key to open the Assembler window. Then just replace the old string offset with the offset you read in the Dump section; in case of the first string this is 400400 in our case. Note: Should the hexadecimal address start with a letter by any chance, prefix the offset with a 0. After clicking "Assemble" close the window to prevent changes to unrelated lines. The disassembly comment should update immediately with the new string, if not, then something is wrong.
Save Changes
The last step is to save all changes made. For that open the context menu in the Disassembly section of the CPU window and select "Copy to executable >" and "All modifications", then choose "Copy All". All changes are then written to a temporary memory image of the executable. A warning about fixups may appear, which in most cases can be safely ignored in .exe files. Do the same thing in the Dump section of the CPU window to transfer the new strings into the image as well.
Finally the in-memory image has to be saved. Open the context-menu in the Dump window and select "Save file", give it a name and save it.
Disclaimer
This document is supposed to serve for general educational purposes and is provided AS IS, without warranty of ANY KIND, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose. The author cannot be made liable for actions, that can arise from the direct or indirect use of this document, including but not limited to modifications of the RO client or running private RO servers. The author cannot be made liable for ANY KIND of damages on software or hardware, that may arise from, including but not limited to use of this document, the mentioned software or websites contents this document links to.
RagnarokOnline, Ragnarok-related graphics and materials are copyright © 2002-2013
Gravity Co., Ltd. & Lee Myoungjin.