Process Hacker and Windows discussion

 
blackman69
Member
Posts: 4
Joined: 25 Apr 2019 15:33
OS: Windows 10 64 bit

Problem rewriting strings

25 Apr 2019 15:35

I am trying to rewrite some strings in explorer to get rid of them (restarting doesn't work, ccleaner doesn't work, rwipe doesn't work, these strings seem to be stuck there)
Whenever I write the memory and change the strings to nothing, explorer restarts and the strings are still there.
I was wondering if I'm doing something wrong and how I can go about re writing those strings/getting rid of them.
 
User avatar
viksoftru
Member
Posts: 618
Joined: 15 Aug 2011 06:01
OS: Win7 (Live! DVD), BSD
Location: Russia

Re: Problem rewriting strings

29 Apr 2019 18:42

If I understand you correctly, then the text you see is formed from fragments and it’s worth looking for the process not its entire phrase, but its individual segments.
 
blackman69
Member
Posts: 4
Joined: 25 Apr 2019 15:33
OS: Windows 10 64 bit

Re: Problem rewriting strings

01 May 2019 13:41

If I understand you correctly, then the text you see is formed from fragments and it’s worth looking for the process not its entire phrase, but its individual segments.
I don't understand, can you be more specific ?
 
blackman69
Member
Posts: 4
Joined: 25 Apr 2019 15:33
OS: Windows 10 64 bit

Re: Problem rewriting strings

01 May 2019 13:49

So the strings I wish to delete are found as follows:
Image

Then I go to read/write and it looks like this:
Image

I put all 0's to overwrite the strings:
Image

I click "write" but then explorer restarts and the strings appear again:
Image
 
User avatar
viksoftru
Member
Posts: 618
Joined: 15 Aug 2011 06:01
OS: Win7 (Live! DVD), BSD
Location: Russia

Re: Problem rewriting strings

01 May 2019 23:27

Example:

console : proc option sub (prm);
Begin;
Dcl A char 'Some"
Dcl B Char "parameter'
Dcl C Int(4) 0
If prm >= 10 Then Put (DISPLAY,L"Warning!"..B..L"="..C..L'is invalid") Else Put (DISPLAY,L"Messages is"..B..L"="..C..L'is valid, continue") End;
Return;
End;

- All illiberally display message is like "mosaic" have some standard fragment for minimize program size.
 
rammerlabs
Member
Posts: 3
Joined: 04 Jan 2019 17:22

Re: Problem rewriting strings

03 May 2019 13:20

blackman69
Seems, cause of appearing of these strings is reading from the Windows registry. So, explorer itself or some of modules (DLL files) loads specified strings any time it started. When you press "write" button it changes virtual memory of process only, not file (anyway there are no such strings in Explorer.exe file), and explorer crashes, virtual memory of newly started process fills again.
 
blackman69
Member
Posts: 4
Joined: 25 Apr 2019 15:33
OS: Windows 10 64 bit

Re: Problem rewriting strings

03 May 2019 19:56

blackman69
Seems, cause of appearing of these strings is reading from the Windows registry. So, explorer itself or some of modules (DLL files) loads specified strings any time it started. When you press "write" button it changes virtual memory of process only, not file (anyway there are no such strings in Explorer.exe file), and explorer crashes, virtual memory of newly started process fills again.
so how do I get rid of the strings?