首页
社区
课程
招聘
[分享]SFX-文本/二进制替换工具
发表于: 2015-8-13 21:48 4313

[分享]SFX-文本/二进制替换工具

2015-8-13 21:48
4313
可以替换文件中的文本或者二进制代码中的字节,“-dump”参数可以显示替换前后对比,“-yes”参数加入才会真的替换。

官方网站:0c0K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4y4@1j5h3S2D9N6$3!0J5K9%4y4Q4x3X3g2U0L8$3#2Q4x3V1k6V1k6i4k6Q4x3V1k6A6L8X3c8W2P5q4)9J5k6i4m8Z5M7q4)9K6c8Y4c8G2L8$3I4Q4x3@1c8J5k6i4l9`.


官方例子:

examples
   sfk replace myfile.dat "/Lemon/Curry/"
      replace Lemon by Curry within myfile.dat. search is
      case-insensitive, therefore "lemon" will be replaced as well.
      the quotes "" are optional here.
   sfk replace -pat /FooCase// -dir . -file .txt
      search for FooCase in all .txt files below current directory.
      note that if you leave out the single fileOrDir parameter,
      you have to say -[s]pat, -bin or -text first to tell clearly
      that you will specify the target fileset later on.
   sfk rep -spat "/The foo/The\tbar/" -dir mydocs
      replaces "The foo" by "The" and "bar" separated by TAB char,
      within all files within mydocs.
   sfk rep -binary /1A/20/ -dir docs -file .txt .info .note
      replaces all bytes with code 0x1A by code 0x20, in all .txt,
      .info and .note files, in directory docs and all subdirectories.
   sfk replace tmp\image.dat -bylist patches.txt
      searches for source patterns in file tmp\image.dat,
      replaces by patterns specified in patches.txt
   SFK Base and XE: swap text in two steps
   sfk -yes rep io.txt /foo34/foo99/ /foo12/foo34/ +rep /foo99/foo12/
      replaces foo12 by foo34 and vice versa. with SFK Base, a word
      which is replaced may be replaced again by a following pattern,
      therefore the intermediate step: turn foo34 into something
      not used anywhere in io.txt, then replace foo12, then replace
      the intermediate pattern back in a second replace command
      on the same file.
   SFK XE only: swap text in one step
   sfk rep io.txt /foo12/foo34/ /foo34/foo12/ -yes
      replaces foo12 by foo34 and vice versa. with XE, a word which
      is replaced is not looked at again in the same command, so
      "foo34" from the first pattern is not changed by the 2nd.
   sfk hexfind mydir -pat /FooCase/ +list -late
      do not replace, just find binary files containing "FooCase",
      then list them sorted by time. also accepts -bylist files.
   sfk replace -binary /666f6f/626172/ -dir mydir -file .dat
      replace binary data with hex values 0x66, 0x6f, 0x6f
      by data with values 0x62, 0x61, 0x72 in all .dat files.

example with output:

preparing a replacement of pattern "class Foo".

   sfk rep testfiles "/class foo/class Other/" -dump

output:

   [simulating:]
   [total hits/matching patterns/non-matching patterns]
   testfiles\FooBank\GUI\include\FooGUI.hpp: hit at offset 0x64
   >6F6E616C 6974792E< onality. 00000054
   >0D0A2A2F 0D0A0D0A< ..*/.... 0000005C
   >636C6173 7320466F< class Fo 00000064
   >6F475549 0D0A7B0D< oGUI..{. 0000006C
   >0A707562 6C69633A< .public: 00000074
   [001/1/0] testfiles\FooBank\GUI\include\FooGUI.hpp
   testfiles\Formats\12-foo-jam.txt: hit at offset 0xE6C
   >6F6E616C 6974792E< onality. 00000E5C
   >0D0A2A2F 0D0A0D0A< ..*/.... 00000E64
   >636C6173 7320466F< class Fo 00000E6C
   >6F475549 0D0A7B0D< oGUI..{. 00000E74
   >0A707562 6C69633A< .public: 00000E7C
   [001/1/0] testfiles\Formats\12-foo-jam.txt
   38 files checked, 2 would be changed.
   [add -yes to execute.]

the input data is listed as hex and ascii, with the hits highlighted.

[培训]科锐逆向工程师培训第53期2025年7月8日开班!

收藏
免费 0
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回