PDA

View Full Version : Change save directory


mint77
January 26th, 2013, 07:43
I have a program and it has no provision to change the location where an exported text file is stored.

The save directory is C:\*uroSoft\*alendar Magic

I used IDA and looked in the Strings but could not find it.

I am kind of new to this and could use some help.

Thanks.

hfm
January 26th, 2013, 10:21
Is the save path the programs install directory?

If so then it is likely getting the path the program is run from.

mint77
January 26th, 2013, 16:38
Yes, it is creates a text file of reminders that I created in the directory where the program is kept.

I would like to change where it stores that text file to another directory.

I searched for the path in the .exe, but it wasn't there.

hfm
January 27th, 2013, 04:38
It is unlikely that the Install path is going to be hardcoded into the application.

Try searching instead for the filename of the file it creates.

From there look at how it is opening the file.

mint77
January 27th, 2013, 14:27
Thanks I will look for it.

mint77
January 27th, 2013, 23:36
When I loaded it in Ollydbg and hit Run, it said "exception is non-continueable."

I want to start the program and have it save my reminders to the text file so I can find where
in the code that it is occurring.

Thanks.

I will load it in Windbg and see what happens.

hfm
January 28th, 2013, 03:44
I get an exception in ollydbg if the program is already running, clossing all instances of the program then running ollydbg makes this go away.

The program is a VB6 application so you may want to try using "VB Decompiler" to find the code your looking for but it is possible to find it in olly also.

mint77
January 28th, 2013, 09:09
Thanks.

mint77
January 28th, 2013, 16:17
I used P32dasm to decompile it, but found no string for the save path for the text file.

Wouldn't think that would be encrypted.

OfMonsterAndMen
January 28th, 2013, 19:25
Hello Mint77,

I would recommend search for the API GetCurrentDirectory() which in turn should be around where the File IO is taking place. Then I would just find the buffer where the current working directory is held and modify that. This could be the reason you cant find the path hard coded in the exe, i.e. because it isn't.

kindest regards
OfMonsterAndMen

mint77
January 28th, 2013, 20:24
Thanks, I will load it in IDA.

Andy

hfm
January 29th, 2013, 04:39
mint77

The API you need to look at is actually __vbaFileOpen. This can take either a file name or file path. If only a file name is specified it assumes the current directory is used otherwise it uses the path specified as you'd expect.

This is an example of it in use in this program.
Code:
006C331A . 68 28FB4700 PUSH calendar.0047FB28 ; UNICODE "myrems.txt"
006C331F . 57 PUSH EDI
006C3320 . 6A FF PUSH -1
006C3322 . 6A 02 PUSH 2
006C3324 . FF15 A0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileOpen>] ; MSVBVM60.__vbaFileOpen


As you can see it is specifying only the file name. To save this file elsewhere you only need to change the file name "myrems.txt" to the full path you want to save the file to.

You may want to look into the way VB6 stores strings before trying to update this though.

hfm

mint77
January 29th, 2013, 17:08
Thanks.

Andy

disavowed
February 6th, 2013, 10:15
Or better yet, change the Windows shortcut to the program such that the "Start in" directory is the directory in which you want to save your files. That will likely fix it.

hfm
February 6th, 2013, 11:33
Quote:
[Originally Posted by disavowed;94215]Or better yet, change the Windows shortcut to the program such that the "Start in" directory is the directory in which you want to save your files. That will likely fix it.


In this case, the program sets the current directory to the path the program is run from at start up, so the "Start in" directory is ignored. Also the program relies on the current directory being the program's install path to find other files it needs to run.

mint77
February 7th, 2013, 01:04
So, can you condense your answer ?