• 0 Posts
  • 3 Comments
Joined 2 years ago
cake
Cake day: June 16th, 2023

help-circle

  • I think I found the half of the answer.

    Out of curiosity I downloaded and installed the trial version from their website. When I inspected it, turns out it’s written in Delphi. What I’m guessing due to monolithic nature of the software (i.e. huge .exe file holding almost everything for the system) the already big (32.9 megabytes) .exe file is actually compressed. When uncompressed it’s approximately 100 megabytes. When I checked the extracted binary(extraction due to execution, hence looking at the memory dump of a once ran executable) the resources now show the logo and the name your censored in a png resource file.

    There are several versions of it but I’m guessing one of them is used in that header, others may be used in about window etc.

    Unfortunately my quickly hacked up dump file doesn’t run. So even if a modification is done, the resulting exe is not useful as it is.

    Detect-it-easy can’t find the exact compressor for the exe sections. So I don’t know if there’s any available de-compressor for this .exe.

    At least my findings show why you can’t see those resources in resource hacker. Because it’s compressed and unreadable as it is from the .exe.

    It’ll probably be possible to modify those resources once someone can create a runnable extracted version of the original .exe. I hope this helps. I’ll post again if I have any other findings and/or solution.