I don’t think there needs to be that much scaffolding to make this work(at least in a really crappy way), let’s see how to reproduce this with a binary(without its symbols), with basically no infrastructure other than a header, a metadata field, a manifest and the necessary documentation pages:
I. Header(0x0000)
First off, if your system’s applications have a recognizable header(so like the first few bytes tell you something about how to reach the data that we need to change):
Looking at the first few bytes of some binary file, we can see 0x0186
as the address in memory where the metadata is located:
a001 8680 0637 a0f0 5a80 0837 a0f0 ba80
0a37 a0f0 aa80 0c37 6018 c2a0 02a8 8022
37a0 0172 8024 3780 0010 2000 4880 2436
a000 2839 2680 043f a00a 9435 ...
II. Metadata(0x0186)
At that location, we find the following bit of text and data:
Left
A Text Editor
By Hundred Rabbits
22 Jul 2024
83 3c5b ( the application icon )
0a 01c0 ( the manifest )
...
The manifest at 0x01c0
is the equivalent of the Machintosh’s MENU
asset, it’s the location in the application memory that stores all the strings needed for localization in the dropdown menu, the shortcuts and so on.
III. Manifest(0x01c0)
So far, we’ve trampolined from 0x0186 -> 0x01c0
where we find the dropdown data that looks like a modifier-key byte, a keyboard character byte, followed by the address to that function, and a null terminated string:
05 Left 00
01 n 0000 New 00
01 r 0000 Rename 00
01 o 0000 Open 00
01 s 0000 Save 00
01 q 0000 Exit 00
02 Edit 00
01 c 0000 Copy 00
01 v 0000 Paste 00
...
The modifier byte is stored as follows:
So if we wanted to change Exit
for alt+q
instead of its current ctrl+q
, we could change that line for:
02 q 0000 Bye! 00
Voila!
Now if had a hex editor that could better navigate these locations in the binary file, we’d approach something like ResEdit, but… there’s only few hours in a day. Regardless, if a program exposes just enough information to the outside world, it’s possible to go and make accessibility changes to it without having the sources readily available.