Questions tagged [pe-resources]
files (icons, dialogs, translation strings, version information, manifest) embedded in a Portable Executable binary.
18
questions
1
vote
0
answers
73
views
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).
Thus I changed it at first Hex Editing using HxD ...
2
votes
1
answer
1k
views
Change manifest file using ResourceHacker CLI
I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI.
I have managed to extract the resources ...
0
votes
2
answers
985
views
Breaking on string access from StringTable (resource)
If I have a resource like this:
STRINGTABLE
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
{
100, "OK"
101, "Warning"
102, "Error"
103, "Name"
104, &...
0
votes
1
answer
1k
views
Resource hacker and Resource tuner don't change taskbar and window icons
I wanted to change a icon of a programs. I tried both Resource Tuner and Resource Hacker programs. When i opened the program there were multiple icons sizes, but when i tried to replace one icon, it ...
3
votes
1
answer
530
views
Reverse old win32 app to find encryption vulnerability
Iām trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
2
votes
1
answer
586
views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
1
vote
0
answers
282
views
How can I extract resource images from Visual Basic 6 Malware
I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I ...
1
vote
1
answer
177
views
How can I know what the executable is missing to run?
I have extracted a presence of MZ file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
2
votes
1
answer
746
views
find a dialog in ida using resource hacker
I am having difficulties finding the dialog reference in IDA.
e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this:
5035 DIALOG 0, 0, 295, 163
STYLE DS_SETFONT | ...
0
votes
2
answers
136
views
How are images found inside DLLs accessed? [closed]
Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
1
vote
2
answers
4k
views
Resource Hacker and IDA PRO
How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH).
e.g. I find, in RH the following Menu items:
POPUP "Painter"
{
MENUITEM "Start/Continue", 32840
...
1
vote
0
answers
1k
views
Extract resources from compiled "resource file"
I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
0
votes
0
answers
466
views
Does malware ever purposely embed resources to thwart resource analysis and extraction
I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
1
vote
1
answer
329
views
What data before the code segment in PE files?
According to IDA the file I'm inspecting has imagebase 0x400000. The first data I can see starts at 0x401000 but the program reads some data which is at 00400174.
When I put a data access breakpoint ...
3
votes
3
answers
514
views
Secure resources from being extracted?
I have a jar file with a resources folder, and I have converted it to EXE using Launch4J.
How can I protect my resources from being extracted using winzip/winrar ?
6
votes
1
answer
201
views
Where are program resources stored in a CIL assembly?
In a CIL assembly, where are resources stored?
I am trying to reverse engineer a sample that appears to be protected by a .NET crypter.
The CIL assembly for the sample does a SHA256 decryption on a ...
13
votes
5
answers
18k
views
Freely available resource hacking applications
I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
13
votes
3
answers
2k
views
How to prevent use of Resource editors
There are variety of tools that allow editing the resources of Windows executables.
These tools allow a very easy interface for changing the programs look and feel.
Replacing icons, text, menus can be ...