1

I'm trying to change the icon of a .exe file, normally a simple task but this .exe file is a installer and for some reason when after I change or remove the icon, the exe shrinks in size from 300 mb to 12 kb and crashes when it runs.

I've tried using Resource Hacker to either replace the icon or remove it but when I try to save it, the result ends up as a tiny file which crashes when it runs. I also tried using IconChanger 3.8 and the same thing happened. I cannot change any resources on the file using Resource Hacker. If I attempt to modify version info, description, anything, it will save as a tiny 12 kb file.

Is there some kind of protection against changing resources that I don't know about? What can I do in this situation? Any other methods that might work for changing an icon or removing its icon in this situation?

Improve this question
6
  • 2
    As you say it's an installer, i'd assume it consists of a 12k stub, and a large resource of unknown type that contains the file to install. If IconChanger or Resource Hacker don't recognize that resource, they'll probably throw it away. See also this answer.
    – Guntram Blohm
    Commented Jan 14, 2015 at 9:13
  • 2
    The overlay is getting stripped on changing the icon. Solution -> Dump the overlay, change the icon, append the dumped overlay.
    – 0xec
    Commented Jan 14, 2015 at 9:35
  • @GuntramBlohm Thanks. I looked at the answers and it would seem like whoever modified this .exe exploited Resource Hacker to cause it to discard the contents
    – Joesph
    Commented Jan 14, 2015 at 18:20
  • @ExtremeCoders How can I dump the overlay of a file? Sorry, I don't have any experience in reverse engineering.
    – Joesph
    Commented Jan 14, 2015 at 18:24
  • @Joesph See answer
    – 0xec
    Commented Jan 14, 2015 at 19:17

1 Answer 1

Reset to default
3

Such a problem is common with executables having overlay.

An overlay is extra data appended at the end of a PE. The overlay is located at the end of the sections. When a PE is loaded the overlay is not mapped into the memory of the process.

An overlay is common with installers, self extracting archives etc. In order to extract the overlay, you can use any decent PE editor such as exeinfope, Detect It Easy or like this way.

Hence for your problem, I would suggest to dump the overlay, make required modifications on the PE, and finally re-append back the dumped overlay to the end of the executable.
For the last step you can use a Hex Editor or the MS-DOS COPY command.

Improve this answer
1
  • To further elaborate on this, you can also use a hex editor to dump the overlay and the specific copy command could be like this copy /b modded.exe+overlay.bin final_exe.exe where /b tells copy that you're copying binary data
    – vane
    Commented Jan 14, 2015 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.