How can I modify binary image resource data?

Question

I've been hacking and modding software for years, and have learned a lot, but there are still a few things that vex me - this is one such case.

I have noticed that some PEs contain an RCData section that can house a large variety of different kinds of data and information. In my experience the data is usually binary files or dialog classes. In this case, I am trying to figure out how an image is being stored in what I can only describe as binary raw format for a dialog (thanks to @Megabeets for refreshing my memory). In my more inexperienced days, I thought the image data in these files was stored directly as plain text or hexadecimal values. When I compared the data in the resource data to the image in question (stored in a different tree as a different format), they did not match. In some cases, this data is its own image with no comparable alternative. Below is an screenshot of the data in question:

I know this data is for an icon, as removing it also removes the image in the application. For some programs, this data can be a dialog GUI asset, or bitmap. How do I "convert" this data into an image or vise versa for modification or replacement?

As a potential alternative solution, could I modify the script to directly reference the main application icon instead?

Side-note: The image is an icon group containing four icons, and acts as the title bar icon.

Answer 1

Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN:

RCDATA defines a raw data resource for an application. Raw data resources permit the inclusion of binary data directly in the executable file.

nameID RCDATA [optional-statements] {raw-data ...}

raw-data
Raw data consisting of one or more integers or strings of characters. Integers can be specified in decimal, octal, or hexadecimal format. To be compatible with 16-bit Windows, integers are stored as WORD values. You can store an integer as a DWORD value by qualifying the integer with the "L" suffix.

In your example we see the configuration of TfrmMain which is the main form that is derived from TForm and is used as user interface for the program.

With that in mind, we can understand that Icon.Data stores an icon for the application in what seems like an hexadecimal representation of it.
And indeed, if we will take a look at the ICO registration information for at IANA we can see that the Magic Number (the first four octets in the file in hexadecimal) of ICO files is same as in your example:

Additional information :
1. Magic number(s) : 00 00 01 00
2. File extension(s) : ico

When you compare the Icon.Data with another image, which you said has different file format, you won't see a match because each image format has different structure and specification and therefore, even though the files might look the same, the binary data is different.

You can convert hex string into an image and an image to hex string easily using python:

import binascii

# open ico file and read its binary content
with open('example.ico', 'rb') as f:
    content = f.read()

# convert the binary content to hexadecimal string
hexstr = binascii.hexlify(content)

# write this hexadecimal string to output.ico as binary
with open('output.ico','wb') as f:
    f.write(binascii.unhexlify(hexstr))

You can copy and paste the Icon.Data to a plain text and then read it with python using:

with open('hexadecimal.txt', 'r') as f:
    content = f.read()

And then write the content to a file in binary format using the example above.

With Resource Hacker you then can remove, add, edit and compile resources in your binary.