3

I've been hacking and modding software for years and have learned alot, but there are still a few things that vex me, this is one such case. I have noticed that some PEs contain an RCData section that can house a large variety of different kinds of data and information. In my experience the data is usually binary files or dialog classes. In this case, I am trying to figure out how an image is being stored in what I can only describe as binary raw format for a dialog (Thanks to @Megabeets for refreshing my memory). In my more inexperienced days, I thought the images data in these files was stored directly as plain text or hexadecimal values. When I compared the data in the resource data to the image in question (stored in a different tree as a different format), they did not match. In some cases, this data is it's own image with no comparable alternative. Below is an screenshot of the data in question: Binary data is hilighted in blue I know this data is for an icon as removing it also removes the image in the application. For some programs this data can be a dialog GUI asset, or bitmap. How do I "convert" this data into an image or vise-versa for modification or replacement?

As a potential alternative solution, could I modify the script to directly reference the main application icon instead?

Side-note: The image is an icon group containing four icons, and acts as the title bar icon.

6

Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN:

RCDATA defines a raw data resource for an application. Raw data resources permit the inclusion of binary data directly in the executable file.

nameID RCDATA [optional-statements] {raw-data ...}

raw-data
Raw data consisting of one or more integers or strings of characters. Integers can be specified in decimal, octal, or hexadecimal format. To be compatible with 16-bit Windows, integers are stored as WORD values. You can store an integer as a DWORD value by qualifying the integer with the "L" suffix.

In your example we see the configuration of TfrmMain which is the main form that is derived from TForm and is used as user interface for the program.

With that in mind, we can understand that Icon.Data stores an icon for the application in what seems like an hexadecimal representation of it.
And indeed, if we will take a look at the ICO registration information for at IANA we can see that the Magic Number (the first four octets in the file in hexadecimal) of ICO files is same as in your example:

Additional information :
1. Magic number(s) : 00 00 01 00
2. File extension(s) : ico

When you compare the Icon.Data with another image, which you said has different file format, you won't see a match because each image format has different structure and specification and therefore, even though the files might look the same, the binary data is different.

You can convert hex string into an image and an image to hex string easily using python:

import binascii

# open ico file and read its binary content
with open('example.ico', 'rb') as f:
    content = f.read()

# convert the binary content to hexadecimal string
hexstr = binascii.hexlify(content)

# write this hexadecimal string to output.ico as binary
with open('output.ico','wb') as f:
    f.write(binascii.unhexlify(hexstr))

You can copy and paste the Icon.Data to a plain text and then read it with python using:

with open('hexadecimal.txt', 'r') as f:
    content = f.read()

And then write the content to a file in binary format using the example above.

With Resource Hacker you then can remove, add, edit and compile resources in your binary.

8
  • I must say, your answer is truly amazing and well-done. Unfortunately I don't know how to program or use languages like Python to perform tasks. It may seem strange (or ironic) that I have a vast understanding of how software works despite this. Even still, I am eager to research this, and once I can utilize your answer I will accept and upvote it. Thank you for your response. Aug 21 '17 at 8:25
  • You're welcome! It's a pretty trivial script, you can easily adapt it to most high-level languages you know. We can give a hand if you want to :)
    – Megabeets
    Aug 21 '17 at 12:01
  • That would be great, but the extent of my programming skills is limited to basic batch scripting... Aug 21 '17 at 17:32
  • it won't be easy to do it using Batch. How about Powershell, Bash, external programs? You can even do it online: hexed.it
    – Megabeets
    Aug 21 '17 at 18:47
  • I'll give PowerShell a shot. Don't get me wrong, I believe that your Python method will work, I just have to learn how to use it first. So, how should I approach this with PowerShell? Aug 21 '17 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.