1

How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH). e.g. I find, in RH the following Menu items:

POPUP "Painter"
{
  MENUITEM "Start/Continue",  32840
  MENUITEM "Stop",  32839
  MENUITEM "Pause",  32860
  MENUITEM "Show 100% View",  32973
  MENUITEM SEPARATOR
  MENUITEM "Add Current Preset to Favorites",  32929
  ….

Yet I cannot find any such text in IDA to refer to these buttons.

Also if RH shows me e.g. a dialog:

301 DIALOG 0, 0, 186, 51
STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU
CAPTION "Measure"
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
FONT 8, "MS Sans Serif"
{
}

How can I find it’s reference in IDA?

Thank you,

Improve this question
1
  • As per the comments, you probably missed the fact it's in unicode
    – Skynight
    Commented Jun 4, 2019 at 0:08

2 Answers 2

Reset to default
1

Those are placed in resources and by default IDA doesn't load this data. To change that, tick the checkbox on the 'Load a new file' dialog.

enter image description here

Next you can go the this segment by pressing CTRL+S and selecting the .rsrc one.

enter image description here

You should see your texts there.

Improve this answer
3
  • i did as you suggested but i still can't see all the strings. i searched all the code(CTRL+T) but it is not there.
    – dandan
    Commented Aug 16, 2018 at 10:08
  • This one: 224 DIALOG 0, 0, 372, 311 STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU CAPTION "Easy Start" LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { CONTROL "OK", 1, BUTTON, BS_DEFPUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 315, 290, 50, 14 CONTROL "Cancel", 2, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_TABSTOP, 244, 290, 50, 14 CONTROL "Do not Show ( Get it back by F1 )", 1006, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 7, 294, 151, 10 CONTROL "", 1053, STATIC, SS_BLACKFRAME | WS_CHILD | WS_VISIBLE, 7, 3, 359, 273 }
    – dandan
    Commented Aug 16, 2018 at 10:12
  • There’s only like 4 strings in that resource and a lot of int values. Also remember that I don’t have your binary so don’t expect I can provide you with exact explanation as of why this particular one is not there.
    – Paweł Łukasik
    Commented Aug 16, 2018 at 10:32
0

The only way you can find the references to the resources is by looking through XREF's to FindResource function and checking which resource ID is used there. Or by looking for 301 value in the database via the binary search and then look through the all found instances to find the one which is used as argument for FindResource.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.