1

How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH). e.g. I find, in RH the following Menu items:

POPUP "Painter"
{
  MENUITEM "Start/Continue",  32840
  MENUITEM "Stop",  32839
  MENUITEM "Pause",  32860
  MENUITEM "Show 100% View",  32973
  MENUITEM SEPARATOR
  MENUITEM "Add Current Preset to Favorites",  32929
  ….

Yet I cannot find any such text in IDA to refer to these buttons.

Also if RH shows me e.g. a dialog:

301 DIALOG 0, 0, 186, 51
STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU
CAPTION "Measure"
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
FONT 8, "MS Sans Serif"
{
}

How can I find it’s reference in IDA?

Thank you,

  • As per the comments, you probably missed the fact it's in unicode – Skynight Jun 4 '19 at 0:08
1

Those are placed in resources and by default IDA doesn't load this data. To change that, tick the checkbox on the 'Load a new file' dialog.

enter image description here

Next you can go the this segment by pressing CTRL+S and selecting the .rsrc one.

enter image description here

You should see your texts there.

| improve this answer | |
  • i did as you suggested but i still can't see all the strings. i searched all the code(CTRL+T) but it is not there. – dandan Aug 16 '18 at 10:08
  • This one: 224 DIALOG 0, 0, 372, 311 STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU CAPTION "Easy Start" LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { CONTROL "OK", 1, BUTTON, BS_DEFPUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 315, 290, 50, 14 CONTROL "Cancel", 2, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_TABSTOP, 244, 290, 50, 14 CONTROL "Do not Show ( Get it back by F1 )", 1006, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 7, 294, 151, 10 CONTROL "", 1053, STATIC, SS_BLACKFRAME | WS_CHILD | WS_VISIBLE, 7, 3, 359, 273 } – dandan Aug 16 '18 at 10:12
  • There’s only like 4 strings in that resource and a lot of int values. Also remember that I don’t have your binary so don’t expect I can provide you with exact explanation as of why this particular one is not there. – Paweł Łukasik Aug 16 '18 at 10:32
0

The only way you can find the references to the resources is by looking through XREF's to FindResource function and checking which resource ID is used there. Or by looking for 301 value in the database via the binary search and then look through the all found instances to find the one which is used as argument for FindResource.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.