0

Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My question is, how does the program access the image in the DLL in assembly and in what format is the image typically stored there? I also have a question about text that the program displays but the text is nowhere to be seen either in the exe or dll, so where is that text stored or is it possibly encrypted?

For example the "made with Unity" splash screen in unity.

closed as too broad by peter ferrie, sudhackar, 0xC0000022L Sep 6 '18 at 14:42

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • it's too broad to be answered. Anyone can come up with their own encoding of both images and text and just decode them on the fly in memory and then display. Provide some specifics (maybe an example of such an app) then we can give you the details. – Paweł Łukasik Aug 29 '18 at 18:34
  • Welcome to RE.SE. I agree with Paweł that the question is too broad as it stands (which means it will likely get closed). Are you talking about the PE resource section or what is the question about specifically? There's a myriad of ways such data could be stored, including obfuscated inside or outside the actual PE image. – 0xC0000022L Aug 29 '18 at 20:29
  • Yes the resources inside a PE / exe. I want to know how to find the image data and its location inside the executable even if it is encrypted. Can I use a program such as ollydbg to back trace the image from it being displayed on screen to the decryption process to memory accessing it ? – Robert Tattorn Aug 29 '18 at 20:34
  • It is given above, there are many DLLs and It is unknown in which of them the image resides, but I'm thinking whether I can access and edit encrypted resources with 'resource hacker' or other similar program. If not, then can I at least find where they reside inside the exe/dll ? – Robert Tattorn Aug 30 '18 at 15:10
0

First find the DLL or EXE file that you want to access for that resource. THe main goal is to create a handle for that resource/image file, as everything in Windows has to accessed by an object/handle.

Procedure

  • Get a handle of that DLL/EXE file with LoadLibrary():
HMODULE hModule = LoadLibrary("FileName.dll");
  • Determine the location of that resource with FindResource():
HRSRC hResInfo = FindResource(hModule, ResourceName, RT_ICON);
  • Retrieves a handle of the resource in memory with LoadResource():
HGLOBAL hResData = LoadResource(hModule, hResInfo);
  • Retrieves a pointer of the resource in memory with LockResource():
HANDLE lpBuffer = LockResource(hResData);
  • Retrieves the size, in bytes, of the resource with SizeofResource():
DWORD dwSize = SizeofResource(hModule, hResInfo);
  • Open a handle of that resource with CreateFile():
HANDLE hFile = CreateFile(FileName, GENERIC_ALL, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);

Change RT_ICON flags with the Resource Type that you want to access. Now use the hFile handle with WriteFile() to make a file or ReadFile() to read that file.

Example

Here is an example of C code to extract the first icon from shell32.dll and save it as image.png file:

#include <Windows.h>

BOOL ExtractResource(PSTR ResName, PSTR FileName) {
    HMODULE hModule = LoadLibrary("shell32.dll");
    HRSRC hResInfo = FindResource(hModule, ResName, RT_ICON);
    HGLOBAL hResData = LoadResource(hModule, hResInfo);
    HANDLE lpBuffer = LockResource(hResData);
    DWORD dwSize = SizeofResource(hModule, hResInfo);
    HANDLE hFile = CreateFile(FileName, GENERIC_ALL, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
    BOOL result = WriteFile(hFile, lpBuffer, dwSize, 0, 0);
    return result;
}

int main() {
    ExtractResource("#1", "image.png");
}
1

As the question is indeed very broad there isn't much we can tell. However, PE resources are often used to cary images and icons inside executable files. They are then loaded using APIs like LoadResource and LoadImage. You can read about resources, their type and formats over on MSDN.

As a side note, images can also be stored as files in other formats, other extensions, other encodings and even compressed or encrypted. So the fact you don't see a .bmp file does not necessarily mean there are no image resource files alongside the executable.

Not the answer you're looking for? Browse other questions tagged or ask your own question.