2

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this:

5035 DIALOG 0, 0, 295, 163
STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP
CAPTION ""
LANGUAGE LANG_DANISH, 0x1
FONT 8, "MS Sans Serif"
{
   CONTROL "", -1, STATIC, SS_BLACKFRAME | WS_CHILD, 0, 0, 295, 163 
   CONTROL "Static", 1526, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 129, 121, 68, 16 
   CONTROL "Static", 1527, STATIC, SS_LEFT | WS_CHILD | WS_GROUP, 199, 123, 93, 14 
   CONTROL 551, -1, STATIC, SS_BITMAP | WS_CHILD | WS_VISIBLE, 0, 0, 295, 163 
   CONTROL "Progress1", 1232, "msctls_progress32", WS_CHILD | WS_VISIBLE | WS_BORDER, 0, 138, 295, 14 
   CONTROL "Number of trials left:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 2, 154, 63, 8 
   CONTROL "15", 1519, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 65, 154, 9, 8 
}

How, or what should i look for in IDA in order to find where it is being referenced?

-1

Search for a call to FindResource with 5035(0x13AB) as lpName argument

| improve this answer | |
  • This answer could be significantly improved – NirIzr Oct 20 '18 at 1:02
  • Nope, the answer is precisely covering all the aspects of the question. – Anton Kukoba Oct 21 '18 at 19:45
  • 3
    I tend to disagree. More specifically: how confident are you there's a call to FindResource and what alternatives are there? What's the significance of 0x13AB, how you got that value and what's it's relation with lpName? – NirIzr Oct 21 '18 at 20:04
  • Totally agree with @NirIzr. This answer makes a whole lot of assumptions and should at the very least mention them explicitly. For example it's well possible to use DialogBoxIndirect() and DialogBox() and their variants without having to resort FindResource(). And while internally something like FindResource() will be employed to look up the resource, this call won't happen from that executable but somewhere in the opaque part of the call path. Also the internal version will likely not be FindResource() but something like LdrFindResource_U() ... – 0xC0000022L Dec 9 '19 at 10:49
  • You still need FindResource to use DialogBoxIndirect and DialogBox. And LdrFindResource_U is totally out of scope. – Anton Kukoba Dec 10 '19 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.