2

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this:

5035 DIALOG 0, 0, 295, 163
STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP
CAPTION ""
LANGUAGE LANG_DANISH, 0x1
FONT 8, "MS Sans Serif"
{
   CONTROL "", -1, STATIC, SS_BLACKFRAME | WS_CHILD, 0, 0, 295, 163 
   CONTROL "Static", 1526, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 129, 121, 68, 16 
   CONTROL "Static", 1527, STATIC, SS_LEFT | WS_CHILD | WS_GROUP, 199, 123, 93, 14 
   CONTROL 551, -1, STATIC, SS_BITMAP | WS_CHILD | WS_VISIBLE, 0, 0, 295, 163 
   CONTROL "Progress1", 1232, "msctls_progress32", WS_CHILD | WS_VISIBLE | WS_BORDER, 0, 138, 295, 14 
   CONTROL "Number of trials left:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 2, 154, 63, 8 
   CONTROL "15", 1519, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 65, 154, 9, 8 
}

How, or what should i look for in IDA in order to find where it is being referenced?

Improve this question
0

1 Answer 1

Reset to default
-1

Search for a call to FindResource with 5035(0x13AB) as lpName argument

Improve this answer
5
  • This answer could be significantly improved
    – NirIzr
    Oct 20, 2018 at 1:02
  • Nope, the answer is precisely covering all the aspects of the question.
    – Anton Kukoba
    Oct 21, 2018 at 19:45
  • 3
    I tend to disagree. More specifically: how confident are you there's a call to FindResource and what alternatives are there? What's the significance of 0x13AB, how you got that value and what's it's relation with lpName?
    – NirIzr
    Oct 21, 2018 at 20:04
  • Totally agree with @NirIzr. This answer makes a whole lot of assumptions and should at the very least mention them explicitly. For example it's well possible to use DialogBoxIndirect() and DialogBox() and their variants without having to resort FindResource(). And while internally something like FindResource() will be employed to look up the resource, this call won't happen from that executable but somewhere in the opaque part of the call path. Also the internal version will likely not be FindResource() but something like LdrFindResource_U() ...
    – 0xC0000022L ♦
    Dec 9, 2019 at 10:49
  • You still need FindResource to use DialogBoxIndirect and DialogBox. And LdrFindResource_U is totally out of scope.
    – Anton Kukoba
    Dec 10, 2019 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.