9

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not work with all Win32 Application, especially with those that are zipped by .exe compressor.

Are there any other open source applications, that I can use to crack and extract resources out of .dll and .exe files?

  • 1
    Regarding compressed binaries, you will probably need to unpack them before you can use tools on them. – ekse Jun 25 '13 at 17:15
  • 1
    Though not open source, another option is Resource Hacker: angusj.com/resourcehacker – Rolf Rolles Jun 26 '13 at 4:27
9

If the previously suggested resource editors aren't to your liking, you can find descriptions and reviews of several resource editors here: http://www.woodmann.com/collaborative/tools/index.php/Category:Resource_Editors

In case you have trouble accessing that page (as per the comments below), here is the list of resource editors as of 6/26/13:

  • Its giving a 403 error. – asheeshr Jun 26 '13 at 1:55
  • Odd, maybe it was a server hiccup? It's working fine for me now. – Jason Geffner Jun 26 '13 at 14:16
  • No change for me i.stack.imgur.com/PbmNK.png Although, I can access it through a Russian proxy server. @Jason this is the exact reason for why link only answers are not considered answers and we explicitly require an excerpt in the answer. So, even if the page doesnt open, I can find some useful content within the answer body itself. – asheeshr Jun 26 '13 at 14:28
  • The site admins regularly block abusive IP netblocks, so it looks like someone in your netblock was causing trouble :( I've edited the answer above to include the basic list from the site, though the full site itself also includes descriptions and reviews. – Jason Geffner Jun 26 '13 at 15:12
  • download link for XN resource editor is not working but it is available on wayback machine web.archive.org/web/20120901000000*/btinternet.com/~wilsoncpw/xn_resourceeditor_setup.exe – Wayne Nov 8 '13 at 22:39
4

You can use ResEdit which is a resource editor for Windows programs available in both 32 Bit and 64 Bit versions.

You can download this freeware application from this link

4

I personally recommend CFF Explorer for reversing purposes as it provides a large volume of additional information on a binary.

CFF Explorer

4

enter image description here

enter image description here

1

I am not so sure what you mean with "zipped by .exe compressor", but if you mean packed executables, then the easiest to EXTRACT packed resources is as follows:

  1. Run the executable, preferably in Virtual Machine.
  2. Dump it using any memory dumper e.g. "Virtual Section Dumper".
  3. Use a PE editor e.g. Stud_PE to fix the section table by shrinking the value of the NumberOfSections field into only one. (One big section) and adjusting Raw/VirtualSize and Raw/VirtualOffset accordingly.
  4. Use Resource Hacker.

N.B.: You can try with more than one Resource editor e.g. ResEdit since many resource editors out there follow weird rules for PE header as they only expect typical PE headers.

Ironically, one resource editor expects the resources to be embedded in a section named .rsrc, otherwise it rejects them. Others don't see resources if embedded in a section marked as IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x80.

One the other hand if you can attach to the running process without problems (No or bypassed Anti-Attaching tricks), you can use OllyDbg v1.10 for that as follows:

  1. After attach, Select "View" then "Memory" Alt+M). You will get list of sections beside other memory blocks.
  2. Spot the resources section. e.g. .rsrc. Right-Click the target section and "View all resources". You will then a list of well-sorted resources.
  3. Right-Click whichever resource you want and select "dump". A new window will pop up.
  4. Right-Click inside the hex view of the new window and select "Backup" and "Save data to file".

Hope it helps

  • Yes... I mean packed execuable files, anyway thanks for your contribution. – Đēēpak Jun 26 '13 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.