13

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not work with all Win32 Application, especially with those that are zipped by .exe compressor.

Are there any other open source applications, that I can use to crack and extract resources out of .dll and .exe files?

2
  • 1
    Regarding compressed binaries, you will probably need to unpack them before you can use tools on them.
    – ekse
    Commented Jun 25, 2013 at 17:15
  • 1
    Though not open source, another option is Resource Hacker: angusj.com/resourcehacker Commented Jun 26, 2013 at 4:27

5 Answers 5

10

If the previously suggested resource editors aren't to your liking, you can find descriptions and reviews of several resource editors here: http://www.woodmann.com/collaborative/tools/index.php/Category:Resource_Editors

In case you have trouble accessing that page (as per the comments below), here is the list of resource editors as of 2022-10-12:

PS: Woodman.com was referenced a few times above and archived versions of it can be found here

0
4

You can use ResEdit which is a resource editor for Windows programs available in both 32 Bit and 64 Bit versions.

You can download this freeware application from this link

4

I personally recommend CFF Explorer for reversing purposes as it provides a large volume of additional information on a binary.

CFF Explorer

4

enter image description here

enter image description here

1
  • Not true that it's not under a free license, see here
    – 0xC0000022L
    Commented Oct 12, 2022 at 10:10
1

I am not so sure what you mean with "zipped by .exe compressor", but if you mean packed executables, then the easiest to EXTRACT packed resources is as follows:

  1. Run the executable, preferably in Virtual Machine.
  2. Dump it using any memory dumper e.g. "Virtual Section Dumper".
  3. Use a PE editor e.g. Stud_PE to fix the section table by shrinking the value of the NumberOfSections field into only one. (One big section) and adjusting Raw/VirtualSize and Raw/VirtualOffset accordingly.
  4. Use Resource Hacker.

N.B.: You can try with more than one Resource editor e.g. ResEdit since many resource editors out there follow weird rules for PE header as they only expect typical PE headers.

Ironically, one resource editor expects the resources to be embedded in a section named .rsrc, otherwise it rejects them. Others don't see resources if embedded in a section marked as IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x80.

One the other hand if you can attach to the running process without problems (No or bypassed Anti-Attaching tricks), you can use OllyDbg v1.10 for that as follows:

  1. After attach, Select "View" then "Memory" Alt+M). You will get list of sections beside other memory blocks.
  2. Spot the resources section. e.g. .rsrc. Right-Click the target section and "View all resources". You will then a list of well-sorted resources.
  3. Right-Click whichever resource you want and select "dump". A new window will pop up.
  4. Right-Click inside the hex view of the new window and select "Backup" and "Save data to file".

Hope it helps

1
  • Yes... I mean packed execuable files, anyway thanks for your contribution.
    – khk
    Commented Jun 26, 2013 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.