I am not so sure what you mean with "zipped by .exe compressor", but if you mean packed executables, then the easiest to EXTRACT packed resources is as follows:
- Run the executable, preferably in Virtual Machine.
- Dump it using any memory dumper e.g. "Virtual Section Dumper".
- Use a PE editor e.g.
Stud_PE to fix the section table by shrinking the value of the
NumberOfSections field into only one. (One big section) and adjusting Raw/VirtualSize and Raw/VirtualOffset accordingly.
- Use Resource Hacker.
N.B.: You can try with more than one Resource editor e.g. ResEdit since many resource editors out there follow weird rules for PE header as they only expect typical PE headers.
Ironically, one resource editor expects the resources to be embedded in a section named
.rsrc, otherwise it rejects them. Others don't see resources if embedded in a section marked as
One the other hand if you can attach to the running process without problems (No or bypassed Anti-Attaching tricks), you can use OllyDbg v1.10 for that as follows:
- After attach, Select "View" then "Memory" Alt+M). You will get list of sections beside other memory blocks.
- Spot the resources section. e.g.
.rsrc. Right-Click the target section and "View all resources". You will then a list of well-sorted resources.
- Right-Click whichever resource you want and select "dump". A new window will pop up.
- Right-Click inside the hex view of the new window and select "Backup" and "Save data to file".
Hope it helps