I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere
And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the strings laid out nicely with their uID's right next to them.
In IDA, the closest thing I've gotten is going to the Strings menu -> right click -> Setup and checking C-Style
, Unicode C-Style (16 bits)
, C-Style (32 bits)
. After that, I start to see some of the strings show up in the strings menu (whereas before I didn't see any strings from the resource side), but they don't look anywhere near as nice to search through, and I can't seem to find any references to the uID
property as seen in Ghidra. (and referenced in the MSDN docs here: https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadstringa?redirectedfrom=MSDN)
I've read online at various places, like here: https://medium.com/@obikag/tryhackme-basic-malware-re-room-writeup-8183730100b2 that you'd usually use something like Resource Hacker to load user32.dll
and view the memory that way, however I'm on MacOS and can't run Resource Hacker.
I am wondering if there's any way to view these resource String ID's in IDA like I can in Ghidra. (See screenshots)