View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra

Question

I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere

And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the strings laid out nicely with their uID's right next to them.

In IDA, the closest thing I've gotten is going to the Strings menu -> right click -> Setup and checking C-Style, Unicode C-Style (16 bits), C-Style (32 bits). After that, I start to see some of the strings show up in the strings menu (whereas before I didn't see any strings from the resource side), but they don't look anywhere near as nice to search through, and I can't seem to find any references to the uID property as seen in Ghidra. (and referenced in the MSDN docs here: https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadstringa?redirectedfrom=MSDN)

I've read online at various places, like here: https://medium.com/@obikag/tryhackme-basic-malware-re-room-writeup-8183730100b2 that you'd usually use something like Resource Hacker to load user32.dll and view the memory that way, however I'm on MacOS and can't run Resource Hacker.

I am wondering if there's any way to view these resource String ID's in IDA like I can in Ghidra. (See screenshots)

Answer 1

By default IDA does not load PE resources as they rarely contain code or other content required for disassembly. You can enable [x] Load resources in the initial Load new file dialog but all it does is load the .rsrc section’s content; it won’t parse the resource data and mark up the strings but at least you’ll have the UTF-16 text somewhere. An alternative option could be to use pefile to parse the strings from the file