3

I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere

And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the strings laid out nicely with their uID's right next to them.

In IDA, the closest thing I've gotten is going to the Strings menu -> right click -> Setup and checking C-Style, Unicode C-Style (16 bits), C-Style (32 bits). After that, I start to see some of the strings show up in the strings menu (whereas before I didn't see any strings from the resource side), but they don't look anywhere near as nice to search through, and I can't seem to find any references to the uID property as seen in Ghidra. (and referenced in the MSDN docs here: https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadstringa?redirectedfrom=MSDN)

I've read online at various places, like here: https://medium.com/@obikag/tryhackme-basic-malware-re-room-writeup-8183730100b2 that you'd usually use something like Resource Hacker to load user32.dll and view the memory that way, however I'm on MacOS and can't run Resource Hacker.

I am wondering if there's any way to view these resource String ID's in IDA like I can in Ghidra. (See screenshots) enter image description here enter image description here

1 Answer 1

1

By default IDA does not load PE resources as they rarely contain code or other content required for disassembly. You can enable [x] Load resources in the initial Load new file dialog but all it does is load the .rsrc section’s content; it won’t parse the resource data and mark up the strings but at least you’ll have the UTF-16 text somewhere. An alternative option could be to use pefile to parse the strings from the file

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.