What is the header and data structure of a .NET resource? I would like to find an equivalent type of documentation to the following, but for .NET resources:


As an example, here is a screenshot of four .NET resources in a sample of AgentTesla:

Dotnet Resources

Focusing on one of them as an example and saving it to a file, in a hex editor, you can see the header and where the PNG data begins. Where is documentation about the specific structure of this header and data?

One Dotnet Resource

For reference, here is the hash of the file in the screenshots above: 40cd96e25835eeba956645398ed73a0f0e14563375530fa5f2db3bcf44dd88d7


1 Answer 1


As stated in the comment googling for the magic const 0xbeefcace i stumbled upon the link

Browsing around the description seem to match your res screen shot

4 bytes magic
4 bytes version = 0x1
4 bytes skip count = 0x91
Png header is at 0x24c 0x91x4 + 8 = 244+8 == 24c

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.