Questions tagged [pe-resources]

files (icons, dialogs, translation strings, version information, manifest) embedded in a Portable Executable binary.

Filter by
Sorted by
Tagged with
1 vote
0 answers
72 views

Making an exe file to recognize the Persian/Arabic characters

So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian). Thus I changed it at first Hex Editing using HxD ...
Fariwar Farsian's user avatar
2 votes
1 answer
1k views

Change manifest file using ResourceHacker CLI

I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI. I have managed to extract the resources ...
ChillSheep's user avatar
0 votes
2 answers
963 views

Breaking on string access from StringTable (resource)

If I have a resource like this: STRINGTABLE LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { 100, "OK" 101, "Warning" 102, "Error" 103, "Name" 104, &...
user1156544's user avatar
0 votes
1 answer
1k views

Resource hacker and Resource tuner don't change taskbar and window icons

I wanted to change a icon of a programs. I tried both Resource Tuner and Resource Hacker programs. When i opened the program there were multiple icons sizes, but when i tried to replace one icon, it ...
LetFan623's user avatar
3 votes
1 answer
528 views

Reverse old win32 app to find encryption vulnerability

I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
Thiago Alves's user avatar
2 votes
1 answer
578 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
Yoni's user avatar
  • 21
1 vote
0 answers
280 views

How can I extract resource images from Visual Basic 6 Malware

I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I ...
LUser's user avatar
  • 783
1 vote
1 answer
177 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
Lamia's user avatar
  • 11
2 votes
1 answer
741 views

find a dialog in ida using resource hacker

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this: 5035 DIALOG 0, 0, 295, 163 STYLE DS_SETFONT | ...
dandan's user avatar
  • 275
0 votes
2 answers
134 views

How are images found inside DLLs accessed? [closed]

Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
Robert Tattorn's user avatar
1 vote
2 answers
4k views

Resource Hacker and IDA PRO

How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH). e.g. I find, in RH the following Menu items: POPUP "Painter" { MENUITEM "Start/Continue", 32840 ...
dandan's user avatar
  • 275
1 vote
0 answers
1k views

Extract resources from compiled "resource file"

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
Sir.pOpE's user avatar
  • 119
0 votes
0 answers
466 views

Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
Fred Concklin's user avatar
1 vote
1 answer
328 views

What data before the code segment in PE files?

According to IDA the file I'm inspecting has imagebase 0x400000. The first data I can see starts at 0x401000 but the program reads some data which is at 00400174. When I put a data access breakpoint ...
Devolus's user avatar
  • 963
3 votes
3 answers
510 views

Secure resources from being extracted?

I have a jar file with a resources folder, and I have converted it to EXE using Launch4J. How can I protect my resources from being extracted using winzip/winrar ?
geek_guy's user avatar
  • 131
6 votes
1 answer
201 views

Where are program resources stored in a CIL assembly?

In a CIL assembly, where are resources stored? I am trying to reverse engineer a sample that appears to be protected by a .NET crypter. The CIL assembly for the sample does a SHA256 decryption on a ...
bobby_analog's user avatar
13 votes
5 answers
18k views

Freely available resource hacking applications

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
13 votes
3 answers
2k views

How to prevent use of Resource editors

There are variety of tools that allow editing the resources of Windows executables. These tools allow a very easy interface for changing the programs look and feel. Replacing icons, text, menus can be ...
Mellowcandle's user avatar
  • 4,795