Introduction to reverse debugging PE structure resource table 07/07

Resource table ：

PE The related resources in can be located in depth through the program , There is one-to-one correspondence between the obtained binary bytecode and the resource script statement .

These data may be used internally in the source code , such as Menu options 、 Interface description, etc ; It may also be external to the source code , For example, the icon file of the program 、 Background music file 、 To configure Documents, etc. , These data are collectively referred to as resources .

Common resources

The six types of resources commonly used in programs include ：

1、 Bitmap resources

2、 cursor resource

3、 Icon resources

4、 Menu resources

5、 Dialog resources

6、 Custom resources

Structure ：

Log in and copy

      
      

       
       IMAGE_RESOURCE_DIRECTORY STRUCT 
       
       
    Characteristics                 //dd   0000h Resource attribute 
       
       
    TimeDatestamp                   //dd   0004h Time stamp 
       
       
    MajorVersion                    //dw   0008h Resource large version number 
       
       
    MinorVersion                    //dw   0008h Resource minor version number 
       
       
    NumberOfNamedEntries            //dw    Number of entries named by name 
       
       
    NumberOfIdEntries               //dw    Number of named entries 
       
       
IMAGE RESOURCE DIRECTORY ENDS
      
      
      
      

       
       
1.
       
       
2.
       
       
3.
       
       
4.
       
       
5.
       
       
6.
       
       
7.
       
       
8.
      
      

Resource directory structure

Log in and copy

      
      

       
       typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {
       
       
  union {
       
       
    struct {
       
       
      DWORD NameOffset : 31;      // Resource name offset 
       
       
      DWORD NameIsString : 1;     // The resource name is string 
       
       
    };
       
       
    DWORD   Name;         // resources / Language type 
       
       
    WORD    Id;         // Resource numbers ID
       
       
  };
       
       
  union {
       
       
    DWORD   OffsetToData;       // Data offset address 
       
       
    struct {
       
       
      DWORD   OffsetToDirectory : 31;         // Subdirectory offset address 
       
       
      DWORD   DataIsDirectory : 1;          // Data is directory 
       
       
    };
       
       
  };
       
       
} IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
      
      
      
      

       
       
1.
       
       
2.
       
       
3.
       
       
4.
       
       
5.
       
       
6.
       
       
7.
       
       
8.
       
       
9.
       
       
10.
       
       
11.
       
       
12.
       
       
13.
       
       
14.
       
       
15.
       
       
16.
       
       
17.
      
      

We use tools to experiment

The tools are

1、360zip Program

2、resource hacker Or is it exescope

3、stud_pe

First let's look at PE Resource table

Yes 9 Resource groups

The first resource table

Let's observe

After we have a general understanding of the resource table of the program

Use resource  Open the program

We modify the function of the menu

The file will simulate the menu options

Change the first level menu

Open the file in the secondary menu , Change the name

Select compile script

file save as

This document , If you open it directly

We put the files in the program directory

One is genuine , One is our modified program （ shell ）

Normal picture

Modified screen

Modification successful .

because PE In the structure, resource tables are set one layer after another . Difficult to analyze manually , So using tools is the best choice .