Sign in to follow this  
Plerion

Reading resources from PE-files

Recommended Posts

Plerion    381
Hello! After parsing several directory-entries of the PE-format (imports, exports, delayed imports/exports) im a bit stuck at parsing resources. I successfully get the roots of the tree, the categories, of the resources. My application hast some some dialogs, a menu and a manifest. Thats correctly reflected by the output of my code. Now i want to go to the next node of the tree. Im using the following code:
DWORD dwOffset = pEntries[i].OffsetToData & ~0x80000000;
PIMAGE_RESOURCE_DIRECTORY_ENTRY pNext = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(((LPBYTE)pResDir) + dwOffset);
The problem is now, that pNext is completly filled with 0. Name/Id and Offset are 0. That of course should not be. What am i doing wrong? This is my code:
void PEFile::InitResources()
{
	DWORD dwResRVA = m_ntHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
	PIMAGE_RESOURCE_DIRECTORY pResDir = (PIMAGE_RESOURCE_DIRECTORY)GetAbsolutePtr(dwResRVA);
	if(!pResDir)
		return;


	PIMAGE_RESOURCE_DIRECTORY_ENTRY pEntries = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(((LPBYTE)pResDir) + sizeof(IMAGE_RESOURCE_DIRECTORY));
	for(UINT32 i = 0; i < pResDir->NumberOfNamedEntries; ++i)
	{
		if(pEntries[i].NameIsString)
		{
			DWORD dwOffset = pEntries[i].NameOffset;
			DWORD dwNameRVA = dwOffset + dwResRVA;
			PIMAGE_RESOURCE_DIRECTORY_STRING str = (PIMAGE_RESOURCE_DIRECTORY_STRING)GetAbsolutePtr(dwNameRVA);
			if(str)
				std::cout << str->NameString << std::endl;
		}
		else
			std::cout << "ID: " << pEntries[i].Id << std::endl;
		if(pEntries[i].DataIsDirectory)
			std::cout << "-> Subdirectory" << std::endl;
		else
			std::cout << "-> Data" << std::endl;
	}
	for(UINT32 i = pResDir->NumberOfNamedEntries, j = 0; j < pResDir->NumberOfIdEntries; ++i, ++j)
	{
		if(pEntries[i].Name & 0x80000000)
		{
			DWORD dwOffset = pEntries[i].Name & ~0x80000000;
			DWORD dwNameRVA = dwOffset + dwResRVA;
			PIMAGE_RESOURCE_DIRECTORY_STRING str = (PIMAGE_RESOURCE_DIRECTORY_STRING)GetAbsolutePtr(dwNameRVA);
			if(str)
				std::cout << str->NameString << std::endl;
		}

		if(pEntries[i].DataIsDirectory)
		{
			if(pEntries[i].Id <= (WORD)RT_MANIFEST)
			{
				std::cout << "Collection of " << gResourceTypes[pEntries[i].Id - 1] << "'s found!" << std::endl;
			}

			DWORD dwOffset = pEntries[i].OffsetToData & ~0x80000000;
			PIMAGE_RESOURCE_DIRECTORY_ENTRY pNext = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(((LPBYTE)pResDir) + dwOffset);

			if(pNext)
				RecursiveParseResource((DWORD)pResDir, pNext);
		}
		else
			std::cout << "Is data!" << std::endl;
	}

}
Greetings Plerion

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this