Sign in to follow this  

Reading resources from PE-files

This topic is 2790 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

If you intended to correct an error in the post then please contact us.

Recommended Posts

Hello! After parsing several directory-entries of the PE-format (imports, exports, delayed imports/exports) im a bit stuck at parsing resources. I successfully get the roots of the tree, the categories, of the resources. My application hast some some dialogs, a menu and a manifest. Thats correctly reflected by the output of my code. Now i want to go to the next node of the tree. Im using the following code:
DWORD dwOffset = pEntries[i].OffsetToData & ~0x80000000;
PIMAGE_RESOURCE_DIRECTORY_ENTRY pNext = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(((LPBYTE)pResDir) + dwOffset);
The problem is now, that pNext is completly filled with 0. Name/Id and Offset are 0. That of course should not be. What am i doing wrong? This is my code:
void PEFile::InitResources()
{
	DWORD dwResRVA = m_ntHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
	PIMAGE_RESOURCE_DIRECTORY pResDir = (PIMAGE_RESOURCE_DIRECTORY)GetAbsolutePtr(dwResRVA);
	if(!pResDir)
		return;


	PIMAGE_RESOURCE_DIRECTORY_ENTRY pEntries = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(((LPBYTE)pResDir) + sizeof(IMAGE_RESOURCE_DIRECTORY));
	for(UINT32 i = 0; i < pResDir->NumberOfNamedEntries; ++i)
	{
		if(pEntries[i].NameIsString)
		{
			DWORD dwOffset = pEntries[i].NameOffset;
			DWORD dwNameRVA = dwOffset + dwResRVA;
			PIMAGE_RESOURCE_DIRECTORY_STRING str = (PIMAGE_RESOURCE_DIRECTORY_STRING)GetAbsolutePtr(dwNameRVA);
			if(str)
				std::cout << str->NameString << std::endl;
		}
		else
			std::cout << "ID: " << pEntries[i].Id << std::endl;
		if(pEntries[i].DataIsDirectory)
			std::cout << "-> Subdirectory" << std::endl;
		else
			std::cout << "-> Data" << std::endl;
	}
	for(UINT32 i = pResDir->NumberOfNamedEntries, j = 0; j < pResDir->NumberOfIdEntries; ++i, ++j)
	{
		if(pEntries[i].Name & 0x80000000)
		{
			DWORD dwOffset = pEntries[i].Name & ~0x80000000;
			DWORD dwNameRVA = dwOffset + dwResRVA;
			PIMAGE_RESOURCE_DIRECTORY_STRING str = (PIMAGE_RESOURCE_DIRECTORY_STRING)GetAbsolutePtr(dwNameRVA);
			if(str)
				std::cout << str->NameString << std::endl;
		}

		if(pEntries[i].DataIsDirectory)
		{
			if(pEntries[i].Id <= (WORD)RT_MANIFEST)
			{
				std::cout << "Collection of " << gResourceTypes[pEntries[i].Id - 1] << "'s found!" << std::endl;
			}

			DWORD dwOffset = pEntries[i].OffsetToData & ~0x80000000;
			PIMAGE_RESOURCE_DIRECTORY_ENTRY pNext = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(((LPBYTE)pResDir) + dwOffset);

			if(pNext)
				RecursiveParseResource((DWORD)pResDir, pNext);
		}
		else
			std::cout << "Is data!" << std::endl;
	}

}
Greetings Plerion

Share this post


Link to post
Share on other sites

This topic is 2790 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

If you intended to correct an error in the post then please contact us.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this