A study on PE resources

Preface: Nothing to say, found that the information is all in English, so I study, while translating, writing their own experience.

I hope you respect the fruits of my work, paste to maintain integrity.

Resources are typically stored in a tree, usually containing 3 layers, under NT, the highest level is the type, then the name, and finally the language.

Whether a PE file contains a resource file usually detects that the Block Table (section table) contains '. rsrc ', although this method is not valid for some PE files.

A type table structure is as follows

——————————————————————————

| RESOURCE DIRECTORY |

——————————————————————————

| RESOURCE DATA |

——————————————————————————

Resource Table 1 (Resource File Layout)

The Resource directory (RESOURCE directory) is structured as follows:

——————————————————————————

| RESOURCE FLAGS |

——————————————————————————