PE file resources

Resources are a very important part of PE files. Almost all PE files contain resources. Compared with the import and export tables, the resource organization method is much more complex. To understand resources, focus on understanding the overall organizational structure of resources.

We know that PE file resources contain more than a dozen standard types, including cursor, icon, bitmap, and menu. In addition, you can also use custom types, there may be multiple resource items in each type of resource. These resource items are identified by different IDs or names. Under a resource ID, there may also be versions of different code pages.

Organization of resources in PE files

 

Resource Organization

1. Obtain the resource location
2. Resource Directory
3. Resource Data Entry

How can we obtain the resource location?

We can obtain it from the data directory Field of the image_optional_header32 structure. The third image_data_directory structure in the data directory is the definition of the resource, and the RVA value of the resource block address is obtained from the virtualaddress of the structure.

 

What is a resource directory?

What we should know is: whether it is the root directory, or the Layer 2 Directory, each directory is composed of an image_resource_directory structure and several image_resource_directory_entry structures that follow, these two structures constitute a directory quickly.

 

Image_resource_directory is defined as follows:

In this structure, the most important is the last two fields. The result of adding the two fields is the number of image_resource_directory_entry results.

 

Here we will introduce the image_resource_entry structure. Each of these structures describes a directory item, which is defined as follows:

When the name1 field is used as the ID, a dual-word can be stored. However, when the name1 field is used as a string, a double character is far from enough. In this case, we only need to define a string pointer here. How can we define these two cases? The method is defined to use the highest bit (31st bits) of the field to distinguish the two cases. When the 31st-bit value is 0, the field value is used as the ID. When the 31st-bit value is 1, the low position of the field is used as the string pointer. However, because the Resource Name string is encoded using Unicode, the pointer is not directly directed to the string, but to the structure of an image_resource_dir_string_u, which contains the length of the Unicode string and the string itself. Image_resource_dir_string_u is defined as follows:

 

What is the resource data entry?

The image_resource_data_entry Structure describes the location and size of resource data. In other words, we finally get detailed information about a resource. This structure is the entry to the resource data.

It is defined as follows:

 

PE file resources