Posted July 9, 200916 yr Hi, I've got another problem. I'm trying to read the read and parse data in the resource section, after reading some articles I've got a pretty good idea about what needs to be done. But, I'm stuck on one little thing, which none of the articles seem to cover. The problem is with the IMAGE_RESOURCE_DIRECTORY_ENTRY values, the Name value seems correct(checked with Index refs), but the OffsetToData value is wrong, or at least the value in the field is way way above even the filesize. Is there something I need to do to the OffsetToData to get the right offset of the IMAGE_RESOURCE_DATA_ENTRY?var dwOffset: DWORD; bFile: TByteArray; IDH: TImageDosHeader; INH: TImageNtHeaders; ISH: TImageSectionHeader; IRD: TImageResourceDirectory; IRDE: TImageResourceDirectoryEntry; IRDEN: TImageResourceDataEntry; i: WORD; dwTable: DWORD;begin if FileToBytes('hellovb6.exe', bFile) then begin CopyMemory(@IDH, @bFile[0], 64); if IDH.e_magic = IMAGE_DOS_SIGNATURE then begin CopyMemory(@INH, @bFile[IDH._lfanew], 248); if INH.Signature = IMAGE_NT_SIGNATURE then begin for i := 0 to INH.FileHeader.NumberOfSections - 1 do begin CopyMemory(@ISH, @bFile[IDH._lfanew + 248 + i * 40], 40); if (INH.OptionalHeader.DataDirectory[2].VirtualAddress >= ISH.VirtualAddress) and (INH.OptionalHeader.DataDirectory[2].VirtualAddress <= (ISH.VirtualAddress + ISH.Misc.VirtualSize)) then begin dwOffset := RVAToOffset(INH.OptionalHeader.DataDirectory[2].VirtualAddress, ISH.VirtualAddress, ISH.PointerToRawData); Break; end; end; CopyMemory(@IRD, @bFile[dwOffset], 16); for i := 0 to IRD.NumberOfIdEntries - 1 do begin CopyMemory(@IRDE, @bFile[dwOffset + 16 + i * 8], 8); //CopyMemory(@IRDEN, @bFile[dwTable], SizeOf(IRDEN)); MessageBox(0, PChar(IntToStr(IRDE.OffsetToData)), nil, 0); //Break; end; end; end; end;end.Thanks. Edited July 9, 200916 yr by steve10120
Create an account or sign in to comment