Jump to content

[Delphi] Resource section help


steve10120

Recommended Posts

steve10120

Hi, I've got another problem. I'm trying to read the read and parse data in the resource section, after reading some articles I've got a pretty good idea about what needs to be done. But, I'm stuck on one little thing, which none of the articles seem to cover.

The problem is with the IMAGE_RESOURCE_DIRECTORY_ENTRY values, the Name value seems correct(checked with Index refs), but the OffsetToData value is wrong, or at least the value in the field is way way above even the filesize. Is there something I need to do to the OffsetToData to get the right offset of the IMAGE_RESOURCE_DATA_ENTRY?

var
dwOffset: DWORD;
bFile: TByteArray;
IDH: TImageDosHeader;
INH: TImageNtHeaders;
ISH: TImageSectionHeader;
IRD: TImageResourceDirectory;
IRDE: TImageResourceDirectoryEntry;
IRDEN: TImageResourceDataEntry;
i: WORD;
dwTable: DWORD;
begin
if FileToBytes('hellovb6.exe', bFile) then
begin
CopyMemory(@IDH, @bFile[0], 64);
if IDH.e_magic = IMAGE_DOS_SIGNATURE then
begin
CopyMemory(@INH, @bFile[IDH._lfanew], 248);
if INH.Signature = IMAGE_NT_SIGNATURE then
begin
for i := 0 to INH.FileHeader.NumberOfSections - 1 do
begin
CopyMemory(@ISH, @bFile[IDH._lfanew + 248 + i * 40], 40);
if (INH.OptionalHeader.DataDirectory[2].VirtualAddress >= ISH.VirtualAddress) and (INH.OptionalHeader.DataDirectory[2].VirtualAddress <= (ISH.VirtualAddress + ISH.Misc.VirtualSize)) then
begin
dwOffset := RVAToOffset(INH.OptionalHeader.DataDirectory[2].VirtualAddress, ISH.VirtualAddress, ISH.PointerToRawData);
Break;
end;
end;
CopyMemory(@IRD, @bFile[dwOffset], 16);
for i := 0 to IRD.NumberOfIdEntries - 1 do
begin
CopyMemory(@IRDE, @bFile[dwOffset + 16 + i * 8], 8);
//CopyMemory(@IRDEN, @bFile[dwTable], SizeOf(IRDEN));
MessageBox(0, PChar(IntToStr(IRDE.OffsetToData)), nil, 0);
//Break;
end;
end;
end;
end;
end.

Thanks.

Edited by steve10120
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...