a way to enumerate resource for PE file

 

// need to update all data entries
auto res_table = (PIMAGE_RESOURCE_DIRECTORY)(&buff[0] + PointerToRawData);
// level one: Resource:Type
// level two: Resource:Id
// level three: Resource:Language
__EnumResources(res_table, res_table, [res_table, ResourceOffset](PIMAGE_RESOURCE_DIRECTORY_ENTRY entry)
{
// update offset
auto data_entry = (PIMAGE_RESOURCE_DATA_ENTRY)((PBYTE)res_table + entry->OffsetToDirectory);
*(LONG*)&data_entry->OffsetToData = (LONG)data_entry->OffsetToData + ResourceOffset;
});

 

auto PEBuilder::__EnumResources(PIMAGE_RESOURCE_DIRECTORY base, PIMAGE_RESOURCE_DIRECTORY table, std::function<void(PIMAGE_RESOURCE_DIRECTORY_ENTRY)> pfn) -> void
{
auto entry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(table + 1);
for (WORD i = 0, total = table->NumberOfIdEntries + table->NumberOfNamedEntries;
i < total;
i++, entry++)
{
if (entry->DataIsDirectory)
{
auto sub_table = (PIMAGE_RESOURCE_DIRECTORY)((PBYTE)base + entry->OffsetToDirectory);
__EnumResources(base, sub_table, pfn);
}
else
{
pfn(entry);
}
}
}

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s