PE editing and disassembling (win32 icons)

[sydetys]

Hi

I hope there is some gurus here.

Tell me: is it possible to extract icon from .exe file only using hex editor (=Neo hex editor) and PEditor (=PE Editor 1.7 from Mod and Yoda)?

Is it already as .ico file in .exe?

Or do I need to create blank .ico file and add data from .exe resource area in optional header in that blank .ico file.

I want to make this manually, without APIs or other programs, that way I can learn better about PE executable images.

BTW that PE editor shows automatically icon "RVA to data" and "Size" Do I need those when calculating where icon data starts and where it ends?

[ToutEnMasm]

Hello,
I am not a guru but try to answer.
To extract an icon you need an "icon extractor" not a PE editor.
Put this terms in google and you will find plentyfull of them.
Have a look on the menu of PEeditor to see if there is a menu to extract icon (not made for that).
What is an Icon ?.
An icon is an image with a limited size  and a special format (.ico).
Study of the PE format allow you to extract icon writing some code.
You can find some example source code here:
        http://asmedit.massmind.org/

[Vortex]

It's probably easier to use an API function for this purpose :

ExtractIcon Function :

http://msdn.microsoft.com/en-us/library/ms648068(VS.85).aspx

[sydetys]

It's probably easier to use an API function for this purpose :

ExtractIcon Function :

http://msdn.microsoft.com/en-us/library/ms648068(VS.85).aspx

I agree to that.

I KNOW I took just icon data out but it won´t show as icon bitmap picture even if added bitmap header.

Win API it will be then...

[sydetys]

Sorry....I HAD to come by and tell.......I DID IT  :U

hexediting using few good and different PE editors. I managed to learn about BMP header: info in it and constants, and based on those I got the icon out of .exe file.

No APIs needed. great.

There are blanks in my knowledge though: 

what are those two bytes after 1st two bytes which marks header as bitmap (BM) file  I mean after 1st bytes "42 4D" <--constants

anyone knows? ALL other info in header are obvious. dimensions etc.

[rags]

Read this:
http://www.fortunecity.com/skyscraper/windows/364/bmpffrmt.html

It may help you understand better.

[ragdog]

Hi

If you need here is a iconextractor (masm32)


greets

[attachment deleted by admin]

[sydetys]

Doing things on my own is more rewarding,

BTW that link was informative thanx.

So those bytes was about size:  3     4     bfSize     ??     specifies the size of the file in bytes.

I NULLied those..still ico file works fine.

According that link: ICO(bmp) file in resource in executable is without Bitmapheader, it starts straight from bitmapinfoheader. Sure there must is somewhere that main bitmap header (in .rsrc area maybe) but last time I just made blank bmp file and copy pasted that main bitmap header.