????
Quote.386
.model flat, stdcall
option casemap :none
include \MASM32\INCLUDE\windows.inc
include \MASM32\INCLUDE\user32.inc
include \MASM32\INCLUDE\kernel32.inc
includelib \MASM32\LIB\user32.lib
includelib \MASM32\LIB\kernel32.lib
.data
diskcopy db 'diskcopy.dll',0
BinFile db 'BINFILE',0;'Data_1.bin',0;
buffer db 512 dup(0)
form db "EAX: %u", 0
.code
start:
invoke LoadLibrary, addr diskcopy
;invoke GetModuleHandle, addr diskcopy
mov ebx, eax
invoke FindResource, ebx, addr BinFile,RT_RCDATA
invoke wsprintf,ADDR buffer,ADDR form,eax
invoke MessageBox,0,addr buffer,0,0
invoke ExitProcess,0
end start
Quote.386
.model flat, stdcall
option casemap :none
include \MASM32\INCLUDE\windows.inc
include \MASM32\INCLUDE\user32.inc
include \MASM32\INCLUDE\kernel32.inc
includelib \MASM32\LIB\user32.lib
includelib \MASM32\LIB\kernel32.lib
EnumResources PROTO :DWORD,:DWORD,:DWORD,:DWORD
.data
diskcopy db 'diskcopy.dll',0
buffer db 512 dup(0)
form db "EAX: %u", 0
.code
start:
invoke LoadLibrary, addr diskcopy
invoke EnumResourceNames, eax, 3, addr EnumResources, 0
invoke ExitProcess,0
EnumResources proc hModule:DWORD,lpszType:DWORD,lpszName:DWORD,lParam:DWORD
invoke wsprintf,ADDR buffer,ADDR form,lpszName
invoke MessageBox,0,addr buffer,0,0
mov eax, 1
ret
EnumResources endp
end start
http://xpdll.nirsoft.net/diskcopy_dll.html
What is this Recources Type: ALL Others?
I enum All possible number of recources type - any 1.4 mb size
Quote.386
.model flat, stdcall
option casemap :none
include \MASM32\INCLUDE\windows.inc
include \MASM32\INCLUDE\user32.inc
include \MASM32\INCLUDE\kernel32.inc
includelib \MASM32\LIB\user32.lib
includelib \MASM32\LIB\kernel32.lib
EnumResources PROTO :DWORD,:DWORD,:DWORD,:DWORD
.data
diskcopy db 'diskcopy.dll',0
buffer db 512 dup(0)
form db 'Number:',9,'%u',13,10,'Type:',9,'%u',13,10,'Size:',9,'%u', 0
MessBox MSGBOXPARAMS <sizeof MSGBOXPARAMS, 0, 0,\
offset buffer, offset diskcopy, MB_OK OR MB_USERICON, 1, 0, 0, 0>
.code
start:
invoke LoadLibrary, addr diskcopy
mov MessBox.hInstance, eax
mov ebx, eax
mov esi, 32
@@:
invoke EnumResourceNames, ebx, esi, addr EnumResources, 0
sub esi, 1
jnz @B
invoke ExitProcess,0
EnumResources proc hModule:DWORD,lpszType:DWORD,lpszName:DWORD,lParam:DWORD
LOCAL hRes:DWORD
LOCAL nSizeOfRes:DWORD
LOCAL pData:DWORD
LOCAL hResLoaded:DWORD
LOCAL FileHandle:DWORD
invoke FindResource,hModule,lpszName,lpszType
mov hRes,eax
invoke LoadResource,hModule, hRes
mov hResLoaded ,eax
invoke LockResource,hResLoaded
mov pData,eax
invoke SizeofResource,hModule,hRes
mov nSizeOfRes,eax
invoke wsprintf,ADDR buffer,ADDR form,lpszName,lpszType,nSizeOfRes
invoke MessageBoxIndirect, addr MessBox
invoke FreeResource,hResLoaded
mov eax, 1
ret
EnumResources endp
end start
Quote.386
.model flat, stdcall
option casemap :none
include \MASM32\INCLUDE\windows.inc
include \MASM32\INCLUDE\user32.inc
include \MASM32\INCLUDE\kernel32.inc
includelib \MASM32\LIB\user32.lib
includelib \MASM32\LIB\kernel32.lib
.data
diskcopy db 'diskcopy.dll',0
BinFile db 'BINFILE',0
form db "EAX: %u", 0
type1 db 'BINFILE',0
bytesWrite dd 0
MyFile db 'Floppy.IMA',0
hFile dd 0
hRes dd 0
nSizeOfRes dd 0
pData dd 0
hResLoaded dd 0
FileHandle dd 0
hModule dd 0
MessBox MSGBOXPARAMS <sizeof MSGBOXPARAMS, 0, 0,\
0, offset diskcopy, MB_OK OR MB_USERICON, 1, 0, 0, 0>
.code
start:
invoke LoadLibrary, addr diskcopy
mov hModule, eax
mov MessBox.hInstance, eax
invoke FindResource, hModule, 1,addr type1
mov hRes,eax
invoke LoadResource,hModule, hRes
mov hResLoaded ,eax
invoke LockResource,hResLoaded
mov pData,eax
invoke SizeofResource,hModule,hRes
mov nSizeOfRes,eax
invoke CreateFile,addr MyFile,GENERIC_WRITE,0,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
mov hFile, eax
invoke WriteFile,hFile,pData,nSizeOfRes, addr bytesWrite,NULL
invoke CloseHandle, hFile
invoke FreeResource,hResLoaded
invoke MessageBoxIndirect, addr MessBox
invoke ExitProcess,0
end start
(http://smiles.kolobok.us/light_skin/dance4.gif)
How ResEdit or Reshaker do it? (http://smiles.kolobok.us/light_skin/unknw.gif)
you can probably review the PE/COFF specification for format info
You can use IDA to make an asm listing.
Unless it's been compressed. :bg
I meam - I do what I want - but I see name of recourse in ResEdit. ResEdit SEE this name.
How to know list of all procedures (functions) inside dll?
Attached is an assembly listing of diskcopy.dll.
I saw procedures in it.
I hope it will help you.
PE Explorer 1.99 R6(http://smiles.kolobok.us/light_skin/declare.gif)