DLGTEMPLATEEX et al

[PBrennick]

Donkey reread my edited post, you will see that 16 entries as a limit is wrong. I have the code to prove it as I described.

Paul

[donkey]

Hi Paul,

Yes, I saw the 20 entries, but looking at a resource dump it is split into 2 tables, one of 1752 bytes and another of 422 bytes, res numbers 1251 and 1252 accordingly. Ofcourse I am using GoRC so that may have affected the test.

I am beginning to suspect that there is no index or master list, just a sequential numbering. I am currently writing a proggy to test my theory but it is a bit complex as I have to take apart a PE files resource section and peer into the bytes in the resource entry structure where I beleive I will find the base ID is stored. Probably take a day or two but I will ofcourse add it to Res2Dlg if it does what I think it will, it will be the first mod to that program in years :) As a matter of fact I know alot more about PE structure now than I did then and I may port it to GoAsm and improve it a bit, WinExplorer has taught me alot and I can put it to good use in that program etiher as a standalone project (for all IDEs) or as an addin for RadASM (probably both).

Edgar

[PBrennick]

Donkey,
It sounds like you have a good plan. I am unsure how the split is done. A split based on the amount of entries just does not make sense to me as the strings vary in length. I bet the split is based on size. It is best that you create your own stringtables for testing so that you can have SOME level of predictability.

BTW: How did you do a resource dump of my program when you do not have a copy?  :bdg

Converting it to GoAsm so there is another nice tool for that assembler is a great idea. That is why I am porting the Builder tools as well.

Let us know how you make out as it is VERY interesting. [Shhh! You could probably just ask Jeremy what he did].
Paul

[donkey]

Hi Paul,

My Res2Dlg program dumps the resources from an executable, I have no need for source code. But in this case I just copied the string table declaration from your post into an executable of mine and recompiled it then dumped the RES section.

BTW Jeremy once gave me a link to a detailed break down of the PE file format but I have lost it somewhere, I prefer to figure it out though, much more fun than just asking for the answer ;)

The following links are very good for an overview of the PE format...

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndebug/html/msdn_peeringpe.asp
http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/

Edgar

[ramguru]

wow what an activity last night... :U  I just have found how to determine string ID, it's ( (table's_ID - 1) * 16) this would be ID of first string, then sequential numbering, as donkey mentioned, unfortunately it's that simple  :red Thank you both for helping me...

[Vortex]

Hi Edgar,

Here, you can find a detailed PE file format specification :

http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/pecoff_v8.doc

[ramguru]

Hi, Vortex, that specification is not very detailed, it doesn't cover individual resource, but it's useful in enumeration process.
...
I still have problems in extracting string resource  :(
I made a routine which seems does the job correctly, but...
results from my program (table ID = 1):

Code Select Expand


STRINGTABLE
BEGIN
0, "Adobe Reader"
1, "
PDF
Acrobat Document
PDF Files (*.pdf)
.pdf
AcroExch.Document
Adobe Acrobat Document"
2, "Oem"
3, "oem%d"
4, "AboutDIB"
5, "DIB"
6, "AdobeViewer"
7, "User"
8, "There is not enough free memory to complete this operation."
9, "A newer version of this printer driver is required for Adobe Acrobat 2.1.  Please obtain a newer version of this driver, or install the Microsoft Windows "PostScript Printer" driver from the Printers Control Panel."
10, "There is not enough free memory to run Acrobat.  The application will now exit."
11, "No"
12, "File '%s' no longer exists."
END

As you can see IDn = (IDt-1)*16+n, so where is the problem you say....

Now I test that resource with Resource Hacker:

Code Select Expand


STRINGTABLE
BEGIN
1, "Adobe Reader"
2, "\nPDF\nAcrobat Document\nPDF Files (*.pdf)\n.pdf\nAcroExch.Document\nAdobe Acrobat Document"
4, "Oem"
5, "oem%d"
6, "AboutDIB"
7, "DIB"
9, "AdobeViewer"
10, "User"
11, "There is not enough free memory to complete this operation."
12, "A newer version of this printer driver is required for Adobe Acrobat 2.1.  Please obtain a newer version of this driver, or install the Microsoft Windows \"PostScript Printer\" driver from the Printers Control Panel."
13, "There is not enough free memory to run Acrobat.  The application will now exit."
14, "No"
15, "File '%s' no longer exists."
END

As you can see IDn != (IDt-1)*16+n & string with ID=2 follows string with ID=4 ... not sequential numbering anymore...why

[ramguru]

I have another theory:
IDn - ID of n-th string
IDt - ID of table
ZWp - number of zero words (0000h) met before LENGTH word (all zeroes add up), meaning if x zeroes were met before 1-st string LENGTH word, and y zeroes were met after 1-st string last char. and before 2-nd string LENGTH word, ZW₂=x+y
IDn = (IDt-1)*16 + ZWp + n

[Vortex]

Hi ramguru,

These are what I found :

LUEVELSMEYER's description about PE file format :

http://spiff.tripnet.se/~iczelion/files/pe1.zip

Icon resources in ICO, DLL and EXE files (Also CUR files) :

http://www.wotsit.org/download.asp?f=icons

Win32 Resource File Format [Marco Cocco] :

http://www.wotsit.org/download.asp?f=res32

Windows Resource (.RES) Files [Ray Lischner]

http://www.wotsit.org/download.asp?f=res

[ramguru]

Vortex, thank you for efforts, I know you're cool guy ready to help anyone, i don't want to disappoint you, but the content of two last  links are far less detailed than official PE_8 documentation, even iczelion's suggested (pe1.zip) "as reference" material doesn't cover individual resource format. Both PE_8 documentation & PSDK are very handy, I even have MSDN mag publications since 2000 (it would be nice to have even MSJ), & when I miss some information I come here in the hope people like you can help me figure it out (but I think my last theory is 80% right)...

[Vortex]

No problem ramguru, I will post more references about resources if I can find.

[PBrennick]

RamGuru,

IDn - ID of n-th string
IDt - ID of table
ZWp - number of zero words (0000h) met before LENGTH word (all zeroes add up), meaning if x zeroes were met before 1-st string LENGTH word, and y zeroes were met after 1-st string last char. and before 2-nd string LENGTH word, ZW2=x+y
IDn = (IDt-1)*16 + ZWp + n

I am getting a headache. :bdg

You are a very smart guy, I know you will figure it out. My question is why? Is this just a search for knowledge which is commendable, in itself, or is there another reason that I might be interested in?  :U

Paul

[ramguru]

My question is why? Is this just a search for knowledge which is commendable, in itself, or is there another reason that I might be interested in?

Hi, Paul, the reason is quite simple, it's my biggest asm project so far RP_0.10_preAlpha
My program doesn't use any Find/LockResource, it does resource enumeration,extraction at lowest level, the program now can show any resource in hex window; DIALOG(EX), MENU(EX),ACCELERATORS,STRINGTABLE  in text form. The main feature in my program will be unicode support for resources...

[PBrennick]

What will it do, convert all resources that are read into UNICODE?

Paul

[donkey]

What will it do, convert all resources that are read into UNICODE?

Paul

Hi Paul,

As far as I know all resource strings, including those in dialogs etc, are stored in UNICODE format anyway, string and message tables and the text in dialogs are converted to UNICODE by the resource compiler then back to ANSI when necessary. I am not aware of any strings in the resource section that are not stored in UNICODE format. I was wondering about that comment as well since you obviously cannot perform any "low level" resource functions without full UNICODE support since it is native to the format.

Donkey