VB6 FindResource


Author: Dave
Date: 08.02.16 - 1:18pm



If you want to load a resource from a PE file you can use the Windows API (below) or parse the structures yourself.

Parsing the PE Resource table manually was a little annoying, but not to bad. I was able to simplify access to resources in the API redesign. (More memory intensive but easier to use)

Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
Private Declare Function LoadLibraryEx Lib "kernel32" Alias "LoadLibraryExA" (ByVal lpLibFileName As String, ByVal hFile As Long, ByVal dwFlags As Long) As Long
Private Declare Function FreeLibrary Lib "kernel32" (ByVal hLibModule As Long) As Long

Private Const LOAD_LIBRARY_AS_DATAFILE = &H2

Private Declare Function FindResource Lib "kernel32" Alias "FindResourceA" (ByVal hInstance As Long, ByVal lpName As String, ByVal lpType As String) As Long
Private Declare Function LoadResource Lib "kernel32" (ByVal hInstance As Long, ByVal hResInfo As Long) As Long

Private Declare Function SizeofResource Lib "kernel32" (ByVal hInstance As Long, ByVal hResInfo As Long) As Long
 

Private Sub Form_Load()

  Const p = "C:\Documents and Settings\david\Desktop\2\test.exE"
  'Const p = "D:\_code\iDef\SysAnalyzer\x64Helper.exe"
  
  Dim hModule As Long, hResource As Long
  Const RT_RCDATA = 10&
  
   hModule = GetModuleHandle(p)
   If hModule = 0 Then
      'as datafile: 32bit can load a x64 PE file for resources, x64 bit can load 32bit also..
      hModule = LoadLibraryEx(p, 0&, LOAD_LIBRARY_AS_DATAFILE)
      If hModule = 0 Then
         Debug.Print "LoadLibraryEx error (" & Err.LastDllError;
         Exit Sub
      End If
   End If
   
   'MsgBox GetModuleHandle(p) 'always returns 0 if the file was loaded as datafile..
   
   'find SCRIPT resource in RCDATA directory
   hResource = FindResource(hModule, "SCRIPT", "#10")
   ressize = SizeofResource(hModule, hResource)
   hmem = LoadResource(hModule, hResource)
   
   rva = hmem - hModule
   Debug.Print "FileStart Offset of script resource: " & Hex(rva + 1) & " Size: " & Hex(ressize)
   
End Sub





Comments: (0)

 
Leave Comment:
Name:
Email: (not shown)
Message: (Required)
Math Question: 52 + 90 = ? followed by the letter: V 



About Me
More Blogs
Main Site
Posts: (All)
2024 ( 1 )
2023 ( 9 )
2022 ( 4 )
2021 ( 2 )
2020 ( 4 )
2019 ( 5 )
2018 ( 6 )
2017 ( 6 )
2016 (22)
     VB6 CDECL
     UDT Tricks pt2
     Remote Data Extraction
     Collection Extender
     VB6 FindResource
     CDO.Message
     DirList Single Click
     Reset CheckPoint VPN Policy
     VB6 BSTR Oddities Explained
     SafeArrays in C
     BSTR and Variant in C++
     Property let optional args
     Misc Libs
     Enum Named Pipes
     Vb6 Collection in C++
     VB6 Overloaded Methods
     EXPORT FUNCDNAME Warning
     VB6 Syncronous Socket
     Simple IPC
     VB6 Auto Resize Form Elements
     Mach3 Automation
     Exit For in While
2015 ( 15 )
2014 ( 25 )
2013 ( 4 )
2012 ( 10 )
2011 ( 7 )
2010 ( 11 )
2009 ( 3 )