void* _GetResourceTable(IMAGE_DOS_HEADER* pDosHeader) { IMAGE_NT_HEADERS* pPE = (IMAGE_NT_HEADERS*)((BYTE*)pDosHeader + pDosHeader->e_lfanew); if (pPE->Signature != IMAGE_NT_SIGNATURE) return NULL; if (pPE->FileHeader.SizeOfOptionalHeader < 2) return NULL; // The DataDirectory is an array of 16 structures. // Each array entry has a predefined meaning for what it refers to. switch (pPE->OptionalHeader.Magic) { case IMAGE_NT_OPTIONAL_HDR32_MAGIC: if (pPE->FileHeader.SizeOfOptionalHeader >= sizeof(IMAGE_OPTIONAL_HEADER32)) return _RelativeVirtualAddresstoPtr(pDosHeader, ((PIMAGE_NT_HEADERS32)pPE)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress); break; case IMAGE_NT_OPTIONAL_HDR64_MAGIC: if (pPE->FileHeader.SizeOfOptionalHeader >= sizeof(IMAGE_OPTIONAL_HEADER64)) return _RelativeVirtualAddresstoPtr(pDosHeader, ((PIMAGE_NT_HEADERS64)pPE)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress); break; } return NULL; }
void* _FindResource(IMAGE_DOS_HEADER* pDosHeader, void* prt, int resIndex, int resType, DWORD* pcbSize) { int count, index = 0; IMAGE_RESOURCE_DIRECTORY_ENTRY* pRes; IMAGE_RESOURCE_DATA_ENTRY* pEntry; pRes = _FindResourceBase(prt, resType, &count); if (resIndex < 0) { for (index = 0; index < count; index++) if (pRes[index].Name == (DWORD)(-resIndex)) break; } else index = resIndex; if (index >= count) return NULL; if (pRes[index].OffsetToData & IMAGE_RESOURCE_DATA_IS_DIRECTORY) { IMAGE_RESOURCE_DIRECTORY* pDir; pDir = (IMAGE_RESOURCE_DIRECTORY*)((LPBYTE)prt + (pRes[index].OffsetToData & ~IMAGE_RESOURCE_DATA_IS_DIRECTORY)); pRes = (IMAGE_RESOURCE_DIRECTORY_ENTRY*)(pDir+1); index = 0; } if (pRes[index].OffsetToData & IMAGE_RESOURCE_DATA_IS_DIRECTORY) return NULL; pEntry = (IMAGE_RESOURCE_DATA_ENTRY*)((LPBYTE)prt + pRes[index].OffsetToData); *pcbSize = pEntry->Size; return _RelativeVirtualAddresstoPtr(pDosHeader, pEntry->OffsetToData); }
void* ExtractIcons::_FindResource( IMAGE_DOS_HEADER* pDosHeader, void* prt, int resIndex, INT_PTR resType, DWORD* pcbSize ) { int count; IMAGE_RESOURCE_DIRECTORY_ENTRY* pRes; pRes = _FindResourceBase( prt, resType, &count ); int index = 0; // find the actual resource // id (resIndex < 0) // ordinal (resIndex >= 0) if( resIndex < 0 ) { for( index = 0; index < count; index++ ) if( pRes[index].Name == (DWORD)(-resIndex) ) break; } else { index = resIndex; } if( index >= count ) return NULL; // index out of range // another Directory // probably language take the first one if( pRes[index].OffsetToData & IMAGE_RESOURCE_DATA_IS_DIRECTORY) { IMAGE_RESOURCE_DIRECTORY* pDir; pDir = (IMAGE_RESOURCE_DIRECTORY*)((LPBYTE)prt + (pRes[index].OffsetToData & ~IMAGE_RESOURCE_DATA_IS_DIRECTORY) ); pRes = (IMAGE_RESOURCE_DIRECTORY_ENTRY*)(pDir+1); index = 0; } // Oooooooooooo no !! another Directory !!! if( pRes[index].OffsetToData & IMAGE_RESOURCE_DATA_IS_DIRECTORY ) return NULL; IMAGE_RESOURCE_DATA_ENTRY* pEntry; pEntry = (IMAGE_RESOURCE_DATA_ENTRY*)((LPBYTE)prt + pRes[index].OffsetToData); // all OffsetToData fields except the final one are relative to // the start of the section. the final one is a virtual address // we need to go back to the header and get the virtual address // of the resource section to do this right. *pcbSize = pEntry->Size; return _RelativeVirtualAddresstoPtr( pDosHeader, pEntry->OffsetToData ); }
void* ExtractIcons::_GetResourceTable( IMAGE_DOS_HEADER* pDosHeader ) { IMAGE_NT_HEADERS32* pPE = (IMAGE_NT_HEADERS32*)((BYTE*)pDosHeader + pDosHeader->e_lfanew); if( pDosHeader->e_magic != IMAGE_DOS_SIGNATURE ) return NULL; if( pPE->Signature != IMAGE_NT_SIGNATURE ) return NULL; if( pPE->FileHeader.SizeOfOptionalHeader < IMAGE_SIZEOF_NT_OPTIONAL32_HEADER ) return NULL; // The DataDirectory is an array of 16 structures. // Each array entry has a predefined meaning for what it refers to. return _RelativeVirtualAddresstoPtr( pDosHeader, pPE->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress ); }