Windows PE Resources

Question

there are many windows PE resource viewers programs. But how do they work? Do they decode function calls to winapi, or does PE have some section for GUI information? Like Android has XML GUI definitons? Thanks.

Solution 1

There are probably different implementation strategies, so it's not possible to answer this universally for all tools.

The PE file format specification is publicly available. It specifies the section structure of a PE file, how to find the .rsrc section in the file, and how to extract individual resources from that section. The individual resource formats are also documented on MSDN. For example, the dialog GUI definitions are defined in the DLGTEMPLATE structure.

Solution 2

There is an API for resources management. Check out Enumerating Resources.

In certain situations application developers may want to discover the resource contents of an unknown Portable Executable (PE) module. The Windows SDK provides resource enumeration functions that enable an application to obtain lists of resource types, names, and languages in a specified module.