Latest available version: IDA and decompilers v8.4.240320 see all releases
Hex-Rays logo State-of-the-art binary code analysis tools
email icon
//
//	This is an example how New Executable Format resources can be
//	analysed. In this example we analyse Version Information resource
//      type only.

//-------------------------------------------------------------------
static nextResource(ea) {	// find next resource
  auto next;
  auto name;

  next = ea;
  while ( (next=NextSeg(next)) != -1 ) {
    name = SegName(next);
    if ( substr(name,0,3) == "res" ) break;	// Yes, this is a resource
  }
  return next;
}

//-------------------------------------------------------------------
static getResourceType(cmt) {
  auto i;
  i = strstr(cmt,"(");
  if ( i != -1 ) {
    i = i + 1;
    return xtol(substr(cmt,i,i+4));	// get type of the resource
  }
  return 0;				// couldn't determine rsc type
}

//-------------------------------------------------------------------
static getResourceID(cmt) {
  auto i;
  i = strstr(cmt,":");
  if ( i != -1 ) {
    i = i + 1;
    return long(substr(cmt,i,-1));	// get ID of the resource
  }
  return 0;				// couldn't determine rsc ID
}

//-------------------------------------------------------------------
static ResourceCursor(ea,id) {
  Message(form("Cursor, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceBitmap(ea,id) {
  Message(form("Bitmap, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceIcon(ea,id) {
  Message(form("Icon, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceMenu(ea,id) {
  Message(form("Menu, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceDbox(ea,id) {
  Message(form("Dbox, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceStrT(ea,id) {
  Message(form("String Table, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceFontDir(ea,id) {
  Message(form("FontDir, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceFont(ea,id) {
  Message(form("Font, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceAccl(ea,id) {
  Message(form("Accelerator, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceData(ea,id) {
  Message(form("Resource Data, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceCurDir(ea,id) {
  Message(form("Cursor Dir, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceIconDir(ea,id) {
  Message(form("Icon Dir, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceName(ea,id) {
  Message(form("Cursor, id: %ld\n",id));
}

//-------------------------------------------------------------------
static ResourceVersion(ea,id) {

  Message(form("Version info, id: %ld\n",id));

  ea = AnalyseVBlock(ea,0);
}

//-------------------------------------------------------------------
static ConvertToStr(vea,len) {
  auto ea;
  auto slen;
  ea = vea;
  for ( ea=vea; len > 0; vea = ea ) {
    while ( Byte(ea) != 0 ) ea = ea + 1;
    ea = ea + 1;
    slen = ea - vea;
    MakeStr(vea,slen);
    len = len - slen;
  }
}

//-------------------------------------------------------------------
static Pad32(ea) {
  auto vea;
  vea = (ea + 3) & ~3;			// align to 32-bit boundary
  if ( vea != ea ) {			// extra bytes found
    MakeArray(ea,vea-ea);
    MakeComm(ea,"Padding bytes");
  }
  return vea;
}

//-------------------------------------------------------------------
static AnalyseVBlock(ea,blnum) {
  auto key,block,vsize,x,vea,keyea;
  auto blstart,blend;

  blstart = ea;				// save block start

  block = Word(ea);
  MakeName(ea,form("rscVinfoBlSize_%ld",blnum));
  MakeWord(ea);
  OpNumber(ea,0);

  ea = ea + 2;
  vsize = Word(ea);
  MakeName(ea,form("rscVinfoValSize_%ld",blnum));
  MakeWord(ea);
  OpNumber(ea,0);

  ea = ea + 2;
  keyea = ea;
  MakeName(key,form("rscVinfoKey_%ld",blnum));
  key = "";
  while ( Byte(ea) != 0 ) {
    key = key + char(Byte(ea));
    ea = ea + 1;
  }
  ea = ea + 1;
  MakeStr(keyea,ea-keyea);

  vea = Pad32(ea);

  MakeName(vea, form("rscVinfoValue_%ld",blnum));

  blend = vea + vsize;			// find block end

//  Message(form("At %lX key is: ",keyea) + key + "\n");

  if      ( key == "VS_VERSION_INFO" ) {

  	;	// nothing to do

  } else if ( key == "VarFileInfo"     ) {

  	;	// nothing to do

  } else if ( key == "Translation"     ) {

    for ( ea=vea; ea