How do you extract an RT_RCDATA section from a Win32 executable (preferably in C#)?

Question

The only way I know how to do this currently is opening up the EXE in Visual Studio. I'd love to be able to do this entirely in C# if possible. Other options include:

• P/Invoking LoadResource() from the Win32 API
• Using an existing tool (anybody know one?)
• Other ideas?

Thanks!

Answer 1

P/Invoke LoadResource will be your safest bet.

Otherwise you'll have to write your own P/E processor eg. PE Processor example. The processor isn't the end of the world, but as you can see much more involved than a P/Invoke.

Almost forgot,as far as tools go, most P/E browsers will do this for you. Eg. P/E Explorer, which is available but not really being developed. I've also used IDA Pro for stuff like this. A quick IDA plugin would do this easily.

Answer 2

I assume that you are trying to read a resource of type RCDATA from an executable (be aware that "executable section" means a different thing - it refers to the .text, .data, .rdata, etc parts of the PE file). If you want to read it from the current assembly, here is a tutorial showing how: Accessing Embedded Resources using GetManifestResourceStream, using the GetManifestResourceNames and GetManifestResourceStream methods.

If you don't want to read it from the current executable, you can use a method similar to the one shown here.

These methods have the advantage over PInvoke that they are 100% .NET and you don't have to fiddle with marshaling the arguments to/from platform data types and making sure that you validated all the return values.