Windows PE - Where and how are strings stored if not in resources?

Question

Usually strings (like content/titles of dialog boxes) in .exe files are stored in some sort of resources.

But in some recent exes I disassembled/resource-inspected I couldn't find any resources containing the string but it was somehow hardcoded with db's into the program source code.

• How can I extract and modify strings directly located in the program? I assume those are just the equivalent to const char*s in C++?

• Why would someone not "outsource" the contents of dialog boxes, menus, etc?

Answer 1

Strings are located in either resources or in read-only data sections of PE file. Second is more common when strings are not captions/titles of controls. When disassembled they are just piece of memory and not specially marked. Smart disassemblers like IDA can notice references to addresses in code and highlight strings definition.

• Extracting and modifing. If you know address of string it is easy to extract and modify it. You take the address of string, then subtract image base, then subtract RVA of section then add physical offset of section. This will give you position of string in file. There you can modify it with hex editor. Finding address is hard - you need to analyze disassembled code.
• Why would someone not "outsource" the contents of dialog boxes, menus, etc? Have no idea. Someone might declare const char* then set it as title without paying attention where is it really stored.

Answer 2

The easiest way to get strings out of a PE, by far, is the strings utility that comes standard with every Linux distro I've ever come across (even uCLinux). It pretty much just goes through the entire binary, looking for a series of null-terminated, printable ascii characters... which is your canonical string. strings --help shows you available parameters such as the minimum length string to look for, encoding, architecture helpers, and other stuff you probably don't need.

If you're not running Linux, I recommend booting a Ubuntu Live CD just for the wealth of simple-yet-effective command line utilities.

Answer 3

If you want to access data in the PE file try this utility (comes with source code and friendly (non-GPL) license so you can use the code in your own app).

PE File Format DLL

You should be able to easily find the address of the appropriate section(s) and then work you way through the data. There is also a PE File Explorer project (with source) that uses the DLL, so you can see how to call the DLL for your app.