Is there a way to find where all resources a PE executable uses?

Question

In my case I'm trying to find the container that persists the configuration parameters, which may be registry, config files (.ini or proprietary) or anything else.

I've tried some resource grabbering tools that can extract resources like images/string out of the executable , but after go through them one by one I find the configuration file is not there.

Anyone has recommendation for this?

Answer 1

There isn't going to be anything inside the image file if it's using the registry, .ini files, or .config files.

Your best bet is to use Process Monitor. It will show you every file and registry access a program uses. From there it may be possible to deduce which is the bit you're interested in.