c++ - How to find specific Resource String given the .rsrc and the identifier of the string to be loaded in IDA? - TagMerge
1How to find specific Resource String given the .rsrc and the identifier of the string to be loaded in IDA?How to find specific Resource String given the .rsrc and the identifier of the string to be loaded in IDA?

How to find specific Resource String given the .rsrc and the identifier of the string to be loaded in IDA?

Asked 5 months ago
0
1 answers

The format of string resources

Unlike the other resource formats, where the resource identifier is the same as the value listed in the *.rc file, string resources are packaged in “bundles”.

...

The strings listed in the *.rc file are grouped together in bundles of sixteen. So the first bundle contains strings 0 through 15, the second bundle contains strings 16 through 31, and so on. In general, bundle N contains strings (N-1)*16 through (N-1)*16+15.

...

The strings in each bundle are stored as counted UNICODE strings, not null-terminated strings. If there are gaps in the numbering, null strings are used. So for example if your string table had only strings 16 and 31, there would be one bundle (number 2), which consists of string 16, fourteen null strings, then string 31.

That blog post also contains a LoadString implementation that shows how to convert the string id to the resource id and then walking the data to find the string.

In your case I believe this is string resource id 18 and the first string in that bundle.

Source: link

Recent Questions on c++

    Programming Languages