Write Resource to File

Index > Windows > Write Resource to File

Goto page 1, 2 Next

Author

Thread

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 00:12

Is it possible to read resource data and write it to a file at runtime? I'm sort of new to assembly so if it is possible, could someone explain how? I've tried searching the forum but didnt find anything specific, but I do apologize if I posted about something that's already been answered. Thanks in advance! Very Happy

_________________
Sit vis vobiscum!

29 Jul 2011, 00:12

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 29 Jul 2011, 00:54

Yes, all is possible.

API's that you'll need:

FindResource | http://msdn.microsoft.com/en-us/library/ms648042%28v=VS.85%29.aspx

LockResource | http://msdn.microsoft.com/en-us/library/ms648047%28v=vs.85%29.aspx

(OR)

LoadResource | http://msdn.microsoft.com/en-us/library/ms648046%28v=vs.85%29.aspx

CreateFile/Ex | http://msdn.microsoft.com/en-us/library/aa363858%28v=vs.85%29.aspx

WriteFile | http://msdn.microsoft.com/en-us/library/aa365747%28v=VS.85%29.aspx

CloseHandle | http://msdn.microsoft.com/en-us/library/ms724211%28v=VS.85%29.aspx

29 Jul 2011, 00:54

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 01:08

Thanks! I'll post back if I have any further questions!

29 Jul 2011, 01:08

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz 29 Jul 2011, 11:15

GoodbyeWorld
and SizeOfResource too http://msdn.microsoft.com/en-us/library/ms648048%28v=vs.85%29.aspx

29 Jul 2011, 11:15

AsmGuru62

Joined: 28 Jan 2004
Posts: 1694
Location: Toronto, Canada

AsmGuru62 29 Jul 2011, 12:57

I doubt that you can write to your own EXE file.

29 Jul 2011, 12:57

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 13:08

Overflowz:
Yeah I figured that out from MSDN. Thanks though!

Everyone and Anyone:
I have a question. In another portion of my code I'm using resources to draw an image (or I will be as soon as I can get my image to load Confused

), I'm using OllyDebug and finding that GetLastError is returning ERROR_INVALID_HANDLE at my breakpoint in the following code:

Code:

section '.data' data readable writeable
        HMOD         dd ?
        SysW          dd ?
        SysH           dd ?
        IMAGE         db 'IMAGE',0
        BITMAP       dd ?
        ...
section '.code' code readable executable
        push 0
        call [GetModuleHandle]
        mov [HMOD],eax

        push 0
        call [GetSystemMetrics]
        mov [SysW],eax
        push 1
        call [GetSystemMetrics];user32.dll
        mov [SysH],eax
        push 0x00000000
        push [SysH]
        push [SysW]
        push 0
        push IMAGE
        push [HMOD]
        call [LoadImage];user32.dll
        mov [Bitmap],eax
        int 3                    ;Breakpoint
        ...

I'm not sure exactly what I'm doing wrong here.

29 Jul 2011, 13:08

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 13:09

Oh and I dont want to write to my own EXE. I want to write that resource to a wav file, but that's later on in my code.

29 Jul 2011, 13:09

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20531
Location: In your JS exploiting you and your system

revolution 29 Jul 2011, 13:13

GoodbyeWorld wrote:

I'm not sure exactly what I'm doing wrong here.

Without an full compilable example showing the problem we also don't know what you are doing wrong.

29 Jul 2011, 13:13

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz 29 Jul 2011, 13:40

GoodbyeWorld
Maybe this ?
BITMAP dd ?
mov [Bitmap],eax
BITMAP != Bitmap
EDIT:
as I guess, BITMAP is structure..

29 Jul 2011, 13:40

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 13:58

Oh. Yeah. Sorry. I changed it and I'm still getting the error at runtime.
And here's an example:

Code:

format PE GUI 4.0
INCLUDE 'C:\ASM\FASM\INCLUDE\WIN32A.INC'
ENTRY START
SECTION '.data' DATA READABLE WRITEABLE
        IMAGE        db 'IMAGE',0
        WAVE       db 'WAVE',0
        HMOD         dd ?
        SysW         dd ?
        SysH         dd ?
        RHand        dd ?
        Bitmap       dd ?
        PointRes     dd ?
        SizeRes      dd ?
        FHAND        dd ?
        FNAME        db 'C:\WAVE.wav',0
SECTION '.code' CODE READABLE EXECUTABLE
START:
        push 0
        call [GetHandle]
        mov [HMOD],eax

        push 0
        call [GetSysMet]
        mov [SysW],eax
        push 1
        call [GetSysMet]
        mov [SysH],eax
        push 0x00000000
        push [SysH]
        push [SysW]
        push 0
        push IMAGE
        push [HMOD]
        call [LoadImg]
        mov [Bitmap],eax
        int 3
        push [HMOD]
        push WAVE
        push RT_RCDATA
        call [FindRes]
        mov [RHand],eax

        push [HMOD]
        push [RHand]
        call [LoadRes]
        push eax


        call [LockRes]
        mov [PointRes],eax

        push [HMOD]
        push [RHand]
        call [SzRes]
        mov [SizeRes],eax

        push 0
        push 1 xor 2
        push 2
        push 0
        push 0
        push GENERIC_ALL
        push FNAME
        call [CreateFile]
        mov [FHAND],eax


        push 0
        push 0
        push [SizeRes]
        push [PointRes]
        push [FHAND]
        call [WriteFile]


        push [FHAND]
        call [CloseHandle]

Cleanup:
        push [Bitmap]
        call [DeleteObj]
        push 0
        call[ExitProcess]
SECTION '.idata' IMPORT DATA READABLE EXECUTABLE
        library gdi32,'GDI32.DLL',\
                gdiplus,'GDIPLUS.DLL',\
                kernel32,'KERNEL32.DLL',\
                shell32,'SHELL32.DLL',\
                user32,'USER32.DLL',\
                winmm,'WINMM.DLL'
        import shell32,\
               Execute,'ShellExecuteA'
        import kernel32,\
               FormatMessage,'FormatMessageA',\
               GetLastError,'GetLastError',\
               ExitProcess,'ExitProcess',\
               GetRsc,'FindResourceA',\
               GetHandle,'GetModuleHandleA',\
               FindRes,'FindResourceA',\
               LoadRes,'LoadResource',\
               LockRes,'LockResource',\
               SzRes,'SizeofResource',\
               WriteFile,'WriteFile',\
               CreateFile,'CreateFileA',\
               CloseHandle,'CloseHandle'
        import gdi32,\
               GetDC,'GetDC',\
               DeleteObj,'DeleteObject'
        import user32,\
               LoadImg,'LoadImageA',\
               GetSysMet,'GetSystemMetrics',\
               MessageBox,'MessageBoxA'
        import winmm,\
               mciSS,'mciSendStringA'
SECTION '.rsrc' DATA READABLE RESOURCE FROM 'MyRes.res'

If you need to see the MyRes.res File, let me know.

29 Jul 2011, 13:58

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz 29 Jul 2011, 14:08

Found some mistakes. When you're calling "FindResource" API, you are using bad argument at ResourceType. Here:

Code:

0040204F   |.  FF35 0B104000    PUSH DWORD PTR DS:[40100B]                                                         ; /ResourceType = "MZ\x80"
00402055   |.  68 06104000      PUSH format.00401006                                                               ; |ResourceName = "WAVE"
0040205A   |.  6A 0A            PUSH 0A                                                                            ; |hModule = 0000000A
0040205C   |.  FF15 A4304000    CALL DWORD PTR DS:[<&KERNEL32.FindResourceA>]                                      ; \FindResourceA

instead of buffer, you should use which type of resource it is. For example, place it in RC_RCDATA type and then use:

Code:

push hMod
push <"WAVE">
push RT_RCDATA
call [FindResource]

You called it reversely Very Happy

here:

Code:

        push [HMOD] 
        push WAVE 
        push RT_RCDATA 
        call [FindRes]

use invoke instead of PUSH&CALL-s.

Code:

push RT_RCDATA
push WAVE
push [HMOD]
call [FindRes]

equal to

Code:

invoke FindResource,[HMOD],WAVE,RC_RCDATA

Last edited by Overflowz on 29 Jul 2011, 15:30; edited 5 times in total

29 Jul 2011, 14:08

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 14:10

Wait, you'll need that to compile it, so I'll just go ahead and post it.

I would post the file, but the filename *.res is not allowed.

Description:	XN Resource Editor - MyRes.res (in case you cant see the image)
Filesize:	20.99 KB
Viewed:	9283 Time(s)

_________________
Sit vis vobiscum!

29 Jul 2011, 14:10

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 14:15

If you absolutely have to download the file, http://frazierb.com/MyRes.res

29 Jul 2011, 14:15

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 14:26

Thanks, Overflowz!

29 Jul 2011, 14:26

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz 29 Jul 2011, 14:28

P.S, are you using debugger to see results ? It would help you a lot.

29 Jul 2011, 14:28

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 14:32

Yes, I am using OllyDbg. It's still showing me this when I debug it and get to the breakpoint.

Description:	OllyDbg output
Filesize:	15.38 KB
Viewed:	9265 Time(s)

29 Jul 2011, 14:32

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz 29 Jul 2011, 14:47

GoodbyeWorld
Instead LoadImage, use LoadBitmap Smile

Code:

push IMAGE
push [HMOD]
call [LoadBitmap]

Works fine for me Wink

Last edited by Overflowz on 29 Jul 2011, 14:49; edited 2 times in total

29 Jul 2011, 14:47

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 14:48

It says it's been superseded by LoadImage, but I'll try it.

29 Jul 2011, 14:48

GoodbyeWorld

Joined: 21 Jul 2011
Posts: 12

GoodbyeWorld 29 Jul 2011, 14:51

It worked! Thanks!

29 Jul 2011, 14:51

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz 29 Jul 2011, 14:59

Here you go, your full working code.

Code:

format PE GUI 4.0
include 'WIN32AX.INC'
ENTRY START
SECTION '.data' DATA READABLE WRITEABLE 
        IMAGE        db 'IMAGE',0 
        WAVE       db 'WAVE',0 
        HMOD         dd ? 
        SysW         dd ? 
        SysH         dd ? 
        RHand        dd ? 
        Bitmap       dd ? 
        PointRes     dd ? 
        SizeRes      dd ? 
        FHAND        dd ?
        wbytes       dd ?
        FNAME        db 'C:\WAVE.wav',0 
SECTION '.code' CODE READABLE EXECUTABLE 
START: 
        push 0 
        call [GetHandle] 
        mov [HMOD],eax 
        push 0
        call [GetSysMet] 
        mov [SysW],eax 
        push 1 
        call [GetSysMet] 
        mov [SysH],eax
        invoke LoadBitmap,[HMOD],IMAGE
        mov [Bitmap],eax 
        push RT_RCDATA
        push WAVE 
        push [HMOD]
        call [FindRes] 
        mov [RHand],eax 

        push [RHand]
        push [HMOD]
        call [LoadRes] 
        push eax 


        call [LockRes] 
        mov [PointRes],eax 

        push [RHand]
        push [HMOD]
        call [SzRes] 
        mov [SizeRes],eax 

        push 0 
        push 1 xor 2 
        push 2 
        push 0 
        push 0 
        push GENERIC_ALL 
        push FNAME 
        call [CreateFile] 
        mov [FHAND],eax 


        push 0 
        push wbytes
        push [SizeRes] 
        push [PointRes] 
        push [FHAND] 
        call [WriteFile] 


        push [FHAND] 
        call [CloseHandle] 

Cleanup: 
        push [Bitmap] 
        call [DeleteObj] 
        push 0 
        call[ExitProcess] 
SECTION '.idata' IMPORT DATA READABLE EXECUTABLE 
        library gdi32,'GDI32.DLL',\ 
                gdiplus,'GDIPLUS.DLL',\ 
                kernel32,'KERNEL32.DLL',\ 
                shell32,'SHELL32.DLL',\ 
                user32,'USER32.DLL',\ 
                winmm,'WINMM.DLL' 
        import shell32,\ 
               Execute,'ShellExecuteA' 
        import kernel32,\ 
               FormatMessage,'FormatMessageA',\ 
               GetLastError,'GetLastError',\ 
               ExitProcess,'ExitProcess',\ 
               GetRsc,'FindResourceA',\ 
               GetHandle,'GetModuleHandleA',\ 
               FindRes,'FindResourceA',\ 
               LoadRes,'LoadResource',\ 
               LockRes,'LockResource',\ 
               SzRes,'SizeofResource',\ 
               WriteFile,'WriteFile',\ 
               CreateFile,'CreateFileA',\ 
               CloseHandle,'CloseHandle' 
        import gdi32,\ 
               GetDC,'GetDC',\ 
               DeleteObj,'DeleteObject' 
        import user32,\ 
               LoadImg,'LoadImageA',\ 
               GetSysMet,'GetSystemMetrics',\ 
               MessageBox,'MessageBoxA',\
               LoadBitmap,'LoadBitmapA'
        import winmm,\ 
               mciSS,'mciSendStringA'
section '.rsrc' data readable resource from 'MyRes.res'

added wbytes for WriteFile and some API calls was called incorrectly. Fixed everything. Next time, try to fix them yourself Smile

P.S I guess you're trying to make some "PRANK VIRUS" ))

29 Jul 2011, 14:59

Goto page 1, 2 Next

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum