attached herewith are the files 'res.inc' the main file and the text resource file containing the extra code.
this program demos how to hide and run code in a resource table. the code can be encrypted also prior to compilation.

enjoy! xD

oh. it says hello world from html because the resource file was an html file but i couldn't upload it here so i just changed it to a text file

An interesting trick could be added so its looks more like a resource html file.

The firsts bytes of the html file should be '<!--' and then goes executable code (so the jmp should be eax + 4.
After the executable code, add '-->' and then some html page.

So if someone extracts the resource, and opens it with IE, Firefox, etc... it will look like a real html file, becouse the executable code will be as a html comment.

of course, if someone looks inside the html, its obvious.

yeah
sounds cool..
but the drawback is once 1 byte is changed equals disaster. i guess one would have to use encryption then and use some kind of dynamic data checksum algo.

Hard coding the address of MessageBox could be a problem, also with DEP enabled for all files does this pass?

^on my XP H.E SP3 it works but i haven't tried vista and WIN7.