flat assembler
Message board for the users of flat assembler.

Index > Windows > How icons are set ?

Author
Thread Post new topic Reply to topic
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz 30 Aug 2011, 22:59
Hi everyone, I was thinking about how icons are set on executable files.. I mean, exe's has it's icon in resources and loading it somehow.. I can't find any information (I'm missing something when googling.) and also, does LNK and EXE-s do same job when loading icon files ? Thanks.
Post 30 Aug 2011, 22:59
View user's profile Send private message Reply with quote
asmhack



Joined: 01 Feb 2008
Posts: 431
asmhack 31 Aug 2011, 00:01
Indeed, icons are stored inside of a resource, then windows explorer loads them for better GUI experience.
Post 31 Aug 2011, 00:01
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz 31 Aug 2011, 00:03
Ohh, Explorer. Can you point me which API calls it uses to set icons to them ? Thanks.
Post 31 Aug 2011, 00:03
View user's profile Send private message Reply with quote
asmhack



Joined: 01 Feb 2008
Posts: 431
asmhack 31 Aug 2011, 00:09
Overflowz wrote:
Ohh, Explorer.

Yeah, Surprise!

I assume:
LoadLibrary
FindResource
LoadResource
LockResource
CreateIconFromResourceEx
DrawIcon

Dunno, ask bill, that's too insane stuff for me anyway
Post 31 Aug 2011, 00:09
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz 31 Aug 2011, 00:15
billy = silly
for making things like these =D
Thanks anyway, I'm going to debug now.
Post 31 Aug 2011, 00:15
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz 31 Aug 2011, 00:21
None of them appers to be valid.. It uses some other technique :\
--
nobody knows ??
Post 31 Aug 2011, 00:21
View user's profile Send private message Reply with quote
bitshifter



Joined: 04 Dec 2007
Posts: 796
Location: Massachusetts, USA
bitshifter 03 Sep 2011, 02:55
There are really TWO icon mechanisms.

1) used by resource compiler.
2) loaded for window class.

The icon on a desktop or folder view is #1
The icon on a window or taskbar is #2

Although both can use same resource.

So what you wanna do?
Play with resource section in PE file?
Post 03 Sep 2011, 02:55
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000
typedef 03 Sep 2011, 03:15
asmhack wrote:
Overflowz wrote:
Ohh, Explorer.

Yeah, Surprise!

I assume:

CreateIconFromResourceEx
DrawIcon

Dunno, ask bill, that's too insane stuff for me anyway


I think explorer does it this way.


Check the registry for associated file type icon(if not exe). If not found, it loads the unknown file type icon.


Or if an exe

Code:
;http://msdn.microsoft.com/en-us/library/bb759792%28v=vs.85%29.aspx


DWORD_PTR SHGetFileInfo(
  __in     LPCTSTR pszPath,
  DWORD dwFileAttributes,
  __inout  SHFILEINFO *psfi,
  UINT cbFileInfo,
  UINT uFlags
);
    


Then Shell32.dll

LoadLibrary
FindResource
LoadResource
LockResource

puts the icon in Global memory and passes the handle to explorer, then explorer adds it to its List View image list and then draws it in the List View.
Post 03 Sep 2011, 03:15
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz 03 Sep 2011, 13:06
bitshifter
I'm trying to debug explorer.exe, just want to know how it does that job.
typedef
none of these APIs are working for that. I did breakpoints on that calls but after refreshing desktop, breakpoints are not passed, just execution goes normally.. on which API I should set breakpoint ? Thanks.
Post 03 Sep 2011, 13:06
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000
typedef 03 Sep 2011, 14:43
@Overflowz
if you hook the current explorer, you'll freeze, make sure you do 'open file' in OllyDbg to create a new instance.
Post 03 Sep 2011, 14:43
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20421
Location: In your JS exploiting you and your system
revolution 03 Sep 2011, 15:50
"CTRL-SHIFT-ESC / file:new" is always available for restarting explorer. I periodically restart explorer to free up the memory leaks.
Post 03 Sep 2011, 15:50
View user's profile Send private message Visit poster's website Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000
typedef 03 Sep 2011, 16:59
^^^Last time I did that I didn't know I got hit by a virus and my Task Manager was disabled. lol Very Happy
Post 03 Sep 2011, 16:59
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.