Windows PE - Where and how are strings stored if not in resources?

Posted by sdadsas on Stack Overflow See other posts from Stack Overflow or by sdadsas
Published on 2010-03-16T15:00:27Z Indexed on 2010/03/23 2:31 UTC
Read the original article Hit count: 372

Filed under:

Windows

|

pe

|

disassembling

Usually strings (like content/titles of dialog boxes) in .exe files are stored in some sort of resources.

But in some recent exes I disassembled/resource-inspected I couldn't find any resources containing the string but it was somehow hardcoded with db's into the program source code.

How can I extract and modify strings directly located in the program? I assume those are just the equivalent to const char*s in C++?
Why would someone not "outsource" the contents of dialog boxes, menus, etc?

© Stack Overflow or respective owner

Related posts about Windows

Server 2012 DFS New Member Issue

as seen on Server Fault - Search for 'Server Fault'
I am trying to add a new member to our DFS topology. We have 3 DCs (VMs - VMware) running Windows server 2012, two servers are located in or Primary site and the third at our DR site. Currently the two servers at our primary site are currently replicating DFS (full mesh) and are working fine. I have… >>> More
error in IIS7 but not on IIS6

as seen on Server Fault - Search for 'Server Fault'
I have a website that is we are now deploying to windows 2008 servers that has worked in the past on IIS6 without a problem. It is using .net 2 framework. Most of the website works. Just when we create a screen report over a certain size on the server we get this error. Event code: 3005 Event… >>> More
error in IIS7 but not on IIS6

as seen on Server Fault - Search for 'Server Fault'
I have a website that is we are now deploying to windows 2008 servers that has worked in the past on IIS6 without a problem. It is using .net 2 framework. Most of the website works. Just when we create a screen report over a certain size on the server we get this error. Event code: 3005 Event… >>> More
Microsoft Management Console stops working when I add snap-in to it

as seen on Super User - Search for 'Super User'
I have Windows 7 Ultimate OS. I'm opening mmc.exe as administrator and trying add Certificates or any other snap-in, then while loading that snap-in MMC breaks and displays following message and after that it closes automatically once I click on close button on that message. What could be the problem… >>> More
Handling keyboard and mouse input (Win API)

as seen on Game Development - Search for 'Game Development'
There is a number of ways to catch mouse or keyboard under Windows. So I tried some of them, but every of them has some advantages and drawbacks. I want to ask you: Which method do use? I've tried these: WM_KEYDOWN/WM_KEYUP - Main disadvantage is that, I can't distinguish between left and right-handed… >>> More

Related posts about pe

How can I read kindle book under xfce(ubuntu)? (using chromebook)(wine not working)

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I'm using chromebook, dual booting xfce(ubuntu) and cr os. The ebook I bought on amazon is not supported on kindle cloud reader. (Under xfce)I downloaded wine and tried installing kindle for pc under wine, and after couples of times of trials, it always said installation error and could not install… >>> More
Error Installing MS office in ubuntu 13.04

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
While I am installing ms office 10 or 13 using wine it says the following: Unhandled exception: 0xc06d007e in 32-bit code (0x7b83ae0b). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:7b83ae0b ESP:0a6cd3f8 EBP:0a6cd45c EFLAGS:00000287( - -- I S - -P-C) EAX:7b826449 EBX:7b8b0000… >>> More
Why is my PE file invalid?

as seen on Stack Overflow - Search for 'Stack Overflow'
I already asked a similar question, "PE Header requirements", but I'm not really satisfied with it's answer. I am building an assembler/linker, in Java SE 1.6. I have read about 5 different documentations/specifications about the PE/COFF header and file format, but I'm stuck at a problem: My generated… >>> More
PE Header Requirements

as seen on Stack Overflow - Search for 'Stack Overflow'
What are the requirements of a PE file (PE/COFF)? What fields should be set, which value, at a bare minimum for enabling it to "run" on Windows (i.e. executing "ret" instruction and then close, without error). The library I am building first is the linker: Now, the problem I have is the PE file (PE/COFF)… >>> More
Modifying .rdata unicode strings from windows PE files

as seen on Stack Overflow - Search for 'Stack Overflow'
I have been looking for a way of modifying static strings stored in Windows .exe files in the .rdata section, however I haven't found a real way to do so yet. The whole thing is too complicated to do by hand (in this case by a HEX editor) and so I wanted to know if you have a solution to do so. >>> More