Resources are the data a program carries with it: icons, cursors, bitmaps, menus,
dialog templates, string tables, the version information that Explorer shows, and the
manifest. They live in the .rsrc section as a tree, which data directory 2
points at. By convention the tree has three levels: the resource type, then the name or
number of the resource, then its language. Offsets inside the tree are counted from the
start of the resource directory, except the data entries’ OffsetToData, which is an
RVA.
Resource directory tables
Each level is a table: IMAGE_RESOURCE_DIRECTORY, 16 bytes, followed by its entries.
| Offset | Size | Type | Field | Meaning |
|---|---|---|---|---|
| 0 | 4 | u32 | Characteristics | Reserved, 0. |
| 4 | 4 | u32 | TimeDateStamp | When the resource compiler made the data; often 0. |
| 8 | 2 | u16 | MajorVersion | A version, often 4.0 or 0.0. |
| 10 | 2 | u16 | MinorVersion | |
| 12 | 2 | u16 | NumberOfNamedEntries | The number of entries with names, which come first. |
| 14 | 2 | u16 | NumberOfIdEntries | The number of entries with numbers, which follow. |
| 16 | 8 each | – | Entries | The entries: named ones sorted by name, then numbered ones in ascending order. |
Entries
IMAGE_RESOURCE_DIRECTORY_ENTRY, 8 bytes:
| Offset | Size | Type | Field | Meaning |
|---|---|---|---|---|
| 0 | 4 | u32 | Name | Top bit set: the low 31 bits are the offset of a name string. Clear: the low 16 bits are a number, the type ID, resource ID or language ID. |
| 4 | 4 | u32 | OffsetToData | Top bit set: the low 31 bits are the offset of the next level’s table. Clear: the offset of a data entry, a leaf. |
At the first level the number is a resource type; at the
second, the resource’s ID; at the third, a language ID such as 1033
(0x409, English, United States) or 0 for neutral.
Name strings
IMAGE_RESOURCE_DIR_STRING_U: a 2-byte length, in characters, then that many UTF-16LE
characters, with no terminator. Named types such as TYPELIB or
REGISTRY, and named resources such as MAINICON, use these.
Data entries
IMAGE_RESOURCE_DATA_ENTRY, 16 bytes, the leaf of the tree:
| Offset | Size | Type | Field | Meaning |
|---|---|---|---|---|
| 0 | 4 | u32 | OffsetToData | The RVA of the resource’s data. Not an offset from the resource directory. |
| 4 | 4 | u32 | Size | Its size in bytes. |
| 8 | 4 | u32 | CodePage | The code page of any text in it, often 0 or 1252. |
| 12 | 4 | u32 | Reserved | 0. |
Microsoft’s tools lay the section out in this order: all the directory tables, then the name strings, then the data entries, then the data of each resource. The data need not be aligned in any fixed way; the explorer allows up to 15 bytes of padding between one resource and the next.
0000DA00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 01 00
0000DA10 18 00 00 00 18 00 00 80 00 00 00 00 00 00 00 00
0000DA20 04 00 00 00 00 00 01 00 02 00 00 00 30 00 00 80
0000DA30 00 00 00 00 00 00 00 00 04 00 00 00 00 00 01 00
0000DA40 09 04 00 00 48 00 00 00 58 10 01 00 5A 01 00 00
0000DA50 E4 04 00 00 00 00 00 00 3C 61 73 73 65 6D 62 6C0x11000 (file 0xDA00). The root table (version 4.0, one numbered entry): type 24, a manifest, whose table is at 0x18. That table: ID 2, table at 0x30. That one: language 1033, data entry at 0x48. The data entry: 346 bytes at RVA 0x11058, code page 1252. The manifest itself, <assembly …, follows at once.A manifest with ID 2 is the one Windows reads for a DLL; a program’s is ID 1.
Resource types
| ID | Name | Holds |
|---|---|---|
| 1 | RT_CURSOR | One image of a cursor. |
| 2 | RT_BITMAP | A bitmap: a BMP without its file header. |
| 3 | RT_ICON | One image of an icon. |
| 4 | RT_MENU | A menu template. |
| 5 | RT_DIALOG | A dialog box template. |
| 6 | RT_STRING | A block of 16 strings of the string table. |
| 7 | RT_FONTDIR | A font directory. |
| 8 | RT_FONT | A font. |
| 9 | RT_ACCELERATOR | A table of keyboard shortcuts. |
| 10 | RT_RCDATA | Raw data, in any form the program likes. |
| 11 | RT_MESSAGETABLE | A message table, for the event log and FormatMessage. |
| 12 | RT_GROUP_CURSOR | A cursor: the list of its images. |
| 14 | RT_GROUP_ICON | An icon: the list of its images, laid out like an .ico directory. |
| 16 | RT_VERSION | The version information: file version, product name, copyright. |
| 17 | RT_DLGINCLUDE | The name of a header file for a dialog. |
| 19 | RT_PLUGPLAY | Plug and Play information. |
| 20 | RT_VXD | VxD information. |
| 21 | RT_ANICURSOR | An animated cursor. |
| 22 | RT_ANIICON | An animated icon. |
| 23 | RT_HTML | An HTML document. |
| 24 | RT_MANIFEST | The side-by-side assembly manifest, in XML. |
The files examined for this site also had types 240 and 241, which MFC’s headers name
RT_DLGINIT and RT_TOOLBAR (an attribution not checked further), and named types such
as TYPELIB, REGISTRY, AVI, RTF,
GIF, JPG, BINDATA and
WINE_REGISTRY. The commonest types were version information, icons and
icon groups, dialogs, string tables and manifests.
The explorer lists every resource with its type, name, language and size, and selects its bytes in the tree. The table is laid out so that viewers for each type can be added to it; none is written yet.