Load Resources

Create and embed a resource

Embedding a resource in an executable is straightforward. The following components are needed:

1. A .exe to “take” the embedded file
2. A file to embed in the .exe
3. A .rc file to “describe” the resource. An example will be presented shortly; for more details on .rc files, see 1

For this demo, a file called calc.ico is used, which is the output of:

1
msfvenom --payload windows/exec CMD=calc.exe -f raw -o calc.ico`

The .rc file is a simple description of the resource file, where the version, the name of the product, and the language are defined:

1
#include <windows.h>
2

3
CALCICO RCDATA "calc.ico"
4

5
VS_VERSION_INFO VERSIONINFO
6
FILEVERSION 1,0,0,0
7
PRODUCTVERSION 1,0,0,0
8
BEGIN
9
    BLOCK "StringFileInfo"
10
    BEGIN
11
        BLOCK "040904B0"
12
        BEGIN
13
            VALUE "FileDescription", "Moise"
14
            VALUE "ProductName", "ProductMoise"
15
        END
16
    END
17
    BLOCK "VarFileInfo"
18
    BEGIN
19
        VALUE "Translation", 0x0409, 1200
20
    END
21
END

These two files and the first payload are then bundled together during compilation. The result is a single .exe, which contains the resource and the logic to extract it.

Before examining the code of the resource extraction logic, it is useful to open the resulting .exe file in pestudio and observe the resource in the “resources” section. From there, the resource can be saved locally by right-clicking on it → instance → dump to file.