Load Resources

Loading the resource

The resource management process is more involved than simply accessing the resource. The following steps are required:

• find the address of the resource and load it (FindResourceW 2 and LoadResource 3)
• get a pointer to the resource with LockResource 4
• get the size of the resource so that it can be allocated in memory or written to a file with SizeofResource 5

1
#include <windows.h>
2

3
#include <stdio.h>
4

5
#define RET_SUCCESS 0
6
#define RET_ERROR -1
7

8
int main() {
9
    HRSRC hRsrc = NULL;
10
    HGLOBAL hRes = NULL;
11
    HANDLE hFile = NULL;
12
    PVOID pData = NULL;
13
    SIZE_T resSize = 0;
14
    DWORD bytesWritten = 0;
15

16
    hRsrc = FindResourceW(NULL, L"CALCICO", MAKEINTRESOURCEW(10));
17
    if (hRsrc == NULL) {
18
        printf("Cannot locate resource, error: %lu \n", GetLastError());
19
        return RET_ERROR;
20
    }
21

22
    resSize = SizeofResource(NULL, hRsrc);
23
    if (resSize == 0) {
24
        printf("Cannot get the size of resource, error: %lu \n", GetLastError());
25
        return RET_ERROR;
26
    }
27

28
    hRes = LoadResource(NULL, hRsrc);
29
    if (hRes == NULL) {
30
        printf("Cannot load resource, error: %lu \n", GetLastError());
31
        return RET_ERROR;
32
    }
33

34
    pData = LockResource(hRes);
35
    hFile = CreateFileW(
36
        L"example.bin",
37
        GENERIC_WRITE,
38
        0,
39
        NULL,
40
        CREATE_ALWAYS,
41
        FILE_ATTRIBUTE_NORMAL,
42
        NULL
43
    );
44

45
    if (hFile == INVALID_HANDLE_VALUE) {
46
        printf("Cannot create file, error %lu\n", GetLastError());
47
        return RET_ERROR;
48
    }
49

50
    BOOL ok = WriteFile(hFile, pData, resSize, &bytesWritten, NULL);
51
    if (!ok) {
52
        printf("Cannot write file, error %lu\n", GetLastError());
53
        CloseHandle(hFile);
54
        return RET_ERROR;
55
    }
56

57
    CloseHandle(hFile);
58
    return RET_SUCCESS;
59
}

To compile the above code, the commands below are used. In both languages they have the same roles: the first builds a COFF file from the .rc specification 6 and the second bundles together the .exe that will be produced from the compilation and the calc.ico file.

1
i686-w64-mingw32-windres load_resource.rc -O coff -o load_resource.res
2
i686-w64-mingw32-gcc -o load_resource.exe -Os -s -ffunction-sections -fdata-sections -Wl,--gc-sections -fno-ident load_resource.c load_resource.res

Note that since the payload returned by msfvenom is 32-bit, the sample might crash, especially in the second example below, if compiled as a 64-bit application.

The function signatures for each of these calls are all pretty similar and rather straightforward. The first is FindResource:

1
HRSRC FindResourceA(
2
  [in, optional] HMODULE hModule,
3
  [in]           LPCSTR  lpName,
4
  [in]           LPCSTR  lpType
5
);

The purpose of this function is to determine the location of a resource with a specific name (lpName) and module (hModule). In the example, the hModule is always set to NULL since, per the documentation: “If this parameter is NULL, the function searches the module used to create the current process.” The second parameter is the name of the resource, which is populated with the value “CALCICO”. This value is defined in the .rc file:

1
CALCICO RCDATA "calc.ico"

which can be read as: “the resource with name CALCICO contains raw data (RCDATA) from the calc.ico file”. The name “CALCICO” is completely arbitrary. RCDATA is also the value of the lpType, which indicates the type of data contained in the resource. The list of possible values is defined in appendix 7, and in this case, since it is raw data, MAKEINTRESOURCE(10) is used.

Note that MAKEINTRESOURCE is a macro defined in the C winuser.h library, which converts an integer, like 10, to a resource type, and 10 means RT_RCDATA. In the Go code, this macro is not defined, so the RT_RCDATA value is used directly 8.

What is returned by FindResourceA is an HRSRC, which is a handle to a resource.

Next, SizeofResource is used:

1
DWORD SizeofResource(
2
  [in, optional] HMODULE hModule,
3
  [in]           HRSRC   hResInfo
4
);

Very simply, the hModule is still NULL for the same reason as above, and the hResInfo handle is the value returned by FindResourceA. The function returns a number.

LoadResource has the same signature as SizeofResource, and it is used to get a second handle, this time to the data themselves. Lastly, to obtain a pointer to the first byte of the resource data, LockResource is used; it takes a single argument, which is the value returned by LoadResource.

1
LPVOID LockResource(
2
  [in] HGLOBAL hResData
3
);

Note that LockResource does not actually lock the resource, but only returns the address of the first byte of data.

This address is then used in WriteFile. Since the function requires both an address to the data to write and the size of the data to write, all the needed information is already available to call the function and write the content to a file.

After execution, a new file called example.bin is created in the same directory as the .exe file.