Click here to Skip to main content
Click here to Skip to main content

ExeScanner

, 6 Jun 2005
Rate this:
Please Sign up or sign in to vote.
This article explains how to enumerate all the objects in a Portable Executable and manipulate them.

ExeScanner

Introduction

Inspired by the ResourceHacker from Angus Johnson, I decided to make one of my own. ExeScanner, as the name suggests, can scan an executable file and enumerate all the objects in its resource section. The next version will have two main features:

  1. Resource scripting engine which can compile/decompile resources.
  2. Enumerate other sections of an executable file besides the resource section.

What does ExeScanner do?

ExeScanner allows you to view bitmaps, cursors, icons, strings, dialogs, menus and binary resources in any executable file. Any other resources except the first 6 are shown as the binary resources. Each resource type can be imported or exported. Import facility allows modifying the resources within the executable file with an external file, while export facility allows to extract and save the resources as a file. Dialogs and menus are exceptions to the import/export facility (as they require the resource scripting engine which will be a part of ExeScanner 1.1).

ExeScanner Design Overview (Class Hierarchy)

ExeScanner has been designed keeping in mind the future extensions and generalization of the project. With class hierarchy I have tried to incorporate a symmetric behavior in each object although they might be very different.

There are two base classes PEBase and PEResource. Any object in a PE file should always inherit from PEBase. If it's a resource object, it should inherit from PEResource. In fact, PEResource also inherits from PEBase. These base classes have some methods and members which make its representation and manipulation standardized and reduces code by implementing polymorphic behavior.

Let's have a look at a few classes and what they do:

  • PortableExecutable - Encapsulates DOS and Windows header. Also holds ResourceSection.
  • ResourceSection - Encapsulates ResourceSectionHeader and holds ResourceBranch.
  • ResourceBranch - Each branch represents a broad category of resources like BITMAP, ICON, STRING, BINARY etc. Also holds ResourceNode.
  • ResourceNode - ResourceNode can hold exactly one resource of any category, i.e., there can be multiple bitmaps in BITMAP category and thus multiple ResourceNode in ResourceBranch with each ResourceNode holding PEResBitmap.
  • PEResBitmap - Bitmap object.
  • PEResIcon - Icon object.
  • PEResCursor - Cursor object.
  • PEResString - String object.
  • PEResMenu - Menu object.
  • PEResBinary - Binary object.
  • PEResDialog - Dialog object.

Above mentioned seven classes encapsulate the logic to display themselves, import, export, and then when requested, give property info.

  • PEFile - Encapsulates the I/O to the executable file being scanned. Provides the facility to directly read/write by specifying the offset from the beginning.
  • PEListTree - It's a doubly linked list that stores each PE object, primarily used for creating navigation tree.

Hope you enjoy using the application. And would welcome your comments/suggestions on how to make it better.

History

  • ExeScanner 1.0 - Initial release.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

Share

About the Author

Vishalsinh Jhala
Web Developer
United States United States
No Biography provided

Comments and Discussions

 
Questiondis is excellent but dere's smthing i want 2 know PinmemberMember 448281617-Dec-08 4:16 
GeneralExcellent job !!! PinmemberCastorTiu18-Oct-06 9:46 
GeneralA bug PinmemberH.B.Shen11-Apr-06 4:00 
QuestionPE Graphical Area Access? PinmemberIslamianFalcon24-Nov-05 21:06 
GeneralExcellent work Pinmemberi8413-Sep-05 0:55 
GeneralNice Work PinmemberBitsAndBytes21-Jun-05 23:21 
GeneralNice PinmemberThatsAlok21-Jun-05 19:45 
Generalmfc70.dll PinmemberLee Middleotn10-Jun-05 16:48 
GeneralRe: mfc70.dll PinmemberArie Levy21-Oct-09 1:20 
GeneralGreat! PinsussCharlieLei9-Jun-05 16:16 
GeneralPhoto scan PinmemberArmen Hakobyan9-Jun-05 2:21 
Questionwhich ceil()? PinmemberUnruled Boy8-Jun-05 17:01 
AnswerRe: which ceil()? PinmemberChristian Graus8-Jun-05 17:27 
AnswerRe: which ceil()? Pinmemberrkh07916-Jun-05 9:54 
Generalnice work. Pinmemberbevpet7-Jun-05 11:19 
Questionwhy not just use visual studio? Pinmemberyafan7-Jun-05 4:25 
AnswerRe: why not just use visual studio? PinmemberTom Archer7-Jun-05 17:59 
AnswerRe: why not just use visual studio? PinmemberVishalsinh Jhala7-Jun-05 19:29 
GeneralRe: why not just use visual studio? Pinmemberahz8-Jun-05 8:23 
GeneralRe: why not just use visual studio? PinmemberJohn M. Drescher9-Jun-05 4:34 
GeneralRe: why not just use visual studio? Pinmemberahz10-Jun-05 7:48 
GeneralRe: why not just use visual studio? PinmemberVishalsinh Jhala13-Jun-05 2:50 
GeneralRe: why not just use visual studio? Pinmemberahz16-Jun-05 9:35 
AnswerRe: why not just use visual studio? PinmemberSuper Lloyd14-Jun-05 13:58 
GeneralRe: why not just use visual studio? PinmemberSuper Lloyd14-Jun-05 14:00 
Questionc# ? PinmemberTrance Junkie7-Jun-05 1:56 
Generalmust 5! Pinmemberf27-Jun-05 1:28 
GeneralRe: must 5! PinmemberGeert van Horrik7-Jun-05 2:01 
GeneralRe: must 5! Pinmemberf27-Jun-05 4:48 
GeneralRe: must 5! PinmemberGeert van Horrik7-Jun-05 5:32 
GeneralRe: must 5! PinmemberVishalsinh Jhala7-Jun-05 18:59 
GeneralRe: must 5! Pinmemberkevinf110816-Jun-05 3:49 
GeneralRe: must 5! PinmemberFranz R.14-Jun-05 1:10 
GeneralFor the other sections... PinmemberMerrion7-Jun-05 1:27 
GeneralExcellent :-) PinstaffNishant Sivakumar7-Jun-05 0:01 
GeneralGreat work... PinmemberGeert van Horrik6-Jun-05 23:43 
GeneralRe: Great work... PinmemberVishalsinh Jhala6-Jun-05 23:52 
GeneralRe: Great work... PinmemberVishalsinh Jhala7-Jun-05 0:05 
GeneralRe: Great work... PinmemberGeert van Horrik7-Jun-05 0:59 
GeneralRe: Great work... PinmemberVishalsinh Jhala7-Jun-05 2:13 
GeneralRe: Great work... PinmemberGeert van Horrik7-Jun-05 2:39 
GeneralRe: Great work... PinmemberVishalsinh Jhala7-Jun-05 18:54 
GeneralRe: Great work... PinsussP Reid15-Jun-05 6:28 
GeneralRe: Great work... PinmemberGeert van Horrik15-Jun-05 6:44 
GeneralExcellent work Pinmemberiberg6-Jun-05 23:16 
GeneralRe: Excellent work PinmembermlkeS14-Jun-05 15:12 
Generalvc6 version.. PinmemberFireEmissary6-Jun-05 23:16 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web04 | 2.8.1411022.1 | Last Updated 7 Jun 2005
Article Copyright 2005 by Vishalsinh Jhala
Everything else Copyright © CodeProject, 1999-2014
Layout: fixed | fluid