linkres2exe issues

[James C. Fuller]

Charles,
  I am having a major issue using linkres2exe. I get "EndUpdateResource failed..." .O2 is the only compiler now where I use it.
I have not done a whole lot of coding these past weeks and during that time all my Window 10 boxes have been updated to the spring update. I do not have an old one I can test on so .....??
I went back and tried older versions of O2 but that does not appear to be the problem.

James

[James C. Fuller]

I think I fixed it.
I recompiled as a 64bit app using PellesC.
Recompiling as a 32bit app did not fix the issue.
James

[James C. Fuller]

FYI this is where I got the source.
http://lists.gnu.org/archive/html/tinycc-devel/2006-10/msg00018.html
Look for the zip near the bottom of the page.

James

[Mike Lobanovsky]

Looks somewhat outdated: resource ID RT_MANIFEST seems to be missing (24 dec, 0x18 hex). I'd also add a call to the MapFileAndCheckSum() API to keep the executable's PE header checksum in sync with the actual file metrics. This might help prevent some silly AV false positives.

[Charles Pegge]

I would like to have a go at porting Res2Exe. Then it could be used as an independent tool or be integrated into OxIde. It should be useable as a JIT program.

[Charles Pegge]

My proposed code for embedded use.

RES files have a very simple layout:

header : data : dword-aligned-header : data : dword-aligned-header : data : ...

Code Select Expand


uses corewin

'https://msdn.microsoft.com/en-us/library/windows/desktop/ms648027(v=vs.85).aspx

type RESOURCEHEADER
  dword DataSize
  dword HeaderSize
  dword TYPE
  dword NAME
  dword DataVersion
  word  MemoryFlags
  word  LanguageId
  dword Version
  dword Characteristics
end type


declare MapFileAndCheckSum lib "Imagehlp.dll"

function AddResToFile(char *ResFile, char *TgtFile) as int
==========================================================
  RESOURCEHEADER *rh
  string Res
  sys hFile,pRes,pData
  int LenRes,i
  '
  hFile=BeginUpdateResource(TgtFile,1)
  if not hFile then return 1
  Res=GetFile ResFile
  if not Res then return 2
  LenRes=len Res
  pRes=strptr Res
  do
    @rh=pRes+i
    pData=@rh+sizeof rh
    if rh.DataSize
      if not UpdateResource(
        hFile,rh.ResType>>16,rh.ResName>>16, 'hiwords
        rh.LangId,pData,rh.DataSize)
        return 3
      end if
    end if
    int a=(rh.DataSize+3) and 0xFFFFFFFC 'ALIGN UP DWORD
    i+=sizeof(rh)+a
    if i>=LenRes then exit do
  loop
  if not EndUpdateResource(hFile,0) then return 4
  '
  'https://msdn.microsoft.com/en-us/library/windows/desktop/ms680355(v=vs.85).aspx
  dword er,HeaderSum, CheckSum
  er=MapFileAndCheckSum(TgtFile, @HeaderSum, @CheckSum)
  if er then return 5
end function


[Mike Lobanovsky]

No no, Charles.

It is not the .RES file but the resultant new .EXE or .DLL file that needs its PE header checksum to be updated after its contents have been changed by a resource update.

Dixit MSDN:

It is recommended that all images have valid checksums. It is the caller's responsibility to place the newly computed checksum into the mapped image and update the on-disk image of the file. (ML: bolding is mine)

For kernel-mode drivers and system libraries, it is not just a recommendation but a requirement. Yet many AV's regard incorrect or missing header checksums (as well as file creation/modification time stamps) in ordinary executable files as a possible indication of low-quality malware residing in such misshaped file disk images.

The checksum value computed via the MapFileAndCheckSum call should be re-written, upon file modification/update, into the CheckSum field of "optional header" section in the modified file disk image's PE header. Note that contrary to its name, the so-called optional header is mandatory in the on-disk image of an executable file.

[Charles Pegge]

Thanks, Mike.

It should have been TgtFile instead of ResFile

I have corrected the offending line.

er=MapFileAndCheckSum(TgtFile, @HeaderSum, @CheckSum)


Does TouchFileTimes change the PE timestamp itself, or just the file attributes. MSDN is not clear.

[James C. Fuller]

Charles,
  Do I detect a #RESOURCE statement in the near future?

James