Resources

Resources

Two distinct kinds of resources can be embedded in a managed PE file: unmanaged platform-specific resources and managed common language runtime specific resources. These two kinds of resources, which have nothing in common, reside in different sections of a managed image file and are accessed by different sets of APIs.

Unmanaged Resources

Unmanaged resources reside in the .rsrc section of the image file. The starting RVA and size of embedded unmanaged resources are represented in the Resource data directory of the PE header.

Unmanaged resources are indexed by type, name, and language and are binary-sorted by these three characteristics in that order. A set of Resource directory tables represents this indexing as follows: each directory table is followed by an array of directory entries, which contain the ID or name of the respective level (the type, name, or language level) and the address of the next-level directory table or of a data description (a leaf node of the tree). Because three indexing characteristics are used, any data description can be reached by analyzing at most three directory tables.

By the time the data description is reached, its type, name, and language are known from the path the search algorithm traversed to arrive at the data description.

The .rsrc section has the following structure:

• Resource directory tables and entries

• Resource directory strings  Unicode strings representing the string data addressed by the directory entries. These strings are 2-byte-aligned. Each string is preceded by a 2-byte unsigned integer representing the string’s length.

• Resource data description  A set of records addressed by directory entries, containing the size and location of actual resource data.

• Resource data  Raw undelimited resource data, consisting of individual resource data whose address and size are defined by data description records.

A Resource directory table structure is defined in Winnt.h as follows:

typedef struct _IMAGE_RESOURCE_DIRECTORY {     DWORD   Characteristics;     DWORD   TimeDateStamp;     WORD    MajorVersion;     WORD    MinorVersion;     WORD    NumberOfNamedEntries;     WORD    NumberOfIdEntries; } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;

The roles of these fields should be evident, in light of the preceding discussion about structuring unmanaged resources and the Resource directory tables. One exception might be the Characteristics field, which is reserved and should be set to 0.

Name entries, which use strings to identify type, name, or language, immediately follow the Resource directory table. After them, ID entries are stored.

A Resource directory entry (either a name entry or an ID entry) is an 8-byte structure consisting of two 4-byte unsigned integers, defined in Winnt.h as follows:

typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {     union {         struct {             DWORD NameOffset:31;             DWORD NameIsString:1;         };         DWORD   Name;         WORD    Id;     };     union {         DWORD   OffsetToData;         struct {             DWORD   OffsetToDirectory:31;             DWORD   DataIsDirectory:1;         };     }; } IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;

If the senior bit of the first 4-byte component is set, the entry is a name entry and the remaining 31 bits represent the name string offset; otherwise, the entry is an ID entry and the remaining bits hold the ID value.

If the senior bit of the second component is set, the item, whose offset is represented by the remaining 31 bits, is a next-level Resource directory table; otherwise, it is a Resource data description.

A Resource data description is a 16-byte structure defined in Winnt.h as follows:

typedef struct _IMAGE_RESOURCE_DATA_ENTRY {     DWORD   OffsetToData;     DWORD   Size;     DWORD   CodePage;     DWORD   Reserved; } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;

The fields OffsetToData and Size characterize the respective chunks of resource data that constitute an individual resource. CodePage is the ID of the code page used to decode the code point values in the resource data. Usually this is the Unicode code page. Finally—no surprise here—the Reserved field is reserved and must be set to 0.

The ILAsm compiler creates the .rsrc section and embeds the unmanaged resources from the respective .RES file if this file is specified in command-line options. The compiler can embed only one unmanaged resource file per module.

When the IL Disassembler analyzes a managed PE file and finds the .rsrc section, it reads the data and its structure from the section and emits a .RES file containing all the unmanaged resources embedded in the PE file.

Managed Resources

The Resources field of the common language runtime header contains the RVA and size of the managed resources embedded in the PE file. It has nothing to do with the Resource directory of the PE header, which specifies the RVA and size of unmanaged platform-specific resources.

In PE files created by the ILAsm compiler, unmanaged resources reside in the .rsrc section of the image file, whereas managed resources are located in the .text section, along with the metadata, the IL code, and so on. Managed resources are stored in the .text section contiguously. Metadata carries ManifestResource records, one for each managed resource, containing the name of the managed resource and the offset of the beginning of the resource from the starting RVA specified in the Resources field. At this offset, a 4-byte unsigned integer indicates the length in bytes of the resource. The resource itself immediately follows.

When the IL Disassembler processes a managed image file and finds embedded managed resources, it writes each resource to a separate file, named according to the resource name.

When the ILAsm compiler creates a PE file, it reads all managed resources defined in the source code as embedded from the file according to the resource names and writes them to the .text section, each preceded by its specified length.