Resource Hacker FX: Unicode support

The new version of Resource Hacker FX partially supports Unicode.

What’s supported:

  • Decompilation and compilation of: string table, message table, accelerators, menu, version info.
  • Menu and dialog preview.

What’s not supported:
Everything else, including:

  • Dialog’s control editor.
  • Search.
  • Export to .rc file.
  • Unicode file names.

Technical details: how did I do that?

So, how did I make Resource Hacker handle Unicode without having it’s source code?

Originally, Resource Hacker’s decompilation process looks more-or-less like this:
File (Unicode)
–[TO_ANSI]–>
Memory (ANSI)
–[DECOMPILE_ANSI]–>
Decompiled text (ANSI)

A native Unicode resource editor would look like this:
File (Unicode)
–>
Memory (Unicode)
–[DECOMPILE_UNICODE]–>
Decompiled text (Unicode)

But making Resource Hacker work this way would require rewriting it’s decompilation functions, as they expect ANSI text, and we want to decompile Unicode.

So, to achieve our goal of easily making Resource Hacker handle Unicode, we need the following:

  • The Unicode information must be preserved in memory.
  • The decompilation functions should work without a major change.

I was thinking about whether this is even possible, and then it hit me: UTF-8!

UTF-8 is (Wikipedia):

a variable-width encoding that can represent every character in the Unicode character set. It was designed for backward compatibility with ASCII and to avoid the complications of endianness and byte order marks in UTF-16 and UTF-32.

Exactly what we need, eh?
Now we can make the decompilation process look like this:
File (Unicode)
–[TO_UTF8]–>
Memory (UTF-8)
–[DECOMPILE_UTF8]–>
Decompiled text (UTF-8)

Making it is relatively easy, and because UTF-8 is backward compatible with ASCII, the original decompiling functions work almost without changes.

The latest question left is: how do we show the decompiled text in Resource Hacker, while it uses non-Unicode controls?
Luckily for us, Resource Hacker uses the rich edit control, which supports multiple encodings even as a non-Unicode control. (this support is not 100%, e.g. you cannot paste Unicode text copied from an external program)

Get the new Resource Hacker FXer here.

Posted in Software, Updates by RaMMicHaeL at February 1st, 2012.
Tags:

53 Responses to “Resource Hacker FX: Unicode support”

  1. VEG says:

    Are you tried to contact author of Resource Hacker for getting the source code?

    • RaMMicHaeL says:

      No, but I’ve read the help file, including the “Show me the source!” section :)
      Also, I’m not really interested in the source, I do not know Delphi.

      I would contact him to ask about publishing the FX version on the official page, but I didn’t find any contact info.

  2. Zero Dubby says:

    Wow… such a huge list… I’m a little bit lost now…

    It’s very Great improvement Dude… :)
    You really did it…
    congratulation… :D

    maybe the ‘paste’ problem is the EM_CANPASTE message…?
    not check them yet… as I’m unable to boot into my another machine which I’m using for modding purposes… :(

    eh by the way if you have IDA signatures you can apply them into Olly…. with ida_sigs plugins, it will make the codes more clearer…

    • RaMMicHaeL says:

      maybe the ‘paste’ problem is the EM_CANPASTE message…?

      The main “problem” is that the control is not a Unicode control, and thus has an ANSI Window Procedure. Every message that goes through marshalling gets its strings converted to ANSI, even if you use e.g. SendMessageW.

      if you have IDA signatures you can apply them into Olly….

      I’d recommend IDR and mapimp :)

      • Zero Dubby says:

        I think this may help you….
        http://sourceforge.net/projects/utf8vcl/

        but it does not have a compiled executable….
        so I compiled it (using delphi7) here http://www.mediafire.com/?15uer0i2a1fgjax

        take a look at SetWindowlongA…. also CallWindowProcA….
        hope this help….. :)

        • RaMMicHaeL says:

          So I’m not the first one to come up with the UTF-8 idea :)

          The example doesn’t work too good for me (edit1 shows garbage when I try to edit it, the FatalAppExit button shows a message with question marks).

          Also, I can’t see how this can help me without actually having reshacker’s source code.

          • Zero Dubby says:

            Yup…. I knew that… maybe it’s editing feature is unimplemented…. also there is an unsupported feature if the example is compiled using delphi7…..
            I don’t know delphi much…

            uhm… I mean the implementation of Wide Character (the ‘W’ function) could be useful…
            Delphi always subclass all it’s child procedure in their own procedure (in ANSI)… so that’s why the ‘W’ function e.g. SendMessageW always return in ANSI….

            a few days ago I was able to force the dialog control editor to show in Unicode by using wide version of SetWindowLong in delphi Form child procedure and CallWindowProcW… but as any other text still in ANSI they incorrectly showed…

            • RaMMicHaeL says:

              a few days ago I was able to force the dialog control editor to show in Unicode by using wide version of SetWindowLong in delphi Form child procedure and CallWindowProcW… but as any other text still in ANSI they incorrectly showed…

              Other than SetWindowLong and CallWindowProc, there’s (I believe) plenty of code to change. I didn’t look at it thoroughly, but it has about five custom wndproc callbacks, everyone of which potentially excepts ANSI text.

              The dialog editor, on the other side, is more low level: it has a small custom wndproc, which doesn’t handle messages with text.
              A->W of CreateDialogIndirectParam, SetWindowLong and CallWindowProc was enough here.

  3. Zero Dubby says:

    Hello it’s me again….

    finally I managed to build a small dev system…
    anyway…
    The paste problem is caused by Rich edit control…. the resource hacker uses (partially) the FIRST version of Rich edit… so just update it… it will be able to paste unicode text from external application….

    just replace string “Riched32.dll” with “Riched20.dll” and update string “RICHEDIT” with “RichEdit20A” also replace the CR,LF with CR only….

    Hope this help…. but I still doesn’t know what’s the side effects…

    • RaMMicHaeL says:

      That fixes the pasting issues, but one thing I’ve noticed is that it’s slower on loading long texts, e.g. try reshacker’s TDlgEdForm.

      Update: This happens only when using Unicode with the richedit, and happens also to the first version.

      • Zero Dubby says:

        I’m wondering if the EditStreamCallback function (what should it be called actually…?) was optimized with ANSI only text…??

        • RaMMicHaeL says:

          I didn’t understand the question…
          Instead of forwarding chunks of ANSI text, I changed it to convert UTF-8 chunks to Unicode and forward them.

          • Zero Dubby says:

            I mean The EditStreamCallback, the function which “read” the text from stream into a buffer to be flushed into rich edit window…. the 3rd parameter inside lParam in em_streamin messages….

            • RaMMicHaeL says:

              OK, I understood what function you’re talking about, but didn’t understand the “optimized with ANSI only text”.

              Again:
              Instead of forwarding chunks of ANSI text, i.e.:
              dwCookie: a memory stream (ANSI) –> pbBuff (ANSI)
              I changed the function to convert UTF-8 chunks to Unicode and forward them:
              dwCookie: a memory stream (UTF-8) –> pbBuff (Unicode)

              • Zero Dubby says:

                well nevermind ’bout that a bit silly question….

                anyway I don’t know it’s useful or not…. I have compiled the previous UTF8 examples into DLL (stripped out not important part) it will replace the import table in reshaker when loaded…. but the MAIN problem is the Treeview is stop working…. :(

                http://www.mediafire.com/?5o7r12uqu4x7s3d

    • RaMMicHaeL says:

      just replace string “Riched32.dll” with “Riched20.dll” and update string “RICHEDIT” with “RichEdit20A” also replace the CR,LF with CR only….

      Done in v1.4.1

      Also, I got your mail with fully Unicode reshacker, but haven’t had a chance to look at it thoroughly yet.

  4. Alex says:

    Hi,
    I’ve a couple of questions
    I’m trying to browse one .exe that has Chinese, Japan, etc strings
    so, what font shall be used in order to display it correctly? (Win XP SP3)
    I’ve tried Arial Unicode MS but still no correct display of it.
    Also this error is show on every click in strings:

    —————————
    Resource Hacker
    —————————
    RichEdit line insertion error.
    —————————
    OK
    —————————

    • RaMMicHaeL says:

      Can you please upload the exe file?

      • Zero Dubby says:

        Can you please upload the exe file?

        Firstly… I’m deeply sorry Alex….
        I just want to help…

        you can load windows XP common control library (inside winsxs folder) and browse the string table and the error will encountered when reshack try load Chinese, Japananese, mostly Asian character….

        also this may helps for speeding up…
        http://bellsouthpwp2.net/r/e/rediv/FAQS/Faqs.html#Bmk039

        also for breaking text limit….
        http://bellsouthpwp2.net/r/e/rediv/FAQS/Faqs.html#Bmk015

        • RaMMicHaeL says:

          you can load windows XP common control library (inside winsxs folder) and browse the string table and the error will encountered when reshack try load Chinese, Japananese, mostly Asian character….

          I don’t have these (or maybe I don’t look in the right place), but I think it should work with v1.4.1. Can you check it?

          • Zero Dubby says:

            I don’t have these (or maybe I don’t look in the right place), but I think it should work with v1.4.1. Can you check it?

            the folder is inside windows folder… I think only XP have multilingual language in one dll….
            the other windows after XP have been separated….

            Yup working properly right now…. but in dialog editor… there is no more red star mark… while the cursor is inside rich edit text… or while individual control is being selected in dialog editor… because the original uses CR,LF for string compare between dialog and the editor…

            Hint: search for “*” (star mark…) there more than 1 occurance though but not so much….
            I’m so sorry I can’t point you directly.. I’m unable to boot into my virtual machine….

            anyway awesome Work…. :D

  5. Zero Dubby says:

    Finally I got it works….
    http://i.imgur.com/uGKIy.jpg

    I have sent the details into your email…. :D

  6. Alex says:

    RaMMicHaeL
    rerards my message from February 14, 2012 at 12:37 pm
    it all fine!
    my fault, sorry, did some steps wrong.

  7. Alex says:

    one more issue report:

    when opening Delphi2007 app in patched FX:

    —————————
    Resource Hacker FX
    —————————
    Stream read error.
    —————————
    OK
    —————————

    other RCData (dfm forms) just hangs, others do not show the full dfm content!

    example of hang case:

    app starts to eat 100% of CPU time
    here is the stack (as from Process Explorer v15.13)

    ntdll.dll+0x19d27
    kernel32.dll+0x1251c
    ResHacker.exe+0x62a0
    ResHacker.exe+0×10350

  8. Zero Dubby says:

    http://www.installationexcellence.com/articles/VistaWithDelphi/Original/Index.html

    the final compiled executables in that website also causes reshacker to be hang up (endless loop) (DFM resources..)…..

    • RaMMicHaeL says:

      I looked at it, and the problem is that the DFM resource of the application has new element types that reshacker doesn’t recognize.

      The function that decompiles the DMF resource: 004145AC (Probably ObjectBinaryToText).

      If you have the latest version of Delphi, a simple compiled program that uses ObjectBinaryToText and ObjectTextToBinary might help.

      A POC patch that allows to decompile the DFM resource of the application above:
      004145E0: DF 03 -> 7C 02

      P.S. Fixing this will probably also fix the limitation described on reshacker’s homepage:

      Limitation:
      Resource HackerTM was compiled using Delphi 3.02. When decompiling and recompiling Borland’s Delphi forms in applications compiled with later version of Delphi, there may be errors in the recompiled forms if frames have been used to create the form. This error is due to new language syntax not being recognized.

      Status:
      I have no plans to recompile Resource HackerTM using a newer version of Delphi.

      • Zero Dubby says:

        Great….. :D
        but I notice that there is a ‘sign’ that incorrectly interpret-ed…
        this sign ==> ” become this ==> {}
        but it should be easy to fix….
        (try to find “DFM explorer”… it should be appear in the first page….)

        thanks again…..

    • RaMMicHaeL says:

      Fixed in v1.4.3.

      • Alex says:

        Hi, author

        what could be the reason of this error of your tooL?

        —————————
        Resource Hacker FX
        —————————
        RichEdit line insertion error.
        —————————
        OK
        —————————

        this errror was shown when clicking on
        Version Info – 1 [2052] tree view item node

        ohhhhhh

        also same error:

        —————————
        Resource Hacker FX
        —————————
        RichEdit line insertion error.
        —————————
        OK
        —————————

        when clicking on String table 7 [2025] item node

  9. Alex says:

    OK, forget it, all is just perfect in latest 1.4.3 edition!
    Long live rammichael!

  10. Alex says:

    new issue found on latest FX ver 1.4.5

    —————————
    Resource Hacker FX
    —————————
    Access violation at address 00402791 in module ‘ResHacker.exe’. Write of address 01FFB000.
    —————————
    OK
    —————————

    link to file http://rghost.net/40368026

    navigate to bmp with ID 8034 and watch the beautifull crash
    cheers

  11. Alex says:

    Thanks
    fix works just like a charm
    good luck, mate!

  12. Alex says:

    One new issue found

    —————————
    Resource Hacker FX
    —————————
    No MCI device open.
    —————————
    OK
    —————————

    how to:

    goto AVI
    2275
    2325 Stop
    WAVE node -> issue (reproduced not 100% but often)

    http://rghost.net/40429257

    • RaMMicHaeL says:

      Fixed in v4.1.7.

      The issue was that reshacker tried to continue looping after the AVI preview was stopped/closed. The bug can be easily reproduced with the first AVI video: exactly when the green square comes back to the computer on the left (the last frame), navigate out, and you’ll see the error message box. Also, if you click stop on the last frame, the preview doesn’t actually stop.

  13. Alex says:

    Thanks, working like a charm

    one more note (not sure why it is so)
    please look at following picture
    pay attention to painted area
    http://rghost.net/40449137
    the question is: why does Reshacker put 0×01 instead of real sublang define?
    for example for english it prints like
    LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US

    let me know what you think regards this micro issue :)

    cheers!

  14. Alex says:

    One thing that I’ve seen today:
    I’ve dropped by mistake a huge DVD iso (~4GB) only ResHackerFX and…
    it started to eat all my RAM + page file so it was not possible even to drag the mouse…… :(

    Question: is it possible to rewrite the way how ResHackerFX reads the input file? I guess it reads (tries to) the full file (oh mamma mia) and then sees if it is Win32 PE or not

    I’ve two ideas:
    1) limit by size – eg 100 MB exe
    2) read first 4..20K and check by MZ/PE header

    again, just an idea in the air!
    cheers
    Alex

  15. Alex says:

    One more idea:

    You know the left hand Tree view that shows all the objects
    what about showing as hint or maybe to the right the number of records in each section? for example:

    [+]AVI-34
    [+]Icon-123
    [+]Dialog-200
    ….

    Thanks

  16. Redde says:

    Does anyone know in where Aero’s Copying and Moving animations are located?

  17. Alex says:

    sw used: 1.4.7
    some dfm forms are putting strange errors when clicking on it,
    eg: click on TFORMABOUT, TFORMCHCONFTABABS,

    —————————
    Resource Hacker FX
    —————————
    Invalid floating point operation.
    —————————
    OK
    —————————

    Other error on clicking the TFORMCHCONFTABRAG resource:

    —————————
    Resource Hacker FX
    —————————
    Stream read error.
    —————————
    OK
    —————————

    wow, TFORMCONFTAB is hanging the app up! (eating 100% of the poors CPU guy :)

    bits are here: http://rghost.net/41503029
    pass is 123

  18. Alex says:

    thanks a lot

  19. adoxa says:

    Would it be possible to support Unicode HTML (23) resources (I have DLLs with UTF-16 XML files there)? Renaming 23 to HTML and 24 to Manifest would be nice, too.

Leave a Reply