Windows PE - 如果字符串不在资源中，则字符串存储在何处以及如何存储？
通常，.exe 文件中的字符串（如对话框的内容/标题）存储在某种资源中。
但在最近的一些exe中，我反汇编/资源检查后，我找不到任何包含该字符串的资源，但它以某种方式用db硬编码到程序源代码中。
如何提取和修改直接位于程序中的字符串？我假设这些相当于 C++ 中的 const char*？
为什么有人不“外包”对话框、菜单等的内容？
Usually strings (like content/titles of dialog boxes) in .exe files are stored in some sort of resources.
But in some recent exes I disassembled/resource-inspected I couldn't find any resources containing the string but it was somehow hardcoded with db's into the program source code.
How can I extract and modify strings directly located in the program? I assume those are just the equivalent to
const char*s in C++?Why would someone not "outsource" the contents of dialog boxes, menus, etc?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您想访问 PE 文件中的数据，请尝试此实用程序（附带源代码和友好（非 GPL）许可证，以便您可以在自己的应用程序中使用该代码）。
PE 文件格式 DLL
您应该能够轻松找到相应的地址部分，然后逐步浏览数据。还有一个使用 DLL 的 PE 文件资源管理器项目（带有源代码），因此您可以了解如何为您的应用程序调用 DLL。
更新（2023 年 9 月）。上面的链接已损坏，因为该公司（Object Media Ltd）已不复存在。不过，您可以找到该工具的改进版本，如 PE 文件浏览器< /a>.
免责声明。这些是我们几年前公开的内部工具。我是这些工具的作者（包括损坏链接上的工具和更新后的工具）。该来源已不再可用，因为自 2010 年以来它已经发生了很大变化。
If you want to access data in the PE file try this utility (comes with source code and friendly (non-GPL) license so you can use the code in your own app).
PE File Format DLL
You should be able to easily find the address of the appropriate section(s) and then work you way through the data. There is also a PE File Explorer project (with source) that uses the DLL, so you can see how to call the DLL for your app.
Update (Sept 2023). The above link is broken because that company (Object Media Ltd) no longer exists. However you can find an improved version of the tool that it worked with as PE File Browser.
Disclaimer. These were in-house tools, that we made public a few years ago. I am the author of the tools (both the ones that were on the broken link, and the updated tool). The source is no longer available as it has changed quite a bit since 2010.
字符串位于 PE 文件的资源或只读数据部分中。当字符串不是控件的标题/标题时，第二种更常见。拆开后，它们只是一块内存，没有特别标记。像 IDA 这样的智能反汇编程序可以注意到代码中对地址的引用并突出显示字符串定义。
Strings are located in either resources or in read-only data sections of PE file. Second is more common when strings are not captions/titles of controls. When disassembled they are just piece of memory and not specially marked. Smart disassemblers like IDA can notice references to addresses in code and highlight strings definition.
到目前为止，从 PE 中获取字符串的最简单方法是使用
strings实用程序，它是我遇到过的每个 Linux 发行版（甚至 uCLinux）的标准配置。它几乎只是遍历整个二进制文件，寻找一系列以 null 结尾的、可打印的 ASCII 字符……这就是您的规范字符串。strings --help显示可用的参数，例如要查找的最小长度字符串、编码、架构帮助程序以及其他您可能不需要的东西。如果您没有运行 Linux，我建议您启动 Ubuntu Live CD，以获得大量简单而有效的命令行实用程序。
The easiest way to get strings out of a PE, by far, is the
stringsutility that comes standard with every Linux distro I've ever come across (even uCLinux). It pretty much just goes through the entire binary, looking for a series of null-terminated, printable ascii characters... which is your canonical string.strings --helpshows you available parameters such as the minimum length string to look for, encoding, architecture helpers, and other stuff you probably don't need.If you're not running Linux, I recommend booting a Ubuntu Live CD just for the wealth of simple-yet-effective command line utilities.