Are resource files prone to tampering by malicious users?

[sync40]

Hi to everyone.
I am developing a simple application in VB6. However, when I will be distributing the application, I do not like the idea to simply put my image files in the current directory and read them into the Image controls, because a user can be replacing the files with another content and using the same filename. So I was thinking about using a resource file. However, I would like to know if the RES files are really secure. I know about some applications like "Resource Hacker" that could inspect an EXE or another system file, even replacing the content of Windows itself, etc. In fact, now I am in doubt about the integrity of my application if everyone using those "resource viewers/editors" could be changing for instance the captions on the command buttons, etc, or any other content in my VB6 application.
Thank you very much for any help in advance.

[The Rogue]

well, you could always put the data encrypted at the end of the file, then read from there at startup.

[jmsrickland]

I suppose it depends on what you have in the resource file.

[randem]

You are seriously worried about image files being hacked????

What real different would that make anyway if someone replaced an image?

You could always load them in an image control...

[Davadvice]

i think you are either worrying about something that you don't really need to, or, the cynic in me thinks you are looking at tips on how to perform this "hack"

what type of application is it ? and who is the target users ? hackers/School kids?

[DigiRev]

ResHack is one of the best ones I've come across although I personally never had a use for it. There might be better ones out there that I'm not aware of.

But use ResHack on your program and see what can be changed. Then ask yourself, "Do I really care if someone changes any of this stuff?".

[Hack]

Also, no matter what you do, someone determined enough will figure out a way to undo it, so just go for the best you can to make it as difficult as you can.

[sync40]

Thank you for all your replys.
The target audience are students, and the application is a non-profit application that includes some important information, utilities, and resources for the students. However, last course, some experienced student replaced "just for fun" as he explained, some of the images that were simply loaded with LoadPicture from the installation directory. Rapidly, the new "version" became popular, and nothing would be more than a local school cuestion, but the most embarrasing was that some images from our sponspors (who financed all the expenses for the project and included some publicity in the application) were changed for some pretty-looking softcore models.
So I am planning to use a modification for generating the images inside the code, and encripted, in fact, using a "new" implementation of the old days BASICA Read-Data statements, for reading the bytes of the image into an array, and then assign this data to the Image controls. I hope this could be made.
Thank you again.

[dilettante]

Sounds like overkill. You could always store hashes of the images in another resource and verify by calculating image resource hashes and comparing when your program starts.

[randem]

If the app was operated as a limited user the student could not replace anything in the app folder for it would be read only...

[Davadvice]

can you not just store the images in a directory in the shcool network that the students have read only privleges ?

[some1uk03]

If you compress your final .exe then even ResourceHack wont be able to see them and it will actually decrease your overall filesize by quite a bit.


Try Upx or PeCompact to compress.

[Chris001]

Here's another solution.

1) Read all the images.
2) Switch the first 2 characters of each image header (corrupt it).
3) Load the images into an UDT.
4) Write the UDT to a single file.

Now you have a single binary file with all the images. When somebody uses a tool to extract the images it fails, because the image headers are invalid. For example, Bitmap headers usually start with BM6, but in the single binary file they start with MB6.

This is what you do in the application that needs the images:

5) Read the binary file back into the UDT.
6) Convert UDT to Byte array
7) Convert Byte array to a Picture
8) Load the images into the PictureBoxes.


Below is an example. All 6 images have a .bmp extension, but that's only to make it easier to load them with a simple loop.

1.bmp = BMP image
2.bmp = JPG image
3.bmp = GIF image
4.bmp = BMP image
5.bmp = JPG image
6.bmp = GIF image

<project removed>

[randem]

Wow... All of that to skip applying READ ONLY privileges... What overkill and really unnecessary.

[Davadvice]

Wow... All of that to skip applying READ ONLY privileges... What overkill and really unnecessary.

I Have to agree here. that looks like the long way round and can go wrong in so many ways, changing file names etc.

Read Yes, Write No.

David

[Chris001]

Ah well, it was only an idea. I use it for one of my apps. I create a single file from several toolbar images and put the single binary file on my site. When the user wants different toolbar images, they can download the single file, put it in the installation folder and then load the images from the app's menu.

I thought it might be a solution to prevent people from messing around with the images.