How does Microangelo replace icons in .exe's?

[John Fritch]

How does the shareware program Microangelo replace icon resource bytes in .exe files? The API functions I've seen can return icon resource bytes out of an .exe file, but I've never seen an API function that identifies the location of the icon bytes or that can replace those bytes. Furthermore, I've never encountered an .exe file wherein the icon bytes have a single contiguous sequential location. So how does Microangelo replace icon bytes in an .exe file?

John Fritch

[ChrisLee]

You won't find an API call to do this.

Microangelo's technique involves modification of the Exe file.

Since all exe files have a standard structure they can read the exe file in until they find the icon definition information.

They then overwrite the original EXE file with a new one containing the alternative icon data.

This is quite a heavy handed approach and it has disabled a number of my programs where the author has included a checksum to prevent hacking of the application.

This does not really help you from a programming point of view!

I've done a lot of work on reading icons manually from binary files. It would be possible (but not easy ) to do this given enough time and effort.

Please someone prove me wrong as I would really like to do this myself!

[John Fritch]

Chris,

MSDN documentation shows that icon and other resource data in .exe files can be replaced with win32 API calls including UpdateResource, BeginUpdateResource, EndUpdateResource, etc., which are demonstrated in the C++ example at http://msdn.microsoft.com/library/ps...ource_86yb.htm . MSDN documentation for UpdateResource says that these calls are supported in Windows NT and 2000, but not in Windows 9x. However, Michael Kaplan on the microsoft.public.vb.winapi forum states, ”I have tested the NT code on Win9x
platforms and it does work." So I suspect that Microangelo does in fact use these API calls, even on Windows 9x machines. But I still would love to see an example that works in Visual Basic. Probably you would too. Michael Kaplan regreted not having any to offer.

John Fritch

[John Fritch]

Matt Curland has provided a definitive answer and implementation at http://groups.google.com/groups?q=+%...%40tkmsftngp07 (the preceding URL might need to be manually copied and pasted into a browser's address box). His implementation does in fact use the win32 API call UpdateResource, but there are some tricks to getting that call to work on Windows 95, 98, and Me.

John Fritch