[RESOLVED] Extracting a string from a DLL

[chris128]

Does anyone know of a way that you can get the string that is held at this reference point (its the contents of a registry value that corresponds to a string - see this thread for more info http://www.vbforums.com/showthread.php?t=617477):

@%Systemroot%\system32\wbem\wmisvc.dll,-204

I think I've seen C# (or maybe C++) code use lines like this but I cant find any way of getting the value from the DLL in VB.NET

Cheers
Chris

[minitech]

Try using IO.File.ReadAllText("%SystemRoot%\system32\wbem\wmisvc.dll") and find the string manually, then try to find its relation with -204. I don't understand what the - sign is for (how do you get a negative resource? is it because the sign bit is set and it's actually at position (Not 204) - 1?)

[formlesstree4]

A bit of googling (supposedly) tells me that's the WMI DLL. I tried utilizing Rundll32 and I got this:

---------------------------
RUNDLL
---------------------------
Error in E:\WINDOWS\system32\wbem\wmisvc.dll
Missing entry:-204
---------------------------
OK   
---------------------------

Removing the negative does the same thing. Do you know what the string you're looking for actually is? You might be able to use ResHack to look at it...

[weirddemon]

Try using IO.File.ReadAllText("%SystemRoot%\system32\wbem\wmisvc.dll") and find the string manually, then try to find its relation with -204. I don't understand what the - sign is for (how do you get a negative resource? is it because the sign bit is set and it's actually at position (Not 204) - 1?)

A DLL is basically an executable, with the exception of an entry point. So you can't just ReadAllText like you would a text file.

[minitech]

I know that If you look inside an EXE using Notepad, you'll see that the strings are in the format:
Hello World
=
H(NUL)e(NUL)l(NUL)o(NUL) and so on. Try it!

[weirddemon]

I know that If you look inside an EXE using Notepad, you'll see that the strings are in the format:
Hello World
=
H(NUL)e(NUL)l(NUL)o(NUL) and so on. Try it!

That's not necessarily true. Maye so with a .NET app, but even still, I don't think you could just ReadAllText.

I just attempted to use that method with the .DLL Chris is trying to work with, and I got nothing.

I opened the .DLL in notepad, I saw very few comprehensible pieces of text. Nothing of which, pertained to what Chris is trying to grab

But... I could be wrong

[minitech]

Really? I got (the attached file)
... and much more. Lots of readable stuff there that could be very valuable.

[weirddemon]

Really? I got (the attached file)
... and much more. Lots of readable stuff there that could be very valuable.

I thought we were talking about the .DLL that Chris is referring to? If so, the attached file is what I got.

Also, have you tried using ReadAllText on one?

I got this when trying to read the aforementioned .DLL:

MZ�

[chris128]

A bit of googling (supposedly) tells me that's the WMI DLL. I tried utilizing Rundll32 and I got this:

I dont think you can use RunDll to extract things from a DLL as thats for actually running methods from a DLL, maybe there is some way you can use it for that though I dunno.

As for using ReadAllText, I was hoping that there would just be some way to pass this "address" straight to a method or some keyword and it would return the string, rather than having to try and parse the file manually. Perhaps there is a Windows API that will do it but I'm finding it hard to get any good search results on google as I think google takes out the @ symbol..

[chris128]

Aha I think I may have found something and it looks like this person wrote it for the exact same reason I'm trying to do it http://www.planetsourcecode.com/URLS...10/anyname.htm

http://msdn.microsoft.com/en-us/libr...86(VS.85).aspx

[chris128]

Hmm well there's a few issues with that code, but it was certainly helpful so I've now got my own version working. For anyone interested, here's the code (needs some error handling adding):

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        MessageBox.Show(GetResourceString("@%Systemroot%\system32\wbem\wmisvc.dll,-204"))
End Sub
 
Private Function GetResourceString(ByVal ResourcePath As String) As String
        Dim SeparatedString() As String = ResourcePath.Split(","c)
        Dim ModuleHandle As IntPtr = ApiDefinitions.LoadLibrary(Environment.ExpandEnvironmentVariables(SeparatedString(0).Replace("@", "")))
        Dim SB As New StringBuilder(1024) 'not ideal but cant find a way of pre-determining the string length
        ApiDefinitions.LoadString(ModuleHandle, CUInt(SeparatedString(1).Replace("-", "")), SB, SB.Capacity + 1)
        ApiDefinitions.FreeLibrary(ModuleHandle)
        Return SB.ToString
End Function

[minitech]

I thought we were talking about the .DLL that Chris is referring to? If so, the attached file is what I got.

Also, have you tried using ReadAllText on one?

I got this when trying to read the aforementioned .DLL:

No, I haven't, but I asked you to open it in Notepad. And that is my version of the DLL Chris is referring to. I'm on XP, remember?