[RESOLVED] How to protect exe file on ".RES"

[riskiadi]

Hey, (using VB6)
here I made a project, and I import an exe file into the ".res", but someone managed to steal files RES me, how do I protect ".res" in order not to be on crack?
i hate cracker

[DataMiser]

Exe files should not be placed in res files doing so raises some red flags for me.

There is no such thing as a hack/crack proof application.

[fafalone]

You could add the contents as a custom type and encrypt them. After that you could raise the effort required to extract it quite significantly depending on how well you protected the key. But that obviously precludes using resources directly, but you couldn't be doing that with an EXE anyway. If it's not a resource you shouldn't be storing it in a resource file anyway though. Just load it from an encrypted normal file.

[The trick]

You can add exe-file into an section. For example into .text section.

[Elroy]

I put absolutely TONS of stuff in my .res files, but they're almost always "custom" resources. I stuff executables, ActiveX controls, templates, pictures, just absolutely all kinds of stuff into them.

Not to be contrary, but, if someone's going to trust me enough to execute my executable, I see little additional risk (on their part) from unpacking a second executable from that one.

Regarding actually "protecting" your .res file (that's embedded in your executable), that's a bit of a different problem. All of my stuff is open-source, so I don't have that problem. However, just for some "light" protection, you could take the 1's compliment of the embedded executable, and also make sure the .exe extension wasn't obvious in the .res file. It'd take a second longer to unpack-and-execute it, but someone would have to know exactly what they were looking for to find it.

I'm also quite puzzled as to why you're worried about protecting an executable. Typically, people are much more worried about protecting their source code.

Regards,
Elroy

[The trick]

You can add exe-file into an section. For example into .text section.

I'm explaining it more details. My method uses the static linking mechanism. So, at first you should create the COFF-file (*.OBJ, *.LIB) that contains needed file (exe file in your case). For it you can use FASM. If you'll put file to section you need to know its offset and the size. For this you should add new module to your vb-project and create couple of functions. These functions will replaced to other functions, that returns correct values after compilation. So add standard module modReplace:

Option Explicit

' // Stub function for obtaining address of the file
Public Function GetEXEOffset() As Long
End Function

' // Stub function for obtaining size of the file
Public Function GetEXESize() As Long
End Function

Okay, further you should create OBJ-file that contains your exe-file and functions for obtaining of the offset and the size. For this use file directive of FASM:

format MS COFF

section '.text' code readable executable

public ?GetEXEOffset@modReplace@@AAGXXZ
public ?GetEXESize@modReplace@@AAGXXZ

?GetEXESize@modReplace@@AAGXXZ:
        mov eax, file_end - file_begin
        ret

?GetEXEOffset@modReplace@@AAGXXZ:
        mov eax, file_begin
        ret

file_begin:

file 'C:\TEMP\Project1.exe' ; Your file

file_end:

I use the VB6 name mangling for GetEXESize and GetEXEOffset. FYI: VB6 uses this mangling - ?NameOfFunction@NameOfModule@@AAGXXZ that means void __stdcall modReplace::GetEXEOffset(void). It just returns file offset of the specified file and its size. After compiling of this file you'll get OBJ file with same name as source file name.
Now you should replace your modReplace in order to VB6 thought as though it original file. For this you should replace it during compilation. I've done special tool for it - LinkHolder. You should run it in other instance of VB6 (or compile it and run directly). Remember you must have only 1 running copy of VB6 (except LinkHolder), because it works only with single instance, i.e. you can run LinkHolder and your project simultaneously. Also you must run LinkHolder after you open project.
After running LinkHolder you can compile your project. When the linking starts it'll wait until you press 'Pass' button, also you see some obj files in the exe folder:

You should delete original modReplace.OBJ and rename src.OBJ to modReplace.OBJ. Further you should press 'Pass' on the LinkHolder window. All right, exe file contains other file, and functions retrieves correct result.
For test i've written very simple program:

Option Explicit

Private Sub Form_Load()
    MsgBox "File offset: " & Hex(GetEXEOffset) & vbNewLine & "File size: " & Hex(GetEXESize)
End Sub

And after compiling:

[Bonnie West]

You might also want to consider using tools such as Yoda's Protector to help deter unsophisticated crackers/hackers from stealing your embedded files.

[riskiadi]

You might also want to consider using tools such as Yoda's Protector to help deter unsophisticated crackers/hackers from stealing your embedded files.

Thanks dude , this is very helpful

[Black_Storm]

"Trick" i inserted a exe file with size near 30mb but now how can use it
for example my file offset is : 4010AC and file size is : 3FB9A7

can i extracted it or load it and run it from memory?
i like to run it without need extract but i dont know yet how extract it too.

i did not add any res data i jst followed ur step bu FASM and compiled with ranem .OBJ file and prjLinkHolder.exe not work for me (win 7 64 bit) i should be run it from idle in vb6 to can use it.

and i have another question about it,am i should be use jst exe for insert in .text section or any data possible? for example if i inserted a mp4 in that section now how can play it inside vb for example without extract it or how can run it?

[The trick]

"Trick" i inserted a exe file with size near 30mb but now how can use it
for example my file offset is : 4010AC and file size is : 3FB9A7

can i extracted it or load it and run it from memory?
i like to run it without need extract but i dont know yet how extract it too.

Why do you need to run an exe from memory? You already wanted the use a counter but now you need an exe. This isn't trivial task. You can read this.

i did not add any res data i jst followed ur step bu FASM and compiled with ranem .OBJ file and prjLinkHolder.exe not work for me (win 7 64 bit) i should be run it from idle in vb6 to can use it.

Please explain how did you do this by steps.

and i have another question about it,am i should be use jst exe for insert in .text section or any data possible? for example if i inserted a mp4 in that section now how can play it inside vb for example without extract it or how can run it?

Playing resources from memory isn't related to storing to memory. There are approaches to play resources from memory. I didn't use mp4 ever but used AVI.

[dz32]

Vbforums soon rebranding to train a malware writer wonderland (tm)

[Black_Storm]

Why do you need to run an exe from memory? You already wanted the use a counter but now you need an exe. This isn't trivial task. You can read this file

i seen ur files before and that link its about how encode data in a res files and saved in RCDATA section in a resource file, but i dont want open final exe with resourcers and find RCDATA section easy,i liked current thread because here data saved on .text section not like as resource section.

but let me explain first if u asked about trivial task and u see jst counter word?!!!.

did u see my other thread too like as this : "Any way to read and write records to "access bank" or sqllite by memory?" ,i explained enough in #5 in that thread too.

this is one my of problems for long time so i always follow them in my threads till can i solve theme about how can load files and show them or play or run theme(maybe banks like as access or sql or sql lite and etc ...,medias like as mp3 mp4 mkv,images like as apng,svg,animated svg etc ... , pdf files,office files,exe files,activexs like as ocx or dlls,and any need to use or load or show or run without save theme on disk so i want keep theme inside exe not like as exernal resources or use installers or etc about save on disk , ...

i said exe because u explained on exe insert in #6 and in ur sample

C:\TEMP\Project1.exe

in asm file,plus this thread about insert exe,but i exaplained more and asked before about it here :

and i have another question about it,am i should be use jst exe for insert in .text section or any data possible? for example if i inserted a mp4 in that section now how can play it inside vb for example without extract it or how can run it?

I have two goals in these tasks :

1- i want can just save my data and can edit it inside my exe,for example i want add and edit some strings not file only.
2- i want add files but not exe maybe mp4 or another data and can edit it or show or play it inside.

maybe i want create a learning software but i want put my mp4 videos inside my exe for better protect to without save on disk.
i want play from inside exe so i used (memory word) i want can play it without save on hard disk.

i want know any size limitation for insert? for example maybe i want add a mp4 file with 100 or 300 mb or biger,its work?!

Please explain how did you do this by steps.

i followed ur steps in #6 and its work so i can replace obj file and compile my exe so done but :

You should run it in other instance of VB6 (or compile it and run directly). Remember you must have only 1 running copy of VB6 (except LinkHolder), because it works only with single instance, i.e. you can run LinkHolder and your project simultaneously. Also you must run LinkHolder after you open project.

when i run [LinkHolder exe only] after open project caption of LinkHolder is "Link Holder by the trick Error" so i cant use that exe file but i can jst open Link Holder project to can use it from idle only so i asked to how can run it (that link holder exe only if i dont want "open link holder project for use") .


about this :

Playing resources from memory isn't related to storing to memory. There are approaches to play resources from memory. I didn't use mp4 ever but used AVI.

i explained i used memory word because i dont know how extract data saved in exe "in this method used by fasm and replace obj file" in vb ,you explained about how insert that exe but you did not expained how used that data stored in exe in vb now

i dont want keep avi with big size problem and inside res section inside exe ,i want use a useful format like as mkv or mp4 with good quality and normal size.maybe i can extract that data like as stream and can play it by some player activex to support stream data but how do that,important for me is i keep my mp4 or other data like as strings in .text section if its only way to can hide my data from res sections and maybe i need edit it inside self in that .text section

for example if i keep a string like as "aaa" in .text section now how can extact it by vb codeing and how can edit it and saved it again in that .text section again.

"i sent a issue in ur github too about ani format and vbpng dll,pls check it"
and i am still wait here to know about how extract that data binded to exe by vb or load it or use it in vb because its not saved like as res section.

[Black_Storm]

Vbforums soon rebranding to train a malware writer wonderland (tm)

You maybe get it wrong oh yeah "wrong writer ".

"this is because my english is weak so maybe some times explain is hard for me or i explain bad :| "

if i want create maleware or talk about maleware so i can create a simple thread about how can create a protable maleware its simple .

[PhuongNam]

Black_Storm
You can refer to the source code on github to see if it helps... they embed the resource in the DLL and use it from the EXE without having to register the DLL with Windows
https://github.com/Planet-Source-Cod...nk-to__1-11683

[Black_Storm]

Black_Storm
You can refer to the source code on github to see if it helps... they embed the resource in the DLL and use it from the EXE without having to register the DLL with Windows
https://github.com/Planet-Source-Cod...nk-to__1-11683

thanks,i check it but problem not solved yet because current thread is important than it and i explained in #12.

[The trick]

This isn't good approach to store data because this data spends all the virtual memory when an exe is loaded. You could use this approach instead. Most of the installers/sfx uses this apprach. Moreover it's quite simple to update the data in this case.

when i run [LinkHolder exe only] after open project caption of LinkHolder is "Link Holder by the trick Error" so i cant use that exe file but i can jst open Link Holder project to can use it from idle only so i asked to how can run it (that link holder exe only if i dont want "open link holder project for use") .

Probably it's because you have no permisson (try to run as admin).

,you explained about how insert that exe but you did not expained how used that data stored in exe in vb now

I don't understand what you mean. It returns the address of data in memory and its size. How to use? As you please.

i dont want keep avi with big size problem and inside res section inside exe ,i want use a useful format like as mkv or mp4 with good quality and normal size.

AVI files supports lossy compression as well. AVI and MP4 are just containers.

for example if i keep a string like as "aaa" in .text section now how can extact it by vb codeing and how can edit it and saved it again in that .text section again.

If you need only a small string you can update the data using renaming/copying the file. Again see this approach. You could use this approach (it doesn't make a exe copy).

[Black_Storm]

This isn't good approach to store data because this data spends all the virtual memory when an exe is loaded. You could use this approach instead. Most of the installers/sfx uses this apprach. Moreover it's quite simple to update the data in this case.

i had seen it before and its good but if i want jst add a simple string inside exe and then edit and save that inside too with this CEmbeddedFiles.cls class how can do that?

i did try for use like as this :

m_cEmbData.Add "mydatastring", "1234"

but it not worked for me because its jst accept files on disk.

if i want use this class so always i should be create a file on disk then add my string to that file and saved and then add to exe and then delete that file
and when i want update my string i should be extract that file on disk again and edited and again save inside exe?

can u send a code to how can just add and edit and save my string used by that class ?because i think its work on files only or add new mothod for can add strings too and edit and deleted it inside exe?

Probably it's because you have no permisson (try to run as admin).

i have permisson and i tested before but not worked yet.i can use that jst by open linker vb project.

I don't understand what you mean. It returns the address of data in memory and its size. How to use? As you please.

if my memory address is 4010AC and file size is : 3FB9A7 so i need a sample vb code to can get that content.
for example i runed my binded exe but now i want click on a button and after clicked on it how can get that content and show it.
If I needed to send a sample file

AVI files supports lossy compression as well. AVI and MP4 are just containers.

I have 10 mp4 files with a size of 200 MB, but if I want to convert to avi, I do not know which compression or encryption system to use so that the output volume of each of my files does not increase. Usually, when I convert MP4 files, the output AVI file size Multiplies the original mp4 files. and next step how can play it that avi file without save on disk?!! any sample code?

pls can answer my qustion,I have asked before, but I ask again, if I want to add a large file, is it okay? Tell me if there are any restrictions. This question of mine is both related to this thread by using fasm and related to the use of that CEmbeddedFiles class.

[Arnoutdv]

Why do the huge files have to be embedded in the actual application?

[The trick]

i had seen it before and its good but if i want jst add a simple string inside exe and then edit and save that inside too with this CEmbeddedFiles.cls class how can do that?

You shouldn't overwrite the data (especially large data) using this approach. This approach is suitable for storing persistent data (like your movies). Do you need to modify your videos each time when you run exe? I think don't.

can u send a code to how can just add and edit and save my string used by that class ?because i think its work on files only or add new mothod for can add strings too and edit and deleted it inside exe?

The example in github shows how to do it. You can add the files to EOFData.exe from EOFData.exe.

if my memory address is 4010AC and file size is : 3FB9A7 so i need a sample vb code to can get that content.
for example i runed my binded exe but now i want click on a button and after clicked on it how can get that content and show it.
If I needed to send a sample file

For example you have a file. You open it and read it to a byte array. How would you open it in this case? The same approach you use here.

I have 10 mp4 files with a size of 200 MB, but if I want to convert to avi, I do not know which compression or encryption system to use so that the output volume of each of my files does not increase. Usually, when I convert MP4 files, the output AVI file size Multiplies the original mp4 files. and next step how can play it that avi file without save on disk?!! any sample code?

This isn't related to storing the data and depends on codec. For example i build 2 files MP4 and AVI. The AVI file has less size and higher quality because i used H264 codec and the MP4 file used other. How to play the files from memory? This isn't related to this thread. There are several ways to do it.

pls can answer my qustion,I have asked before, but I ask again, if I want to add a large file, is it okay? Tell me if there are any restrictions. This question of mine is both related to this thread by using fasm and related to the use of that CEmbeddedFiles class.

If you want to store big files you should use the EOF approach like in CEmbeddedFiles class. You shouldn't use resources and sections.

[Black_Storm]

You shouldn't overwrite the data (especially large data) using this approach. This approach is suitable for storing persistent data (like your movies). Do you need to modify your videos each time when you run exe? I think don't.

which approach is better?

The example in github shows how to do it. You can add the files to EOFData.exe from EOFData.exe.

i know,i asked before i dont want "just add files" only maybe i want add strings and then maybe need edit/delete strings inside too.

For example you have a file. You open it and read it to a byte array. How would you open it in this case? The same approach you use here.

I left out the method of using fasm because of your suggestion to use a CEmbeddedFiles .

For example i build 2 files MP4 and AVI. The AVI file has less size and higher quality because i used H264 codec and the MP4 file used other.

The problem is that I do not want to create a new video(build),my videos are pre-made(not by myself) with pre-made codecs .
And when they are converted to the format you suggested, the file size increases.

If you want to store big files you should use the EOF approach like in CEmbeddedFiles class. You shouldn't use resources and sections.

if i want use CEmbeddedFiles class and then i want protect my exe so CEmbeddedFiles not worked after exe protected ,so its enough add encoded files or strings inside exe by using CEmbeddedFiles or better idea (without save on disk) ?

Why do the huge files have to be embedded in the actual application?

I create this thread

Thread: add/delete/edit strings or files at runtime inside exe without res/section and show ?