exe function importt table executable Import Address Table IAT Import Directory Table ILT IAT Windows Portable Executable PE format pefile Portable Executable profile

codeproject
2873/tips-on-internationalization-of-software
430684/loading-win-dlls-manually-without-loadlibrary
3356/Internationalization-and-Multiple-Language-Support?msg=1114625#xx1114625xx

 The Windows CRT exposes 5 symbols mainCRTStartup , wmainCRTStartup , wWinMainCRTStartup , _DllMainCRTStartup and WinMainCRTStartup
https://github.com/MicrosoftDocs/cpp-docs/blob/main/docs/atl/linking-to-the-crt-in-your-atl-project.md
https://learn.microsoft.com/zh-tw/cpp/build/reference/entry-entry-point-symbol?view=msvc-170
https://stackoverflow.com/questions/28005324/linking-to-crt-unresolved-external-symbol-winmaincrtstartup

https://reverseengineering.stackexchange.com/questions/16870/import-table-vs-import-address-table
https://learn.microsoft.com/zh-tw/windows/win32/debug/pe-format?redirectedfrom=MSDN
https://learn.microsoft.com/zh-tw/windows/win32/debug/pe-format?redirectedfrom=MSDN#import_directory_table



import address table (IAT)

entry point function
https://learn.microsoft.com/zh-tw/cpp/build/reference/entry-entry-point-symbol?view=msvc-170
https://learn.microsoft.com/zh-tw/windows/win32/dlls/dynamic-link-library-entry-point-function

http://in4k.untergrund.net/various%20web%20articles/Creating_Small_Win32_Executables_-_Fast_Builds.htm

https://github.com/Mattiwatti/WinMain-is-usually-a-function/blob/master/src/main-semireadable.cpp

https://www.ired.team/offensive-security/code-injection-process-injection/import-adress-table-iat-hooking

http://www.heaventools.com/PE_Explorer_exe-import-viewer.htm

The Import Address Table is now write-protected, and what that means for rogue patching - The Old New Thing
https://devblogs.microsoft.com/oldnewthing/20221006-07/?p=107257

https://www.codeguru.com/windows/injective-code-inside-an-import-table/


Injective Code inside Import Table - CodeProject
  Export Table  Import Table  Resource Table  Exception Table  Certificate File  Relocation Table   Debug Data   Architecture Data   Global Ptr Thread Local Storage Table   Load Config Table Bound Import Table Import Address Table  Delay Import Descriptor  COM+ Runtime Header  Reserved
https://www.codeproject.com/Articles/14360/Injective-Code-inside-Import-Table



A dive into the PE file format - PE file structure - Part 5: PE Imports (Import Directory Table, ILT, IAT) - 0xRick’s Blog
Bound Import Data Directory  Import Lookup Table (ILT)      Hint/Name Table  Import Address Table (IAT)
https://0xrick.github.io/win-internals/pe6/
https://chromium.googlesource.com/external/pefile/+/714882b7d254e2580fe93e2669d2f0e1463d4408/pefile.py
https://github.com/omriher/CapTipper/blob/master/pefile.py
https://f3real.github.io/iat_hooking.html

stdafx afxwin afxext afxdisp afxdtctl afxcmn afxres MFC Predefined Symbols , ATL headers (afx.h, afxwin.h, afxres.h)

 https://learn.microsoft.com/en-us/cpp/windows/mfc-predefined-symbols?view=msvc-170
 

AFX_ID_PREVIEW_CLOSE
AFX_ID_PREVIEW_NEXT
AFX_ID_PREVIEW_NUMPAGE
AFX_ID_PREVIEW_PREV
AFX_ID_PREVIEW_PRINT
AFX_ID_PREVIEW_ZOOMIN
AFX_ID_PREVIEW_ZOOMOUT
AFX_IDB_CHECKLISTBOX_95
AFX_IDB_MINIFRAME_MENU
AFX_IDC_BROWSE
AFX_IDC_BROWSER
AFX_IDC_CHANGE
AFX_IDC_CLEAR
AFX_IDC_COLOR_BLACK
AFX_IDC_COLOR_BLUE
AFX_IDC_COLOR_CYAN
AFX_IDC_COLOR_DARKBLUE
AFX_IDC_COLOR_DARKCYAN 

https://learn.microsoft.com/zh-tw/cpp/mfc/reference/application-information-and-management?view=msvc-170
AfxBeginThread
AfxContextMenuManager
AfxEndThread
AfxFindResourceHandle
AfxFreeLibrary
AfxGetApp
AfxGetAppName
AfxGetInstanceHandle
AfxGetMainWnd
AfxGetPerUserRegistration

winapi tresourcestream resources rcdata file delphi kernel32 system FindResourceA LoadResource WindowsBase

 winapi  resources rcdata  WinBase.h resource.h kernel32.dll" "system"   FindResourceA
winapi tresourcestream resources rcdata
delphi kernel32  system FindResourceA LoadResource WindowsBase

https://github.com/search?q=repo%3Amicrosoft%2Fwindows-rs%20FindResourceA&type=code

FindResource MAKEINTRESOURCE
https://learn.microsoft.com/zh-tw/windows/win32/menurc/using-resources

LoadLibrary  
FindResource
LoadResource
LockResource
BeginUpdateResource
UpdateResource
EndUpdateResource

https://docwiki.embarcadero.com/Libraries/Alexandria/en/System.FindResource

https://docwiki.embarcadero.com/Libraries/Alexandria/en/System.Classes.TResourceStream
http://docwiki.embarcadero.com/RADStudio/Alexandria/en/Streams,_Reader_and_Writers
https://docwiki.embarcadero.com/Libraries/Alexandria/en/System.Classes.ReadComponentRes

embarcadero TResourceStream
https://docwiki.embarcadero.com/Libraries/Alexandria/en/System

Lazarus FPC  TResourceStream
https://www.freepascal.org/docs-html/rtl/classes/tresourcestream.html

https://github.com/ultibohub/FPC/blob/3a6be9bc116ee0b22011b6a7234a78b455df2e15/source/rtl/objpas/classes/streams.inc#L890

delphi system FindResource LoadResource  LockResource
https://stackoverflow.com/questions/2374317/failed-to-extract-files-from-delphi-resource-file

https://rdk.deadbsd.org/fravia/71.6.196.237/fravia/aitodelp.htm
aitodelp.htm: Delphi Reverse Engineering DFM Files, Windows RCDATA and Object Conversion Routines
https://learn.microsoft.com/en-us/windows/win32/menurc/resource-types

procedure ObjectBinaryToText(Input, Output: TStream); procedure ObjectTextToBinary(Input, Output: TStream); procedure ObjectResourceToText(Input, Output: TStream); procedure ObjectTextToResource(Input, Output: TStream);

Delphi Reverse Engineering
DFM Files, Windows RCDATA and
Object Conversion Routines.


https://github.com/6700github/awesome-reverse-engineering/blob/master/Readme_full.md

delphi exe include  exe Tresourcestream  Embed another EXE file in the Delphi EXE file

Add executable to my resource file then shell execute it [Solved]
https://forum.lazarus.freepascal.org/index.php?topic=44067.0

uses LCLType, Classes, Process; procedure TMainForm.CRunButtonClick(Sender: TObject); var Output: TFileStream; Resource: TResourceStream; var Colorization: TProcess; begin Output := TFileStream.Create('colorization.exe', fmCreate); Resource := TResourceStream.Create(HINSTANCE, 'COLORIZATION', RT_RCDATA); try Output.CopyFrom(Resource, Resource.Size); finally Output.Free(); Resource.Free(); end; Colorization := TProcess.Create(nil); try Colorization.Executable := 'colorization.exe'; Colorization.Execute(); finally Colorization.Free(); end; end; 

 

program Launcher; {$R 'Program.res' 'Program.rc'} uses Windows, SysUtils, ShellAPI, Classes; {$R *.res} type TIsWOW64Process = function(hProcess:THandle;var IsWOW64:Boolean):Boolean;stdcall; const FileName = 'Program.exe'; Res32 = 'Program32'; Res64 = 'Program64'; function GetTempFolder: String; var Buffer: array [0..MAX_PATH+1] of WideChar; begin GetTempPath(MAX_PATH, Buffer); Result := IncludeTrailingPathDelimiter(String(Buffer)); end; function Is64Process:Boolean; var Kernel:HMODULE;IsWOW64Process:TIsWOW64Process;Temp:Boolean; begin Result := false; Kernel := LoadLibrary('kernel32'); if Kernel = 0 then Exit; IsWOW64Process := GetProcAddress(Kernel, 'IsWow64Process'); if not Assigned(IsWow64Process) then Exit; IsWOW64Process(GetCurrentProcess, Temp); Result := Temp; FreeLibrary(Kernel); end; var ResName, FilePath, Params:String; Source:TResourceStream;Dest:TStream; I:Integer;StartupInfo:TStartupInfo; ProcessInfo:TProcessInformation; begin if Is64Process then begin ResName := Res64; end else begin ResName := Res32; end; FilePath := GetTempFolder + FileName; Source := TResourceStream.Create(hInstance, ResName, RT_RCDATA); Dest := TFileStream.Create(FilePath, fmCreate); Dest.CopyFrom(Source, 0); Dest.Write(Source.Memory, Source.Size); Dest.Free; Source.Free; Params := '"'+FilePath+'"'; for I := 1 to ParamCount do begin Params := Params + ' ' + ParamStr(I); end; GetStartupInfo(StartupInfo); if CreateProcess(PWideChar(FilePath), PWideChar(Params), nil, nil, false, CREATE_UNICODE_ENVIRONMENT, nil, PWideChar(GetCurrentDir), StartupInfo, ProcessInfo) then begin if ProcessInfo.hProcess <> 0 then begin WaitForSingleObject(ProcessInfo.hProcess, INFINITE); end; end; DeleteFile(FilePath); end.