exe function importt table executable Import Address Table IAT Import Directory Table ILT IAT Windows Portable Executable PE format pefile Portable Executable profile

codeproject
2873/tips-on-internationalization-of-software
430684/loading-win-dlls-manually-without-loadlibrary
3356/Internationalization-and-Multiple-Language-Support?msg=1114625#xx1114625xx

 The Windows CRT exposes 5 symbols mainCRTStartup , wmainCRTStartup , wWinMainCRTStartup , _DllMainCRTStartup and WinMainCRTStartup
https://github.com/MicrosoftDocs/cpp-docs/blob/main/docs/atl/linking-to-the-crt-in-your-atl-project.md
https://learn.microsoft.com/zh-tw/cpp/build/reference/entry-entry-point-symbol?view=msvc-170
https://stackoverflow.com/questions/28005324/linking-to-crt-unresolved-external-symbol-winmaincrtstartup

https://reverseengineering.stackexchange.com/questions/16870/import-table-vs-import-address-table
https://learn.microsoft.com/zh-tw/windows/win32/debug/pe-format?redirectedfrom=MSDN
https://learn.microsoft.com/zh-tw/windows/win32/debug/pe-format?redirectedfrom=MSDN#import_directory_table



import address table (IAT)

entry point function
https://learn.microsoft.com/zh-tw/cpp/build/reference/entry-entry-point-symbol?view=msvc-170
https://learn.microsoft.com/zh-tw/windows/win32/dlls/dynamic-link-library-entry-point-function

http://in4k.untergrund.net/various%20web%20articles/Creating_Small_Win32_Executables_-_Fast_Builds.htm

https://github.com/Mattiwatti/WinMain-is-usually-a-function/blob/master/src/main-semireadable.cpp

https://www.ired.team/offensive-security/code-injection-process-injection/import-adress-table-iat-hooking

http://www.heaventools.com/PE_Explorer_exe-import-viewer.htm

The Import Address Table is now write-protected, and what that means for rogue patching - The Old New Thing
https://devblogs.microsoft.com/oldnewthing/20221006-07/?p=107257

https://www.codeguru.com/windows/injective-code-inside-an-import-table/


Injective Code inside Import Table - CodeProject
  Export Table  Import Table  Resource Table  Exception Table  Certificate File  Relocation Table   Debug Data   Architecture Data   Global Ptr Thread Local Storage Table   Load Config Table Bound Import Table Import Address Table  Delay Import Descriptor  COM+ Runtime Header  Reserved
https://www.codeproject.com/Articles/14360/Injective-Code-inside-Import-Table



A dive into the PE file format - PE file structure - Part 5: PE Imports (Import Directory Table, ILT, IAT) - 0xRick’s Blog
Bound Import Data Directory  Import Lookup Table (ILT)      Hint/Name Table  Import Address Table (IAT)
https://0xrick.github.io/win-internals/pe6/
https://chromium.googlesource.com/external/pefile/+/714882b7d254e2580fe93e2669d2f0e1463d4408/pefile.py
https://github.com/omriher/CapTipper/blob/master/pefile.py
https://f3real.github.io/iat_hooking.html

stdafx afxwin afxext afxdisp afxdtctl afxcmn afxres MFC Predefined Symbols , ATL headers (afx.h, afxwin.h, afxres.h)

 https://learn.microsoft.com/en-us/cpp/windows/mfc-predefined-symbols?view=msvc-170
 

AFX_ID_PREVIEW_CLOSE
AFX_ID_PREVIEW_NEXT
AFX_ID_PREVIEW_NUMPAGE
AFX_ID_PREVIEW_PREV
AFX_ID_PREVIEW_PRINT
AFX_ID_PREVIEW_ZOOMIN
AFX_ID_PREVIEW_ZOOMOUT
AFX_IDB_CHECKLISTBOX_95
AFX_IDB_MINIFRAME_MENU
AFX_IDC_BROWSE
AFX_IDC_BROWSER
AFX_IDC_CHANGE
AFX_IDC_CLEAR
AFX_IDC_COLOR_BLACK
AFX_IDC_COLOR_BLUE
AFX_IDC_COLOR_CYAN
AFX_IDC_COLOR_DARKBLUE
AFX_IDC_COLOR_DARKCYAN 

https://learn.microsoft.com/zh-tw/cpp/mfc/reference/application-information-and-management?view=msvc-170
AfxBeginThread
AfxContextMenuManager
AfxEndThread
AfxFindResourceHandle
AfxFreeLibrary
AfxGetApp
AfxGetAppName
AfxGetInstanceHandle
AfxGetMainWnd
AfxGetPerUserRegistration

winapi tresourcestream resources rcdata file delphi kernel32 system FindResourceA LoadResource WindowsBase

 winapi  resources rcdata  WinBase.h resource.h kernel32.dll" "system"   FindResourceA
winapi tresourcestream resources rcdata
delphi kernel32  system FindResourceA LoadResource WindowsBase

https://github.com/search?q=repo%3Amicrosoft%2Fwindows-rs%20FindResourceA&type=code

FindResource MAKEINTRESOURCE
https://learn.microsoft.com/zh-tw/windows/win32/menurc/using-resources

LoadLibrary  
FindResource
LoadResource
LockResource
BeginUpdateResource
UpdateResource
EndUpdateResource

https://docwiki.embarcadero.com/Libraries/Alexandria/en/System.FindResource

https://docwiki.embarcadero.com/Libraries/Alexandria/en/System.Classes.TResourceStream
http://docwiki.embarcadero.com/RADStudio/Alexandria/en/Streams,_Reader_and_Writers
https://docwiki.embarcadero.com/Libraries/Alexandria/en/System.Classes.ReadComponentRes

embarcadero TResourceStream
https://docwiki.embarcadero.com/Libraries/Alexandria/en/System

Lazarus FPC  TResourceStream
https://www.freepascal.org/docs-html/rtl/classes/tresourcestream.html

https://github.com/ultibohub/FPC/blob/3a6be9bc116ee0b22011b6a7234a78b455df2e15/source/rtl/objpas/classes/streams.inc#L890

delphi system FindResource LoadResource  LockResource
https://stackoverflow.com/questions/2374317/failed-to-extract-files-from-delphi-resource-file

https://rdk.deadbsd.org/fravia/71.6.196.237/fravia/aitodelp.htm
aitodelp.htm: Delphi Reverse Engineering DFM Files, Windows RCDATA and Object Conversion Routines
https://learn.microsoft.com/en-us/windows/win32/menurc/resource-types

procedure ObjectBinaryToText(Input, Output: TStream); procedure ObjectTextToBinary(Input, Output: TStream); procedure ObjectResourceToText(Input, Output: TStream); procedure ObjectTextToResource(Input, Output: TStream);

Delphi Reverse Engineering
DFM Files, Windows RCDATA and
Object Conversion Routines.


https://github.com/6700github/awesome-reverse-engineering/blob/master/Readme_full.md

delphi exe include  exe Tresourcestream  Embed another EXE file in the Delphi EXE file

Add executable to my resource file then shell execute it [Solved]
https://forum.lazarus.freepascal.org/index.php?topic=44067.0

uses LCLType, Classes, Process; procedure TMainForm.CRunButtonClick(Sender: TObject); var Output: TFileStream; Resource: TResourceStream; var Colorization: TProcess; begin Output := TFileStream.Create('colorization.exe', fmCreate); Resource := TResourceStream.Create(HINSTANCE, 'COLORIZATION', RT_RCDATA); try Output.CopyFrom(Resource, Resource.Size); finally Output.Free(); Resource.Free(); end; Colorization := TProcess.Create(nil); try Colorization.Executable := 'colorization.exe'; Colorization.Execute(); finally Colorization.Free(); end; end; 

 

program Launcher; {$R 'Program.res' 'Program.rc'} uses Windows, SysUtils, ShellAPI, Classes; {$R *.res} type TIsWOW64Process = function(hProcess:THandle;var IsWOW64:Boolean):Boolean;stdcall; const FileName = 'Program.exe'; Res32 = 'Program32'; Res64 = 'Program64'; function GetTempFolder: String; var Buffer: array [0..MAX_PATH+1] of WideChar; begin GetTempPath(MAX_PATH, Buffer); Result := IncludeTrailingPathDelimiter(String(Buffer)); end; function Is64Process:Boolean; var Kernel:HMODULE;IsWOW64Process:TIsWOW64Process;Temp:Boolean; begin Result := false; Kernel := LoadLibrary('kernel32'); if Kernel = 0 then Exit; IsWOW64Process := GetProcAddress(Kernel, 'IsWow64Process'); if not Assigned(IsWow64Process) then Exit; IsWOW64Process(GetCurrentProcess, Temp); Result := Temp; FreeLibrary(Kernel); end; var ResName, FilePath, Params:String; Source:TResourceStream;Dest:TStream; I:Integer;StartupInfo:TStartupInfo; ProcessInfo:TProcessInformation; begin if Is64Process then begin ResName := Res64; end else begin ResName := Res32; end; FilePath := GetTempFolder + FileName; Source := TResourceStream.Create(hInstance, ResName, RT_RCDATA); Dest := TFileStream.Create(FilePath, fmCreate); Dest.CopyFrom(Source, 0); Dest.Write(Source.Memory, Source.Size); Dest.Free; Source.Free; Params := '"'+FilePath+'"'; for I := 1 to ParamCount do begin Params := Params + ' ' + ParamStr(I); end; GetStartupInfo(StartupInfo); if CreateProcess(PWideChar(FilePath), PWideChar(Params), nil, nil, false, CREATE_UNICODE_ENVIRONMENT, nil, PWideChar(GetCurrentDir), StartupInfo, ProcessInfo) then begin if ProcessInfo.hProcess <> 0 then begin WaitForSingleObject(ProcessInfo.hProcess, INFINITE); end; end; DeleteFile(FilePath); end.

reverse_engineering

 
CFF Explorer
API Monitor
WinHex
Hiew  BIN/CMD/ELF formats   BIN/CMD/ELF formats TAR  GZIP NE, LE, LX, PE/PE32+, ELF/ELF64(little-endian), Mach-O(little-endian)  TE/TE64  NLM, DSK, LAN

Bytecode Viewer — Java decompiler
Fiddler
Scylla
Relocation SecTAR or GZIP tion Editor
PEiD
HIEW  hex editor deasembler
64dbg   
IDA Pro, Hex Rays
dnSpy NET ultimate tool
Sandboxie  Run unknown code without a fear
Resource Hacker - Hack the planet!
DiE   Protections obfuscators identifier
Bytecode Viewer   Java decompiler (also for Android apps)
Process Monitor  Monitor system changes
Wireshark  Network sniffer

https://www.apriorit.com/dev-blog/366-software-reverse-engineering-tools
https://www.trackawesomelist.com/Hack-with-Github/Awesome-Hacking/readme/
https://github.com/ReversingID/Awesome-Reversing
https://github.com/tylerha97/awesome-reversing
https://online.yu.edu/katz/blog/best-reverse-engineering-software-2022
https://gitee.com/hzfcode/awesome-reverse-engineering
https://jaimevalero.github.io/managing-awesome-lists/var/topics/reverse-engineering.html
https://hackreveals.medium.com/the-8-best-reverse-engineering-tools-in-2023-69513fc0a7
https://www.quora.com/What-is-the-current-state-of-artificial-intelligences-ability-to-decompile-binary-code-and-reverse-engineer-it
https://en.wikipedia.org/wiki/AI-assisted_reverse_engineering
https://www.bengrewell.com/chatgpt/
ChatGPT Unraveled: A Guide to Leveraging AI for Software Reverse Engineering
https://www.reddit.com/r/GameUpscale/comments/y91zpv/decompiling_with_ai_is_going_to_be_revolutionary/

gold parsing system alternative AWESOME
https://en.wikipedia.org/wiki/Comparison_of_parser_generators
GLR parser
C++ parser generator
pidgin parser
C# parser
LALR parser
c# lalr parser
LALR parser wiki
ANTLR
https://github.com/Kryuski/GOLD-Parsing-System-For-Delphi/blob/master/README.md

JEB Decompiler PNF Software Decompile Intel x86, ARM MIPS executable programs malware Reverse JEB analyze Android reverse engineer Windows malware audit embedded

Software Reverse Engineering Computer Books special... guide on how to reverse engineer legacy systems to understand their problems Four Essential AI Use Cases. AI

Small-C is both a subset of the C programming language, suitable for resource-limited microcomputers and embedded systems, Cross Small-C implementation based microcomputers

 https://en.wikipedia.org/wiki/Small-C

https://godbolt.org/

 

https://forum.community.tw/t/topic/65

 https://www.renesas.com/us/en/software-tool/cc-compiler-package-superh-family#additional_details
"C/C++ Compiler Package for SuperH Family Software Component List (PDF | English, 日本語)".

 

https://dansanderson.com/mega65/
https://dansanderson.com/mega65/cross-development/
https://dansanderson.com/mega65/cross-development-2/
          https://m65digest.substack.com/
          https://m65digest.substack.com/p/cross-development-for-fun-and-profit                              https://files.mega65.org/html/main.php?id=4fc0ab25-e381-4a64-a43c-d1d338166a7c
          https://files.mega65.org/html/main.php?id=8b189d0b-ea1e-45a7-a4de-87bcb0b11696
          https://files.mega65.org/html/main.php?id=3ef45802-446a-4325-bcc2-b387f818b33c https://www.forth.com/forth/
https://github.com/ptorric/figforth
https://github.com/timmoorhouse/mega65-forth
https://github.com/timmoorhouse/mega65-forth/wiki/Getting-Started