03-Sep-00

May not be deliberate anti-disassembly code but... 
...Named resources that disassemblers don't recognize.

I noticed that deleting the .rsrc section allowed Wdasm to disassemble the file. So I started exploring the section with PEBrowsePro, Peridump, a hexeditor, some notes on Win32 Resource formats and a beer.

"Named" resources are ones specified by the programmer, and differ from the pre-defined types such as Menus, Dialogs, Accelerators, Strings, Icons, Cursors, Bitmaps, Fonts and Version.

Undefined resource types can be put in RCDATA, but can also be specified separately as well. In the case of Xara3D, they are "AVI", "BINARY" and "TEXT". The "" are part of the resource name here.

PEBrowsePro shows the following structure for the .rsrc section

Characteristics = 0x00000000
TimeDateStamp = 0x00000000
MajorVersion = 0x0000
MinorVersion = 0x0000
NumberOfNamedEntries = 0x0003
NumberOfIdEntries = 0x000C

Named Entry #1
Type = 0x80001B28
OffsetToData = 0x80000088

Named Entry #2
Type = 0x80001B30
OffsetToData = 0x800000A0

Named Entry #3
Type = 0x80001B3E
OffsetToData = 0x800000B8

Id Entry #1
Type = 0x00000001
OffsetToData = 0x800000D0


You can see this structure in the hex code beginning at the Raw Offset EE000

000EE000- 0000 0000 0000 0000 0000 0000 0300 0C00 281B 0080
000EE014- 8800 0080 301B 0080 A000 0080 3E1B 0080 B800 0080
000EE028- 0100 0000 D000 0080

After the NumberOfNamedEntries = 0x0003 and NumberOfIdEntries = 0x000C WORD values are the Type and OffsetToData DWORD entries for the 3 NamedEntries. The last 2 DWORD values are from Id Entry #1 and is the start of the Cursor resource.

By deleting the 6 DWORD values for the NamedEntries and changing the NumberOfNamedEntries from 3 to 0, Wdasm could properly disassemble the file.

'Course the program won't run now, but at least the mystery is solved ;-)



To change the NumberOfEntries:

In the first line of hex, 0300 is the WORD value for NumberOfNamedEntries = 0x0003. Change this to 0000. I don't know if this really matters anyway. None of it really matters anyway, you could just delete the whole .rsrc section and the file could be disassembled by Wdasm or IDA now.
I do know that if you just fill those 6 DWORD values which define the resource header for the Named Entries with zeroes, it still can't be disass. properly. It seems they need to be deleted entirely to "fix up" the structure.
I *think* this is the reason for the problem because Peridump (a resource dumper - find it at Players Tools as well ;), seems to stop right at this point. Here's it's output:
RESOURCE TABLE

First Resource Directory RVA = 0012E000 
Total Resource Section Size = 0002ED20 
+Named Entries in Directory = 00000003 
+ID Entries in Directory = 0000000C - STOPS output

It *should* continue with the Named Entries listing, but doesn't. Fix up the .rsrc structure by deleting the Named Entries part, and Peridump continues on it's merry way detailing the rest of the resource structure.

Regards,



Kayaker
