CODEWITHSUNDEEP
embedded-resourceportable-executable
ollydbg
ollydbg

Reputation: 3525

Is there a way to find where all resources a PE executable uses?

In my case I'm trying to find the container that persists the configuration parameters, which may be registry, config files (.ini or proprietary) or anything else.

I've tried some resource grabbering tools that can extract resources like images/string out of the executable , but after go through them one by one I find the configuration file is not there.

Anyone has recommendation for this?

Upvotes: 0

Views: 564

Answers (1)

Tergiver
Tergiver

Reputation: 14517

There isn't going to be anything inside the image file if it's using the registry, .ini files, or .config files.

Your best bet is to use Process Monitor. It will show you every file and registry access a program uses. From there it may be possible to deduce which is the bit you're interested in.

Upvotes: 1

Related Questions