Resource Cracker v1.0
by Bartosz Wójcik
https://www.pelock.com


WHAT IT IS

Resource Cracker is a Windows program for viewing and editing resources stored
in executable files and in standalone resource files. Open a file, pick a
resource in the tree, and look at it as a preview, as a structured editor, or
as raw bytes. You can change resources, add new ones, delete them, and save
the file. The same operations are available from the command line.


REQUIREMENTS

Windows with the .NET Framework 4.8 runtime.
The program is a desktop application. Command-line mode attaches to the
console you started it from, or opens its own console window.


OPENING A FILE

File, Open (Ctrl+O), or drag a file onto the window. Several files can be
open at once; each one is a tab. Drag a tab to reorder it. Middle-click a
tab, or press Ctrl+W, to close it.

A path on the command line, with no switches, opens that file in the window:

    "Resource Cracker.exe" C:\Windows\System32\notepad.exe

File, Open with Windows loader opens a module the way the Windows loader
sees it. That view is read-only.

A 16-bit NE file can be edited and saved. Save rewrites the resource table
and the resource bytes. It does not move the program segments. Save is
refused, and the file is left unchanged, when the new table would overlap a
segment or another resource, a resource is larger than one NE entry can
record, a name is longer than 255 bytes, an integer id is above 32767, a
resource was truncated when the file was read, or one type has more
resources than an NE type list can hold.


SUPPORTED BINARIES

The file kind is recognized from the contents, not only from the extension.

    PE64+                         .exe .dll .ocx .cpl .scr .sys .drv .ax .efi
    PE32                          .exe .dll .ocx .cpl .scr .sys .drv .ax .efi
    NE (16-bit)                   .exe .dll .drv
    .NET IL (CIL)                 .exe .dll
    .NET ReadyToRun (R2R)         .exe .dll
    .NET Native AOT               .exe .dll
    C++/CLI (IJW)                 .exe .dll
    Windows metadata (WinMD)      .winmd
    Netmodule                     .netmodule
    Language files (MUI)          .mui .mun
    Compiled resources            .res
    Resource script               .rc

A folder dropped on the window is scanned for modules inside it.


THE WINDOW

The left side is the resource tree. Types are the parents. Each resource is
shown as its name and language, for example 1 [1033].

The right side has three views of the selected resource:

    Preview     a picture, a dialog, a menu, a version block, a manifest,
                or the text of a scriptable resource
    Editor      the structured editor for that type, when one exists
    Hex editor  the raw bytes

View, or Ctrl+1, Ctrl+2, Ctrl+3 and Ctrl+4, switches among the open tabs of
the selected resource.

The status bar shows the file kind, the path, the selected resource, and
whether the file has unsaved changes. A type node marked with * has a
modified or new resource under it. A new resource is drawn in green.


SUPPORTED RESOURCE TYPES

Standard Win32 types are listed under a friendly name and the RT_ constant.
A file can also contain custom types (a number or a name that is not in this
list). Those are shown as #number or as the type name, and they can be
viewed in the hex editor and dumped as raw bytes.

    Cursor              RT_CURSOR            1
    Bitmap              RT_BITMAP            2
    Icon                RT_ICON              3
    Menu                RT_MENU              4
    Dialog              RT_DIALOG            5
    String Table        RT_STRING            6
    Font Directory      RT_FONTDIR           7
    Font                RT_FONT              8
    Accelerators        RT_ACCELERATOR       9
    RCData              RT_RCDATA           10
    Message Table       RT_MESSAGETABLE     11
    Cursor Group        RT_GROUP_CURSOR     12
    Icon Group          RT_GROUP_ICON       14
    Version             RT_VERSION          16
    Dialog Include      RT_DLGINCLUDE       17
    Plug and Play       RT_PLUGPLAY         19
    VXD                 RT_VXD              20
    Animated Cursor     RT_ANICURSOR        21
    Animated Icon       RT_ANIICON          22
    HTML                RT_HTML             23
    Manifest            RT_MANIFEST         24

Icon and cursor groups own the individual icon and cursor images. Editing
the group updates those images together. In a mask, ICON means the icon
group and CURSOR means the cursor group.

.NET modules can also show a "Managed resources" node. That node is a
listing of the managed resources. It is not a Win32 resource you rewrite
with the resource editor.

What you can do with each kind:

    Bitmap, icon, cursor, animated icon, animated cursor
        Preview the picture. Paint in the image editor. Export as PNG, BMP,
        JPEG, GIF, TIFF, or WebP. Replace by dropping an image on the preview.
    Icon group, cursor group
        Preview every image in the group. Export the whole group as .ico
        or .cur.
    Dialog
        Preview the dialog. Edit it on the dialog designer or as script.
    Menu
        Preview the menu. Edit items in the menu editor or as script.
    String table
        Edit the strings. Blocks hold sixteen strings.
    Accelerators
        Edit the shortcut table.
    Version
        Edit the fixed info and the string tables.
    Manifest
        Preview and edit the XML, with an analyzer for common problems.
    Message table
        Read the messages.
    HTML, RCData, dialog include, fonts, and anything else
        Preview when the bytes are text or an image. Otherwise use the hex
        editor. Dump raw always writes the stored bytes.
    Custom type
        Hex editor and raw dump. You can add one with Action, Add resource
        and type a name or a number.


SAVING

File, Save (Ctrl+S) writes the current file. File, Save As writes a new
path. File, Save All (Ctrl+Shift+S) writes every modified file.

When "Create a .bak backup before the first save of a file" is on (Tools,
Options, General), the first save of a session copies the original to a
.bak file beside it.

Saving a 16-bit NE file rewrites its resources in place. If the new resource
table or a resource does not fit the limits of the NE format, the save stops
and the original file stays as it was.

Undo (Ctrl+Z) and Redo (Ctrl+Y) apply to the editor you are in first, and
then to resource changes such as add, delete, and replace.


ADDING, REPLACING, DELETING

Action, Add resource (Ctrl+Ins), or drop a file on the tree. You choose the
type, name, and language. A name is a number (decimal or 0x hex, or #number)
or a text name. Language 0 is Neutral. Other languages use the usual Windows
language id, such as 1033 for English (United States).

Action, Replace (Ctrl+R) replaces the selected resource from a file. Dropping
an image on an image preview does the same.

Delete (Del) removes the selected resource. Deleting a type node removes
every resource of that type.

F2 renames a resource or changes its language. Alt+Enter opens properties.

Copy, cut, and paste (Ctrl+C, Ctrl+X, Ctrl+V) work on resources in the tree,
and also on text and images in the editors.


EXPORTING

Action, Export as (Ctrl+E) writes the resource in another format when one
exists. Bitmaps, icons, and cursors can be written as PNG, BMP, JPEG, GIF,
TIFF, or WebP. An icon group can be written as .ico and a cursor group as
.cur. Scriptable resources can be written as an .rc script.

Action, Dump raw (Ctrl+D) writes the resource bytes as they are stored.

File, Export all writes every resource of the current file.

Drag a resource from the tree onto Explorer to export it.


FINDING

Ctrl+F searches. F3 finds the next match. In Preview, Editor, or Hex, the
search stays in that view. In the tree, it selects the matching resource.

Ctrl+G goes to an offset in the hex editor. Insert switches insert and
overwrite there.

Alt+Left and Alt+Right move back and forward through resources you have
selected.


DIALOG DESIGNER

Arrow keys move the selected controls. Hold Ctrl to move by one dialog unit.
Hold Shift to resize. Ctrl+click or Shift+click adds to the selection. Drag
on empty space to draw a rubber band. Del deletes the selected controls.
Ctrl+C, Ctrl+X, and Ctrl+V copy, cut, and paste them. Esc clears the
selection and leaves tab-order mode.


MENU EDITOR

Alt+Up and Alt+Down move an item. Alt+Left outdents it. Alt+Right indents it.
Insert adds an item. Del removes it.


OPTIONS

Tools, Options.

    General          language, theme (System, Light, or Dark), backup,
                     recent files
    Fonts            editor font
    Default editors  which view opens for each resource type
    Hex              bytes per line and grouping
    Preview          how pictures are fitted
    Image            checkerboard colors behind transparent images
    Performance      background work

The interface languages are English, Polish, Spanish, Chinese (Simplified),
and Hindi. Changing the language takes effect after you confirm the options.
The theme follows Windows when it is set to System.


KEYBOARD SHORTCUTS

Files
    Ctrl+O            Open file (also drag a file onto the window)
    Ctrl+S            Save
    Ctrl+Shift+S      Save all
    Ctrl+W            Close file (or middle-click its tab)

Resources (tree)
    Alt+Left / Right  Back / forward through selected resources
    Ctrl+C / X / V    Copy / cut / paste resources (images and text too)
    Del               Delete resource (a type node deletes all of that type)
    F2                Rename / change language
    Alt+Enter         Properties
    Ctrl+Ins          Add resource from file (or drop a file on the tree)
    Ctrl+R            Replace from file (or drop an image on the preview)
    Ctrl+E            Export as
    Ctrl+D            Dump raw
    Drag a resource   Export it to Explorer

Editing
    Ctrl+Z / Ctrl+Y   Undo / redo (editor first, then resource changes)
    Ctrl+1 / 2 / 3 / 4  The open views, in order
    Ctrl+F, F3        Find. In Preview, Editor, or Hex, searches that view
    Ctrl+G            Go to offset in the hex editor
    Insert            Toggle insert / overwrite in the hex editor
    Ctrl++ / - / 0    Zoom in / out / actual size (Ctrl+wheel on images)

Dialog designer
    Arrows            Move selection (Ctrl: by 1 dialog unit, Shift: resize)
    Ctrl/Shift+click  Add to selection; drag on empty space for a rubber band
    Del, Ctrl+C/X/V   Delete, copy, cut, paste controls
    Esc               Clear selection, leave tab order mode

Menu editor
    Alt+Up / Down     Move item
    Alt+Left / Right  Outdent / indent item
    Insert, Del       Insert / delete item


COMMAND LINE

A filename by itself opens the window. Any switch runs a batch and does not
open the window. A switch starts with - or /. The name can be shortened as
long as it stays unique, so -o is -open and -a is -action. A value follows
the switch as the next argument, or after = or :.

    "Resource Cracker.exe" -help
    "Resource Cracker.exe" -help script

    -open file        PE, .res, or .rc to read
    -save file        file to write, or a folder when extracting many resources
    -resource file    file to add (.res, .rc, .bmp, .ico, .cur, or any file)
    -action name      add, addskip, addoverwrite, modify, compile, delete,
                      extract, changelanguage(lang)
    -mask T,N,L       type, name, and language; each part is optional
    -log file|CON|NUL log file, the console, or no log
    -script file      run several commands from one file

-open is required, except that -help does not open a file. -save is required
when the command changes the file. Saving over the same path updates it in
place. A different -save path writes a copy.

If you omit -log, messages go to Resource Cracker.log in the current
directory. CON writes them to the console. NUL writes nothing. The process
returns 0 on success and 1 when the command fails.

The mask is Type,Name,Language. Leave a part empty to match every value.
Commas are required when a later part is present. Quote a name that contains
a comma. A type may be a number, an RT_ name, or one of these words:

    CURSOR, CURSORGROUP, GROUP_CURSOR
    ICON, ICONGROUP, GROUP_ICON
    BITMAP, MENU, DIALOG
    STRING, STRINGTABLE
    FONTDIR, FONT
    ACCELERATOR, ACCELERATORS
    RCDATA, MESSAGETABLE
    VERSION, VERSIONINFO
    DLGINCLUDE, PLUGPLAY, VXD
    ANICURSOR, ANIICON, HTML, MANIFEST

ICON and CURSOR select the group, not the individual image.

Actions:

    add              add the resource; fail if that type, name, and language
                     already exist
    addskip          add it, or leave the existing one unchanged
    addoverwrite     add it, or replace the existing one
    modify           replace an existing resource; skip it if it is missing
    delete           delete every resource that matches the mask
    extract          write the matching resources; -resource or -save is the
                     destination file, or a folder when more than one matches
    changelanguage(n)  set the language id of every match, for example
                     changelanguage(1049)
    compile          compile an .rc script (-open) into a .res file (-save);
                     this action is used on its own, not together with others

Adding one ordinary file requires a type and a name in the mask. Adding from
another PE, .res, or .rc copies the resources that match the mask. A missing
mask matches every resource.

Examples:

    "Resource Cracker.exe" -open app.exe -action extract -mask ICON -save C:\out

    "Resource Cracker.exe" -open app.exe -resource logo.png -action addoverwrite -mask BITMAP,1,1033 -save app.exe

    "Resource Cracker.exe" -open app.exe -action delete -mask VERSION -save app-noversion.exe

    "Resource Cracker.exe" -open script.rc -action compile -save script.res

    "Resource Cracker.exe" -open app.exe -action changelanguage(1033) -mask DIALOG,100, -save app.exe -log CON


SCRIPT FILES

    "Resource Cracker.exe" -script commands.txt

Lines starting with // are comments, except inside quotes. The file has two
sections:

    [FILENAMES]
    Open=C:\in\app.exe
    Save=C:\out\app.exe
    Log=C:\out\app.log

    [COMMANDS]
    -add logo.png, BITMAP,1,1033
    -addskip extra.res, ,,
    -addoverwrite picture.ico, ICON,1,0
    -modify note.txt, RCDATA,NOTE,0
    -extract C:\out\icons, ICON
    -delete VERSION
    -changelanguage(1033) DIALOG,100,

Open may also be written as Exe. Save may also be written as SaveAs.
Open is required. Save is required when a command changes the file.
A script needs at least one command. Compile is not a script step; use
-action compile on the command line for that.
