Skip to content

Instantly share code, notes, and snippets.

@andrewkroh
Created Jul 23, 2019
Embed
What would you like to do?
Extact the msobjs.dll message table
#include <windows.h>
#include <stdio.h>
int ProcessBlock(MESSAGE_RESOURCE_DATA* data, MESSAGE_RESOURCE_BLOCK* block)
{
MESSAGE_RESOURCE_ENTRY* entry = (MESSAGE_RESOURCE_ENTRY*) ((unsigned char*)data + block->OffsetToEntries);
for (DWORD id = block->LowId; id <= block->HighId; id++)
{
if (entry->Flags == 0x0001) // wide char
printf("%d, %ls", id, entry->Text);
else if (entry->Flags == 0x0000) // ANSI
printf("%d, %s", id, entry->Text);
entry = (MESSAGE_RESOURCE_ENTRY*) ((unsigned char*)entry + entry->Length);
}
return 1;
}
int main(void)
{
HMODULE hMod = LoadLibrary("C:\\Windows\\System32\\msobjs.dll");
if (hMod == NULL) return 1;
HRSRC hRsrc = FindResource(hMod, MAKEINTRESOURCE(1), RT_MESSAGETABLE);
if (hRsrc == NULL) return 1;
HGLOBAL hGlobal = LoadResource(hMod, hRsrc);
if (hGlobal == NULL) return 1;
MESSAGE_RESOURCE_DATA* data = (MESSAGE_RESOURCE_DATA*)LockResource(hGlobal);
if (data == NULL) return 1;
for (DWORD block = 0; block < data->NumberOfBlocks; block++)
if (!ProcessBlock(data, &data->Blocks[block]))
return 1;
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment