Today, just for fun i tried to play with resources of import reconstructor.

Acutally i know very well how to replace the resources but now i want add the extra resource to the exe and i want to add an jpg image file to exe but getting trouble in that. I am really not getting how to insert that control. This is the location where i want to add a small jpg image. So i just deleted that resouce and inserted the new control bitmap but how to add that specific image file which i want.
http://i28.tinypic.com/2vm8p5y.jpg


Any nice tip over it.

Probably your biggest problem was deleting the resource and then inserting a new one rather than modifying the existing resource, (you must have a very forgiving PE, most will gag on any major change especially if they contain a CRC check), all resources are given a unique ID in Olly examining the resources of a file will show a hex identifier - deleting then adding would assign a unique identifier, I've never explored modifying to this extent, just usually eliminating a watermark if the programmer is so inexperienced he doesn't embed it in the PE itself, you also raise the question in my mind whether or not the size won't throw off the whole compilitation - not much help, just my thoughts.

SiGiNT

Yes, i have seen couple of tut over modifying resources which is easy like but i only heard that we can add aditional source to exe especially at least a image file without any trouble and i have seen that few guys and has done that but still dont know how they actually did. Is there any nice guy who can let us know how to add an image resource to an exe at any location

Well it's not this simple, but assuming you have the original PE the resource you deleted should have a number identifier, (I think), that you can see in XN Resource editor, it would be in decimal - convert it to hex, then search your PE in Olly or a disassembler for Push XXX where XXX is the old resource, change to your new number and it might work, like I said I have a big question in my mind if you've relocated the base of the compilation, and whether or not anything will work correctly.

SiGiNT

Don't get me wrong, I'm in no way trying to discourage you, actually I think your zeal for experimentation is quite admirable!

alternativly from a dev standpoint you could superclass/subclass the window procedure..and dynamicly replace the picture..using the resource functions..lol ;}
or hook the area where is 'push XXX' resource id as SiGiNT descibed and push your resources id instead(its a small 'data' hook)...

BanMe