I try to edit resources (pictures) in an executable file compiled by visual basic 6. I use PE Explorer and Resource Hacker, but they can't find any picture, only the icon.
Is there anyway to edit resources in an exe compiled by VB6??

No, there are no resources in a VB6 file. You have to get the location of the pictures yourself.

How do I find the picture I want to edit?
Can I edit the picture using hex editor? How?

There are 2 ways to go about doing this:

Way number 1 - The picture file method
============================

1. Here, the picture exists as a seperate .BMP/.JPG/.GIF whatever.

2. Go to sysinternals.com

3. Get FILEMON and REGMON

4. Check to see which picture file is being accessed using FILEMON

5. Check if the registry points to any picture file using REGMON

6. Do not be surprised if the picture is not in the normal extension like .bmp or .jpg

Way number 2 - The Binary method
=========================

1. You can assume that the picture is NOT in the VB6 executable

2. But, it CAN be in the .DLLs that the VB6 program checks

3. Get a dependency scanner (www.dependencywalker.com) and get going on the dlls accessed (including delay loaded and getproc-ed ones)

4. Ignore the System dlls (kernel, advapi, user, etc)

5. Resource edit those dll files that you find other that the above.

Way number 3 - Highly difficult, but not impossible
===================================

If the picture plays an important part, chances are, its going to be in the encrypted form. In this case, your best bet is to use a debugger and try to find out where the picture is being accessed. This is very difficult, but not impossible. For you to decrypt, and for the programmer to encrypt.

Have Phun

It seems that the pictures are inside the code, no dlls, just vb runtime
So they're encrypted in the exe file?

Quite possibly.

Alternatively, it could be EMBEDDED in the code.

Search the msgboard for BIOS cracking in Compaq for my reply on the COMPAQ bmp and how to extract it.

It is also embedded.

Have Phun,

Yeah, it's embedded in the code.
I found the JFIF header and end of image, extract that block, open in mspaint, o yes that's the image I want to replace.
I replace the block with my own jpeg block, now the application show my picture