0

I'm new to using Resource Hacker to alter *.EXE and *.DLL files and I need help understanding all the data it provides when "opening" these files.

More specifically, using Res Hacker, I opened ntoskrnl.exe which is located in C:\Windows\System32\ and I pressed "PREFETCHWLIST : 0" file in the "RCData" folder. This is what Res Hacker displayed:

(Image)

What does all this data represent? What type of data is displayed in each of the three columns? Thank you!

DavidPostill
  • 153,128
  • 77
  • 353
  • 394
Banana Programmer
  • 1
  • 1

1 Answers1

0

First column is the address in memory. Second column is the raw dump of the byte data Third is that same data displayed decoded using defaults. see here http://www.angusj.com/resourcehacker/

rimraf
  • 156
  • 1
  • 7
  • Thanks, archae0pteryx. (I upvoted your answer but it's not yet visible.) Is it possible to use the data dump to decompile the program (**ntoskrnl.exe**)? – Banana Programmer Sep 04 '16 at 17:47
  • @banana I'm not sure. That's a bit outta my depth... =) I would start here if i was going at this sort of thing... http://stackoverflow.com/questions/2146192/general-purpose-utility-or-library-for-compiling-decompiling-binary-data-files – rimraf Sep 04 '16 at 17:56
  • Once again, thanks. I'll make sure to check that question. – Banana Programmer Sep 04 '16 at 18:17