0

I'm new to using Resource Hacker to alter *.EXE and *.DLL files and I need help understanding all the data it provides when "opening" these files.

More specifically, using Res Hacker, I opened ntoskrnl.exe which is located in C:\Windows\System32\ and I pressed "PREFETCHWLIST : 0" file in the "RCData" folder. This is what Res Hacker displayed:

(Image)

What does all this data represent? What type of data is displayed in each of the three columns? Thank you!

1 Answer 1

0

First column is the address in memory. Second column is the raw dump of the byte data Third is that same data displayed decoded using defaults. see here http://www.angusj.com/resourcehacker/

3
  • Thanks, archae0pteryx. (I upvoted your answer but it's not yet visible.) Is it possible to use the data dump to decompile the program (ntoskrnl.exe)? Sep 4, 2016 at 17:47
  • @banana I'm not sure. That's a bit outta my depth... =) I would start here if i was going at this sort of thing... stackoverflow.com/questions/2146192/…
    – rimraf
    Sep 4, 2016 at 17:56
  • Once again, thanks. I'll make sure to check that question. Sep 4, 2016 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .