There are variety of tools that allow editing the resources of Windows executables.These tools allow a very easy interface for changing the programs look and feel.Replacing icons, text, menus can be easily done without any knowledge in reversing.My question is, what option I have to prevent the resources being so easily edited ?
How to prevent use of Resource editors
windows;pe resources
Resources are just a standard structure with defined constants, but in the end, it's just a recursive structure to a buffer, no matter what it contains (here is the standard layout).It can theoretically contain anything - any depth, loops, invalid types, etc... but then standard APIs will not work with them.So, you need to make sure that, if you encrypt or compress resources, they need to be restored (both the resource directory structure, and their content) before any of these APIs is used, which might not be obvious.In particular, some resources will be used by the OS even before the file is executed, such as first icons, manifest and version information - so you probably want to keep these intact.A simple way to prevent trivial resource editing would be to run a stream cipher on selected resources, on the final binary (after the linker put them in place and generated the resource entry in the DataDirectory), and to restore these resources on demand or on program initialization.If you're looking for a ready-made solution, many good packers such as PECompact support resource compression, thus preventing external resource editing.