You've enumerated the resources in the module which tells you the name of each resource of a specific type. Once you've done that you need to load the resource to examine its content. In your case you need the resource of type RT_MESSAGETABLE
that is named 1
.
You now need to use FindResource
, LoadResource
and LockResource
to get a pointer to the beginning of the message table structures. You can then use the MESSAGE_RESOURCE_DATA
struct , and in turn MESSAGE_RESOURCE_BLOCK
and MESSAGE_RESOURCE_ENTRY
to unpack the content of the message table. This Code Project article goes into more detail on the process.
Here's a rather naff C program that enumerates your message table:
#include <windows.h>
#include <stdio.h>
int ProcessBlock(MESSAGE_RESOURCE_DATA* data, MESSAGE_RESOURCE_BLOCK* block)
{
MESSAGE_RESOURCE_ENTRY* entry = (MESSAGE_RESOURCE_ENTRY*) ((unsigned char*)data + block->OffsetToEntries);
for (DWORD id = block->LowId; id <= block->HighId; id++)
{
if (entry->Flags == 0x0001) // wide char
printf("%d, %ls", id, entry->Text);
else if (entry->Flags == 0x0000) // ANSI
printf("%d, %s", id, entry->Text);
entry = (MESSAGE_RESOURCE_ENTRY*) ((unsigned char*)entry + entry->Length);
}
return 1;
}
int main(void)
{
HMODULE hMod = LoadLibrary("C:\desktop\EventLogMsgs.dll");
if (hMod == NULL) return 1;
HRSRC hRsrc = FindResource(hMod, MAKEINTRESOURCE(1), RT_MESSAGETABLE);
if (hRsrc == NULL) return 1;
HGLOBAL hGlobal = LoadResource(hMod, hRsrc);
if (hGlobal == NULL) return 1;
MESSAGE_RESOURCE_DATA* data = (MESSAGE_RESOURCE_DATA*)LockResource(hGlobal);
if (data == NULL) return 1;
for (DWORD block = 0; block < data->NumberOfBlocks; block++)
if (!ProcessBlock(data, &data->Blocks[block]))
return 1;
return 0;
}
Output
1, Installation
2, Database Query
3, Data Refresh
1000, My application message text, in English, for message id 1000, called from %1.
1002, My generic information message in English, for message id 1002.
1004, The update cycle is complete for %%5002.
5001, Sample Event Log
5002, SVC_UPDATE.EXE
-2147482647, My application message text, in English, for message id 1001, called from %1.
-2147482645, My generic warning message in English, for message id 1003, called from %1.
-2147482643, The refresh operation did not complete because the connection to server %1 could not be established.
Please excuse my appalling C. Neither C nor C++ are languages that I am remotely fluent in. However, the code will at least show you how to extract the information you desire.