Decode RT_STRING from PE resources.

libexeinfo/PE/PE.cs

@@ -51,9 +51,9 @@ namespace libexeinfo
         string[]             importedNames;
         string               moduleName;
         COFF.SectionHeader[] sectionHeaders;
+        public Version[]     Versions;
         public ResourceNode  WindowsResourcesRoot;
         WindowsHeader64      winHeader;
-        public Version[] Versions;
 
         /// <summary>
         ///     Initializes a new instance of the <see cref="T:libexeinfo.PE" /> class.
@@ -395,6 +395,9 @@ namespace libexeinfo
                     Versions = GetVersions().ToArray();
 
                     strings.AddRange(from v in Versions from s in v.StringsByLanguage from k in s.Value select k.Value);
+
+                    foreach(ResourceNode rtype in WindowsResourcesRoot.children.Where(r => r.name == "RT_STRING"))
+                        strings.AddRange(GetStrings(rtype));
                 }
 
             sectionHeaders = newSectionHeaders.Values.OrderBy(s => s.pointerToRawData).ToArray();
@@ -501,8 +504,14 @@ namespace libexeinfo
                     };
 
                     if(level == 2)
-                        try { thisNode.children[i].name = new CultureInfo((int)thisNode.children[i].id).DisplayName; }
-                        catch { thisNode.children[i].name = $"Language ID {thisNode.children[i].id}"; }
+                        if(thisNode.children[i].id == 0)
+                            thisNode.children[i].name = "Neutral";
+                        else
+                            try
+                            {
+                                thisNode.children[i].name = new CultureInfo((int)thisNode.children[i].id).DisplayName;
+                            }
+                            catch { thisNode.children[i].name = $"Language ID {thisNode.children[i].id}"; }
 
                     stream.Position = dataEntry.rva - (rsrcVa - rsrcStart);
                     stream.Read(thisNode.children[i].data, 0, (int)dataEntry.size);

libexeinfo/PE/Strings.cs

@@ -0,0 +1,70 @@
+//
+// Strings.cs
+//
+// Author:
+//       Natalia Portillo <claunia@claunia.com>
+//
+// Copyright (c) 2017-2018 Copyright © Claunia.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+namespace libexeinfo
+{
+    public partial class PE
+    {
+        public static IEnumerable<string> GetStrings(ResourceNode resource)
+        {
+            List<string> strings = new List<string>();
+
+            if(resource.data != null) strings.AddRange(GetStrings(resource.data));
+
+            if(resource.children == null) return strings;
+
+            foreach(ResourceNode child in resource.children) strings.AddRange(GetStrings(child));
+
+            return strings;
+        }
+
+        public static IEnumerable<string> GetStrings(byte[] data)
+        {
+            List<string> strings = new List<string>();
+
+            int pos = 0;
+            while(pos < data.Length)
+            {
+                ushort len = BitConverter.ToUInt16(data, pos);
+                pos += 2;
+
+                if(len == 0) break;
+
+                byte[] buffer = new byte[len * 2];
+                Array.Copy(data, pos, buffer, 0, buffer.Length);
+                string str = Encoding.Unicode.GetString(buffer);
+                if(!string.IsNullOrWhiteSpace(str)) strings.Add(str);
+                pos += buffer.Length;
+            }
+
+            return strings;
+        }
+    }
+}

libexeinfo/libexeinfo.csproj

@@ -67,6 +67,7 @@
     <Compile Include="Os2\Enums.cs" />
     <Compile Include="Os2\Resources.cs" />
     <Compile Include="Os2\Structs.cs" />
+    <Compile Include="PE\Strings.cs" />
     <Compile Include="PE\Version.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="MZ\Consts.cs" />