Question

When I was searching on Google I found a useful class which let us change the icon of any .exe file using the following line of code :

WindowsFormsApplication1.IconInjector.InjectIcon("myfile.exe", "myicon.ico", 200, 1);

Where 200 and 1 are respectively icon GroupID and icon BaseID which I can determine using Resource Hacker. In this case the file’s icon changes successfully without corrupting the file.

So i planned to use this class on my program which is a SFX / Software protector, the output file always hasn’t an icon, all what I can see on Resource hacker is the below :

i can’t see icon group id nor the base id, anyway, (I don’t know what to put instead of 200 and 1 in this case) So I tried to change the icon using the same line of code mentioned above, I used the following line of code (same as above):

WindowsFormsApplication1.IconInjector.InjectIcon("myfile.exe", "myicon.ico", 200, 1);

The file icon was successfully changed but the file doesn’t work anymore!

When I tried to reopen the file using ResourceHacker, I found the below:

It seems that the icon resources were successfully added, but i can’t figure out why the file doesn’t work anymore, it seems that is corrupted.

Any help would be appreciated.

Note : I tried using this class with unprotected file and it works like a charm!

The class I am using is the below:

// IconInjector.cs
using System;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace WindowsFormsApplication1
{

/// <summary>
/// IconInjectorクラスの定義
/// </summary>
public class IconInjector
{
    [DllImport("kernel32.dll", SetLastError = true)]
    //static extern bool UpdateResource(IntPtr hUpdate, string lpType, string lpName, ushort wLanguage, IntPtr lpData, uint cbData);
    static extern int UpdateResource(IntPtr hUpdate, uint lpType, uint lpName, ushort wLanguage, byte[] lpData, uint cbData);

    [DllImport("kernel32.dll", SetLastError = true)]
    static extern IntPtr BeginUpdateResource(string pFileName,
        [MarshalAs(UnmanagedType.Bool)]bool bDeleteExistingResources);

    [DllImport("kernel32.dll", SetLastError = true)]
    static extern bool EndUpdateResource(IntPtr hUpdate, bool fDiscard);

    /// <summary>
    /// アプリケーションのメイン エントリ ポイントです。
    /// </summary>
    [STAThread]
    public static void InjectIcon(string execFileName, string iconFileName, uint iconGroupID, uint iconBaseID)
    {
        const uint RT_ICON = 3;
        const uint RT_GROUP_ICON = 14;

        // アイコンファイルの読み込み
        IconFile iconFile = new IconFile();
        iconFile.Load(iconFileName);

        // リソースの更新開始
        IntPtr hUpdate = BeginUpdateResource(execFileName, false);
        Debug.Assert(hUpdate != IntPtr.Zero);

        // RT_GROUP_ICON 書き込み
        byte[] data = iconFile.CreateIconGroupData(iconBaseID);
        UpdateResource(hUpdate, RT_GROUP_ICON, iconGroupID, 0, data, (uint)data.Length);

        // RT_ICON書き込み
        for (int i = 0; i < iconFile.GetImageCount(); i++)
        {
            byte[] image = iconFile.GetImageData(i);
            UpdateResource(hUpdate, RT_ICON, (uint)(iconBaseID + i), 0, image, (uint)image.Length);
        }

        // リソースの更新終了
        EndUpdateResource(hUpdate, false);
    }
}
}

Any help or suggestion on adding the icon to the protected file without corrupting it?

Answer 1

It sounds like the protection application is verifying that the contents of the file haven’t been tampered with. Injecting an icon is definitely a form of tampering, and unless the protection software is updated to ignore it, it will always fail. Alternatively if you own the protection software you could update it to not strip the icons.