When a PE contains resources in multiple languages, all the resources are listed in the Resource
directory, along with their LANGID
and Size
. However, when viewing the resources, all of them show the same content, which appears to be the one from the first available language. The same PE when viewed with ArcLite, shows the correct content.
The PE file FortiClient VPN Installer contains resources in multiple languages. If you open this file in PE Analyzer and navigate to the Resource\DIALOG
directory, you will see 14 entries for the dialog 0x000000cb (203)
. If you select the entry with LANGID
of 0x0409
and press F3
to view the resource, the first line will display LANGUAGE LANG_CHINESE SUBLANG_DEFAULT
, which is incorrect, since 0x409
or 1033
is English, not Chinese. All 14 entries for the dialog show the same resource with LANG_CHINESE
.
This issue is not present in PE Analyzer version 3.8.0
. Versions from 3.9.2
to the current version 3.10.8
all have this issue.
Anonymous
3.10.9
Thanks, but you forgot to release the binaries, so I can't try it out yet.
Oops... Done.
I just tried out
3.10.9
. This issue is now resolved.Also, thanks for adding the language name to the filename. I was going to report an issue with search, which was caused by duplicate filenames. But now that the filenames are unique, that issue got resolved too.
I just noticed that resources like
MANIFEST
andICON
, which are language independent, show the language in the filename. For example, in the PE file FortiClient VPN Installer, the name of the manifest is displayed as1_en-US
. Shouldn't the name be1
or even1_system
instead?These resources are the ones defined with
LANGID
=0x0800
, which isLOCALE_SYSTEM_DEFAULT
. Since my system is configured with language English (United States), these resources show up withen_US
in the name.LANG_SYSTEM_DEFAULT = MAKELANGID(LANG_NEUTRAL, SUBLANG_SYS_DEFAULT)
base lang_id is LANG_NEUTRAL I think "1" is more suitable.
Agreed.
3.10.10
Looks great. Thanks!
PE's that contains resources with
LANGID
of0x0000
and0x0400
, which areLANG_NEUTRAL
andLANG_USER_DEFAULT
, still display resources with the language suffix, which isen-US
in my case.I think you'll have to make the change for these two languages as well. Actually, for any language that is
LANG_NEUTRAL
. Something like the following should cover all three cases.Note that if a PE contains resources with any of these combinations, the filenames will be duplicate, causing the issue that I reported in this ticket. However, I think its an unlikely case.
Agreed. 3.10.11
I tested it, and it's working fine. Thank you.