Windows PE resource embedding Shellcode, loading and executing Shellcode from the DATA resource segment of EXE

Build Environment |

• Compiler: MSVC (Visual Studio 2019)
• Platform Toolset: v142
• Target Platform: Windows x86 / x64
• Subsystem: Windows (No console)

ConsoleApplication1

Win32 Windows subsystem program (without console black window). Embed the shellcode binary file as a 'DATA' type resource inside the EXE, read the shellcode in its own PE resource segment at runtime, apply for memory, copy, and modify memory page permissions, and then execute the shellcode.

Technical Points

1. PE Resource section .rsrc : Use .rc resource script embed binary file as DATA resource. PE资源段，通过rc脚本将二进制文件打包为DATA自定义资源
2. Resource related Win32 API:
   • FindResourceW — Locate resource by ID & resource‑type
   • LoadResource — Load resource into process memory
   • SizeofResource — Get resource binary size
   • LockResource — Get pointer point to resource raw data（return read‑only memory pointer）
3. VirtualAlloc: Reserve & commit memory page, initial permission PAGE_READWRITE
4. VirtualProtect: Modify memory page permission to PAGE_EXECUTE_READ after memcpy shellcode
5. Function pointer cast, jump to memory buffer and execute raw machine‑code shellcode