Bajty 24..25 od początku pliku pliku zawierają offset do windowsowego nagłówka, a w nim z kolei (bajty 36..37 relatywnie do początku tegoż nagłówka) offset do tablicy zasobów. Jej konstrukcji już nie chce mi się tłumaczyć :P, więc zacytuję dokumentację:
Resource Table
The resource table describes and identifies the location of each resource in the executable file. The table has the following form:
<bcb>
WORD rscAlignShift;
TYPEINFO rscTypes[];
WORD rscEndTypes;
BYTE rscResourceNames[];
BYTE rscEndNames;
</bcb>
Following are the members in the resource table:
rscAlignShift Specifies the alignment shift count for resource data. When the shift count is used as an exponent of 2,
the resulting value specifies the factor, in bytes, for computing the location of a resource in the
executable file.
rscTypes Specifies an array of TYPEINFO structures containing information about resource types. There must
be one TYPEINFO structure for each type of resource in the executable file.
rscEndTypes Specifies the end of the resource type definitions. This member must be zero.
rscResourceNames Specifies the names (if any) associated with the resources in this table. Each name is stored as
consecutive bytes; the first byte specifies the number of characters in the name.
rscEndNames Specifies the end of the resource names and the end of the resource table. This member must be
zero.
Type Information
The TYPEINFO structure has the following form:
<bcb>
typedef struct _TYPEINFO {
WORD rtTypeID;
WORD rtResourceCount;
DWORD rtReserved;
NAMEINFO rtNameInfo[];
} TYPEINFO;</bcb>
Following are the members in the TYPEINFO structure:
rtTypeID Specifies the type identifier of the resource. This integer value is either a resource-type value or an offset
to a resource-type name. If the high bit in this member is set (0x8000), the value is one of the following
resource-type values:
Value Resource type
RT_ACCELERATOR Accelerator table
RT_BITMAP Bitmap
RT_CURSOR Cursor
RT_DIALOG Dialog box
RT_FONT Font component
RT_FONTDIR Font directory
RT_GROUP_CURSOR Cursor directory
RT_GROUP_ICON Icon directory
RT_ICON Icon
RT_MENU Menu
RT_RCDATA Resource data
RT_STRING String table
If the high bit of the value in this member is not set, the value represents an offset, in bytes relative to the
beginning of the resource table, to a name in the rscResourceNames member.
rtResourceCount Specifies the number of resources of this type in the executable file.
rtReserved Reserved.
rtNameInfo Specifies an array of NAMEINFO structures containing information about individual resources. The
rtResourceCount member specifies the number of structures in the array.
Name Information
The NAMEINFO structure has the following form:
<bcb>
typedef struct _NAMEINFO {
WORD rnOffset;
WORD rnLength;
WORD rnFlags;
WORD rnID;
WORD rnHandle;
WORD rnUsage;
} NAMEINFO;
</bcb>
Following are the members in the NAMEINFO structure:
rnOffset Specifies an offset to the contents of the resource data (relative to the beginning of the file). The offset is in terms of
alignment units specified by the rscAlignShift member at the beginning of the resource table.
rnLength Specifies the resource length, in bytes.
rnFlags Specifies whether the resource is fixed, preloaded, or shareable. This member can be one or more of the following
values:
Value Meaning
0x0010 Resource is movable (MOVEABLE). Otherwise, it is fixed.
0x0020 Resource can be shared (PURE).
0x0040 Resource is preloaded (PRELOAD). Otherwise, it is loaded on demand.
rnID Specifies or points to the resource identifier. If the identifier is an integer, the high bit is set (8000h). Otherwise, it is an
offset to a resource string, relative to the beginning of the resource table.
rnHandle Reserved.
rnUsage Reserved.