Introduction

The .rsrc section stores resources associated with a Windows executable or DLL. Typical resources include icons, dialogs, menus, version information, strings, and application-defined binary data.

A raw payload can be added as an RCDATA resource and linked into the executable without representing it as a C array. RCDATA is intended for application-defined binary data, and the resource compiler includes the supplied bytes directly in the resulting PE image.

This approach is especially convenient for payloads maintained as separate binary files. It does not exist because .data or .rdata have a small fixed payload limit; those sections can also contain large objects. Resources simply provide a cleaner build-time method for embedding and identifying external data.

Adding the Payload as a Resource

The steps below illustrate how to store a payload in the .rsrc section.

1. Inside Visual Studio, right-click on Resource files then click Add > New Item.

1. Select Resource File (.rc) and add it to the project.

1. This will generate a new sidebar, the Resource View. Right-click on the .rc file (Resource.rc is the default name), and select the Add Resource option.

1. Select Import to import an existing binary file.

1. The screenshot uses a file named calc.ico, but the payload does not need to be disguised as an icon. A file such as payload.bin can be imported directly because Visual Studio will ask for the resource type in the following step.

1. A prompt will appear requesting the resource type, enter RCDATA.

1. After clicking OK, the payload should be displayed in raw binary format within the Visual Studio project