Skip to content

.rsrc Section

The .rsrc section of a PE file contains resources such as icons, images, and version information. Malware sometimes hides shellcode within these resources and extracts it at runtime, as the section is usually ignored by cursory code scans. Although the example for this technique is not yet implemented in the repository, the idea is to embed the payload as a resource and read it from the .rsrc section when needed. See https://github.com/CX330Blake/Black-Hat-Zig/issues/5 for future updates.