How are Win32 executable resources handled?

Question

I don’t know why it is so difficult to find the answer to this question on Google, but I want to establish something direct.

Are Win32 resources implemented in the same way as static data, where is this data stored in RAM for the entire process runtime, or is it stored on disk like a regular file before being loaded into memory? Functions like LoadResource / LoadString imply the latter, but I want to be absolutely sure that the abstraction does not deceive me.

Answer 1

In the old days (for example, Windows 3.1 and earlier), resources were copied to memory at boot time, and you just got a handle from them. A memory manager could do things like transferring a copy in memory to defragment space or even secretly unload a resource until you need it. When you needed a resource, the second step was taken to "block" it in memory. This gave you a pointer to the copy and convinced that the resource manager does not move it until you unlock it again.

On 32-bit versions of Windows, resources are not copied. The executable (or DLL) is mapped to memory, and if you touch the resource, the virtual memory manager will make sure that it is there for you.

APIs (FindResource, LoadResource, LockResource) reflect old days, with handles to resources and locking of handles, etc. But the implementation is much simpler now, because the descriptor is just a pointer to the beginning of the resource and the lock does not actually work, throws the descriptor into the type of the pointer and returns it.

Answer 2

You may notice that all resource APIs accept the hModule argument - this is actually a pointer to the PE header of the module in memory, not a file descriptor on disk. Thus, the PE resource section of the file ( .rsrc ) must be present in the program memory space for these APIs to work. Of course, as with all memory-mapped files, data probably doesn't actually load into physical memory until it is needed.