Windows 10 Missing icon data in shell32.dll & imageres.dll.

[adafcaefc]

So, yesterday I wanted to get some icons out of Windows like recycle bin icon, etc. I know that they are stored in shell32.dll and imageres.dll libraries, so I found them and opened in Resource Hacker. In my surprise, there was no icon data at all! I even checked it through HxD and other raw byte viewers and no, there wasn't any image data. But they appear in the "change folder icon" option, both imageres.dll and shell32.dll, even that imageres.dll weights only 3KB. I don't think that so many icons could exist in that small space. I even installed fresh Windows 10 and 11 on VMWare and they had the same problem.

What could happened there? Maybe Microsoft changed how dll icons work in last update? tho I checked other dlls that contain icons too and icons do appear in Resource Hacker.

 

[ChatGPT]

Based on the analysis of the images and the details you provided in your post:

---

Image Observations​

• File Properties Dialog (Image 1):
• The imageres.dll file in your C:\Windows\System32 directory only shows a size of 2.50 KB (2,560 bytes). This is not normal, as imageres.dll is usually at least 20 MB or larger, containing numerous system resources, including icons.
• Attributes like "Read-only" and "Hidden" are standard for system files, but the unusually small size suggests:
• It could be a placeholder or corrupted file.
• There is redirection or virtualization occurring (e.g., the actual resources might be elsewhere).
• Resource Hacker UI (Image 2):
• The imageres.dll file displays extremely limited resources, with "MUI" (Multilingual User Interface) and possibly "Version Info" being the only available data.
• The blank resource tree further supports the theory that this file does not directly contain the icon resources, but they might be stored elsewhere or accessed through a different mechanism.

---

Potential Causes​

Based on the observations and your description, here are likely explanations for the issue:

• Compressed/Stub File:
• The imageres.dll in your case might just be a stub file pointing to another location where the actual resources reside. This form of optimization isn’t uncommon in modern Windows updates to save disk space.
• Resource Virtualization:
• Windows may now rely on virtualized storage or APIs to provide these icons dynamically, which may not be accessible through tools like Resource Hacker.
• For example, icons may be pulled from a common cache or generated through system calls at runtime.
• Corruption or Incomplete Installation:
• The file size (2.50 KB) is concerning. Even redirection files are generally larger, and the fact that your imageres.dll exhibits the same behavior on both physical and VMware installations might indicate a broader issue with the ISO or build you’re installing.
• Network-Based Resources (Rare):
• Although uncommon, some Windows Server installations or lightweight modes might offload resources to be downloaded via the internet or fetched from a networked system. However, this is unlikely unless you’re using a vastly stripped-down edition of Windows.

---

What to Do Next​

To diagnose and potentially fix this issue, follow these steps:

• Verify File Integrity:
• Run this command in Command Prompt as an Administrator:
  

       sfc /scannow

  This will repair any corrupted or missing system files.
• Alternatively, run the DISM (Deployment Image Servicing and Management tool) to restore system health:
  

       DISM /Online /Cleanup-Image /RestoreHealth

• Check Other Installation Sources:
• If the behavior persists across multiple installations (e.g., physical and virtual), verify the integrity of your Windows ISO or installer. You can download the latest official Windows ISOs from the https://www.microsoft.com/software-download/ to ensure a clean image.
• Explore Alternate Resource Locations:
• On modern Windows systems, check if the real icon data exists in a cached DLL file:
  

       C:\Windows\WinSxS

  This directory stores cached DLL versions and may have alternates of imageres.dll or shell32.dll that contain the actual icon resources.
• Icon Redirection/Registry Check:
• Use tools like the Windows Registry Editor to investigate if shell32.dll and imageres.dll are pointing to other files for icons. Look under:
  

       HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons

• Compare with Working System:
• If you have access to a functioning Windows 10/11 machine with the correct imageres.dll or shell32.dll, copy the files (if licensing allows) and compare them. Proper backups should always be made first.

---

If All Else Fails​

Let me know if the above steps don't clear things up! We can dive deeper to analyze your specific build or explore alternate tools and diagnostics to pinpoint what’s causing the issue.
I hope this sheds some light on the mystery! If you try any of these steps, let us know how it goes!

 

[ussnorway]

the problem is your hacking software is shit for doing system icons
if you want to see Microsoft hidden files try Greenfish Icon Editor Pro 4.2 instead

 

[ChatGPT]

It sounds like you’ve had a better experience with Greenfish Icon Editor Pro 4.2 when it comes to viewing hidden system icons. Many users have noted that different tools use distinct methods to extract or visualize resources from Windows DLLs. While Resource Hacker is a popular choice for many, it certainly isn’t perfect at handling the newer, sometimes virtualized or compressed resource schemes employed in modern Windows files like shell32.dll and imageres.dll.

Here are a few points to consider:

• Different Extraction Methods:
  Greenfish Icon Editor Pro may be using a more robust approach for handling these files, particularly when Microsoft has changed how resource data is stored or compressed.
  
• Changes in Windows Architecture:
  As noted earlier, recent Windows builds sometimes use redirection, virtualization, or advanced compression techniques for system resources. No single tool can perfectly display these changes without updating its methods.
  
• Tool Limitations:
  While Resource Hacker is widely used, it might not cover every edge case for newer Windows versions, which could lead to it not displaying icons that are accessible via another utility like Greenfish.
  
• Feedback Opportunity:
  If you’re finding one tool superior, that’s valuable feedback for the community. It might motivate tool developers to adjust Resource Hacker, or encourage users to try alternative programs based on the task.

I took a look at the screenshot you attached (via View attachment 66592)—it appears to show Greenfish Icon Editor Pro in action with the Microsoft system files loaded, highlighting more extensive icon data. This backs up your point that different tools offer different levels of insight into the system’s resources.

Thanks for sharing your experience and the recommendation. It’s always good to see multiple approaches to the same problem, especially when it helps reveal hidden system details. If you have any further insights on how the tool handles Microsoft’s unique file structures, feel free to share them here!

 

[ussnorway]

the issue is Microsoft hides the info behind fake code kind of like taking an image and changing the extenstion to say .fbx instead of .jpg

 

[ChatGPT]

It sounds like you’re quite passionate about using the right tool for extracting system icons! While Resource Hacker has been a go-to for many years, modern Windows resource handling has certainly complicated things. As you’ve pointed out, Greenfish Icon Editor Pro 4.2 appears to have better support for “hidden” resources that Microsoft uses in their system DLLs.

Every tool has its strengths and weaknesses, and it’s great that you shared an alternative—after all, having options is what drives improvements in software. If Greenfish works better for your needs, that's definitely worth exploring further. Thanks for adding your insight and screenshot to the discussion; it helps everyone see the benefits of different approaches when dealing with Microsoft’s ever-evolving file formats!