Windows Resource (.RES) Files

A Windows resource file (.RES) contains a series of packed resource entries, with no other structure, that is no headers, footers, padding, etc. The format of a resource entry is different for Windows 3.x (16-bit) and Win32, that is, Windows 95, Windows NT/XP/Vista (32-bit).

32-bit

A 32-bit .RES file starts with an empty resource entry of 32 bytes:
00000000 20000000 FFFF0000 FFFF0000
00000000 00000000 00000000 00000000

After that comes the real resource entries, packed into the file with no padding or other structure -- just a series of resource entries.

Each resource entry has a header followed immediately by the resource data. Immediately after the data for one entry comes the header for the next entry. Each header has the following format:

Field	Size (bytes)	Description
Data Size	4	Size of the resource data that follow the header
Header Size	4	Size of the resource header (always at least 16)
Type	variable	Resource type
Name	variable	Resource name or identifier
Data Version	4	Version number for resource data format, usually 0
Flags	2	Most flags are for backward compability with Win16.Discardable (100016) is the only Win32 flag.
Language	2	Primary and secondary language identifiers. Zero for language-neutral, or look up your Windows documentation for a full list of identifiers. Form a language identifier from a primary and sublanguage as follows: (sublanguage << 10 | primary).
Version	4	Version number for the resource entry
Characteristics	4	Anything you want

The type and name can be numeric or textual. If the first two bytes are FFFF₁₆, the subsequent two bytes are the numeric value. Otherwise, the first two bytes are the first Unicode character in a zero-terminated string.

16-bit

Each resource entry has a header followed immediately by the resource data. Immediately after the data for one entry comes the header for the next entry. Each header has the following format:

Field	Size	Description
Type	variable	Resource type
Name	variable	Resource name or identifier
Flags	2	Discardable=100016, Moveable=001016, Pure=002016, Preload=004016
Size	4	Size of the resource data that immediately follow the header

The type and name can be numeric or textual. If the first byte is FF₁₆, the subsequent two bytes are the numeric value. Otherwise, the first byte is the first character of the ANSI string.

Resource types

Windows reserves numeric resource types under 256 for its own use. In this range are several predefined resource types:

Type	Value	Description
RT_CURSOR	1	Cursor image (one entry in a cursor group)
RT_BITMAP	2	Bitmap (Windows or OS/2 BMP format)
RT_ICON	3	Icon image (one entry in an icon group)
RT_MENU	4	Menu
RT_DIALOG	5	Dialog box
RT_STRING	6	String table (must have numeric identifier, not textual)
RT_FONTDIR	7	Font directory
RT_FONT	8	Font entry
RT_ACCELERATOR	9	Keyboard accelerator table
RT_RCDATA	10	Application-defined data
RT_GROUP_CURSOR	12	Group header for a cursor
RT_GROUP_ICON	14	Group header for an icon

Win32 defines additional resource types:

Type	Value	Description
RT_MESSAGETABLE	11	Message table
RT_VERSION	16	Version information
RT_DLGINCLUDE	17	Dialog include
RT_PLUGPLAY	19	Plug and play
RT_VXD	20	VxD
RT_ANICURSOR	21	Animated cursor