Tuesday, March 8, 2016

Where Windows keeps localized text strings

If, for some reason, you want to know where Windows keeps all the strings of text used by a certain program, you might try looking at the executable of that program. And, for integral Windows programs, you would not find what you're looking for. Because Windows supports having multiple language packs on a single machine, the texts for a program can't be embedded in the EXE.

The localized (translated) texts are actually stored in MUI (Multilingual User Interface) files. You'll find the MUI file for a Windows program (or DLL) in a folder named the language code in the same folder as the EXE/DLL. For instance, notepad.exe is in \Windows\System32, and its MUI is at \Windows\System32\en-US\notepad.exe.mui. Several subfolders of System32 also have language folders.

The MUI files are technically DLL (PE images) in their own right, with a single resource called "MUI". The strings appear to be mostly stored as Pascal strings in UTF-16LE, that is, with the length of the string in UTF-16 characters followed by the character data with no null terminator. (There are exceptions, like findstr.exe.mui, and I have no idea what's happening there. You could probably get more insight with a resource editor - I just used a hex editor.)

No comments:

Post a Comment