README

Icon-Worker:

     :
                     
:
  :
 :
      :

The ICO file format is an image file format for computer icons in Microsoft Windows. ICO files contain one or more small images at multiple sizes and color depths, such that they may be scaled appropriately. In Windows, all executables that display an icon to the user, on the desktop, in the Start Menu, or in file Explorer, must carry the icon in ICO format.

Icons introduced in Windows 1.0 were 32×32 pixels in size and were monochrome. Support for 16 colors was introduced in Windows 3.0.[citation needed]

Win32 introduced support for storing icon images of up to 16.7 million colors (TrueColor) and up to 256×256 pixels in dimensions. Windows 95 also introduced a new Device Independent Bitmap (DIB) engine. However, 256 color was the default icon color depth in Windows 95. It was possible to enable 65535 color (Highcolor) icons by either modifying the Shell Icon BPP value in the registry or by purchasing Microsoft Plus! for Windows 95. The Shell Icon Size value allows using larger icons in place of 32×32 icons and the Shell Small Icon Size value allows using custom sizes in place of 16×16 icons. Thus, a single icon file could store images of any size from 1×1 pixel up to 256×256 pixels (including non-square sizes) with 2 (rarely used), 16, 256, 65535, or 16.7 million colors; but the shell could not display very large sized icons. The notification area of the Windows taskbar was limited to 16 color icons by default until Windows Me when it was updated to support high color icons.

Of course, it's not possible to modify the resources of all files because they have been processed differently. Some executables are heavily compressed or protected with special security programs that deny access to the resources, or attempting to access them would corrupt the file.

In simple terms, a Windows application's resources are separate from its program code. This distinction allows you to make significant changes to the interface without recompiling the entire application.

A resource is any non-executable data that is logically deployed with an application. A resource might be displayed in an application as error messages or as part of the user interface. Resources can contain data in a number of forms, including a collection of icons, strings, images, and data objects. Examples of resources include:

• Error messages
• User interface elements: menus, dialogs, hot keys
• Icons and cursors
• Strings of text
• Multimedia files: sounds, images, and videos
• Product information and vendor details (copyrights, trademarks, origins)
• Data objects

Storing data in a resource section allows for changing the data without recompiling the entire application. When developers create an application, they embed resources directly into an executable file, producing a single EXE containing both code and resources. At run-time, the application can use these resource items again and again and they will never run out. The operation system also reads the file's resources when displaying the application icon on your desktop and showing the product information (version, file description and copyright notice).

File structure:

An ICO or CUR file is made up of an ICONDIR ("Icon directory") structure, containing an ICONDIRENTRY structure for each image in the file, followed by a contiguous block of all image bitmap data (which may be in either Windows BMP format, excluding the BITMAPFILEHEADER structure, or in PNG format, stored in its entirety).

Offset (bytes)	Field	Size (bytes)	Description
0	idReserved	2	Reserved. Must be 0.
2	idType	2	Image type: 1 for ICO image, 2 for CUR image. Other values are invalid.
4	idCount	2	Number of images in the file.
6	idEntries	idCount * 16	ICONDIRENTRY array. Each entry represents an image.

When changing icons, ensure the replacement icons are the same size and have the same number of colors as the original (e.g., a 16x16 4-bit icon cannot be replaced with a 32x32 8-bit icon). If you encounter a mismatch error when attempting to replace an icon that appears to be the same size and bit depth, the source icon likely has a different color depth (24-bit and 32-bit icons can look very similar).

Why is this important? The icon size and color depth in an EXE file are fixed, and there are typically multiple icons within a Windows executable. Here's an example of an Icon Group found in the Notepad application:

When Windows displays a main application icon, such as for a desktop shortcut, it selects an icon based on specific criteria rather than the first one it finds. Carelessly swapping out icons of different sizes or color depths can result in visual artifacts.

Icon Extractor:

Generally, the icons of all files can be extracted, even those whose resource area is heavily modified and full of files. It's not always just image files that are present, but rather a wider range of other files in the resource area. For example, the resource area of ​​Photoshop.exe contains 116 files.

The extractor can be used to extract all this information and find the icon.

Windows Shell Icons:

shell32.dll is a Windows system file that functions as a dynamic link library (DLL). It contains functions for the Windows shell, including the desktop, the Start menu, the taskbar, and the ability to open files and web links. This DLL is an essential part of the operating system and cannot be easily removed.

This is also where the Windows icons, such as those displayed in Explorer, are located. When the icon view of a folder is to be changed, these exact icons are loaded from shell32.dll.

Here is a list of all icons in Windows 10. : https://renenyffenegger.ch/development/Windows/PowerShell/examples/WinAPI/ExtractIconEx/shell32.html

Icon Worker can extract these symbols and import the executables.

Cache:

If the icon of an executable file has been changed, it is usually not immediately visible, and the old icon is still displayed. This is because the Windows cache still contains the old information about this file and has not been updated. Only when the file is renamed or moved, or the system is restarted, is the cache information renewed.

Cache writes must eventually be propagated to the backing store. The timing for this is governed by the write policy. The two primary write policies are:

• Write-through: Writes are performed synchronously to both the cache and the backing store.
• Write-back: Initially, writing is done only to the cache. The write to the backing store is postponed until the modified content is about to be replaced by another cache block.

A write-back cache is more complex to implement since it needs to track which of its locations have been written over and mark them as dirty for later writing to the backing store. The data in these locations are written back to the backing store only when they are evicted from the cache, a process referred to as a lazy write. For this reason, a read miss in a write-back cache may require two memory accesses to the backing store: one to write back the dirty data, and one to retrieve the requested data. Other policies may also trigger data write-back. The client may make many changes to data in the cache, and then explicitly notify the cache to write back the data.

Write operations do not return data. Consequently, a decision needs to be made for write misses: whether or not to load the data into the cache.

Virus false Alert:

I don't want to dwell on this topic any longer, as there are many discussions online about why antivirus manufacturers do things this way. I can even create a file with no content that every antivirus program will classify as dangerous and trigger an alert.

This probably has to do with our corporate structure, which aims to mislead users as much as possible. Therefore, it can happen that if an icon in an EXE file is changed, your antivirus program will subsequently classify it as dangerous, even though nothing more has been done than to alter the file's graphic.

Everyone has to decide for themselves how to deal with this issue, because a file that is recognized as harmless and whose graphics area has been modified cannot then be declared dangerous, which happens again and again! (?).